#!/bin/bash
# kbypass-enum — scan target system for active kernel mitigations and
# emit the bypass plan from our framework.
#
# Run on the TARGET system (Resolute or other). Outputs a bypass-strategy
# report.
#
# Reads (mostly unprivileged-readable):
#   /proc/cmdline
#   /sys/kernel/{kptr_restrict, ...}
#   /proc/sys/{kernel,vm,fs,net}/...
#   /proc/version, /proc/cpuinfo
#   /sys/devices/system/cpu/vulnerabilities/
#   /boot/config-$(uname -r)  (root only — graceful fallback)

set -u
KVER="$(uname -r)"
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

green() { printf "\033[32m%s\033[0m\n" "$*"; }
red()   { printf "\033[31m%s\033[0m\n" "$*"; }
yellow(){ printf "\033[33m%s\033[0m\n" "$*"; }
gray()  { printf "\033[90m%s\033[0m\n" "$*"; }

section() { echo; echo "=== $* ==="; }

check_sysctl() {
    local name="$1" expect_safe="$2"
    if [ -r "/proc/sys/$name" ]; then
        v=$(cat "/proc/sys/$name" 2>/dev/null)
        if [ "$v" = "$expect_safe" ]; then
            green "  $name = $v  [hardened]"
        else
            red "  $name = $v  [permissive]"
        fi
    fi
}

check_config() {
    local cfg="$1" expect="$2"
    if [ -r "/boot/config-$KVER" ]; then
        v=$(grep "^${cfg}=" "/boot/config-$KVER" | cut -d= -f2)
        if [ "$v" = "$expect" ]; then
            green "  $cfg=$v  [hardened]"
        else
            red "  $cfg=${v:-not-set}  [missing/weak]"
        fi
    else
        gray "  $cfg: cannot read /boot/config-$KVER (need root)"
    fi
}

section "Kernel version"
echo "  $(uname -r) ($(uname -m))"
echo "  cmdline: $(cat /proc/cmdline)"

section "Class A — Informational mitigations"
check_sysctl kernel/kptr_restrict 1
check_sysctl kernel/perf_event_paranoid 4
check_config CONFIG_RANDOMIZE_BASE y
check_config CONFIG_RANDOM_KMALLOC_CACHES y
echo
echo "  Bypass plan:"
echo "    - KASLR/kptr_restrict: kbypass-research/kaslr-leak/entrybleed (UNPRIV)"
echo "    - RANDOM_KMALLOC_CACHES: kbypass-research/random-kmalloc/ (offline + brute-16)"

section "Class B — Structural mitigations"
check_config CONFIG_HARDENED_USERCOPY y
check_config CONFIG_FORTIFY_SOURCE y
check_config CONFIG_INIT_ON_ALLOC_DEFAULT_ON y
check_config CONFIG_INIT_ON_FREE_DEFAULT_ON y
check_config CONFIG_PAGE_POISONING y
check_config CONFIG_KFENCE y
check_config CONFIG_VMAP_STACK y
check_config CONFIG_STACKPROTECTOR_STRONG y
check_config CONFIG_SLAB_FREELIST_RANDOM y
check_config CONFIG_SLAB_BUCKETS y
check_config CONFIG_PAGE_TABLE_CHECK y
check_config CONFIG_CFI_CLANG y
echo
echo "  Bypass plan:"
echo "    - HARDENED_USERCOPY/FORTIFY: use in-kernel/runtime-sized memcpy bugs"
echo "    - INIT_ON_ALLOC/PAGE_POISONING: write-side primitives or realloc-spray"
echo "    - KFENCE: minimize trigger count, ~99% bypass per attempt"
echo "    - VMAP_STACK/STACKPROTECTOR: avoid stack class"
echo "    - SLAB_FREELIST_RANDOM: heavy spray (>= 80% page fill)"
echo "    - SLAB_BUCKETS: ensure bug fires in attacker's process context"
echo "    - CFI: type-equivalent function gadget"

section "Class C — Gating mitigations"
check_sysctl kernel/unprivileged_bpf_disabled 2
check_sysctl vm/unprivileged_userfaultfd 0
check_sysctl kernel/apparmor_restrict_unprivileged_userns 1
check_sysctl kernel/dmesg_restrict 1
check_sysctl kernel/yama/ptrace_scope 1
check_sysctl vm/mmap_min_addr 65536
check_sysctl kernel/io_uring_disabled 0
echo
echo "  Bypass plan:"
echo "    - unprivileged_bpf_disabled: use io_uring as spray gadget"
echo "    - unprivileged_userfaultfd: use FUSE-as-stall"
echo "    - apparmor_restrict_userns: use kbypass-research/userns-escape/aa-rootns"
echo "    - dmesg_restrict: use process-death/uptime as oop signal"

section "CPU/Hardware mitigations"
if [ -d /sys/devices/system/cpu/vulnerabilities ]; then
    for v in /sys/devices/system/cpu/vulnerabilities/*; do
        n=$(basename "$v")
        s=$(cat "$v" 2>/dev/null)
        case "$s" in
            "Mitigation:"*|"Not affected") gray "  $n: $s" ;;
            *) yellow "  $n: $s" ;;
        esac
    done
fi

section "Available bypass tools (this framework)"
KBYPASS_ROOT="${KBYPASS_ROOT:-$(dirname "$SCRIPT_DIR")}"
if [ -d "$KBYPASS_ROOT" ]; then
    for d in "$KBYPASS_ROOT"/*/; do
        n=$(basename "$d")
        [ "$n" = "framework" ] && continue
        echo "  - $n/"
    done
else
    echo "  (set KBYPASS_ROOT to the kbypass-research directory)"
fi

section "Next steps"
echo "  Pick a target bug from the unfixed CVE list."
echo "  Apply bypasses per Class A/B/C above."
echo "  See framework/MASTER_PLAN.md for end-to-end exploit-chain template."