"""
Autarch Android Forensics — forensic acquisition and IOC scanning for Android devices.
by: SsSnake
"""

import json
import os
import re
from datetime import datetime
from pathlib import Path

_manager = None


def get_android_forensics_manager():
    global _manager
    if _manager is None:
        _manager = AutarchAndroidManager()
    return _manager


class AutarchAndroidManager:
    """Forensic acquisition and IOC scanning for Android devices."""

    IOC_DATA_DIR = Path(__file__).parent.parent / 'data' / 'ioc'
    ACQ_DATA_DIR = Path(__file__).parent.parent / 'data' / 'android_forensics'

    def __init__(self):
        self._ioc_db = None  # lazy-loaded

    # ── Helpers ─────────────────────────────────────────────────────

    def _hw(self):
        from core.hardware import get_hardware_manager
        return get_hardware_manager()

    def _adb(self, serial, cmd, timeout=60):
        """Run an ADB shell command, return stdout string."""
        result = self._hw().adb_shell_raw(serial, cmd, timeout=timeout)
        if isinstance(result, dict):
            return result.get('output', '') or ''
        return str(result or '')

    def _acq_dir(self, serial, acq_id):
        d = self.ACQ_DATA_DIR / serial / acq_id
        d.mkdir(parents=True, exist_ok=True)
        return d

    def _new_acq_id(self):
        return datetime.now().strftime('%Y%m%d_%H%M%S')

    # ── IOC Database ────────────────────────────────────────────────

    def load_ioc_database(self, force=False):
        """Lazy-load and merge all IOC data from data/ioc/. Returns merged dict."""
        if self._ioc_db is not None and not force:
            return self._ioc_db

        db = {
            'packages':   {},   # pkg_name   -> {name, source, severity}
            'certs':      {},   # sha1/sha256 -> {name, source}
            'domains':    {},   # domain      -> {name, source}
            'ips':        set(),
            'file_paths': {},   # path        -> {name, source}
            'processes':  {},   # proc_name   -> {name, source}
            'hashes':     {},   # sha256      -> {name, source}
        }

        # 1. Stalkerware ioc.yaml + watchware.yaml
        for fname in ('ioc.yaml', 'watchware.yaml'):
            fpath = self.IOC_DATA_DIR / 'stalkerware' / fname
            if fpath.exists():
                self._parse_stalkerware_yaml(fpath, db)

        # 2. Amnesty investigations
        amnesty_dir = self.IOC_DATA_DIR / 'spyware' / 'amnesty'
        if amnesty_dir.exists():
            for campaign_dir in sorted(amnesty_dir.iterdir()):
                if campaign_dir.is_dir():
                    self._parse_investigation(campaign_dir, db)

        # 3. MVT indicators
        mvt_dir = self.IOC_DATA_DIR / 'spyware' / 'mvt'
        if mvt_dir.exists():
            for campaign_dir in sorted(mvt_dir.iterdir()):
                if campaign_dir.is_dir():
                    self._parse_investigation(campaign_dir, db)

        # 4. Citizen Lab campaigns
        cl_dir = self.IOC_DATA_DIR / 'spyware' / 'citizen_lab'
        if cl_dir.exists():
            for campaign_dir in sorted(cl_dir.iterdir()):
                if campaign_dir.is_dir():
                    self._parse_investigation(campaign_dir, db)

        # 5. iMazing indicators (recursive)
        imazing_dir = self.IOC_DATA_DIR / 'spyware' / 'imazing'
        if imazing_dir.exists():
            for item in imazing_dir.rglob('*'):
                if item.is_dir():
                    self._parse_investigation(item, db)

        # 6. Existing stalkerware_signatures.json
        sigs_path = Path(__file__).parent.parent / 'data' / 'stalkerware_signatures.json'
        if sigs_path.exists():
            self._parse_sigs_json(sigs_path, db)

