# =============================================================================
#  BOMBAMC.PL :: SYSTEM ANTY-CHEAT & SCREENSHARE ENGINE (v1.1.0)
#  Host: https://sprawdzanie.bombamc.pl
# =============================================================================
$ErrorActionPreference = 'Stop'

# -----------------------------------------------------------------------------
#  [SEKCJA 1] SILNIK SKANOWANIA PAMIECI (WIN32 API)
# -----------------------------------------------------------------------------
$CS = @'
using System;
using System.Collections.Generic;
using System.Runtime.InteropServices;
using System.Text;

public class BombaScanner_8fe933c5
{
    [DllImport("kernel32.dll", SetLastError = true)]
    static extern IntPtr OpenProcess(int access, bool inherit, int pid);
    [DllImport("kernel32.dll")]
    static extern bool ReadProcessMemory(IntPtr h, IntPtr addr, byte[] buf, IntPtr size, out IntPtr read);
    [DllImport("kernel32.dll")]
    static extern int VirtualQueryEx(IntPtr h, IntPtr addr, out MI mi, uint len);
    [DllImport("kernel32.dll")]
    static extern bool CloseHandle(IntPtr h);

    [StructLayout(LayoutKind.Sequential)]
    public struct MI
    {
        public IntPtr BaseAddress;
        public IntPtr AllocationBase;
        public uint   AllocationProtect;
        public IntPtr RegionSize;
        public uint   State;
        public uint   Protect;
        public uint   Type;
    }

    const int PROCESS_QUERY_INFORMATION = 0x0400;
    const int PROCESS_VM_READ           = 0x0010;
    const int MEM_COMMIT                = 0x1000;
    const int CHUNK                     = 4 * 1024 * 1024;

    IntPtr   h;
    byte[][] pats;
    int[]    owner;
    int[]    encOf;     // 0 = ASCII, 1 = UTF-16
    int[][]  byPair;    // kubelki po DWOCH pierwszych bajtach
    byte[]   buf;
    int      maxLen;
    long     curBase;

    public bool[] Found;
    public long[] Addr;      // adres pierwszego trafienia
    public int[]  Enc;       // kodowanie trafienia
    public long   BytesRead;

    public static BombaScanner_8fe933c5 Open(int pid, string[] targets)
    {
        IntPtr h = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, false, pid);
        if (h == IntPtr.Zero) return null;
        BombaScanner_8fe933c5 s = new BombaScanner_8fe933c5();
        s.h = h;
        s.Build(targets);
        return s;
    }

    void Build(string[] targets)
    {
        Found = new bool[targets.Length];
        Addr  = new long[targets.Length];
        Enc   = new int[targets.Length];

        List<byte[]> pl = new List<byte[]>();
        List<int>    ol = new List<int>();
        List<int>    el = new List<int>();
        for (int i = 0; i < targets.Length; i++)
        {
            pl.Add(Encoding.ASCII.GetBytes(targets[i]));   ol.Add(i); el.Add(0);
            pl.Add(Encoding.Unicode.GetBytes(targets[i])); ol.Add(i); el.Add(1);
        }
        pats  = pl.ToArray();
        owner = ol.ToArray();
        encOf = el.ToArray();

        List<int>[] buckets = new List<int>[65536];
        maxLen = 2;
        for (int i = 0; i < pats.Length; i++)
        {
            if (pats[i].Length < 2) continue;
            int key = (pats[i][0] << 8) | pats[i][1];
            if (buckets[key] == null) buckets[key] = new List<int>();
            buckets[key].Add(i);
            if (pats[i].Length > maxLen) maxLen = pats[i].Length;
        }
        byPair = new int[65536][];
        for (int i = 0; i < 65536; i++)
            byPair[i] = (buckets[i] == null) ? null : buckets[i].ToArray();

        buf = new byte[CHUNK];
    }

    public long[][] Regions()
    {
        List<long[]> list = new List<long[]>();
        long addr  = 0;
        long limit = (IntPtr.Size == 4) ? 0x7FFF0000L : 0x7FFFFFFF0000L;
        uint sz    = (uint)Marshal.SizeOf(typeof(MI));
        MI   mi;
        while (addr < limit)
        {
            if (VirtualQueryEx(h, new IntPtr(addr), out mi, sz) == 0) break;
            long rs  = mi.RegionSize.ToInt64();
            long bas = mi.BaseAddress.ToInt64();
            if (rs <= 0) break;

            uint p = mi.Protect;
            bool readable = (p == 0x02 || p == 0x04 || p == 0x08 ||
                             p == 0x20 || p == 0x40 || p == 0x80);
            if (mi.State == MEM_COMMIT && readable)
                list.Add(new long[] { bas, rs });

            long next = bas + rs;
            if (next <= addr) break;
            addr = next;
        }
        return list.ToArray();
    }

    public void Scan(long baseAddr, long size)
    {
        long off = 0;
        while (off < size)
        {
            int want = (int)Math.Min((long)CHUNK, size - off);
            IntPtr read;
            if (!ReadProcessMemory(h, new IntPtr(baseAddr + off), buf, (IntPtr)want, out read))
            {
                off += want;
                continue;
            }
            int n = (int)read.ToInt64();
            if (n <= 0) { off += want; continue; }

