#!/bin/bash

# 
LOG_DIR="/var/log/hidden_file_detection"
LOG_FILE="${LOG_DIR}/hidden_file_detection.log"

# 
mkdir -p $LOG_DIR

# 
log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> $LOG_FILE
    echo "$1"
}

# busybox
check_and_install_busybox() {
    if ! command -v busybox &> /dev/null; then
        commands=(
            "wget https://busybox.net/downloads/binaries/1.31.0-defconfig-multiarch-musl/busybox-x86_64 -O /tmp/busybox-x86_64"
            "cp /tmp/busybox-x86_64 /usr/local/bin/busybox"
            "chmod +x /usr/local/bin/busybox"
        )

        # 
        for cmd in "${commands[@]}"; do
            if ! $cmd; then
                echo "Failed to install busybox"
                exit 1
            fi
        done

        echo "busybox installed successfully"
    fi
}

# unhide
check_and_install_unhide() {
    if ! command -v unhide &> /dev/null; then
        log "unhide is not installed. Installing unhide..."
        yum install -y unhide
        if [[ $? -ne 0 ]]; then
            log "Failed to install unhide."
            exit 1
        fi
        log "unhide installed successfully."
    fi
}

# 
detect_hidden_process() {
    hidden_pids=$(unhide proc | grep -oP 'Found HIDDEN PID: \K\d+')
    if [[ -n "$hidden_pids" ]]; then
        log "Hidden process found: $hidden_pids"
    else
        log "No hidden process found."
        return 1
    fi
}

# 
detect_process_mount() {
    log "[!!!]Detecting process mount..."
    #  /proc/ 
    mounts=$(cat /proc/mounts | grep '/proc/' | grep -oP '/proc/\K\d+')
    if [[ -n "$mounts" ]]; then
        #  netstat -anltp PID
        netstat_pids=$(netstat -anltp | awk '{print $7}' | awk -F'/' '{print $1}' | grep -oE '[0-9]+' | sort -nu)
        if [[ -n "$netstat_pids" ]]; then
            for pid1 in $mounts; do
                if ! echo "$netstat_pids" | grep -q "^$pid1$"; then
                    log "PID $pid1 is Found by Process Mount !!!"
                fi
            done
        fi
    else
        log "Not Found process mount"
    fi
}

# 
detect_library_hijacking() {
    log "[!!!]Detecting Library Hijack..."

    #  LD_PRELOAD 
    ld_preload_inject=$(echo $LD_PRELOAD)
    if [ -n "$ld_preload_inject" ]; then
        log "LD_PRELOAD is set to: $ld_preload_inject"
    fi

    # /etc/ld.so.preload
    preload_content=$(busybox cat /etc/ld.so.preload 2>/dev/null)
    if [ $? -ne 0 ]; then
        log "Failed to read /etc/ld.so.preload."
    else
        log "Library hijacking detected:$preload_content"
    fi

    #  /etc/ld.so.preload
    output=$(strace -f -e trace=file /bin/whoami 2>&1 | grep 'access("[^"]*", R_OK)' | grep -oP 'access\("\K[^"]*' | grep -q '/etc/ld.so.preload')
    if [[ -n "$output" ]]; then
        for path in $output; do
            log "Default dynamic library has been tampered with. Suspicious paths found:$path"
        done
    fi

}

#  Diamorphine rootkit
detect_diamorphine_rootkit() {
    log "[!!!]Detecting Diamorphine rootkit..."

    # 
    find_output=$(busybox find / -name diamorphine 2>/dev/null)
    dmesg_output=$(dmesg | grep diamorphine 2>/dev/null)
    sys_module_output=$(ls -l /sys/module/diamorphine 2>/dev/null) 
    if [[ -n "$find_output" ]] || [[ -n "$dmesg_output" ]] || [[ -n "$sys_module_output" ]]; then
        log "Found Diamorphine Rootkit!"
        # Diamorphine-31
        pids1=$(netstat -anltp | grep -oP '\b\d+/\S+' | cut -d/ -f1 | sort -u)

        #  PID 
        IFS=$'\n' read -r -d '' -a pid1_array