        # Convert ips set to list for JSON serialisation
        db['ips'] = list(db['ips'])

        self._ioc_db = db
        self._save_index(db)
        return db

    def _parse_stalkerware_yaml(self, path, db):
        """Parse stalkerware/watchware ioc.yaml into db."""
        try:
            import yaml
        except ImportError:
            return
        try:
            with open(path, encoding='utf-8', errors='ignore') as f:
                data = yaml.safe_load(f)
            if not isinstance(data, dict):
                return
            for vendor, info in data.items():
                if not isinstance(info, dict):
                    continue
                source = f'stalkerware/{path.name}:{vendor}'
                for pkg in info.get('packages', []) or []:
                    if pkg:
                        db['packages'][pkg] = {'name': vendor, 'source': source, 'severity': 'high'}
                for cert in info.get('certificates', []) or []:
                    if cert:
                        db['certs'][cert.lower()] = {'name': vendor, 'source': source}
                for domain in (info.get('domains', []) or []) + (info.get('c2', []) or []) + (info.get('website', []) or []):
                    if domain:
                        db['domains'][domain.lower()] = {'name': vendor, 'source': source}
        except Exception:
            pass

    def _parse_investigation(self, campaign_dir, db):
        """Parse a campaign directory for IOC text files and STIX2."""
        name = campaign_dir.name
        source = f'spyware/{campaign_dir.parent.name}/{name}'

        for f in campaign_dir.iterdir():
            if not f.is_file():
                continue
            fname = f.name.lower()

            if fname in ('domains.txt', 'domains'):
                self._load_txt_lines(f, db['domains'], name, source)
            elif fname in ('package_names.txt', 'package_names'):
                self._load_txt_lines(f, db['packages'], name, source, extra={'severity': 'critical'})
            elif fname in ('processes.txt', 'processes'):
                self._load_txt_lines(f, db['processes'], name, source)
            elif fname in ('file_paths.txt', 'file_paths'):
                self._load_txt_lines(f, db['file_paths'], name, source)
            elif fname in ('ips.txt', 'ip_addresses.txt', 'ip-addresses.txt'):
                self._load_txt_set(f, db['ips'])
            elif fname.endswith('.stix2') or fname.endswith('_stix.json'):
                self._parse_stix(f, db, name, source)
            elif fname in ('sha256.txt', 'sha256.csv'):
                self._load_hashes(f, db['hashes'], name, source)
            elif fname == 'package_cert_hashes.txt':
                self._load_txt_lines(f, db['certs'], name, source)
            elif fname.endswith('.json') and 'ioc' in fname:
                self._parse_ioc_json(f, db, name, source)
            elif fname.endswith('.csv') and 'ioc' in fname:
                self._parse_ioc_csv(f, db, name, source)

    def _load_txt_lines(self, path, target_dict, name, source, extra=None):
        """Load one-indicator-per-line text file into a dict."""
        try:
            with open(path, encoding='utf-8', errors='ignore') as f:
                for line in f:
                    line = line.strip().lower()
                    if line and not line.startswith('#'):
                        entry = {'name': name, 'source': source}
                        if extra:
                            entry.update(extra)
                        target_dict[line] = entry
        except Exception:
            pass

    def _load_txt_set(self, path, target_set):
        try:
            with open(path, encoding='utf-8', errors='ignore') as f:
                for line in f:
                    line = line.strip()
                    if line and not line.startswith('#'):
                        target_set.add(line)
        except Exception:
            pass

    def _load_hashes(self, path, target_dict, name, source):
        try:
            with open(path, encoding='utf-8', errors='ignore') as f:
                for line in f:
                    parts = line.strip().split(',')
                    h = parts[0].strip().lower()
                    if h and len(h) in (32, 40, 64):
                        target_dict[h] = {'name': name, 'source': source}
        except Exception:
            pass

    def _parse_stix(self, path, db, name, source):
        """Parse a STIX2 JSON file for indicators."""
        try:
            with open(path, encoding='utf-8', errors='ignore') as f:
                data = json.load(f)
            objects = data.get('objects', []) if isinstance(data, dict) else []
            for obj in objects:
                if obj.get('type') != 'indicator':
                    continue
                pattern = obj.get('pattern', '')
                for m in re.findall(r"domain-name:value\s*=\s*'([^']+)'", pattern):
                    db['domains'][m.lower()] = {'name': name, 'source': source}
                for m in re.findall(r"file:hashes\.'[^']+'\s*=\s*'([a-fA-F0-9]+)'", pattern):
                    db['hashes'][m.lower()] = {'name': name, 'source': source}
                for m in re.findall(r"process:name\s*=\s*'([^']+)'", pattern):
                    db['processes'][m.lower()] = {'name': name, 'source': source}
                for m in re.findall(r"(?:file:name|directory:path)\s*=\s*'([^']+)'", pattern):
                    db['file_paths'][m] = {'name': name, 'source': source}
                for m in re.findall(r"ipv[46]-addr:value\s*=\s*'([^']+)'", pattern):
                    db['ips'].add(m)
        except Exception:
            pass

