┌─────────────────────────────────────────────────────────────────────────────┐
│ Docker Network: ics-untrusted (192.168.96.0/24)                             │
│                                                                             │
│   ┌───────────────────────┐       ┌───────────────────────┐                │
│   │ seL4 Gateway          │       │ Snort IDS             │                │
│   │ Port 502              │       │ Port 503              │                │
│   │                       │       │                       │                │
│   │ • Protocol-break      │       │ • Packet-forwarding   │                │
│   │ • TCP termination     │       │ • Inline inspection   │                │
│   │ • Length validation   │       │ • Rule-based detection│                │
│   └───────────┬───────────┘       └───────────┬───────────┘                │
│               │                               │                             │
├───────────────┼───────────────────────────────┼─────────────────────────────┤
│ Docker Network: ics-protected (192.168.95.0/24)                             │
│               │                               │                             │
│               └───────────────┬───────────────┘                             │
│                               ▼                                             │
│               ┌───────────────────────────────┐                             │
│               │ PLC (District Heating)        │                             │
│               │ Vulnerable libmodbus 3.1.2    │                             │
│               │ Port 5020 (direct access)     │                             │
│               └───────────────────────────────┘                             │
└─────────────────────────────────────────────────────────────────────────────┘

# Place your seL4 kernel image at:
gateway/sel4-image/capdl-loader-image-arm-qemu-arm-virt

# Build all containers
sudo docker compose build

# Start individual containers
sudo docker compose up plc        # PLC only
sudo docker compose up gateway    # seL4 gateway + PLC
sudo docker compose up snort      # Snort IDS + PLC

# Start all
sudo docker compose up

# Through seL4 gateway (protected - protocol-break)
echo -ne '\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x01' | nc localhost 502 | xxd

# Through Snort IDS (protected - packet-forwarding)
echo -ne '\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x01' | nc localhost 503 | xxd

# Direct to PLC (unprotected - vulnerable)
echo -ne '\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x01' | nc localhost 5020 | xxd

# Start PLC in CVE-2019-14462 mode
sudo docker compose --profile cve14462 up plc-14462

# Build attack tools
cd cve_tools && make

# Attack unprotected PLC (crashes)
./cve_14462_attack 127.0.0.1 5022

# Attack through seL4 (BLOCKED)
./cve_14462_attack 127.0.0.1 502

# Attack through Snort (DETECTED by Quickdraw rules)
./cve_14462_attack 127.0.0.1 503

# Default PLC runs in CVE-2022-0367 mode with ASAN
sudo docker compose up plc

# Build attack tools
cd cve_tools && make

# Attack PLC - ASAN will detect heap-buffer-overflow
./cve_0367_attack 127.0.0.1 5020

# Attack with custom parameters
./cve_0367_attack 127.0.0.1 5020 88 0x4141  # Corrupt tab_registers pointer
./cve_0367_attack 127.0.0.1 5020 72 0xFFFF  # Corrupt nb_registers

# Attack through seL4 (BLOCKED - address validation)
./cve_0367_attack 127.0.0.1 502

# Attack through Snort (DETECTED by custom rules)
./cve_0367_attack 127.0.0.1 503

# 1. Verify Snort is working (should return Modbus response)
echo -ne '\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x01' | nc -w 2 localhost 503 | xxd

# 2. Attack the Snort IDS
./cve_20685_attack 127.0.0.1 503

# 3. Verify Snort is frozen (should timeout with NO response)
echo -ne '\x00\x01\x00\x00\x00\x06\x01\x03\x00\x00\x00\x01' | nc -w 5 localhost 503 | xxd

# 4. Check Snort CPU (should be 100%)
sudo docker exec ics-snort top -b -n 1 | grep snort

# 5. seL4 is IMMUNE (no Modbus preprocessor to exploit)
./cve_20685_attack 127.0.0.1 502  # No effect on seL4

# 6. Restart Snort after demo
sudo docker compose restart snort

# Check if host is vulnerable
uname -r  # Vulnerable: v5.14 - v6.6 (before patches)

# The exploit is available at:
ls cve_tools/cve-2024-1086/

# Full demo with 4 quadrants (PLC, seL4, Snort, User terminal)
./scripts/demo.sh

# Snort-only demo with 3 panes (PLC, Snort, User terminal)
./scripts/demo-snort.sh

# Run automated comparison
./scripts/run_comparison.sh

# Run Snort with specific profile
sudo docker compose --profile snort-talos up

# Compare detection efficiency
sudo docker compose --profile snort-quickdraw up -d
./cve_tools/cve_0367_attack 127.0.0.1 503  # Test detection
sudo docker compose --profile snort-quickdraw down

sudo docker compose --profile snort-combined up -d
./cve_tools/cve_0367_attack 127.0.0.1 503  # Test detection
sudo docker compose --profile snort-combined down

Client ────TCP────► Snort ────TCP────► PLC
          (same connection flows through)

Client ────TCP1────► seL4 ────TCP2────► PLC
              (terminates, validates, new connection)

# Default mode (CVE-2022-0367 with ASAN)
sudo docker compose up plc

# CVE-2019-14462 mode
sudo docker compose --profile cve14462 up plc-14462