            curBase = baseAddr + off;
            Search(n);
            BytesRead += n;

            int step = n - (maxLen - 1);
            if (step <= 0) step = n;
            off += step;
        }
    }

    void Search(int n)
    {
        byte[] b = buf;
        for (int i = 0; i + 1 < n; i++)
        {
            int[] cand = byPair[(b[i] << 8) | b[i + 1]];
            if (cand == null) continue;
            for (int k = 0; k < cand.Length; k++)
            {
                int pi = cand[k];
                int o  = owner[pi];
                if (Found[o]) continue;
                byte[] p = pats[pi];
                if (i + p.Length > n) continue;
                int j = 2;
                while (j < p.Length && b[i + j] == p[j]) j++;
                if (j == p.Length)
                {
                    Found[o] = true;
                    Addr[o]  = curBase + i;
                    Enc[o]   = encOf[pi];
                }
            }
        }
    }

    public void Close()
    {
        if (h != IntPtr.Zero) { CloseHandle(h); h = IntPtr.Zero; }
    }
}
'@

# -----------------------------------------------------------------------------
#  [SEKCJA 2] FUNKCJE INTERFEJSU KONSOLOWEGO I FORMATOWANIA
# -----------------------------------------------------------------------------
$SCRIPT_UI = @{
    Unicode = $true
    Width   = 80
    Padding = '  '
}
try { [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 } catch { $SCRIPT_UI.Unicode = $false }

if ($SCRIPT_UI.Unicode) {
    $G = @{
        DTL = [char]0x2554; DTR = [char]0x2557; DBL = [char]0x255A; DBR = [char]0x255D
        DH  = [char]0x2550; DV  = [char]0x2551
        TL  = [char]0x250C; TR  = [char]0x2510; BL  = [char]0x2514; BR  = [char]0x2518
        H   = [char]0x2500; V   = [char]0x2502; ML  = [char]0x251C; MR  = [char]0x2524
        FULL= [char]0x2588; HALF= [char]0x2591; DOT = [char]0x00B7; ELL = [char]0x2026
        OK  = [char]0x2714; BAD = [char]0x2718; WARN= [char]0x25B2
    }
} else {
    $G = @{
        DTL='+'; DTR='+'; DBL='+'; DBR='+'; DH='='; DV='|'
        TL='+'; TR='+'; BL='+'; BR='+'; H='-'; V='|'; ML='+'; MR='+'
        FULL='#'; HALF='-'; DOT='.'; ELL='~'; OK='+'; BAD='x'; WARN='!'
    }
}

$W  = $SCRIPT_UI.Width
$IN = $W - 2
$PAD = $SCRIPT_UI.Padding

function Fit-Text {
    param([string]$Text, [int]$Len)
    if ($null -eq $Text) { $Text = '' }
    if ($Text.Length -le $Len) { return $Text.PadRight($Len) }
    return $Text.Substring(0, [Math]::Max(1, $Len - 1)) + $G.ELL
}

function Render-FrameTop([string]$Title, [string]$BorderColor = 'DarkYellow', [switch]$Double) {
    $tl = $(if ($Double) { $G.DTL } else { $G.TL })
    $tr = $(if ($Double) { $G.DTR } else { $G.TR })
    $h  = $(if ($Double) { $G.DH }  else { $G.H  })
    if ($Title) {
        $tag = " [ $Title ] "
        $leftBar = [string]$h * 3
        $rem = $IN - 3 - $tag.Length
        if ($rem -lt 0) { $rem = 0 }
        Write-Host ($PAD + $tl + $leftBar) -ForegroundColor $BorderColor -NoNewline
        Write-Host $tag -ForegroundColor White -NoNewline
        Write-Host (([string]$h * $rem) + $tr) -ForegroundColor $BorderColor
    } else {
        Write-Host ($PAD + $tl + ([string]$h * $IN) + $tr) -ForegroundColor $BorderColor
    }
}

function Render-FrameBottom([string]$BorderColor = 'DarkYellow', [switch]$Double) {
    $bl = $(if ($Double) { $G.DBL } else { $G.BL })
    $br = $(if ($Double) { $G.DBR } else { $G.BR })
    $h  = $(if ($Double) { $G.DH }  else { $G.H  })
    Write-Host ($PAD + $bl + ([string]$h * $IN) + $br) -ForegroundColor $BorderColor
}

function Render-FrameDivider([string]$BorderColor = 'DarkYellow') {
    Write-Host ($PAD + $G.ML + ([string]$G.H * $IN) + $G.MR) -ForegroundColor $BorderColor
}

