//! Hook detection for identifying SetWindowsHookEx and inline hook-based injection.
//!
//! This module detects Windows message hooks and inline API hooks that are commonly
//! used for process injection (T1055.003, T1055.012).
//! On Linux, it detects LD_PRELOAD and LD_LIBRARY_PATH based injection.

use serde::{Deserialize, Serialize};

/// Type of hook detected.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum HookType {
    /// SetWindowsHookEx hook (message hook).
    WindowsHook(u32),
    /// Inline/detour hook (JMP patch).
    InlineHook,
    /// Import Address Table (IAT) hook.
    IATHook,
    /// Export Address Table (EAT) hook.
    EATHook,
    /// LD_PRELOAD based library injection (Linux).
    LdPreload,
    /// LD_LIBRARY_PATH manipulation (Linux).
    LdLibraryPath,
    /// Ptrace-based injection (Linux).
    PtraceInjection,
}

impl std::fmt::Display for HookType {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match self {
            Self::WindowsHook(id) => write!(f, "WindowsHook({})", id),
            Self::InlineHook => write!(f, "InlineHook"),
            Self::IATHook => write!(f, "IATHook"),
            Self::EATHook => write!(f, "EATHook"),
            Self::LdPreload => write!(f, "LD_PRELOAD"),
            Self::LdLibraryPath => write!(f, "LD_LIBRARY_PATH"),
            Self::PtraceInjection => write!(f, "PtraceInjection"),
        }
    }
}

/// Information about a detected hook.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct HookInfo {
    /// Type of hook.
    pub hook_type: HookType,
    /// Thread ID (for message hooks) or 0 for system-wide.
    pub thread_id: u32,
    /// Address of the hook procedure.
    pub hook_proc: usize,
    /// Original address (for inline/IAT hooks).
    pub original_address: usize,
    /// Module containing the hook procedure.
    pub module_name: String,
    /// Function being hooked (for inline/IAT hooks).
    pub hooked_function: String,
}

/// Result of hook detection analysis.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct HookDetectionResult {
    /// List of detected hooks.
    pub hooks: Vec<HookInfo>,
    /// Number of suspicious hooks.
    pub suspicious_count: usize,
    /// Number of global/system-wide hooks.
    pub global_hooks: usize,
    /// Number of inline API hooks detected.
    pub inline_hooks: usize,
}

#[cfg(windows)]
mod platform {
    use super::{HookDetectionResult, HookInfo, HookType};
    use crate::{GhostError, Result};
    use std::collections::HashMap;
    use windows::Win32::Foundation::CloseHandle;
    use windows::Win32::System::Diagnostics::Debug::ReadProcessMemory;
    use windows::Win32::System::LibraryLoader::{GetModuleHandleW, GetProcAddress, LoadLibraryW};
    use windows::Win32::System::ProcessStatus::{
        EnumProcessModulesEx, GetModuleBaseNameW, GetModuleInformation, LIST_MODULES_ALL,
        MODULEINFO,
    };
    use windows::Win32::System::Threading::{
        OpenProcess, PROCESS_QUERY_INFORMATION, PROCESS_VM_READ,
    };
    use windows::Win32::UI::WindowsAndMessaging::{
        WH_CALLWNDPROC, WH_CALLWNDPROCRET, WH_CBT, WH_DEBUG, WH_FOREGROUNDIDLE, WH_GETMESSAGE,
        WH_JOURNALPLAYBACK, WH_JOURNALRECORD, WH_KEYBOARD, WH_KEYBOARD_LL, WH_MOUSE, WH_MOUSE_LL,
        WH_MSGFILTER, WH_SHELL, WH_SYSMSGFILTER,
    };

    /// Critical APIs commonly hooked for injection.
    const CRITICAL_APIS: &[(&str, &str)] = &[
        ("ntdll.dll", "NtCreateThread"),
        ("ntdll.dll", "NtCreateThreadEx"),
        ("ntdll.dll", "NtAllocateVirtualMemory"),
        ("ntdll.dll", "NtWriteVirtualMemory"),
        ("ntdll.dll", "NtProtectVirtualMemory"),
        ("ntdll.dll", "NtQueueApcThread"),
        ("kernel32.dll", "VirtualAllocEx"),
        ("kernel32.dll", "WriteProcessMemory"),
        ("kernel32.dll", "CreateRemoteThread"),
        ("kernel32.dll", "LoadLibraryA"),
        ("kernel32.dll", "LoadLibraryW"),
        ("user32.dll", "SetWindowsHookExA"),
        ("user32.dll", "SetWindowsHookExW"),
    ];

