patch_base_6_6.h

#pragma once
#include <iostream>
#include <vector>
#include "patch_kernel_sk.h"
#include "analyze/symbol_analyze.h"

using namespace asmjit;
using namespace asmjit::a64;
using namespace asmjit::a64::Predicate;

// 6.6内核专用PatchBase类 - 移除了所有版本判断逻辑
class PatchBase66 {
public:
    PatchBase66(const std::vector<char>& file_buf, size_t cred_uid_offset);
    PatchBase66(const PatchBase66& other);
    virtual ~PatchBase66();

    // 生成跳转指令
    size_t patch_jump(size_t patch_addr, size_t jump_addr, std::vector<patch_bytes_data>& vec_out_patch_bytes_data);

protected:
    // 6.6固定参数 - 不再需要运行时判断
    int get_cred_atomic_usage_len() { return m_cred_uid_offset; }
    int get_cred_uid_region_len() { return 32; } // uid/gid/suid/sgid/euid/egid/fsuid/fsgid = 8*4=32字节
    int get_cred_euid_offset() { return get_cred_atomic_usage_len() + 16; } // euid在第5个字段
    int get_cred_securebits_padding() { return (get_cred_atomic_usage_len() == 8) ? 4 : 0; }
    uint64_t get_cap_ability_max() { return kernel_6_6::CAP_ABILITY_MAX; }
    int get_cap_cnt() { return kernel_6_6::CAP_CNT; }

    // 6.6必定启用CONFIG_THREAD_INFO_IN_TASK
    bool is_CONFIG_THREAD_INFO_IN_TASK() { return true; }

    // 获取current task - 6.6简化版，直接从SP_EL0读取
    void emit_get_current(Assembler* a, GpX x);

    // 安全的BL调用（保护x29/x30）
    void emit_safe_bl(Assembler* a, size_t func_base_addr, size_t target);

    // 查找所有RET指令偏移
    std::vector<size_t> find_all_aarch64_ret_offsets(size_t offset, size_t size);

    const std::vector<char>& m_file_buf;
    size_t m_cred_uid_offset = 0;
};