    def _parse_ioc_json(self, path, db, name, source):
        try:
            with open(path, encoding='utf-8', errors='ignore') as f:
                data = json.load(f)
            items = data.get('items', data.get('iocs', [])) if isinstance(data, dict) else data
            if not isinstance(items, list):
                return
            for item in items:
                if not isinstance(item, dict):
                    continue
                itype = item.get('type', '').lower()
                val = str(item.get('value', item.get('indicator', ''))).strip().lower()
                if not val:
                    continue
                if 'domain' in itype:
                    db['domains'][val] = {'name': name, 'source': source}
                elif 'ip' in itype:
                    db['ips'].add(val)
                elif 'hash' in itype or 'sha' in itype or 'md5' in itype:
                    db['hashes'][val] = {'name': name, 'source': source}
        except Exception:
            pass

    def _parse_ioc_csv(self, path, db, name, source):
        try:
            import csv
            with open(path, encoding='utf-8', errors='ignore', newline='') as f:
                reader = csv.DictReader(f)
                for row in reader:
                    val = (row.get('value') or row.get('indicator') or row.get('domain') or '').strip().lower()
                    itype = (row.get('type') or row.get('indicator_type') or '').lower()
                    if not val:
                        continue
                    if 'domain' in itype:
                        db['domains'][val] = {'name': name, 'source': source}
                    elif 'hash' in itype or 'sha256' in itype:
                        db['hashes'][val] = {'name': name, 'source': source}
        except Exception:
            pass

    def _parse_sigs_json(self, path, db):
        """Merge existing stalkerware_signatures.json into db."""
        try:
            with open(path, encoding='utf-8') as f:
                data = json.load(f)
            for vendor, info in data.get('stalkerware', {}).items():
                source = f'stalkerware_signatures.json:{vendor}'
                sev = info.get('severity', 'high')
                for pkg in info.get('packages', []):
                    if pkg and pkg not in db['packages']:
                        db['packages'][pkg] = {'name': vendor, 'source': source, 'severity': sev}
            for spyware in data.get('government_spyware', []):
                name = spyware.get('name', 'unknown')
                source = f'stalkerware_signatures.json:{name}'
                for ind in spyware.get('indicators', []):
                    itype = ind.get('type', '')
                    val = ind.get('value', '')
                    if not val:
                        continue
                    if itype == 'process':
                        db['processes'][val.lower()] = {'name': name, 'source': source}
                    elif itype == 'domain':
                        db['domains'][val.lower()] = {'name': name, 'source': source, 'severity': 'critical'}
                    elif itype == 'file_path':
                        db['file_paths'][val] = {'name': name, 'source': source}
        except Exception:
            pass

    def _save_index(self, db):
        try:
            def _count_dirs(d):
                return sum(1 for p in d.iterdir() if p.is_dir()) if d.exists() else 0

            ips = db.get('ips', [])
            index = {
                'generated': datetime.now().isoformat(),
                'counts': {
                    'packages':   len(db.get('packages', {})),
                    'certs':      len(db.get('certs', {})),
                    'domains':    len(db.get('domains', {})),
                    'ips':        len(ips) if not isinstance(ips, set) else len(ips),
                    'file_paths': len(db.get('file_paths', {})),
                    'processes':  len(db.get('processes', {})),
                    'hashes':     len(db.get('hashes', {})),
                },
                'sources': {
                    'stalkerware_ioc_yaml':     (self.IOC_DATA_DIR / 'stalkerware' / 'ioc.yaml').exists(),
                    'amnesty_investigations':   _count_dirs(self.IOC_DATA_DIR / 'spyware' / 'amnesty'),
                    'mvt_campaigns':            _count_dirs(self.IOC_DATA_DIR / 'spyware' / 'mvt'),
                    'citizen_lab_campaigns':    _count_dirs(self.IOC_DATA_DIR / 'spyware' / 'citizen_lab'),
                    'yara_rules':               sum(1 for _ in (self.IOC_DATA_DIR / 'yara').rglob('*.yar*'))
                                                if (self.IOC_DATA_DIR / 'yara').exists() else 0,
                },
            }
            self.IOC_DATA_DIR.mkdir(parents=True, exist_ok=True)
            with open(self.IOC_DATA_DIR / 'index.json', 'w', encoding='utf-8') as f:
                json.dump(index, f, indent=2)
        except Exception:
            pass

