#!/usr/bin/env bash
# setup_remnux.sh - Install malware analysis tools on a Linux (Ubuntu/Debian) system.
# Usage: sudo bash setup_remnux.sh [--minimal] [--skip-python] [--skip-network]
#
# Options:
#   --minimal       Install only core tools (ghidra, radare2, capa, yara)
#   --skip-python   Skip Python library installation
#   --skip-network  Skip network analysis tool installation
#
# Requirements: Ubuntu 22.04+ or Debian 12+, root privileges, internet access.

set -euo pipefail

# ---------------------------------------------------------------------------
# Globals
# ---------------------------------------------------------------------------
LOGFILE="/var/log/setup_remnux.log"
MINIMAL=false
SKIP_PYTHON=false
SKIP_NETWORK=false

CAPA_VERSION="7.1.0"
GHIDRA_VERSION="11.1.2"
GHIDRA_DATE="20240709"
YARA_VERSION="4.5.1"

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------
log_info()  { echo -e "${GREEN}[+]${NC} $*" | tee -a "$LOGFILE"; }
log_warn()  { echo -e "${YELLOW}[!]${NC} $*" | tee -a "$LOGFILE"; }
log_error() { echo -e "${RED}[-]${NC} $*" | tee -a "$LOGFILE"; }

die() { log_error "$@"; exit 1; }

check_root() {
    if [[ $EUID -ne 0 ]]; then
        die "This script must be run as root (use sudo)."
    fi
}

parse_args() {
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --minimal)      MINIMAL=true; shift ;;
            --skip-python)  SKIP_PYTHON=true; shift ;;
            --skip-network) SKIP_NETWORK=true; shift ;;
            -h|--help)
                head -12 "$0" | tail -10
                exit 0
                ;;
            *) die "Unknown option: $1" ;;
        esac
    done
}

command_exists() { command -v "$1" &>/dev/null; }

# ---------------------------------------------------------------------------
# Installation functions
# ---------------------------------------------------------------------------
install_base_packages() {
    log_info "Updating package lists..."
    apt-get update -qq

    log_info "Installing base development packages..."
    apt-get install -y -qq \
        build-essential git curl wget unzip p7zip-full \
        cmake automake autoconf libtool pkg-config \
        libssl-dev libffi-dev libjansson-dev libmagic-dev \
        python3 python3-pip python3-venv python3-dev \
        openjdk-17-jdk jq file hexedit xxd \
        sqlite3 libsqlite3-dev
}

install_radare2() {
    if command_exists r2; then
        log_warn "radare2 already installed: $(r2 -v 2>/dev/null | head -1)"
        return
    fi
    log_info "Installing radare2..."
    local tmpdir
    tmpdir=$(mktemp -d)
    git clone --depth=1 https://github.com/radareorg/radare2.git "$tmpdir/radare2"
    pushd "$tmpdir/radare2" >/dev/null
    sys/install.sh
    popd >/dev/null
    rm -rf "$tmpdir"
    log_info "radare2 installed: $(r2 -v 2>/dev/null | head -1)"
}

install_ghidra() {
    if [[ -d /opt/ghidra ]]; then
        log_warn "Ghidra already installed at /opt/ghidra"
        return
    fi
    log_info "Installing Ghidra ${GHIDRA_VERSION}..."
    local url="https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_${GHIDRA_VERSION}_build/ghidra_${GHIDRA_VERSION}_PUBLIC_${GHIDRA_DATE}.zip"
    local tmpdir
    tmpdir=$(mktemp -d)
    wget -q -O "$tmpdir/ghidra.zip" "$url"
    unzip -q "$tmpdir/ghidra.zip" -d /opt/
    mv /opt/ghidra_${GHIDRA_VERSION}_PUBLIC /opt/ghidra
    ln -sf /opt/ghidra/ghidraRun /usr/local/bin/ghidra
    rm -rf "$tmpdir"
    log_info "Ghidra installed to /opt/ghidra"
}

install_capa() {
    if command_exists capa; then
        log_warn "capa already installed: $(capa --version 2>/dev/null)"
        return
    fi
    log_info "Installing capa ${CAPA_VERSION}..."
    local arch
    arch=$(uname -m)
    case "$arch" in
        x86_64)  arch="linux" ;;
        aarch64) arch="linux" ;;
        *) die "Unsupported architecture for capa: $arch" ;;
    esac
    local url="https://github.com/mandiant/capa/releases/download/v${CAPA_VERSION}/capa-v${CAPA_VERSION}-${arch}.zip"
    local tmpdir
    tmpdir=$(mktemp -d)
    wget -q -O "$tmpdir/capa.zip" "$url"
    unzip -q "$tmpdir/capa.zip" -d "$tmpdir"
    install -m 755 "$tmpdir/capa" /usr/local/bin/capa
    rm -rf "$tmpdir"
    log_info "capa installed: $(capa --version 2>/dev/null)"
}

