#!/bin/bash
set +e
L=$HOME/cf_probe.log; : > "$L"
E(){ echo "$@" | tee -a "$L"; }
S(){ echo; echo "═══ $* ═══" | tee -a "$L"; }

S "1. KERNEL + MODULE FINGERPRINT"
uname -r
modinfo algif_aead 2>&1 | grep -E "^(filename|version|srcversion|vermagic)"
modinfo af_alg 2>&1 | grep -E "^(filename|version|srcversion|vermagic)"

S "2. AF_ALG AEAD — reachability test"
python3 - <<'PY' 2>&1 | tee -a "$L"
import socket, errno, os, sys
tests = [
    ("AF_ALG", socket.AF_ALG),
]
try:
    s = socket.socket(socket.AF_ALG, socket.SOCK_SEQPACKET, 0)
    print("[+] AF_ALG socket created")
    try:
        s.bind(('aead', 'gcm(aes)'))
        print("[+] bind(aead, gcm(aes)) OK — algif_aead reachable")
    except OSError as e:
        print(f"[-] bind failed: {e}")
    try:
        s.bind(('hash', 'sha256'))
        print("[+] bind(hash, sha256) OK — af_alg base reachable")
    except OSError as e:
        print(f"[-] hash bind failed: {e}")
    s.close()
except OSError as e:
    print(f"[-] socket(AF_ALG) failed: {e}")
PY

S "3. UNSHARED USER-NS — الـ PoC يحتاجها؟"
unshare -U -r id 2>&1 | head -3
cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null
cat /proc/sys/user/max_user_namespaces 2>/dev/null

S "4. KERNEL CONFIG — AEAD + 관련"
grep -E "CONFIG_CRYPTO_USER_API_AEAD|CONFIG_CRYPTO_USER_API|CONFIG_CRYPTO_AEAD|CONFIG_CRYPTO_GCM" /boot/config-$(uname -r) 2>/dev/null

S "5. UBUNTU SECURITY — هل صدر إصلاح لـ 4.15 bionic؟"
apt-cache policy linux-image-4.15.0-213-generic 2>/dev/null | head -5
apt-cache policy linux-image-generic 2>/dev/null | head -5
# ابحث في قائمة التحديثات
apt list --upgradable 2>/dev/null | grep -i "linux-image" | head -5

S "6. USN reference locally"
grep -rIiE "CVE-2026-31431|copy.fail|algif_aead" /usr/share/doc 2>/dev/null | head -5
grep -rIiE "CVE-2026-31431|copy.fail" /var/lib/apt/lists/ 2>/dev/null | head -5

S "7. algif_aead kernel source symbol (fuzzy check)"
# ابحث عن الدالة aead_recvmsg في vmlinux / kallsyms
grep -E "aead_recvmsg|aead_sendmsg" /proc/kallsyms 2>/dev/null | head -5
# إن ظهرت العناوين، الكود محمّل في النواة
grep -E "aead_recvmsg" /boot/System.map-$(uname -r) 2>/dev/null | head -3

S "8. STRACE — فعّل مكالمات AF_ALG في poc بسيط"
# فقط نتأكد أن نداء AF_ALG يعمل
python3 -c "import os; print('aead test:', os.system('python3 -c \"import socket; s=socket.socket(38,5,0); s.close(); print(1)\" 2>/dev/null'))" 2>&1

S "9. MODULE LOADED COUNT + LAST USE"
lsmod 2>/dev/null | grep -E "algif|af_alg|aead"

S "10. بحث محلي عن أي ملف PoC / hint"
find / -xdev -name "*copy*fail*" -o -name "*algif*" -o -name "*31431*" 2>/dev/null | grep -vE "^/proc|^/sys|^/lib/modules" | head -10

S "11. FILESYSTEM + PAGE CACHE + PROTECTED REGULAR"
cat /proc/sys/fs/protected_regular 2>/dev/null
cat /proc/sys/fs/protected_fifos 2>/dev/null
cat /proc/sys/vm/mmap_min_addr 2>/dev/null
cat /proc/sys/vm/mmap_rnd_bits 2>/dev/null
cat /proc/sys/kernel/randomize_va_space 2>/dev/null

S "12. مطابقة مع Ubuntu changelog"
grep -iE "CVE-2026|copy|algif|aead" /usr/share/doc/linux-image-4.15.0-213-generic/changelog.Debian.gz 2>/dev/null | zcat 2>/dev/null | head -10
zcat /usr/share/doc/linux-image-4.15.0-213-generic/changelog.Debian.gz 2>/dev/null | grep -iE "CVE-2026|algif|aead|copy.fail" | head -5

S "SUMMARY"
E "log: $L ($(wc -l < $L) lines)"
S "DONE"