    def get_ioc_stats(self):
        """Return IOC database statistics (from index.json if available)."""
        idx_path = self.IOC_DATA_DIR / 'index.json'
        if idx_path.exists():
            try:
                with open(idx_path, encoding='utf-8') as f:
                    return json.load(f)
            except Exception:
                pass
        db = self.load_ioc_database()
        return {'counts': {k: len(v) for k, v in db.items() if isinstance(v, (dict, list))}}

    def reload_ioc_database(self):
        """Force reload all IOC data from disk."""
        self._ioc_db = None
        return self.load_ioc_database(force=True)

    # ── Acquisition Methods ─────────────────────────────────────────

    def acquire_packages(self, serial):
        """Get list of installed packages with paths and system/user classification."""
        try:
            all_out = self._adb(serial, 'pm list packages -f', timeout=30)
            sys_out = self._adb(serial, 'pm list packages -s', timeout=30)

            # Build system package set from -s output (format: "package:com.pkg.name")
            sys_pkgs = set()
            for line in sys_out.splitlines():
                line = line.strip()
                if line.startswith('package:'):
                    sys_pkgs.add(line[8:].strip())

            # Parse -f output (format: "package:/path/to/base.apk=com.pkg.name")
            packages = []
            for line in all_out.splitlines():
                line = line.strip()
                if not line.startswith('package:'):
                    continue
                line = line[8:]  # strip "package:"
                # Split on last '=' to handle paths that may contain '='
                eq_pos = line.rfind('=')
                if eq_pos == -1:
                    pkg_name = line
                    apk_path = ''
                else:
                    apk_path = line[:eq_pos]
                    pkg_name = line[eq_pos + 1:]
                pkg_name = pkg_name.strip()
                if pkg_name:
                    packages.append({
                        'package': pkg_name,
                        'path':    apk_path.strip(),
                        'system':  pkg_name in sys_pkgs,
                    })
            return {'ok': True, 'packages': packages, 'total': len(packages)}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'packages': []}

    def acquire_processes(self, serial):
        """Get list of running processes."""
        try:
            out = self._adb(serial, 'ps -A', timeout=30)
            lines = [l for l in out.splitlines() if l.strip()]
            return {'ok': True, 'output': out, 'count': max(0, len(lines) - 1)}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'output': ''}

    def acquire_getprop(self, serial):
        """Get all system properties via getprop."""
        try:
            out = self._adb(serial, 'getprop', timeout=30)
            props = {}
            for line in out.splitlines():
                m = re.match(r'\[(.+)\]:\s*\[(.*)\]\s*$', line)
                if m:
                    props[m.group(1)] = m.group(2)
            return {'ok': True, 'props': props, 'output': out}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'props': {}}

    def acquire_settings(self, serial):
        """Get global, secure, and system settings."""
        try:
            result = {}
            for ns in ('global', 'secure', 'system'):
                out = self._adb(serial, f'settings list {ns}', timeout=30)
                settings = {}
                for line in out.splitlines():
                    if '=' in line:
                        k, _, v = line.partition('=')
                        settings[k.strip()] = v.strip()
                result[ns] = settings
            return {'ok': True, 'settings': result}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'settings': {}}

    def acquire_services(self, serial):
        """List all running Android services."""
        try:
            out = self._adb(serial, 'service list', timeout=30)
            return {'ok': True, 'output': out, 'count': len(out.splitlines())}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'output': ''}

    def acquire_dumpsys(self, serial):
        """Full dumpsys output (may be large)."""
        try:
            out = self._adb(serial, 'dumpsys', timeout=180)
            return {'ok': True, 'output': out, 'size': len(out)}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'output': ''}

