RedBear-OS/local/scripts/capture-host-evidence/capture-root.sh

#!/usr/bin/env bash
# capture-root.sh — X670E root-evidence capture helper
#
# Run with:  sudo ./local/scripts/capture-host-evidence/capture-root.sh
#
# Captures artifacts that need root (acpidump, dmidecode, dmesg, iomem, nvme, usb debug).
# Raw acpidump binaries go to ~/redbear-evidence-raw/ (OUTSIDE the repo).
# Redacted/decompiled excerpts + sha256 manifest go to the evidence dir.
# After running, re-run the Rust tool: cargo run --manifest-path local/scripts/capture-host-evidence/Cargo.toml

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
EVIDENCE_DIR="$REPO_ROOT/local/docs/evidence/ryzen-x670e"
RAW_DIR="$HOME/redbear-evidence-raw"
TIMESTAMP="$(date +%Y-%m-%dT%H:%M:%S%z)"

# Guard: must be root
if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: This script must be run as root (sudo)."
    echo "  sudo $0"
    exit 1
fi

echo "=== X670E Root Evidence Capture ==="
echo "Timestamp: $TIMESTAMP"
echo "Evidence dir: $EVIDENCE_DIR"
echo "Raw dump dir:  $RAW_DIR"
echo ""

mkdir -p "$EVIDENCE_DIR" "$RAW_DIR"

# ─── ACPI tables ────────────────────────────────────────────────
echo "[1/7] acpidump -b (all tables → $RAW_DIR)"
cd "$RAW_DIR"
acpidump -b 2>&1 || true
ls -la *.dat 2>/dev/null | head -20
echo ""

# Compute SHA-256 of each raw table
echo "# ACPI Raw Table Hashes" > "$RAW_DIR/RAW-MANIFEST.md"
echo "# Captured: $TIMESTAMP" >> "$RAW_DIR/RAW-MANIFEST.md"
echo "" >> "$RAW_DIR/RAW-MANIFEST.md"
for f in *.dat; do
    if [ -f "$f" ]; then
        sha256=$(sha256sum "$f" | awk '{print $1}')
        echo "- $f: sha256:$sha256" >> "$RAW_DIR/RAW-MANIFEST.md"
    fi
done

# Copy the APIC table for MADT parsing by the Rust tool
if [ -f "apic.dat" ]; then
    cp apic.dat "$EVIDENCE_DIR/raw-apic.dat"
    echo "  APIC table copied to evidence dir for MADT parsing: $EVIDENCE_DIR/raw-apic.dat"
fi

# Decompile key tables with iasl for redacted excerpts
for tbl in DSDT SSDT1 SSDT2 SSDT3 SSDT4; do
    if [ -f "${tbl}.dat" ]; then
        iasl -d "${tbl}.dat" 2>/dev/null && \
            cp "${tbl}.dsl" "$EVIDENCE_DIR/${tbl}.dsl" && \
            echo "  Decompiled ${tbl}.dat → $EVIDENCE_DIR/${tbl}.dsl" || \
            echo "  iasl failed for ${tbl}.dat (may be fine)"
    fi
done

# ─── dmidecode (redacted in repo) ────────────────────────────────
echo "[2/7] dmidecode"
dmidecode > "$EVIDENCE_DIR/dmidecode-raw.txt"
echo "  Saved raw dmidecode to $EVIDENCE_DIR/dmidecode-raw.txt"
echo "  (Re-run capture-host-evidence tool to redact serials/UUIDs)"

# ─── dmesg (amdgpu/drm lines) ────────────────────────────────────
echo "[3/7] dmesg (amdgpu/drm/fb lines)"
dmesg | grep -iE 'amdgpu|drm|fb|efifb|simplefb|nvidia' > "$EVIDENCE_DIR/dmesg-display.txt" || echo "# No amdgpu/drm lines found" > "$EVIDENCE_DIR/dmesg-display.txt"
echo "  Saved filtered dmesg to $EVIDENCE_DIR/dmesg-display.txt"

# ─── /proc/iomem (full) ──────────────────────────────────────────
echo "[4/7] /proc/iomem (full, root)"
cat /proc/iomem > "$EVIDENCE_DIR/iomem.txt"
echo "  Saved full /proc/iomem to $EVIDENCE_DIR/iomem.txt"
# Report AMDIF031 region
grep -i 'AMDIF031\|0xfb300000' "$EVIDENCE_DIR/iomem.txt" | head -10 || echo "  AMDIF031 NOT FOUND in iomem"

# ─── nvme id-ctrl (HMB fields) ──────────────────────────────────
echo "[5/7] nvme id-ctrl (HMB fields)"
for dev in /dev/nvme0 /dev/nvme1; do
    if [ -e "$dev" ]; then
        echo "# $dev" >> "$EVIDENCE_DIR/nvme-id-ctrl.txt"
        nvme id-ctrl "$dev" | grep -iE 'hmpre|hmmin|hmminds|hmmaxd|hmb|host memory' >> "$EVIDENCE_DIR/nvme-id-ctrl.txt" 2>&1 || \
            echo "# $dev: nvme id-ctrl failed or no HMB fields" >> "$EVIDENCE_DIR/nvme-id-ctrl.txt"
    else
        echo "# $dev: device not found" >> "$EVIDENCE_DIR/nvme-id-ctrl.txt"
    fi
done
echo "  Saved HMB-relevant fields to $EVIDENCE_DIR/nvme-id-ctrl.txt"

# ─── USB debug devices ──────────────────────────────────────────
echo "[6/7] /sys/kernel/debug/usb/devices"
if [ -f "/sys/kernel/debug/usb/devices" ]; then
    cat /sys/kernel/debug/usb/devices > "$EVIDENCE_DIR/usb-debug-devices.txt"
    echo "  Saved to $EVIDENCE_DIR/usb-debug-devices.txt"
else
    mount -t debugfs none /sys/kernel/debug 2>/dev/null || true
    cat /sys/kernel/debug/usb/devices > "$EVIDENCE_DIR/usb-debug-devices.txt" || \
        echo "# debugfs not available" > "$EVIDENCE_DIR/usb-debug-devices.txt"
    echo "  (mounted debugfs then captured)"
fi

# ─── lspci full config space (root) ──────────────────────────────
echo "[7/7] lspci -nnvvv -xxxx (full extended config space)"
lspci -nnvvv -xxxx > "$EVIDENCE_DIR/lspci-xxxx.txt"
echo "  Saved extended config space to $EVIDENCE_DIR/lspci-xxxx.txt"

echo ""
echo "=== Root capture complete ==="
echo "Raw ACPI tables:  $RAW_DIR"
echo "Manifest:         $RAW_DIR/RAW-MANIFEST.md"
echo "Evidence dir:     $EVIDENCE_DIR"
echo ""
echo "NEXT: Re-run the Rust tool to redact + analyze + secret-scan:"
echo "  cargo run --manifest-path local/scripts/capture-host-evidence/Cargo.toml"
echo ""
echo "Then commit evidence + tool. Do NOT commit raw acpidump binaries."