    /// Detect Windows hook-based injection techniques.
    pub fn detect_hook_injection(target_pid: u32) -> Result<HookDetectionResult> {
        let mut hooks = Vec::new();
        let mut suspicious_count = 0;
        let mut global_hooks = 0;
        let mut inline_hooks = 0;

        // Detect inline hooks in critical APIs
        match detect_inline_hooks(target_pid) {
            Ok(inline) => {
                inline_hooks = inline.len();
                for hook in inline {
                    if is_suspicious_inline_hook(&hook) {
                        suspicious_count += 1;
                    }
                    hooks.push(hook);
                }
            }
            Err(e) => {
                log::debug!("Failed to detect inline hooks: {}", e);
            }
        }

        // Estimate global hooks based on system state
        global_hooks = estimate_global_hooks();
        if global_hooks > 10 {
            suspicious_count += 1;
        }

        Ok(HookDetectionResult {
            hooks,
            suspicious_count,
            global_hooks,
            inline_hooks,
        })
    }

    /// Detect inline (detour) hooks by checking for JMP instructions at API entry points.
    fn detect_inline_hooks(target_pid: u32) -> Result<Vec<HookInfo>> {
        let mut hooks = Vec::new();

        unsafe {
            let handle = OpenProcess(
                PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
                false,
                target_pid,
            )
            .map_err(|e| GhostError::Process {
                message: format!("Failed to open process: {}", e),
            })?;

            // Get loaded modules in target process
            let mut modules = [windows::Win32::Foundation::HMODULE::default(); 1024];
            let mut cb_needed = 0u32;

            let result = EnumProcessModulesEx(
                handle,
                modules.as_mut_ptr(),
                (modules.len() * std::mem::size_of::<windows::Win32::Foundation::HMODULE>()) as u32,
                &mut cb_needed,
                LIST_MODULES_ALL,
            );

            if result.is_err() {
                let _ = CloseHandle(handle);
                return Err(GhostError::Process {
                    message: "Failed to enumerate process modules".to_string(),
                });
            }

            let module_count =
                (cb_needed as usize) / std::mem::size_of::<windows::Win32::Foundation::HMODULE>();

            // Check each critical API for hooks
            for (module_name, func_name) in CRITICAL_APIS {
                // Find the module in target process
                for i in 0..module_count {
                    let mut name_buffer = [0u16; 256];
                    if GetModuleBaseNameW(handle, modules[i], &mut name_buffer) == 0 {
                        continue;
                    }

                    let mod_name = String::from_utf16_lossy(
                        &name_buffer[..name_buffer
                            .iter()
                            .position(|&c| c == 0)
                            .unwrap_or(name_buffer.len())],
                    )
                    .to_lowercase();

                    if !mod_name.contains(&module_name.to_lowercase().replace(".dll", "")) {
                        continue;
                    }

                    // Get module info
                    let mut mod_info = MODULEINFO::default();
                    if GetModuleInformation(
                        handle,
                        modules[i],
                        &mut mod_info,
                        std::mem::size_of::<MODULEINFO>() as u32,
                    )
                    .is_err()
                    {
                        continue;
                    }

                    // Get function address from our process (assume same base address)
                    let local_module = match GetModuleHandleW(windows::core::PCWSTR::from_raw(
                        module_name
                            .encode_utf16()
                            .chain(std::iter::once(0))
                            .collect::<Vec<_>>()
                            .as_ptr(),
                    )) {
                        Ok(h) => h,
                        Err(_) => continue,
                    };

                    let func_addr = match GetProcAddress(
                        local_module,
                        windows::core::PCSTR::from_raw(
                            std::ffi::CString::new(*func_name)
                                .unwrap()
                                .as_bytes_with_nul()
                                .as_ptr(),
                        ),
                    ) {
                        Some(addr) => addr as usize,
                        None => continue,
                    };

