#!/usr/bin/env node
// ULTRAZE AC 
import { execFileSync } from "node:child_process";
import { createHash } from "node:crypto";
import { readFileSync, writeFileSync, existsSync } from "node:fs";
import os from "node:os";
import path from "node:path";
import readline from "node:readline";

const VERSION = "1.1.0";
const API_CANDIDATES = [
  process.env.ULTRAZE_AC_API,
  "https://ultraze.eu/api/public/ac/heartbeat",
  "https://nexus-warfare-pro.lovable.app/api/public/ac/heartbeat",
].filter(Boolean);
let API = API_CANDIDATES[0];
const CONFIG = path.join(os.homedir(), ".ultraze-ac.json");

const BLOCKLIST = [
  "cheatengine", "extreme injector", "processhacker", "xenos", "gh injector",
  "artmoney", "wemod", "engine.exe", "injector", "aimbot", "esp.exe", "kdmapper",
];

function readConfig() {
  if (!existsSync(CONFIG)) return {};
  try { return JSON.parse(readFileSync(CONFIG, "utf8")); } catch { return {}; }
}
function writeConfig(cfg) { writeFileSync(CONFIG, JSON.stringify(cfg, null, 2)); }

function ask(question) {
  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
  return new Promise((resolve) => rl.question(question, (a) => { rl.close(); resolve(a.trim()); }));
}

function run(cmd, args) {
  try { return execFileSync(cmd, args, { encoding: "utf8", timeout: 15000, windowsHide: true }); }
  catch { return ""; }
}

function machineHash() {
  const raw = [os.hostname(), os.userInfo().username, os.cpus()[0]?.model, os.totalmem()].join("|");
  return createHash("sha256").update(raw).digest("hex");
}

function checkProcesses() {
  const out = run("tasklist", ["/fo", "csv"]).toLowerCase();
  if (!out) return null;
  return !BLOCKLIST.some((bad) => out.includes(bad));
}

function checkDrivers() {
  const out = run("driverquery", ["/si", "/fo", "csv"]);
  if (!out) return null;
  const lines = out.split(/\r?\n/).slice(1).filter(Boolean);
  const unsigned = lines.filter((l) => /,\s*"?FALSE"?/i.test(l));
  return unsigned.length === 0;
}

function checkVirtualization() {
  const out = (run("wmic", ["computersystem", "get", "model"]) + os.cpus()[0]?.model).toLowerCase();
  if (!out) return null;
  return !["virtualbox", "vmware", "qemu", "kvm", "hyper-v", "parallels"].some((v) => out.includes(v));
}

function checkIntegrity(selfPath) {
  try {
    const hash = createHash("sha256").update(readFileSync(selfPath)).digest("hex");
    const cfg = readConfig();
    if (!cfg.selfHash) { writeConfig({ ...cfg, selfHash: hash }); return true; }
    return cfg.selfHash === hash;
  } catch { return null; }
}

function checkDebugger() {
  const out = run("tasklist", ["/fo", "csv"]).toLowerCase();
  if (!out) return null;
  return !["x64dbg", "ollydbg", "windbg", "ida64", "ida.exe", "dnspy"].some((d) => out.includes(d));
}

function checkOverlay() {
  const out = run("tasklist", ["/fo", "csv"]).toLowerCase();
  if (!out) return null;
  return !["overwolf", "rivatuner", "rtss.exe"].some((d) => out.includes(d));
}

/* ---------- Couches materielles (cartes DMA) ---------- */

function ps(script) {
  return run("powershell", ["-NoProfile", "-NonInteractive", "-Command", script]);
}

// Identifiants materiels recurrents des cartes DMA du commerce (FPGA Xilinx/Lattice,
// Screamer / Squirrel / Enigma / CaptainDMA & co) + noms commerciaux.
const DMA_IDS = ["ven_10ee", "ven_1204", "ven_1c5c&dev_1a34", "ven_1e0f&dev_0001"];
const DMA_NAMES = [
  "screamer", "squirrel", "enigma", "captaindma", "pciescreamer", "leetdma",
  "ft601", "xilinx", "lattice", "fpga", "dma card",
];

function checkDmaHardware() {
  const out = ps(
    "Get-PnpDevice -PresentOnly | ForEach-Object { \"$($_.InstanceId)|$($_.FriendlyName)|$($_.Status)\" }",
  ).toLowerCase();
  if (!out) return null;
  if (DMA_IDS.some((id) => out.includes(id))) return false;
  return !DMA_NAMES.some((n) => out.includes(n));
}

// Une carte DMA masquee en NVMe se voit au decalage controleurs / disques reellement montes.
function checkStorageCoherence() {
  const controllers = ps(
    "(Get-PnpDevice -Class SCSIAdapter,HDC -PresentOnly | Measure-Object).Count",
  ).trim();
  const disks = ps("(Get-PhysicalDisk | Measure-Object).Count").trim();
  const nvme = ps(
    "(Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -like '*NVME*' } | Measure-Object).Count",
  ).trim();
  if (!controllers || !disks) return null;
  const c = Number(controllers), d = Number(disks), n = Number(nvme || "0");
  if (!Number.isFinite(c) || !Number.isFinite(d)) return null;
  // Plus de controleurs NVMe annonces que de disques physiques reels = incoherence.
  return !(n > d + 1 || c > d + 4);
}

