Get Handle for Binder_node through in Android

I'm trying to learn exploitdev for fun. While researching cve-2023-20938 (android binder uaf), I encountered a barrier. I need to create binder_node in my process and get handle for that binder_node in order to send malicious transactions. But I have no idea how to get handle for specific binder_node or how to create new binder_node and register it in context manager in android kernel.

I find a github repo that likely reproduces that bug but it uses ITokenManager but I have no idea what it is and I could find any docs for that.

If you have such experience, please help me.