    def acquire_logcat(self, serial):
        """Recent logcat entries (last 1000 lines)."""
        try:
            out = self._adb(serial, 'logcat -d -t 1000', timeout=60)
            return {'ok': True, 'output': out, 'lines': len(out.splitlines())}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'output': ''}

    def acquire_tmp_files(self, serial):
        """List files in /data/local/tmp/."""
        try:
            out = self._adb(serial, 'ls -la /data/local/tmp/ 2>/dev/null', timeout=15)
            return {'ok': True, 'output': out, 'lines': len(out.splitlines())}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'output': ''}

    def acquire_files(self, serial, max_depth=5):
        """Recursive file listing from common paths."""
        try:
            paths = ['/data/local/tmp', '/sdcard/Android/data', '/data/data',
                     '/system/app', '/data/app']
            results = []
            for base in paths:
                out = self._adb(
                    serial,
                    f'find {base} -maxdepth {max_depth} -type f 2>/dev/null | head -500',
                    timeout=30,
                )
                for line in out.splitlines():
                    line = line.strip()
                    if line:
                        results.append({'path': line})
            return {'ok': True, 'files': results, 'total': len(results)}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'files': []}

    def acquire_logs(self, serial):
        """Full logcat with thread-time format (last 2000 lines)."""
        try:
            out = self._adb(serial, 'logcat -d -v threadtime -t 2000', timeout=90)
            return {'ok': True, 'output': out, 'lines': len(out.splitlines())}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'output': ''}

    def acquire_bugreport_info(self, serial):
        """Collect bugreport header info (device state, battery, memory) without full zip."""
        try:
            sections = {}
            for name, cmd in [
                ('memory',  'cat /proc/meminfo'),
                ('cpuinfo', 'cat /proc/cpuinfo | head -40'),
                ('uptime',  'cat /proc/uptime'),
                ('mounts',  'cat /proc/mounts'),
            ]:
                sections[name] = self._adb(serial, cmd, timeout=15)
            return {'ok': True, 'sections': sections}
        except Exception as e:
            return {'ok': False, 'error': str(e), 'sections': {}}

    # ── IOC Scanning ────────────────────────────────────────────────

    def scan_packages(self, serial, packages_data=None):
        """Match installed packages against IOC package names."""
        db = self.load_ioc_database()
        if packages_data is None:
            result = self.acquire_packages(serial)
            if not result.get('ok'):
                return {'ok': False, 'error': result.get('error'), 'findings': []}
            packages_data = result['packages']

        findings = []
        for pkg_info in packages_data:
            pkg = pkg_info.get('package', '').strip()
            if pkg and pkg in db['packages']:
                match = db['packages'][pkg]
                findings.append({
                    'package':      pkg,
                    'path':         pkg_info.get('path', ''),
                    'system':       pkg_info.get('system', False),
                    'threat_name':  match['name'],
                    'source':       match['source'],
                    'severity':     match.get('severity', 'high'),
                    'type':         'package_match',
                })
        return {
            'ok': True,
            'total_scanned': len(packages_data),
            'findings': findings,
            'clean': len(findings) == 0,
        }

    def scan_certificates(self, serial):
        """Check APK signing cert hashes against known-bad certs in IOC database."""
        db = self.load_ioc_database()
        findings = []
        if not db.get('certs'):
            return {'ok': True, 'findings': [], 'note': 'No cert IOCs loaded'}
        try:
            pkg_result = self.acquire_packages(serial)
            # Only check user-installed (non-system) packages; limit to 100 for speed
            packages = [p for p in pkg_result.get('packages', []) if not p.get('system')][:100]
            for pkg_info in packages:
                pkg = pkg_info.get('package', '')
                if not pkg:
                    continue
                out = self._adb(serial, f'pm dump {pkg} 2>/dev/null | grep -A2 "Signing"', timeout=15)
                for line in out.splitlines():
                    m = re.search(r'([a-fA-F0-9]{40,64})', line)
                    if m:
                        cert_hash = m.group(1).lower()
                        if cert_hash in db['certs']:
                            match = db['certs'][cert_hash]
                            findings.append({
                                'package':     pkg,
                                'cert_hash':   cert_hash,
                                'threat_name': match['name'],
                                'source':      match['source'],
                                'severity':    'critical',
                                'type':        'cert_match',
                            })
        except Exception as e:
            return {'ok': False, 'error': str(e), 'findings': findings}
        return {'ok': True, 'findings': findings, 'clean': len(findings) == 0}