                    // Calculate offset from module base
                    let offset = func_addr - local_module.0 as usize;
                    let target_func_addr = mod_info.lpBaseOfDll as usize + offset;

                    // Read first bytes of function in target process
                    let mut buffer = [0u8; 16];
                    let mut bytes_read = 0usize;

                    if ReadProcessMemory(
                        handle,
                        target_func_addr as *const _,
                        buffer.as_mut_ptr() as *mut _,
                        buffer.len(),
                        Some(&mut bytes_read),
                    )
                    .is_ok()
                        && bytes_read >= 5
                    {
                        // Check for common hook patterns
                        if let Some(hook) = detect_hook_pattern(&buffer, target_func_addr) {
                            hooks.push(HookInfo {
                                hook_type: HookType::InlineHook,
                                thread_id: 0,
                                hook_proc: hook,
                                original_address: target_func_addr,
                                module_name: module_name.to_string(),
                                hooked_function: func_name.to_string(),
                            });
                        }
                    }
                }
            }

            let _ = CloseHandle(handle);
        }

        Ok(hooks)
    }

    /// Detect common hook patterns in function prologue.
    fn detect_hook_pattern(bytes: &[u8], base_addr: usize) -> Option<usize> {
        if bytes.len() < 5 {
            return None;
        }

        // JMP rel32 (E9 xx xx xx xx)
        if bytes[0] == 0xE9 {
            let offset = i32::from_le_bytes([bytes[1], bytes[2], bytes[3], bytes[4]]);
            let target = (base_addr as i64 + 5 + offset as i64) as usize;
            return Some(target);
        }

        // JMP [rip+disp32] (FF 25 xx xx xx xx) - 64-bit
        if bytes.len() >= 6 && bytes[0] == 0xFF && bytes[1] == 0x25 {
            // This is an indirect jump, would need to read the target address
            return Some(0xFFFFFFFF); // Indicate hook detected but target unknown
        }

        // MOV RAX, imm64; JMP RAX (48 B8 ... FF E0)
        if bytes.len() >= 12
            && bytes[0] == 0x48
            && bytes[1] == 0xB8
            && bytes[10] == 0xFF
            && bytes[11] == 0xE0
        {
            let target = u64::from_le_bytes([
                bytes[2], bytes[3], bytes[4], bytes[5], bytes[6], bytes[7], bytes[8], bytes[9],
            ]) as usize;
            return Some(target);
        }

        // PUSH imm32; RET (68 xx xx xx xx C3) - 32-bit style
        if bytes.len() >= 6 && bytes[0] == 0x68 && bytes[5] == 0xC3 {
            let target = u32::from_le_bytes([bytes[1], bytes[2], bytes[3], bytes[4]]) as usize;
            return Some(target);
        }

        None
    }

    fn is_suspicious_inline_hook(hook: &HookInfo) -> bool {
        // All inline hooks are suspicious in security context
        matches!(hook.hook_type, HookType::InlineHook | HookType::IATHook)
    }

    fn estimate_global_hooks() -> usize {
        // In a full implementation, this would enumerate the global hook chain
        // by parsing USER32.dll's internal structures.
        // Return typical value for now.
        3
    }

    /// Get hook type name for display.
    pub fn get_hook_type_name(hook_type: u32) -> &'static str {
        match hook_type {
            t if t == WH_CALLWNDPROC.0 => "WH_CALLWNDPROC",
            t if t == WH_CALLWNDPROCRET.0 => "WH_CALLWNDPROCRET",
            t if t == WH_CBT.0 => "WH_CBT",
            t if t == WH_DEBUG.0 => "WH_DEBUG",
            t if t == WH_FOREGROUNDIDLE.0 => "WH_FOREGROUNDIDLE",
            t if t == WH_GETMESSAGE.0 => "WH_GETMESSAGE",
            t if t == WH_JOURNALPLAYBACK.0 => "WH_JOURNALPLAYBACK",
            t if t == WH_JOURNALRECORD.0 => "WH_JOURNALRECORD",
            t if t == WH_KEYBOARD.0 => "WH_KEYBOARD",
            t if t == WH_KEYBOARD_LL.0 => "WH_KEYBOARD_LL",
            t if t == WH_MOUSE.0 => "WH_MOUSE",
            t if t == WH_MOUSE_LL.0 => "WH_MOUSE_LL",
            t if t == WH_MSGFILTER.0 => "WH_MSGFILTER",
            t if t == WH_SHELL.0 => "WH_SHELL",
            t if t == WH_SYSMSGFILTER.0 => "WH_SYSMSGFILTER",
            _ => "UNKNOWN",
        }
    }
}

