CellGuard: LTE/5G-NR lock + IMSI-catcher detection KSU module

- cgcap.ko: cpif CP-frame capture via kprobe/kallsyms, stock-GKI build
- ratlock.sh: hold modem to LTE+NR(5G), block 2G/3G downgrade
- cgdetect.sh: always-on behavioral cell-site-simulator detection
- cgctl.sh + WebUI: block/detect toggles, status + alerts
- build-stock-gki.sh: reproducible stock-GKI module build pipeline

cgctl.sh

@@ -0,0 +1,40 @@
+#!/system/bin/sh
+# CellGuard WebUI backend. Emits one JSON line per command. Two independent
+# toggles, each a flag file honored by its daemon:
+#   block  -> $CG/enabled         (ratlock.sh: force LTE+5G, block 2G/3G)
+#   detect -> $CG/detect_enabled  (cgdetect.sh: IMSI-catcher detection)
+CG=/data/adb/cellguard
+BLOCK="$CG/enabled"
+DETECT="$CG/detect_enabled"
+STATUS="$CG/status"
+ALERTS="$CG/alerts"
+mkdir -p "$CG"
+
+esc() { printf '%s' "$1" | sed 's/\\/\\\\/g; s/"/\\"/g; s/[[:cntrl:]]//g'; }
+kv()  { grep -m1 "^$1=" "$STATUS" 2>/dev/null | cut -d= -f2-; }
+
+case "$1" in
+  block)  [ "$2" = on ] && echo 1 > "$BLOCK"  || echo 0 > "$BLOCK";  printf '{"ok":true}\n' ;;
+  detect) [ "$2" = on ] && echo 1 > "$DETECT" || echo 0 > "$DETECT"; printf '{"ok":true}\n' ;;
+  status)
+    b=1; [ "$(cat "$BLOCK"  2>/dev/null)" = 0 ] && b=0
+    d=1; [ "$(cat "$DETECT" 2>/dev/null)" = 0 ] && d=0
+    allow=""
+    for s in 0 1; do v=$(cmd phone get-allowed-network-types-for-users -s "$s" 2>/dev/null); [ -n "$v" ] && allow="$v"; done
+    lock=false; case "$allow" in *GSM*|*WCDMA*|*UMTS*|*CDMA*) lock=false;; *LTE*|*NR*) lock=true;; esac
+    printf '{"ok":true,"block":%s,"detect":%s,"lock":%s,"rat":"%s","plmn":"%s","operator":"%s","ci":"%s","pci":"%s","tac":"%s","earfcn":"%s","frames":"%s","suspect":"%s","allowed":"%s"}\n' \
+      "$b" "$d" "$lock" "$(esc "$(kv rat)")" "$(esc "$(kv plmn)")" "$(esc "$(kv operator)")" \
+      "$(esc "$(kv ci)")" "$(esc "$(kv pci)")" "$(esc "$(kv tac)")" "$(esc "$(kv earfcn)")" \
+      "$(esc "$(kv frames)")" "$(esc "$(kv suspect)")" "$(esc "$allow")"
+    ;;
+  alerts)
+    printf '{"ok":true,"lines":['
+    first=1
+    tail -n 25 "$ALERTS" 2>/dev/null | while IFS= read -r l; do
+      [ "$first" = 1 ] || printf ','; first=0
+      printf '"%s"' "$(esc "$l")"
+    done
+    printf ']}\n'
+    ;;
+  *) printf '{"ok":false,"error":"usage: block on|off | detect on|off | status | alerts"}\n' ;;
+esac