#!/system/bin/sh

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
NC='\033[0m'

echo "========== 木马检测脚本 =========="
echo "设备: $(getprop ro.product.model) - Android$(getprop ro.build.version.release)"
echo ""

risk_count=0

check_path() {
    if [ -e "$1" ]; then
        echo -e "${RED}[发现]${NC} $1 存在"
        risk_count=$((risk_count + 1))
        if [ -d "$1" ]; then
            ls -la "$1" 2>/dev/null | head -n 5
        else
            ls -la "$1" 2>/dev/null
        fi
        echo ""
    else
        echo -e "${GREEN}[安全]${NC} $1 不存在"
    fi
}

check_process() {
    local proc_pattern="$1"
    local pids=""
    local exe_path=""
    local cmdline=""
    local risk=0

    if command -v pgrep >/dev/null 2>&1; then
        pids=$(pgrep -f "$proc_pattern" 2>/dev/null)
    else
        for pid in $(ls /proc | grep -E '^[0-9]+$'); do
            if [ -f /proc/$pid/cmdline ]; then
                cmd=$(cat /proc/$pid/cmdline 2>/dev/null | tr '\0' ' ')
                if echo "$cmd" | grep -qE "$proc_pattern"; then
                    pids="$pids $pid"
                fi
            fi
        done
    fi

    if [ -z "$pids" ]; then
        echo -e "${GREEN}[安全]${NC} 未发现进程: $proc_pattern"
        return 0
    fi

    for pid in $pids; do
        if [ -L "/proc/$pid/exe" ]; then
            exe_path=$(readlink "/proc/$pid/exe" 2>/dev/null)
        fi
        if [ -f "/proc/$pid/cmdline" ]; then
            cmdline=$(cat "/proc/$pid/cmdline" 2>/dev/null | tr '\0' ' ')
        fi

        local in_suspicious=0
        case "$exe_path" in
            /data/local/localadb/*|/data/adb/service.d/*|/data/adb/modules/*)
                in_suspicious=1
                ;;
        esac
        if [ $in_suspicious -eq 0 ]; then
            case "$cmdline" in
                *"/data/local/localadb"*|*"/data/adb/service.d"*|*"/data/adb/modules"*)
                    in_suspicious=1
                    ;;
            esac
        fi

        if [ $in_suspicious -eq 1 ]; then
            echo -e "${RED}[发现]${NC} 进程 $proc_pattern (PID: $pid) 位于可疑目录: $exe_path"
            echo "  命令行: $cmdline"
            risk=1
            break
        else
            if echo "$cmdline" | grep -qE '(base64 -d|eval|gzip -d|xxd -r)'; then
                echo -e "${RED}[发现]${NC} 进程 $proc_pattern (PID: $pid) 命令行含危险指令"
                echo "  命令行: $cmdline"
                risk=1
                break
            else
                echo -e "${GREEN}[安全]${NC} 进程 $proc_pattern (PID: $pid) 路径正常: $exe_path"
            fi
        fi
    done

    if [ $risk -eq 1 ]; then
        risk_count=$((risk_count + 1))
    fi
}

check_base64_content() {
    local file="$1"
    local found=0
    if [ ! -f "$file" ]; then
        echo -e "${GREEN}[安全]${NC} 文件 $file 不存在"
        return 0
    fi
    echo -e "${YELLOW}[检查]${NC} 分析 $file 内容 ..."
    if grep -qE '(base64 -d|eval|gzip -d|xxd -r)' "$file" 2>/dev/null; then
        echo -e "${RED}[发现]${NC} 文件中包含 base64 解码或 eval 等危险指令"
        found=1
    fi
    if grep -qE '[A-Za-z0-9+/=]{100,}' "$file" 2>/dev/null; then
        echo -e "${RED}[发现]${NC} 文件中包含疑似 Base64 编码的长字符串"
        sample=$(grep -Eo '[A-Za-z0-9+/=]{100,}' "$file" 2>/dev/null | head -1 | cut -c1-80)
        echo "  样本: ${sample}..."
        found=1
    fi
    if grep -q 'base64.*|.*sh' "$file" 2>/dev/null; then
        echo -e "${RED}[发现]${NC} 文件包含通过 base64 管道执行 shell 的指令"
        found=1
    fi
    if [ $found -eq 0 ]; then
        echo -e "${GREEN}[安全]${NC} 文件 $file 未发现可疑内容"
    fi
    return $found
}

