#!/bin/sh
# cold-attach variant: usb-redir device present from QEMU start; server must
# be listening first. RNDIS_MALFORMED=1 env selects the malformed descriptors.
set -e
cd "$(dirname "$0")/../../../dfbsd-qemu"
pkill -f '^python3 .*findings/poc/DF-5396/usbredir_rndis.py' 2>/dev/null || true
sleep 0.5
setsid -f env ${RNDIS_MALFORMED:+RNDIS_MALFORMED=1} python3 ../findings/poc/DF-5396/usbredir_rndis.py \
    </dev/null >../findings/poc/DF-5396/server.log 2>&1
sleep 1
rm -f rig.pid rig-ser.sock rig-mon.sock
qemu-system-x86_64 \
    -enable-kvm -m 4096 -smp 6 \
    -drive file=disk.qcow2,if=virtio,format=qcow2 \
    -device piix3-usb-uhci,id=uhci0 \
    -chardev socket,id=cd0,host=127.0.0.1,port=45600 \
    -device usb-redir,id=rndis0,chardev=cd0,bus=uhci0.0,port=1 \
    -netdev user,id=n0,hostfwd=tcp:127.0.0.1:5522-:22 \
    -device virtio-net-pci,netdev=n0 \
    -display none -monitor unix:rig-mon.sock,server,nowait \
    -serial unix:rig-ser.sock,server,nowait \
    -daemonize -pidfile rig.pid \
    2>qemu-stderr.log || true
echo "qemu pid $(cat rig.pid 2>/dev/null)"