// ============================================================================
// WARLOCK'S STAVE: Firmware & Hardware Analysis
// ============================================================================
//
// Analyzes UEFI NVRAM variables and ACPI table entries for stealth
// persistence mechanisms that survive OS-level analysis.

use std::path::Path;

use crate::polymorphic_ipc::{AdvancedTelemetryEvent, TelemetryEventCategory};

/// Analyzes UEFI NVRAM variables and firmware-level indicators
/// for stealth persistence mechanisms.
pub struct HardwareFirmwareAnalyzer;

impl HardwareFirmwareAnalyzer {
    /// Audits Linux efivarfs for UEFI NVRAM variables that do not
    /// belong to known firmware or OS vendors.
    pub fn audit_uefi_nvram() -> Vec<AdvancedTelemetryEvent> {
        let mut events = Vec::new();
        let nvram_path = Path::new("/sys/firmware/efi/efivars");
        if !nvram_path.exists() {
            return events; // Not UEFI or not Linux
        }

        // Known vendor GUID prefixes (simplified)
        let known_vendors = [
            "8be4df61", // Microsoft Corporation
            "721c8b66", // Firmware vendor
            "a1f02e8c", // Linux Foundation
            "605dab50", // Intel Corporation
        ];

        if let Ok(entries) = std::fs::read_dir(nvram_path) {
            for entry in entries.flatten() {
                let name = entry.file_name().to_string_lossy().to_string();
                let is_known = known_vendors
                    .iter()
                    .any(|vendor| name.contains(vendor));
                if !is_known {
                    events.push(AdvancedTelemetryEvent {
                        category: TelemetryEventCategory::FirmwareAnomaly,
                        message: format!(
                            "Unauthorized NVRAM variable: {}",
                            name
                        ),
                        pid: 0,
                        severity: 3,
                    });
                }
            }
        }
        events
    }

    /// Checks for firmware-level sideloading signals by examining
    /// ACPI table entries exported via sysfs. Detects custom ACPI
    /// tables that could be used for bootkit persistence.
    pub fn detect_stealth_sideload_signals() -> Vec<AdvancedTelemetryEvent> {
        let mut events = Vec::new();
        let acpi_path = Path::new("/sys/firmware/acpi/tables");
        if !acpi_path.exists() {
            return events;
        }

        // Standard ACPI tables
        let standard_tables = [
            "DSDT", "FACP", "APIC", "SSDT", "MCFG", "HPET",
        ];
        let mut found_tables = Vec::new();

        if let Ok(entries) = std::fs::read_dir(acpi_path) {
            for entry in entries.flatten() {
                let name = entry
                    .file_name()
                    .to_string_lossy()
                    .to_string();
                let is_standard = standard_tables
                    .iter()
                    .any(|&t| name.starts_with(t));
                if !is_standard && !name.starts_with('.') {
                    found_tables.push(name);
                }
            }
        }

        for table in &found_tables {
            events.push(AdvancedTelemetryEvent {
                category: TelemetryEventCategory::FirmwareAnomaly,
                message: format!(
                    "Non-standard ACPI table detected: {}", table
                ),
                pid: 0,
                severity: 2,
            });
        }
        events
    }
}