check_network() {
    local c2_domain="bjm.cc.cd"
    local found_conn=0

    if command -v netstat >/dev/null 2>&1; then
        if netstat -an 2>/dev/null | grep -q "$c2_domain"; then
            echo -e "${RED}[发现]${NC} 存在到 $c2_domain 的网络连接 (netstat)"
            found_conn=1
        fi
    elif command -v ss >/dev/null 2>&1; then
        if ss -an 2>/dev/null | grep -q "$c2_domain"; then
            echo -e "${RED}[发现]${NC} 存在到 $c2_domain 的网络连接 (ss)"
            found_conn=1
        fi
    else
        echo -e "${YELLOW}[信息]${NC} 未找到 netstat 或 ss，无法检测网络连接"
    fi

    if [ $found_conn -eq 1 ]; then
        risk_count=$((risk_count + 1))
    else
        echo -e "${GREEN}[安全]${NC} 未发现到 $c2_domain 的活跃连接"
    fi
}

echo "--- 1. 检查木马主目录 ---"
check_path "/data/local/localadb"
check_path "/data/local/localadb/.h"

echo "--- 2. 检查LSPosed模块是否被感染 ---"
MODULE_SERVICE="/data/adb/modules/zygisk_lsposed/service.sh"
if [ -f "$MODULE_SERVICE" ]; then
    if check_base64_content "$MODULE_SERVICE"; then
        echo -e "${GREEN}[安全]${NC} 文件 $MODULE_SERVICE 存在但内容正常"
    else
        echo -e "${RED}[发现]${NC} 文件 $MODULE_SERVICE 存在且内容可疑"
        risk_count=$((risk_count + 1))
    fi
else
    echo -e "${GREEN}[安全]${NC} $MODULE_SERVICE 不存在"
fi

echo "--- 3. 检查开机自启脚本 ---"
check_path "/data/adb/service.d/guard.sh"
if [ -d "/data/adb/service.d" ]; then
    for f in /data/adb/service.d/*; do
        [ -f "$f" ] || continue
        if grep -q "guard" "$f" 2>/dev/null; then
            echo -e "${RED}[发现]${NC} 自启脚本包含 'guard' 关键字: $f"
            risk_count=$((risk_count + 1))
        fi
    done
fi

echo "--- 4. 检查木马相关进程 ---"
check_process "guard_"
check_process "guard.sh"
check_process "lspservice"
check_process "curl_bin"

echo "--- 5. 检查device_key文件 ---"
check_path "/data/local/localadb/device_key"

echo "--- 6. 检查木马依赖curl工具 ---"
if [ -f "/data/local/localadb/curl" ] || [ -f "/data/local/localadb/curl_bin" ]; then
    echo -e "${RED}[发现]${NC} 存在内置curl工具"
    risk_count=$((risk_count + 1))
else
    echo -e "${GREEN}[安全]${NC} 未发现内置curl"
fi

echo "--- 7. 检查可疑挂载点 ---"
if mount | grep -q "/data/local/localadb"; then
    echo -e "${RED}[发现]${NC} /data/local/localadb 被挂载"
    mount | grep "/data/local/localadb"
    risk_count=$((risk_count + 1))
else
    echo -e "${GREEN}[安全]${NC} 未发现挂载"
fi

echo "--- 8. 检查C2网络连接记录 ---"
check_network

echo "--- 9. 检查其他可疑自启引用 ---"
if grep -r "guard.sh" /data/adb/service.d /data/adb/post-fs-data.d 2>/dev/null | grep -v grep; then
    echo -e "${RED}[发现]${NC} 存在引用 guard.sh 的自启脚本"
    risk_count=$((risk_count + 1))
else
    echo -e "${GREEN}[安全]${NC} 未发现额外引用"
fi

echo ""
echo "========== 检测结果 =========="
if [ $risk_count -eq 0 ]; then
    echo -e "${GREEN}未发现明显木马痕迹，系统相对安全${NC}"
else
    echo -e "${RED}发现 ${risk_count} 个风险项，请谨慎处理！${NC}"
    echo "建议："
    echo "1. 立刻禁用所有模块"
    echo "2. 重启进入安全模式"
    echo "3. 手动删除检测到的危险目录和文件"
    echo "4. 重启后再次运行本脚本验证"
fi
echo "================================"