# -*- coding: utf-8 -*-
"""TNG reverse notes helper — ForceExit / abort / Promon suicide map."""
import re
import zipfile
from pathlib import Path

APK = Path(__file__).resolve().parents[1] / "apks" / "tng" / "base.apk"
SO = Path(__file__).resolve().parents[1] / "apks" / "tng" / "libtngdigital_ewallet.so"


def main():
    with zipfile.ZipFile(APK) as z:
        data = b"".join(z.read(n) for n in z.namelist() if n.endswith(".dex"))

    print("=== suicide ladder (from runtime + static) ===")
    print("1) Promon root hit -> openSecurityUrl Rooting FAQ (Xposed blocks)")
    print("2) xwwqazamx.W -> KillApplicationHandler (Xposed blocks)")
    print("3) native exit_group(1) OR SIGABRT SI_USER via libc abort/raise/tgkill")
    print("4) AppSecurityManager.startForceExitCountdown* / addIntoQueueAndLaunch")
    print()

    print("=== ForceExit-related descriptors ===")
    for m in sorted(set(re.findall(rb"L[A-Za-z0-9_/$]*ForceExit[A-Za-z0-9_/$]*;", data))):
        print(m.decode())

    print("\n=== AppSecurityManager log strings (detection events) ===")
    for m in re.finditer(rb"AppSecurityManager: [A-Za-z][^\x00]{5,80}", data):
        s = m.group().decode("utf-8", "ignore")
        if any(k in s for k in ("Root", "Hook", "Emulator", "Force", "Unhandled", "Navigat")):
            print(s)

    if SO.exists():
        raw = SO.read_bytes()
        print("\n=== SO imports of interest ===")
        for s in (b"abort", b"raise", b"tgkill", b"kill", b"exit"):
            print(s.decode(), "at", hex(raw.find(s)) if raw.find(s) >= 0 else None)


if __name__ == "__main__":
    main()