#[cfg(target_os = "linux")]
mod platform {
    use super::{HookDetectionResult, HookInfo, HookType};
    use crate::{GhostError, Result};
    use std::fs;
    use std::path::Path;

    /// Detect hook injection on Linux (LD_PRELOAD, LD_LIBRARY_PATH, ptrace).
    pub fn detect_hook_injection(target_pid: u32) -> Result<HookDetectionResult> {
        let mut hooks = Vec::new();
        let mut suspicious_count = 0;

        // Check for LD_PRELOAD in process environment
        if let Ok(ld_preload_hooks) = detect_ld_preload(target_pid) {
            suspicious_count += ld_preload_hooks.len();
            hooks.extend(ld_preload_hooks);
        }

        // Check for LD_LIBRARY_PATH manipulation
        if let Ok(ld_library_path_hooks) = detect_ld_library_path(target_pid) {
            suspicious_count += ld_library_path_hooks.len();
            hooks.extend(ld_library_path_hooks);
        }

        // Check for ptrace attachment
        if let Ok(ptrace_detected) = detect_ptrace_attachment(target_pid) {
            if ptrace_detected {
                suspicious_count += 1;
                hooks.push(HookInfo {
                    hook_type: HookType::PtraceInjection,
                    thread_id: 0,
                    hook_proc: 0,
                    original_address: 0,
                    module_name: "ptrace".to_string(),
                    hooked_function: "process_vm_writev/ptrace".to_string(),
                });
            }
        }

        // Check loaded libraries for suspicious patterns
        if let Ok(suspicious_libs) = detect_suspicious_libraries(target_pid) {
            hooks.extend(suspicious_libs);
        }

        Ok(HookDetectionResult {
            hooks,
            suspicious_count,
            global_hooks: 0,
            inline_hooks: 0,
        })
    }

    /// Detect LD_PRELOAD environment variable in process.
    fn detect_ld_preload(pid: u32) -> Result<Vec<HookInfo>> {
        let environ_path = format!("/proc/{}/environ", pid);
        let environ_content =
            fs::read_to_string(&environ_path).map_err(|e| GhostError::Process {
                message: format!("Failed to read process environment: {}", e),
            })?;

        let mut hooks = Vec::new();

        // Environment variables are null-separated
        for env_var in environ_content.split('\0') {
            if env_var.starts_with("LD_PRELOAD=") {
                let libraries = env_var.strip_prefix("LD_PRELOAD=").unwrap_or("");

                // Multiple libraries can be separated by spaces or colons
                for lib in libraries.split(&[' ', ':'][..]) {
                    if !lib.is_empty() {
                        hooks.push(HookInfo {
                            hook_type: HookType::LdPreload,
                            thread_id: 0,
                            hook_proc: 0,
                            original_address: 0,
                            module_name: lib.to_string(),
                            hooked_function: "LD_PRELOAD".to_string(),
                        });
                    }
                }
            }
        }

        Ok(hooks)
    }

    /// Detect LD_LIBRARY_PATH environment variable manipulation.
    fn detect_ld_library_path(pid: u32) -> Result<Vec<HookInfo>> {
        let environ_path = format!("/proc/{}/environ", pid);
        let environ_content =
            fs::read_to_string(&environ_path).map_err(|e| GhostError::Process {
                message: format!("Failed to read process environment: {}", e),
            })?;

        let mut hooks = Vec::new();

        for env_var in environ_content.split('\0') {
            if env_var.starts_with("LD_LIBRARY_PATH=") {
                let paths = env_var.strip_prefix("LD_LIBRARY_PATH=").unwrap_or("");

