patch_kernel_sk.h

#pragma once
#include <iostream>
#include <vector>
#include <string>
#include <filesystem>
#include <fstream>
#include <cstring>
#include <random>
#include <algorithm>

#include "analyze/base_func.h"
#include "3rdparty/aarch64_asm_helper.h"

// SKRoot Pro - Linux 6.6内核专用版
// 本版本移除了多版本兼容逻辑，专门针对6.6内核优化

#define ROOT_KEY_LEN 48
#define FOLDER_HEAD_ROOT_KEY_LEN 16

// Patch数据结构
struct patch_bytes_data {
    std::string str_bytes;
    size_t write_addr;
};

// 6.6内核固定参数
namespace kernel_6_6 {
    constexpr int CRED_UID_OFFSET = 8;                      // cred->uid偏移
    constexpr int CAP_CNT = 5;                              // capability字段数
    constexpr uint64_t CAP_ABILITY_MAX = 0x1FFFFFFFFFF;     // 最大capability (CAP_LAST_CAP=40)
    constexpr bool CONFIG_THREAD_INFO_IN_TASK = true;       // 6.6必定启用
    constexpr int FILLDIR64_HIDE_RETURN = 1;                // 隐藏返回值 (6.1+)
    constexpr const char* DO_EXECVE_FUNC = "do_execveat_common";
    constexpr int DO_EXECVE_FILENAME_REG = 1;               // x1寄存器
    constexpr int TIF_SECCOMP = 11;                         // seccomp标志位
    constexpr int MAX_ERRNO = 4095;
}

// 通信命令码
enum SKRootCommand : uint32_t {
    CMD_NOP = 0,
    CMD_READ_KERNEL_MEM = 1,      // 读取内核内存
    CMD_WRITE_KERNEL_MEM = 2,     // 写入内核内存
    CMD_EXEC_SHELLCODE = 3,       // 执行shellcode
    CMD_KALLSYMS_LOOKUP = 4,      // 符号查找
    CMD_INSTALL_HOOK = 5,         // 安装Hook
    CMD_ALLOC_KERNEL_MEM = 6,     // 分配内核内存
    CMD_FREE_KERNEL_MEM = 7,      // 释放内核内存
    CMD_HOOK_AREA_INFO = 8,       // 获取Hook区信息
    // 奥创版Phase 2新增
    CMD_SELINUX_TOGGLE = 9,       // 切换SELinux状态 (0=permissive, 1=enforcing)
    CMD_HIDE_PID = 10,            // 隐藏进程PID
};

// 宏定义：消耗符号区域空间
#define PATCH_AND_CONSUME(region, size) \
    do { \
        size_t _sz = (size); \
        if (_sz == 0) { \
            std::cout << "[发生错误] " << #region << " patch failed" << std::endl; \
            return r; \
        } \
        (region).consume(_sz); \
    } while(0)

// generate_random_str 已在 analyze/base_func.h 中定义

// patch辅助函数
inline void patch_ret_cmd(const std::vector<char>& file_buf, size_t addr, std::vector<patch_bytes_data>& out) {
    // RET指令: 0xD65F03C0
    uint32_t ret_insn = 0xD65F03C0;
    std::string str_bytes = bytes2hex((const unsigned char*)&ret_insn, sizeof(ret_insn));
    out.push_back({ str_bytes, addr });
}

inline void patch_ret_0_cmd(const std::vector<char>& file_buf, size_t addr, std::vector<patch_bytes_data>& out) {
    // MOV W0, #0; RET
    aarch64_asm_ctx ctx = init_aarch64_asm();
    auto a = ctx.assembler();
    a->mov(asmjit::a64::w0, asmjit::Imm(0));
    a->ret(asmjit::a64::x30);
    std::vector<uint8_t> bytes = aarch64_asm_to_bytes(a);
    std::string str_bytes = bytes2hex(bytes.data(), bytes.size());
    out.push_back({ str_bytes, addr });
}

inline void patch_ret_1_cmd(const std::vector<char>& file_buf, size_t addr, std::vector<patch_bytes_data>& out) {
    // MOV W0, #1; RET
    aarch64_asm_ctx ctx = init_aarch64_asm();
    auto a = ctx.assembler();
    a->mov(asmjit::a64::w0, asmjit::Imm(1));
    a->ret(asmjit::a64::x30);
    std::vector<uint8_t> bytes = aarch64_asm_to_bytes(a);
    std::string str_bytes = bytes2hex(bytes.data(), bytes.size());
    out.push_back({ str_bytes, addr });
}

inline void patch_data(const std::vector<char>& file_buf, size_t addr, void* data, size_t len, std::vector<patch_bytes_data>& out) {
    std::string str_bytes = bytes2hex((const unsigned char*)data, len);
    out.push_back({ str_bytes, addr });
}