    def scan_network_indicators(self, serial):
        """Check DNS/proxy settings and active TCP connections against IOC domains/IPs."""
        db = self.load_ioc_database()
        findings = []
        try:
            props = self.acquire_getprop(serial).get('props', {})
            for key, val in props.items():
                if 'dns' in key.lower() and val and val.lower() in db['domains']:
                    match = db['domains'][val.lower()]
                    findings.append({
                        'type': 'dns_property', 'key': key, 'value': val,
                        'threat_name': match['name'], 'source': match['source'], 'severity': 'high',
                    })

            ioc_ips = set(db.get('ips', []))
            if ioc_ips:
                tcp_out = self._adb(serial, 'cat /proc/net/tcp 2>/dev/null', timeout=15)
                for line in tcp_out.splitlines()[1:]:
                    parts = line.strip().split()
                    if len(parts) < 3:
                        continue
                    try:
                        remote_hex = parts[2]
                        ip_hex, port_hex = remote_hex.split(':')
                        # /proc/net/tcp stores IPs in little-endian hex
                        ip = '.'.join(str(int(ip_hex[i:i+2], 16)) for i in (6, 4, 2, 0))
                        port = int(port_hex, 16)
                        if ip not in ('0.0.0.0', '127.0.0.1') and ip in ioc_ips:
                            findings.append({
                                'type': 'tcp_connection', 'remote_ip': ip, 'remote_port': port,
                                'severity': 'critical', 'source': 'network_scan',
                                'threat_name': 'Known malicious IP',
                            })
                    except Exception:
                        pass
        except Exception as e:
            return {'ok': False, 'error': str(e), 'findings': findings}
        return {'ok': True, 'findings': findings, 'clean': len(findings) == 0}

    def scan_file_indicators(self, serial):
        """Check device for known spyware artifact file paths."""
        db = self.load_ioc_database()
        if not db.get('file_paths'):
            return {'ok': True, 'findings': [], 'note': 'No file path IOCs loaded'}
        findings = []
        try:
            for fpath, match in list(db['file_paths'].items())[:200]:
                out = self._adb(serial, f'ls "{fpath}" 2>/dev/null', timeout=5)
                if out.strip() and 'No such file' not in out:
                    findings.append({
                        'type':        'file_path',
                        'path':        fpath,
                        'threat_name': match['name'],
                        'source':      match['source'],
                        'severity':    'critical',
                    })
        except Exception as e:
            return {'ok': False, 'error': str(e), 'findings': findings}
        return {'ok': True, 'findings': findings, 'clean': len(findings) == 0}

    def scan_process_indicators(self, serial):
        """Cross-reference running processes against known spyware process names."""
        db = self.load_ioc_database()
        if not db.get('processes'):
            return {'ok': True, 'findings': [], 'note': 'No process IOCs loaded'}
        findings = []
        try:
            proc_output = self.acquire_processes(serial).get('output', '').lower()
            for proc_name, match in db['processes'].items():
                if proc_name and proc_name in proc_output:
                    findings.append({
                        'type':        'process_match',
                        'process':     proc_name,
                        'threat_name': match['name'],
                        'source':      match['source'],
                        'severity':    'critical',
                    })
        except Exception as e:
            return {'ok': False, 'error': str(e), 'findings': findings}
        return {'ok': True, 'findings': findings, 'clean': len(findings) == 0}

