#!/bin/bash

# Handshake Verification and Statistics Script
# Analyzes CAP/PCAP files for valid WPA/WPA2 handshakes before cracking

set -e

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
WORKSPACE_DIR="$(dirname "$SCRIPT_DIR")"

# Configuration
INPUT_DIR="$WORKSPACE_DIR/input"
CONVERTED_DIR="$WORKSPACE_DIR/converted"
RESULTS_DIR="$WORKSPACE_DIR/results"
VERIFY_DIR="$WORKSPACE_DIR/verification"
REPORT_FILE="$VERIFY_DIR/handshake_report_$(date +%Y%m%d_%H%M%S).txt"

# Colors for output
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Create directories
mkdir -p "$VERIFY_DIR" "$RESULTS_DIR"

# Function to print colored messages
print_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

print_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Function to check if tools are available
check_tools() {
    local tools=("hcxpcapngtool" "tshark" "capinfos")
    local missing=()
    
    for tool in "${tools[@]}"; do
        if ! command -v "$tool" &> /dev/null; then
            missing+=("$tool")
        fi
    done
    
    if [ ${#missing[@]} -gt 0 ]; then
        print_warning "Missing tools: ${missing[*]}"
        print_info "Some verification features may be limited"
        return 1
    fi
    
    return 0
}

# Function to analyze CAP/PCAP file with hcxpcapngtool
analyze_with_hcxpcapngtool() {
    local input_file="$1"
    local output_file="$2"
    
    print_info "Analyzing: $(basename "$input_file")"
    
    # Run hcxpcapngtool with verbose output
    local analysis_output
    analysis_output=$(hcxpcapngtool -v "$input_file" 2>&1 || true)
    
    # Extract key information
    local handshake_count=$(echo "$analysis_output" | grep -c "EAPOL pairs" || echo "0")
    local pmkid_count=$(echo "$analysis_output" | grep -c "PMKID(s)" || echo "0")
    local valid_handshake="NO"
    
    if [ "$handshake_count" -gt 0 ] || [ "$pmkid_count" -gt 0 ]; then
        valid_handshake="YES"
    fi
    
    # Save detailed analysis
    echo "=== Analysis of $(basename "$input_file") ===" > "$output_file"
    echo "File: $input_file" >> "$output_file"
    echo "Size: $(du -h "$input_file" | cut -f1)" >> "$output_file"
    echo "Analysis Time: $(date)" >> "$output_file"
    echo "" >> "$output_file"
    echo "$analysis_output" >> "$output_file"
    
    # Return summary
    echo "$valid_handshake:$handshake_count:$pmkid_count"
}

# Function to analyze with tshark (Wireshark)
analyze_with_tshark() {
    local input_file="$1"
    local output_file="$2"
    
    print_info "Running packet analysis with tshark..."
    
    # Check for EAPOL packets (WPA handshake)
    local eapol_count=$(tshark -r "$input_file" -Y "eapol" 2>/dev/null | wc -l || echo "0")
    
    # Check for beacon frames to identify networks
    local beacon_info=$(tshark -r "$input_file" -Y "wlan.fc.type_subtype == 0x0008" -T fields -e wlan.sa -e wlan.ssid 2>/dev/null | head -5 || echo "No beacon frames")
    
    # Get packet count and duration
    local packet_count=$(capinfos -c "$input_file" 2>/dev/null | grep "Number of packets" | cut -d: -f2 | tr -d ' ' || echo "N/A")
    local duration=$(capinfos -a "$input_file" 2>/dev/null | grep "Capture duration" | cut -d: -f2 | tr -d ' ' || echo "N/A")
    
    # Append to output file
    echo "" >> "$output_file"
    echo "=== Wireshark Analysis ===" >> "$output_file"
    echo "Total packets: $packet_count" >> "$output_file"
    echo "Capture duration: $duration" >> "$output_file"
    echo "EAPOL packets (handshake): $eapol_count" >> "$output_file"
    echo "Beacon frames (networks):" >> "$output_file"
    echo "$beacon_info" >> "$output_file"
    
    echo "$eapol_count"
}

# Function to generate summary report
generate_summary_report() {
    local summary_file="$1"
    shift
    local files=("$@")
    
    print_info "Generating summary report..."
    
