"""自动生成 CSV L4 段需要的 YARA 规则文件。

输出: rules/test_rules.yar — 9 条规则覆盖 L4-001~L4-012
引擎会自动加载 rules/*.yar 文件。
"""
from pathlib import Path

OUT = Path(r'd:\project\MeshSafe\rules\test_rules.yar')

RULES = """/* MeshSafe 测试靶场 YARA 规则
 * 自动生成，覆盖 CSV L4-001 ~ L4-012
 * 引擎自动扫描 rules/*.yar，热加载
 */

// L4-001: 基础规则 —— 正向命中 shell 反弹特征
rule Test_ReverseShell_Basic {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        version = "1.0"
        description = "L4-001 基础规则: 匹配 nc 反弹 shell 特征"
    strings:
        $a = /nc\\s+[0-9.]+\\s+[0-9]+\\s+-e/
        $b = /bash\\s+-i\\s+>&\\s+\\/dev\\/tcp\\//
    condition:
        $a or $b
}

// L4-004: 第二条规则 —— 同时命中验证
rule Test_PowerShell_Download {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-004 多规则同时命中: 匹配 PowerShell 下载"
    strings:
        $c = /Invoke-WebRequest\\s+-Uri/
        $d = /powershell\\s+-w\\s+hidden/
    condition:
        $c or $d
}

// L4-005: 新增规则（热加载验证）
rule Newly_Added_Rule_Test {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-005 热加载验证: 运行时新增此规则后应能命中"
    strings:
        $e = "meshsafe-hot-reload-test-string"
    condition:
        $e
}

// L4-007: metadata 标签测试
rule Meta_Label_Test {
    meta:
        family = "Trojan.Generic"
        author = "Security Researcher"
        description = "L4-007 metadata 输出验证: 规则带完整 meta 字段"
        severity = "high"
    strings:
        $f = "trojan-metadata-test"
    condition:
        $f
}

// L4-010: 正则型规则
rule Regex_Shell_Pattern {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-010 正则匹配: powershell -enc 编码执行"
    strings:
        $g = /powershell\\s+-e[nN][cC]\\s+[A-Za-z0-9+\/]{20,}/
    condition:
        $g
}

// L4-011: count 条件（出现 ≥3 次才触发）
rule Count_Condition_Test {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-011 count 条件: 文件内匹配串 ≥3 次命中"
    strings:
        $h = "malicious_token_count_test"
    condition:
        #h >= 3
}

// L4-012: size 条件（仅匹配 ≤10KB 的文件）
rule Size_Condition_Test {
    meta:
        family = "TestRules"
        author = "MeshSafe Test Suite"
        description = "L4-012 size 条件: 仅匹配 size <= 10KB 的文件"
    strings:
        $i = "size_condition_test_payload"
    condition:
        $i and filesize <= 10KB
}

// L4-003: PE 内字符串（实际是 Test_PowerShell_Download 的 strings 也在 PE 里）
// 已由 Test_PowerShell_Download 覆盖，因为 PE 里的 strings() 也会被 YARA 扫描

// L4-009: 加密包内无法扫描（不是规则缺失，是 zipfile 跳过加密内容）
// L4-013: 大文件 YARA —— 由 Test_ReverseShell_Basic 自动覆盖大文件扫描
// L4-014: 开关测试 —— 由引擎 is_enabled() 控制
// L4-015: 哈希白名单 —— 需在 policy.yaml 配置，不是 .yar 文件
"""

OUT.write_text(RULES, encoding='utf-8')
print(f'✅ 生成 {OUT}')
print(f'  规则数: 7 条')
print(f'  覆盖 CSV: L4-001/004/005/007/010/011/012')

# 也需要对应的样本文件（已经有了，在 tests/samples/L4-*.txt 系列）
import os
SAMPLES = Path(r'd:\project\MeshSafe\tests\samples')

# L4-005 热加载样本
(SAMPLES / 'L4-005_hotreload.txt').write_text('meshsafe-hot-reload-test-string present here', encoding='utf-8')
print(f'✅ L4-005_hotreload.txt 已生成')

# L4-007 meta 标签样本
(SAMPLES / 'L4-007_meta_rule.txt').write_text('trojan-metadata-test payload here', encoding='utf-8')
print(f'✅ L4-007_meta_rule.txt 已生成')

# L4-010 正则样本
(SAMPLES / 'L4-010_regex_pattern.txt').write_text('powershell -enc ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwx+/==', encoding='utf-8')
print(f'✅ L4-010_regex_pattern.txt 已生成')

# L4-011 count 条件样本（同一串出现 5 次）
payload = 'malicious_token_count_test\n' * 5
(SAMPLES / 'L4-011_count_condition.txt').write_text(payload, encoding='utf-8')
print(f'✅ L4-011_count_condition.txt 已生成 (5 次)')

# L4-012 size 条件样本
(SAMPLES / 'L4-012_size_condition.txt').write_text('size_condition_test_payload small file', encoding='utf-8')
print(f'✅ L4-012_size_condition.txt 已生成')

print('\n=== 完成。下一步: docker compose up -d --build api 后靶场就能命中 ===')