    # ── SLM Heuristic Scanner ────────────────────────────────────────

    def _heuristic_scan(self, data_type, items, threshold=0.65):
        """Run SLM heuristic pass on a list of items via the local LLM.
        data_type: 'packages' | 'processes' | 'network' | 'files'
        Returns list of {item, score, reason, category} for items scoring >= threshold."""
        if not items:
            return []
        try:
            from core.llm import get_llm, LLMError
            llm = get_llm()
            if not llm or not llm.is_loaded:
                return []
        except Exception:
            return []

        prompts = {
            'packages': (
                'Classify each Android package name for stalkerware/spyware/adware risk. '
                'Score 0.0-1.0. High risk: names impersonating system apps, random strings, '
                'unknown publishers with device-admin-sounding names. '
                'Return only a JSON array: [{"item":"...","score":0.0,"reason":"...","category":"stalkerware|adware|suspicious|clean"}]'
            ),
            'processes': (
                'Classify each Android process name for malware risk. Score 0.0-1.0. '
                'Suspicious: random hex strings, names mimicking system processes with slight misspellings. '
                'Return only a JSON array: [{"item":"...","score":0.0,"reason":"...","category":"malware|suspicious|clean"}]'
            ),
            'network': (
                'Classify each domain or IP for C2/malware beacon risk. Score 0.0-1.0. '
                'High risk: DGA-looking names, dynamic DNS (duckdns, no-ip, ddns), unusual TLDs, high-entropy subdomains. '
                'Return only a JSON array: [{"item":"...","score":0.0,"reason":"...","category":"c2_beacon|dga_domain|suspicious|clean"}]'
            ),
            'files': (
                'Classify each Android file path for spyware/stalkerware artifact risk. Score 0.0-1.0. '
                'High risk: hidden directories, paths in /data/local/tmp, surveillance-sounding names. '
                'Return only a JSON array: [{"item":"...","score":0.0,"reason":"...","category":"spyware|suspicious|clean"}]'
            ),
        }
        base_prompt = prompts.get(data_type, prompts['packages'])

        findings = []
        # Process in chunks of 50 (on-device SLM token budget)
        for i in range(0, len(items), 50):
            chunk = items[i:i + 50]
            prompt = f'{base_prompt}\n\nItems:\n' + '\n'.join(str(x) for x in chunk)
            try:
                raw = get_llm().generate(prompt, max_tokens=800)
                # Extract JSON array from response
                m = re.search(r'\[.*\]', raw, re.DOTALL)
                if not m:
                    continue
                parsed = json.loads(m.group(0))
                for entry in parsed:
                    if isinstance(entry, dict) and float(entry.get('score', 0)) >= threshold:
                        findings.append({
                            'item':       str(entry.get('item', '')),
                            'score':      float(entry.get('score', 0)),
                            'reason':     str(entry.get('reason', '')),
                            'category':   str(entry.get('category', 'suspicious')),
                            'confidence': float(entry.get('score', 0)),
                            'heuristic':  True,
                            'data_type':  data_type,
                        })
            except Exception:
                continue
        return findings

    # ── Composite Operations ─────────────────────────────────────────

    def full_acquisition(self, serial):
        """Run all acquisition modules and all IOC scans. Save results to disk."""
        acq_id = self._new_acq_id()
        acq_dir = self._acq_dir(serial, acq_id)

        report = {
            'acq_id':    acq_id,
            'serial':    serial,
            'timestamp': datetime.now().isoformat(),
            'modules':   {},
            'ioc_findings': [],
        }

        module_map = {
            'packages':     self.acquire_packages,
            'processes':    self.acquire_processes,
            'getprop':      self.acquire_getprop,
            'settings':     self.acquire_settings,
            'services':     self.acquire_services,
            'logcat':       self.acquire_logcat,
            'tmp_files':    self.acquire_tmp_files,
            'files':        self.acquire_files,
            'logs':         self.acquire_logs,
            'bugreport':    self.acquire_bugreport_info,
        }

        for mod_name, func in module_map.items():
            try:
                result = func(serial)
                report['modules'][mod_name] = result
                with open(acq_dir / f'{mod_name}.json', 'w', encoding='utf-8') as f:
                    json.dump(result, f, indent=2, default=str)
            except Exception as e:
                report['modules'][mod_name] = {'ok': False, 'error': str(e)}