    cat > "$summary_file" << 'EOF'
HANDSHAKE VERIFICATION REPORT
=============================
Generated: $(date)

SUMMARY
-------
EOF
    
    local total_files=0
    local valid_files=0
    local total_handshakes=0
    local total_pmkids=0
    
    for file in "${files[@]}"; do
        if [ -f "$file" ]; then
            total_files=$((total_files + 1))
            
            # Get analysis results
            local analysis_file="$VERIFY_DIR/$(basename "$file").analysis.txt"
            if [ -f "$analysis_file" ]; then
                local valid_line=$(grep -E "^YES:|^NO:" "$analysis_file" | head -1)
                if [[ "$valid_line" == YES:* ]]; then
                    valid_files=$((valid_files + 1))
                    IFS=':' read -r valid handshakes pmkids <<< "$valid_line"
                    total_handshakes=$((total_handshakes + handshakes))
                    total_pmkids=$((total_pmkids + pmkids))
                fi
            fi
        fi
    done
    
    cat >> "$summary_file" << EOF

Statistics:
- Total files analyzed: $total_files
- Files with valid handshakes: $valid_files
- Total EAPOL pairs found: $total_handshakes
- Total PMKIDs found: $total_pmkids

RECOMMENDATIONS
---------------
EOF
    
    if [ "$valid_files" -eq 0 ]; then
        cat >> "$summary_file" << EOF
❌ NO VALID HANDSHAKES FOUND
- None of the capture files contain valid WPA/WPA2 handshakes
- Recapture is required before cracking can proceed
- Ensure you capture the 4-way handshake or PMKID
EOF
    elif [ "$valid_files" -lt "$total_files" ]; then
        cat >> "$summary_file" << EOF
⚠️  PARTIAL HANDSHAKES FOUND
- $valid_files out of $total_files files contain handshakes
- Consider recapturing missing handshakes
- Proceed with cracking for files that have handshakes
EOF
    else
        cat >> "$summary_file" << EOF
✅ ALL FILES HAVE VALID HANDSHAKES
- All $total_files files contain handshakes
- Ready for cracking
- Total handshake material: $total_handshakes EAPOL pairs, $total_pmkids PMKIDs
EOF
    fi
    
    cat >> "$summary_file" << EOF

DETAILED ANALYSIS
-----------------
EOF
    
    for file in "${files[@]}"; do
        if [ -f "$file" ]; then
            local analysis_file="$VERIFY_DIR/$(basename "$file").analysis.txt"
            if [ -f "$analysis_file" ]; then
                echo "" >> "$summary_file"
                echo "File: $(basename "$file")" >> "$summary_file"
                grep -E "^(EAPOL pairs|PMKID|YES:|NO:)" "$analysis_file" | head -5 >> "$summary_file"
            fi
        fi
    done
    
    cat >> "$summary_file" << EOF

NEXT STEPS
----------
1. Files with handshakes will be converted to hashcat format
2. Conversion output: $CONVERTED_DIR/
3. Run cracking with: ./auto_crack.sh or ./scripts/crack_pipeline.sh

Report saved: $summary_file
EOF
}

# Function to display quick statistics
display_quick_stats() {
    local files=("$@")
    
    echo ""
    echo "=========================================="
    echo "QUICK HANDSHAKE STATISTICS"
    echo "=========================================="
    
    local file_count=0
    local valid_count=0
    
    for file in "${files[@]}"; do
        if [ -f "$file" ]; then
            file_count=$((file_count + 1))
            local filename=$(basename "$file")
            
