apt update && apt install -y \
    build-essential bc bison flex \
    libssl-dev libelf-dev libncurses-dev \
    dwarves pahole gcc make wget xz-utils git python3 libfuse3-dev

cd /home/ubuntu/
wget https://cdn.kernel.org/pub/linux/kernel/v5.x/linux-5.13.19.tar.xz
tar xf linux-5.13.19.tar.xz
cd linux-5.13.19

cp /boot/config-$(uname -r) .config
make olddefconfig

# 启用完整调试符号和 GDB 支持
scripts/config --enable  CONFIG_DEBUG_INFO
scripts/config --enable  CONFIG_DEBUG_INFO_DWARF4
scripts/config --disable CONFIG_DEBUG_INFO_REDUCED
scripts/config --enable  CONFIG_FRAME_POINTER
scripts/config --enable  CONFIG_GDB_SCRIPTS

# 构建 ESP 模块 — CVE 目标
scripts/config --module  CONFIG_INET6_ESP
scripts/config --module  CONFIG_INET_ESP

# 禁用 KASLR 以方便调试
scripts/config --disable CONFIG_RANDOMIZE_BASE

# 禁用模块签名以加载未签名模块
scripts/config --disable CONFIG_MODULE_SIG
scripts/config --disable CONFIG_MODULE_SIG_FORCE
scripts/config --disable CONFIG_SYSTEM_TRUSTED_KEYS
scripts/config --disable CONFIG_SYSTEM_REVOCATION_KEYS

# 禁用 BTF 以避免 pahole 构建错误
scripts/config --disable CONFIG_DEBUG_INFO_BTF

# 禁用看门狗，防止 GDB 断点期间触发 panic/reboot
scripts/config --disable CONFIG_SOFTLOCKUP_DETECTOR
scripts/config --disable CONFIG_HARDLOCKUP_DETECTOR
scripts/config --disable CONFIG_DETECT_HUNG_TASK
scripts/config --disable CONFIG_WQ_WATCHDOG

make olddefconfig

make -j$(nproc) 2>&1 | tee ~/build.log

make modules_install
make install
update-grub

# 查找菜单项索引
grep -E "menuentry|submenu" /boot/grub/grub.cfg | grep -v "^#" | head -20

# 设置默认项（按需调整索引）
vi /etc/default/grub
# GRUB_DEFAULT="1>2"

update-grub
reboot

uname -r          # 应输出 5.13.19

# 开机自动加载 esp6，并立即加载
echo "esp6" >> /etc/modules
modprobe esp6

# 验证
modinfo esp6
grep CONFIG_INET6_ESP /boot/config-5.13.19   # CONFIG_INET6_ESP=m

# 云 / 网络等待
systemctl disable cloud-init cloud-config cloud-final \
    cloud-init-local systemd-networkd-wait-online

# 防止崩溃报告程序干扰内核 panic
systemctl disable apport

# 防止测试期间产生随机磁盘 I/O
systemctl disable apt-daily apt-daily-upgrade \
    apt-daily.timer apt-daily-upgrade.timer

# 开发虚拟机中不需要
systemctl disable snapd multipathd fwupd

IP=<VM-IP>
scp ubuntu@${IP}:~/linux-5.13.19/vmlinux .
scp ubuntu@${IP}:~/linux-5.13.19/net/ipv6/esp6.ko .
scp ubuntu@${IP}:/usr/bin/fusermount3 ./exploit/bin/
scp ubuntu@${IP}:/usr/lib/x86_64-linux-gnu/libfuse3.so.3 ./exploit/lib/
scp -r ubuntu@${IP}:/usr/include/fuse3 ./exploit/include/

<domain type='kvm' xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'>
  ...
  <qemu:commandline>
    <qemu:arg value='-s'/>
  </qemu:commandline>
</domain>

<filesystem type='mount' accessmode='passthrough'>
  <source dir='/path/to/your/host/dir'/>
  <target dir='hostshare'/>
</filesystem>

mkdir -p /pwn
mount -t 9p -o trans=virtio hostshare /pwn