        # IOC scans — reuse already-acquired package list
        packages_data = report['modules'].get('packages', {}).get('packages', [])
        all_findings = []
        for scan_name, scan_func in [
            ('packages',  lambda s: self.scan_packages(s, packages_data)),
            ('network',   self.scan_network_indicators),
            ('files',     self.scan_file_indicators),
            ('processes', self.scan_process_indicators),
        ]:
            try:
                scan_result = scan_func(serial)
                for finding in scan_result.get('findings', []):
                    finding['scan_type'] = scan_name
                    all_findings.append(finding)
            except Exception:
                pass

        report['ioc_findings'] = all_findings
        report['scan_summary'] = {
            'total_findings': len(all_findings),
            'critical': sum(1 for f in all_findings if f.get('severity') == 'critical'),
            'high':     sum(1 for f in all_findings if f.get('severity') == 'high'),
            'clean':    len(all_findings) == 0,
        }

        with open(acq_dir / 'report.json', 'w', encoding='utf-8') as f:
            json.dump(report, f, indent=2, default=str)

        return report

    def get_acquisition_list(self, serial):
        """List past acquisitions for a device."""
        device_dir = self.ACQ_DATA_DIR / serial
        if not device_dir.exists():
            return []
        acquisitions = []
        for acq_dir in sorted(device_dir.iterdir(), reverse=True):
            if not acq_dir.is_dir():
                continue
            report_path = acq_dir / 'report.json'
            entry = {'acq_id': acq_dir.name, 'has_report': report_path.exists()}
            if report_path.exists():
                try:
                    with open(report_path, encoding='utf-8') as f:
                        r = json.load(f)
                    entry['timestamp'] = r.get('timestamp', acq_dir.name)
                    entry['modules']   = list(r.get('modules', {}).keys())
                    entry['findings']  = r.get('scan_summary', {}).get('total_findings', 0)
                except Exception:
                    pass
            acquisitions.append(entry)
        return acquisitions

    def export_report(self, serial, acq_id):
        """Load a saved acquisition report from disk."""
        report_path = self.ACQ_DATA_DIR / serial / acq_id / 'report.json'
        if not report_path.exists():
            return {'ok': False, 'error': 'Report not found'}
        try:
            with open(report_path, encoding='utf-8') as f:
                return {'ok': True, 'report': json.load(f), 'path': str(report_path)}
        except Exception as e:
            return {'ok': False, 'error': str(e)}

    # ── Direct (WebUSB) Mode ─────────────────────────────────────────

    def get_direct_commands(self, operation):
        """Return ADB shell commands for browser-side WebUSB execution."""
        commands = {
            'packages':        'pm list packages -f',
            'packages_sys':    'pm list packages -s',
            'processes':       'ps -A',
            'getprop':         'getprop',
            'settings_global': 'settings list global',
            'settings_secure': 'settings list secure',
            'settings_system': 'settings list system',
            'services':        'service list',
            'logcat':          'logcat -d -t 1000',
            'tmp_files':       'ls -la /data/local/tmp/ 2>/dev/null',
            'tcp_connections': 'cat /proc/net/tcp 2>/dev/null',
        }
        if operation == 'full':
            return commands
        cmd = commands.get(operation)
        return {operation: cmd} if cmd else {}

    def parse_direct_output(self, operation, raw_output):
        """Parse raw ADB output returned from a WebUSB browser client."""
        if operation == 'packages':
            packages = []
            for line in raw_output.splitlines():
                line = line.strip()
                if not line.startswith('package:'):
                    continue
                line = line[8:]
                eq_pos = line.rfind('=')
                if eq_pos == -1:
                    pkg_name, apk_path = line, ''
                else:
                    apk_path, pkg_name = line[:eq_pos], line[eq_pos + 1:]
                pkg_name = pkg_name.strip()
                if pkg_name:
                    packages.append({'package': pkg_name, 'path': apk_path.strip(), 'system': False})
            return {'ok': True, 'packages': packages, 'total': len(packages)}

        elif operation == 'processes':
            lines = [l for l in raw_output.splitlines() if l.strip()]
            return {'ok': True, 'output': raw_output, 'count': max(0, len(lines) - 1)}

        elif operation == 'getprop':
            props = {}
            for line in raw_output.splitlines():
                m = re.match(r'\[(.+)\]:\s*\[(.*)\]\s*$', line)
                if m:
                    props[m.group(1)] = m.group(2)
            return {'ok': True, 'props': props, 'output': raw_output}

        else:
            return {'ok': True, 'output': raw_output}