install_yara() {
    if command_exists yara && yara --version 2>/dev/null | grep -q "${YARA_VERSION}"; then
        log_warn "yara ${YARA_VERSION} already installed"
        return
    fi
    log_info "Installing YARA ${YARA_VERSION}..."
    local tmpdir
    tmpdir=$(mktemp -d)
    wget -q -O "$tmpdir/yara.tar.gz" \
        "https://github.com/VirusTotal/yara/archive/refs/tags/v${YARA_VERSION}.tar.gz"
    tar -xzf "$tmpdir/yara.tar.gz" -C "$tmpdir"
    pushd "$tmpdir/yara-${YARA_VERSION}" >/dev/null
    ./bootstrap.sh
    ./configure --with-crypto --enable-cuckoo --enable-magic --enable-dotnet
    make -j"$(nproc)"
    make install
    ldconfig
    popd >/dev/null
    rm -rf "$tmpdir"
    log_info "YARA installed: $(yara --version)"
}

install_additional_tools() {
    log_info "Installing additional analysis tools..."
    apt-get install -y -qq \
        binwalk foremost upx-ucl strace ltrace \
        volatility3 2>/dev/null || true

    # Install retdec (decompiler)
    if ! command_exists retdec-decompiler; then
        log_info "Installing RetDec..."
        apt-get install -y -qq retdec 2>/dev/null || log_warn "RetDec not in repos, skipping"
    fi

    # Install DIE (Detect It Easy)
    if ! command_exists diec; then
        log_info "Installing Detect It Easy..."
        local die_url="https://github.com/horsicq/DIE-engine/releases/latest"
        log_warn "Install DIE manually from: $die_url"
    fi
}

install_python_libs() {
    if $SKIP_PYTHON; then
        log_warn "Skipping Python library installation (--skip-python)"
        return
    fi
    log_info "Installing Python analysis libraries..."
    pip3 install --break-system-packages --quiet \
        pefile \
        lief \
        capstone \
        unicorn \
        keystone-engine \
        yara-python \
        oletools \
        pycryptodome \
        dnfile \
        pyelftools \
        angr \
        floss \
        malduck \
        vt-py \
        stix2 \
        taxii2-client \
        networkx \
        requests \
        rich \
        2>/dev/null || {
            log_warn "Some pip installs failed, trying with --user..."
            pip3 install --user --quiet pefile lief capstone unicorn yara-python oletools pycryptodome 2>/dev/null || true
        }
    log_info "Python libraries installed"
}

install_network_tools() {
    if $SKIP_NETWORK; then
        log_warn "Skipping network tool installation (--skip-network)"
        return
    fi
    log_info "Installing network analysis tools..."
    apt-get install -y -qq \
        wireshark-common tshark tcpdump ngrep \
        net-tools dnsutils whois nmap \
        inetsim fakenet 2>/dev/null || true

    # Install mitmproxy
    if ! command_exists mitmproxy; then
        pip3 install --break-system-packages --quiet mitmproxy 2>/dev/null || \
            log_warn "mitmproxy install via pip failed; install manually"
    fi
    log_info "Network tools installed"
}

print_summary() {
    log_info "============================================"
    log_info "  Analysis Environment Setup Complete"
    log_info "============================================"
    echo ""
    log_info "Installed tools:"
    for tool in r2 ghidra capa yara python3 tshark file strings objdump; do
        if command_exists "$tool"; then
            echo -e "  ${GREEN}✓${NC} $tool"
        else
            echo -e "  ${RED}✗${NC} $tool"
        fi
    done
    echo ""
    log_info "Log file: $LOGFILE"
    log_info "Next steps:"
    echo "  1. Configure network isolation: sudo bash scripts/network_isolation.sh --mode isolated"
    echo "  2. Take a VM snapshot labeled 'analysis-ready'"
    echo "  3. Verify tools: capa --version && yara --version && r2 -v"
}

# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------
main() {
    parse_args "$@"
    check_root

    echo "" > "$LOGFILE"
    log_info "Starting analysis environment setup ($(date))"

    install_base_packages
    install_radare2
    install_ghidra
    install_capa
    install_yara

    if ! $MINIMAL; then
        install_additional_tools
        install_python_libs
        install_network_tools
    else
        log_info "Minimal mode: skipping additional tools, Python libs, and network tools"
    fi

    print_summary
}

main "$@"