            # Quick check with hcxpcapngtool
            local quick_check=$(hcxpcapngtool -v "$file" 2>&1 | grep -E "(EAPOL pairs|PMKID)" || true)
            
            if echo "$quick_check" | grep -q "EAPOL pairs: [1-9]" || echo "$quick_check" | grep -q "PMKID(s): [1-9]"; then
                echo -e "${GREEN}✓${NC} $filename: VALID handshake found"
                valid_count=$((valid_count + 1))
                
                # Extract counts
                local eapol=$(echo "$quick_check" | grep "EAPOL pairs" | grep -o '[0-9]*' || echo "0")
                local pmkid=$(echo "$quick_check" | grep "PMKID(s)" | grep -o '[0-9]*' || echo "0")
                echo "    EAPOL pairs: $eapol, PMKIDs: $pmkid"
            else
                echo -e "${RED}✗${NC} $filename: NO valid handshake"
            fi
        fi
    done
    
    echo ""
    echo "Summary: $valid_count/$file_count files have valid handshakes"
    
    if [ "$valid_count" -eq 0 ]; then
        echo -e "${RED}❌ No valid handshakes found. Recapture required.${NC}"
        return 1
    elif [ "$valid_count" -lt "$file_count" ]; then
        echo -e "${YELLOW}⚠️  Some files missing handshakes. Consider recapturing.${NC}"
        return 0
    else
        echo -e "${GREEN}✅ All files have valid handshakes. Ready for cracking.${NC}"
        return 0
    fi
}

# Main function
main() {
    echo ""
    echo "=========================================="
    echo "HANDSHAKE VERIFICATION & STATISTICS"
    echo "=========================================="
    
    # Check for tools
    check_tools
    
    # Find CAP/PCAP files
    local capture_files=()
    while IFS= read -r -d $'\0' file; do
        capture_files+=("$file")
    done < <(find "$INPUT_DIR" -type f \( -name "*.cap" -o -name "*.pcap" -o -name "*.pcapng" \) -print0)
    
    if [ ${#capture_files[@]} -eq 0 ]; then
        print_error "No CAP/PCAP files found in $INPUT_DIR/"
        print_info "Please place capture files in the input directory"
        exit 1
    fi
    
    print_info "Found ${#capture_files[@]} capture file(s)"
    
    # Display quick statistics
    display_quick_stats "${capture_files[@]}"
    local quick_status=$?
    
    echo ""
    print_info "Running detailed analysis..."
    
    # Analyze each file
    local analysis_results=()
    for capture_file in "${capture_files[@]}"; do
        local analysis_file="$VERIFY_DIR/$(basename "$capture_file").analysis.txt"
        local result=$(analyze_with_hcxpcapngtool "$capture_file" "$analysis_file")
        
        # Also run tshark analysis if available
        if command -v tshark &> /dev/null; then
            analyze_with_tshark "$capture_file" "$analysis_file"
        fi
        
        analysis_results+=("$result")
        
        # Display result
        IFS=':' read -r valid handshakes pmkids <<< "$result"
        if [ "$valid" = "YES" ]; then
            print_success "$(basename "$capture_file"): $handshakes EAPOL pairs, $pmkids PMKIDs"
        else
            print_warning "$(basename "$capture_file"): No valid handshake"
        fi
    done
    
    # Generate comprehensive report
    generate_summary_report "$REPORT_FILE" "${capture_files[@]}"
    
    echo ""
    echo "=========================================="
    echo "ANALYSIS COMPLETE"
    echo "=========================================="
    echo ""
    echo "Detailed reports saved in: $VERIFY_DIR/"
    echo "Summary report: $REPORT_FILE"
    echo ""
    
    # Recommendation
    if [ $quick_status -eq 1 ]; then
        print_error "RECOMMENDATION: Recapture handshakes before cracking"
    else
        print_success "RECOMMENDATION: Proceed with cracking"
        print_info "Run: ./auto_crack.sh or place files in input/ and run main script"
    fi
    
    echo ""
    print_info "Next: Files with valid handshakes will be automatically converted"
    print_info "      during the cracking workflow."
}

# Run main function
main "$@"