#!/bin/sh
# 飞鱼分流固件只读识别器
# 用法: sh feiyu_rootfs_detect.sh <rootfs目录> [报告文件]
# 退出码: 0=CLEAN, 1=SUSPECTED_FEIYU, 2=非iKuai/参数错误
set -u

ROOT=${1:-}
OUT=${2:-}
[ -n "$ROOT" ] && [ -d "$ROOT" ] || { echo 'usage: feiyu_rootfs_detect.sh <rootfs> [report]'; exit 2; }

emit() {
  line="$1"
  printf '%s\n' "$line"
  [ -n "$OUT" ] && printf '%s\n' "$line" >> "$OUT"
}

[ -n "$OUT" ] && : > "$OUT"
DATE=$(date -Iseconds 2>/dev/null || date)
HIT=0
STRONG=0
TARGET=0

# 先确认目标是iKuai rootfs，避免把分析机/普通Linux误报成感染。
if [ -f "$ROOT/etc/release" ] || [ -d "$ROOT/usr/ikuai" ] || [ -d "$ROOT/etc/mnt/ikuai" ]; then
  TARGET=1
fi
if [ "$TARGET" = 0 ]; then
  emit 'RESULT=NOT_AN_IKUAI_ROOTFS'
  emit "DATE=$DATE"
  exit 2
fi

emit '=== FEIYU ROOTFS DETECTION ==='
emit "DATE=$DATE"
emit "ROOT=$ROOT"

check_file() {
  rel="$1"
  if [ -e "$ROOT/$rel" ]; then
    emit "HIT_FILE=$rel"
    HIT=$((HIT + 1))
    return 0
  fi
  return 1
}

check_string() {
  rel="$1"
  needle="$2"
  [ -f "$ROOT/$rel" ] || return 1
  if strings "$ROOT/$rel" 2>/dev/null | grep -F -q "$needle"; then
    emit "HIT_STRING=$rel::$needle"
    HIT=$((HIT + 1))
    return 0
  fi
  return 1
}

# 强特征: 伪装进程名 + 临时脚本执行路径的组合。
if [ -f "$ROOT/sbin/autoinit" ]; then
  check_string sbin/autoinit '/tmp/scrH' || true
  check_string sbin/autoinit 'kworker/u8:1-ev' || true
  if strings "$ROOT/sbin/autoinit" 2>/dev/null | grep -F -q '/tmp/scrH' && \
     strings "$ROOT/sbin/autoinit" 2>/dev/null | grep -F -q 'kworker/u8:1-ev'; then
    STRONG=$((STRONG + 1))
    emit 'STRONG=autoinit_scrH_kworker_combo'
  fi
fi

# 启动钩子证据：只读文本检查，不执行rootfs中的任何脚本。
for rel in usr/ikuai/script/plugins.sh usr/ikuai/script/rc; do
  [ -f "$ROOT/$rel" ] || continue
  if grep -nE '(/sbin/)?autoinit[[:space:]]*&|start_remote_services' "$ROOT/$rel" 2>/dev/null | head -5 | while IFS= read -r line; do emit "HIT_BOOT=$rel::$line"; done; then
    :
  fi
  if grep -qE '(/sbin/)?autoinit[[:space:]]*&' "$ROOT/$rel" 2>/dev/null; then
    STRONG=$((STRONG + 1))
  fi
done

# 辅助特征：只能提高置信度，不能单独定性。
for rel in usr/ikuai/script/wuying.sh usr/bin/ik_get_hosts_clt usr/lib/iptables/libxt_location.so; do
  check_file "$rel" || true
done
if [ -f "$ROOT/usr/ikuai/script/wuying.sh" ]; then
  check_string usr/ikuai/script/wuying.sh 'rick-cli' || true
  check_string usr/ikuai/script/wuying.sh 'no-check-certificate' || true
fi

if [ -f "$ROOT/etc/passwd" ]; then
  UID0=$(awk -F: '$3 == 0 {n++} END {print n+0}' "$ROOT/etc/passwd" 2>/dev/null)
  emit "UID0_ACCOUNT_COUNT=$UID0"
  if [ "$UID0" -gt 1 ]; then
    emit 'WARN=multiple_uid0_accounts'
  fi
fi

# 判定门槛：强组合命中才定性，避免把普通mihomo/Clash插件当成飞鱼。
if [ "$STRONG" -ge 2 ]; then
  RESULT=SUSPECTED_FEIYU
  RC=1
elif [ "$HIT" -gt 0 ]; then
  RESULT=FEIYU_RELATED_FEATURES_ONLY
  RC=0
else
  RESULT=CLEAN_OR_NOT_DETECTED
  RC=0
fi
emit "HIT_COUNT=$HIT"
emit "STRONG_COUNT=$STRONG"
emit "RESULT=$RESULT"
emit 'NOTE=只读检测；命中不等于完成犯罪归因，需保留固件原件、哈希、版本和授权来源。'
exit "$RC"