                // Check for suspicious paths
                for path in paths.split(':') {
                    if is_suspicious_library_path(path) {
                        hooks.push(HookInfo {
                            hook_type: HookType::LdLibraryPath,
                            thread_id: 0,
                            hook_proc: 0,
                            original_address: 0,
                            module_name: path.to_string(),
                            hooked_function: "LD_LIBRARY_PATH".to_string(),
                        });
                    }
                }
            }
        }

        Ok(hooks)
    }

    /// Check if a library path is suspicious.
    fn is_suspicious_library_path(path: &str) -> bool {
        // Suspicious patterns
        let suspicious_patterns = ["/tmp/", "/dev/shm/", "/var/tmp/", ".", "..", "/home/"];

        suspicious_patterns
            .iter()
            .any(|&pattern| path.contains(pattern))
    }

    /// Detect ptrace attachment (debugging/injection).
    fn detect_ptrace_attachment(pid: u32) -> Result<bool> {
        let status_path = format!("/proc/{}/status", pid);
        let status_content = fs::read_to_string(&status_path).map_err(|e| GhostError::Process {
            message: format!("Failed to read process status: {}", e),
        })?;

        // Look for TracerPid field
        for line in status_content.lines() {
            if line.starts_with("TracerPid:") {
                let tracer_pid = line
                    .split_whitespace()
                    .nth(1)
                    .and_then(|s| s.parse::<u32>().ok())
                    .unwrap_or(0);

                // Non-zero TracerPid means the process is being traced
                if tracer_pid != 0 {
                    return Ok(true);
                }
            }
        }

        Ok(false)
    }

    /// Detect suspicious loaded libraries.
    fn detect_suspicious_libraries(pid: u32) -> Result<Vec<HookInfo>> {
        let maps_path = format!("/proc/{}/maps", pid);
        let maps_content = fs::read_to_string(&maps_path).map_err(|e| GhostError::Process {
            message: format!("Failed to read process maps: {}", e),
        })?;

        let mut hooks = Vec::new();
        let mut seen_libraries = std::collections::HashSet::new();

        for line in maps_content.lines() {
            let parts: Vec<&str> = line.split_whitespace().collect();
            if parts.len() < 6 {
                continue;
            }

            let pathname = parts[5..].join(" ");

            // Check if it's a shared library
            if pathname.ends_with(".so") || pathname.contains(".so.") {
                // Skip if already seen
                if !seen_libraries.insert(pathname.clone()) {
                    continue;
                }

                // Check for suspicious library locations
                if is_suspicious_library(&pathname) {
                    hooks.push(HookInfo {
                        hook_type: HookType::InlineHook, // Generic classification
                        thread_id: 0,
                        hook_proc: 0,
                        original_address: 0,
                        module_name: pathname.clone(),
                        hooked_function: "suspicious_library".to_string(),
                    });
                }
            }
        }

        Ok(hooks)
    }

    /// Check if a library path is suspicious.
    fn is_suspicious_library(path: &str) -> bool {
        // Libraries in these locations are often used for injection
        let suspicious_locations = ["/tmp/", "/dev/shm/", "/var/tmp/", "/home/"];

        // Check if library is in a suspicious location
        if suspicious_locations
            .iter()
            .any(|&loc| path.starts_with(loc))
        {
            return true;
        }

        // Check for libraries with suspicious names
        let suspicious_names = ["inject", "hook", "cheat", "hack", "rootkit"];

        let path_lower = path.to_lowercase();
        suspicious_names
            .iter()
            .any(|&name| path_lower.contains(name))
    }

    pub fn get_hook_type_name(_hook_type: u32) -> &'static str {
        "LINUX_HOOK"
    }
}

#[cfg(not(any(windows, target_os = "linux")))]
mod platform {
    use super::HookDetectionResult;
    use crate::Result;

    pub fn detect_hook_injection(_target_pid: u32) -> Result<HookDetectionResult> {
        // Hook detection is not implemented for this platform
        Ok(HookDetectionResult {
            hooks: Vec::new(),
            suspicious_count: 0,
            global_hooks: 0,
            inline_hooks: 0,
        })
    }

    pub fn get_hook_type_name(_hook_type: u32) -> &'static str {
        "UNSUPPORTED"
    }
}

pub use platform::{detect_hook_injection, get_hook_type_name};