// Identite des disques NVMe : numeros de serie vides, dupliques ou fabriques.
function checkNvmeIdentity() {
  const out = ps(
    "Get-PhysicalDisk | ForEach-Object { \"$($_.SerialNumber)|$($_.Model)|$($_.BusType)\" }",
  );
  if (!out) return null;
  const rows = out.split(/\r?\n/).map((l) => l.trim().toLowerCase()).filter(Boolean);
  if (rows.length === 0) return null;
  const serials = rows.map((r) => r.split("|")[0]);
  const suspicious = serials.filter(
    (s) => !s || s === "0" || /^0+$/.test(s) || s.includes("0123456789") || s === "none",
  );
  const duplicated = new Set(serials.filter((s) => s)).size !== serials.filter((s) => s).length;
  return suspicious.length === 0 && !duplicated;
}

// Composants presents mais sans pilote officiel / invisibles au scan standard.
function checkGhostDevices() {
  const out = ps(
    "Get-PnpDevice -PresentOnly | Where-Object { $_.Status -ne 'OK' } | ForEach-Object { \"$($_.Class)|$($_.FriendlyName)|$($_.Status)|$($_.Problem)\" }",
  ).toLowerCase();
  if (!out.trim()) return true;
  const rows = out.split(/\r?\n/).filter(Boolean);
  // On ne retient que le materiel de bus (PCI / stockage / reseau) sans pilote : le reste
  // (imprimantes, peripheriques USB debranches) genere trop de faux positifs.
  const risky = rows.filter(
    (r) =>
      /unknown|system|scsiadapter|hdc|net/.test(r) &&
      /(error|unknown|\|28$|\|28\b)/.test(r),
  );
  return risky.length === 0;
}

// Kernel DMA Protection (IOMMU) : signal complementaire, jamais une preuve seule.
function checkKernelDmaProtection() {
  const out = ps(
    "(Get-CimInstance -Namespace root/Microsoft/Windows/DeviceGuard -ClassName Win32_DeviceGuard).AvailableSecurityProperties -join ','",
  ).trim();
  const policy = run("reg", [
    "query",
    "HKLM\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses",
  ]);
  if (!out && !policy) return null;
  // 7 = DMA protection presente/active dans les proprietes de securite Windows.
  if (out.split(",").map((v) => v.trim()).includes("7")) return true;
  // Signal informatif : jamais bloquant a lui seul (et falsifiable), donc "en attente".
  return policy ? true : null;
}

function collectModules(selfPath) {
  const raw = {
    integrity: checkIntegrity(selfPath),
    processes: checkProcesses(),
    drivers: checkDrivers(),
    debugger: checkDebugger(),
    virtualization: checkVirtualization(),
    overlay: checkOverlay(),
    dma: checkDmaHardware(),
    storage: checkStorageCoherence(),
    nvme: checkNvmeIdentity(),
    ghost: checkGhostDevices(),
    dmaguard: checkKernelDmaProtection(),
  };
  const modules = {};
  for (const [name, value] of Object.entries(raw)) modules[name] = value !== false;
  return modules;
}

const STATUS_TEXT = {
  off: "ULTRAZE AC eteint - interdit de jouer",
  invalid: "Modules de securite invalides - interdit de jouer",
  linking: "Modules OK, liaison au match en cours - autorise",
  ready: "AC + modules + match lie - autorise",
};

async function main() {
  const selfPath = process.argv[1] || process.execPath;
  let cfg = readConfig();
  if (!cfg.key) {
    console.log("ULTRAZE AC " + VERSION);
    console.log("Colle ta cle personnelle (page ULTRAZE AC sur le site) :");
    cfg.key = await ask("> ");
    writeConfig(cfg);
  }

  let sessionId = null;
  const beat = async (stopping = false) => {
    const modules = collectModules(selfPath);
    try {
      const res = await fetch(API, {
        method: "POST",
        headers: { "content-type": "application/json" },
        body: JSON.stringify({
          key: cfg.key,
          sessionId,
          agentVersion: VERSION,
          osVersion: os.version ? os.version() + " " + os.release() : os.release(),
          machineHash: machineHash(),
          modules,
          stopping,
        }),
      });
      const data = await res.json();
      if (!res.ok) { console.log("Erreur : " + (data.error || res.status)); return; }
      sessionId = data.sessionId;
      const failed = (data.failedModules || []).join(", ");
      console.clear();
      console.log("ULTRAZE AC " + VERSION);
      console.log(STATUS_TEXT[data.status] || data.status);
      if (failed) console.log("Modules en echec : " + failed);
      if (data.matchId) console.log("Match lie : " + data.matchId);
      console.log("Laisse cette fenetre ouverte pendant ton match.");
    } catch (err) {
      console.log("Connexion au serveur impossible : " + err.message);
    }
  };

  await beat();
  const timer = setInterval(beat, 15000);
  const stop = async () => { clearInterval(timer); await beat(true); process.exit(0); };
  process.on("SIGINT", stop);
  process.on("SIGTERM", stop);
}

main();