function Render-FrameRow {
    param(
        [Parameter(Mandatory=$true)][object[]]$Columns,
        [string]$BorderColor = 'DarkYellow',
        [switch]$Double
    )
    $v = $(if ($Double) { $G.DV } else { $G.V })
    $total = 0
    foreach ($c in $Columns) { $total += $c.T.Length }
    Write-Host ($PAD + $v) -ForegroundColor $BorderColor -NoNewline
    foreach ($c in $Columns) {
        $col = $c.C
        if (-not $col) { $col = 'Gray' }
        Write-Host $c.T -ForegroundColor $col -NoNewline
    }
    $space = $IN - $total
    if ($space -lt 0) { $space = 0 }
    Write-Host ((' ' * $space) + $v) -ForegroundColor $BorderColor
}

function Render-Field([string]$Name, [string]$Val, [string]$ValColor = 'White') {
    Render-FrameRow @(
        @{ T = '  ' + (Fit-Text $Name 15); C = 'DarkGray' },
        @{ T = $Val;                         C = $ValColor }
    ) 'DarkGray'
}

function Render-HeaderBanner([string]$Brand, [string]$Ver) {
    Write-Host ''
    Write-Host ($PAD + '  ██████╗  ██████╗ ███╗   ███╗██████╗  █████╗ ███╗   ███╗ ██████╗') -ForegroundColor Red
    Write-Host ($PAD + '  ██╔══██╗██╔═══██╗████╗ ████║██╔══██╗██╔══██╗████╗ ████║██╔════╝') -ForegroundColor DarkRed
    Write-Host ($PAD + '  ██████╔╝██║   ██║██╔████╔██║██████╔╝███████║██╔████╔██║██║     ') -ForegroundColor Yellow
    Write-Host ($PAD + '  ██╔══██╗██║   ██║██║╚██╔╝██║██╔══██╗██╔══██║██║╚██╔╝██║██║     ') -ForegroundColor DarkYellow
    Write-Host ($PAD + '  ██████╔╝╚██████╔╝██║ ╚═╝ ██║██████╔╝██║  ██║██║ ╚═╝ ██║╚██████╗') -ForegroundColor Red
    Write-Host ($PAD + '  ╚═════╝  ╚═════╝ ╚═╝     ╚═╝╚═════╝ ╚═╝  ╚═╝╚═╝     ╚═╝ ╚═════╝') -ForegroundColor DarkRed
    Write-Host ''

    Render-FrameTop '' 'Red' -Double
    $left  = '  ' + $Brand + ' // SYSTEM ANTY-CHEAT & SCREENSHARE'
    $right = 'WERSJA v' + $Ver + ' '
    $g = $IN - $left.Length - $right.Length
    if ($g -lt 1) { $g = 1 }
    Render-FrameRow @(
        @{ T = $left;                C = 'Yellow' },
        @{ T = ((' ' * $g) + $right); C = 'DarkYellow' }
    ) 'Red' -Double
    Render-FrameBottom 'Red' -Double
}

function Render-ProgressBar([int]$Percent, [string]$Label, [int]$Megabytes, [double]$Duration) {
    $barLength = 28
    $fill = [int]($barLength * $Percent / 100)
    if ($fill -gt $barLength) { $fill = $barLength }
    if ($fill -lt 0) { $fill = 0 }
    $barStr = ([string]$G.FULL * $fill) + ([string]$G.HALF * ($barLength - $fill))
    $rate = 0
    if ($Duration -gt 0.2) { $rate = [int]($Megabytes / $Duration) }
    Write-Host ("`r" + $PAD + ' ') -NoNewline
    Write-Host $barStr -ForegroundColor Yellow -NoNewline
    Write-Host ("  {0,3}%  " -f $Percent) -ForegroundColor White -NoNewline
    Write-Host ("{0,-22} {1,6} MB  {2,5} MB/s   " -f $Label, $Megabytes, $rate) -ForegroundColor DarkGray -NoNewline
}

function Render-AlertBox([string]$Header, [string]$Sub, [string]$BgColor, [string]$FgColor) {
    $blank = ' ' * $W
    Write-Host ''
    Write-Host ($PAD + $blank) -BackgroundColor $BgColor -ForegroundColor $FgColor
    Center-TextLine $Header $BgColor $FgColor
    if ($Sub) { Center-TextLine $Sub $BgColor $FgColor }
    Write-Host ($PAD + $blank) -BackgroundColor $BgColor -ForegroundColor $FgColor
    Write-Host ''
}

function Center-TextLine([string]$Txt, [string]$BgColor, [string]$FgColor) {
    $t = $Txt
    if ($t.Length -gt $W) { $t = $t.Substring(0, $W) }
    if ((($W - $t.Length) % 2) -eq 1) { $t = $t + ' ' }
    $padSide = ($W - $t.Length) / 2
    Write-Host ($PAD + (' ' * $padSide) + $t + (' ' * ($W - $padSide - $t.Length))) -BackgroundColor $BgColor -ForegroundColor $FgColor
}

function Render-SecurityFooter([string]$SId, [datetime]$StartTime, [string]$EndpointUrl, [string]$AuthToken) {
    Render-FrameTop 'BEZPIECZENSTWO I WERYFIKACJA' 'DarkGray'
    Render-FrameRow @(@{ T = '  Skrypt dziala w trybie READ-ONLY. Nie zapisuje danych na dysk.'; C = 'White' })
    Render-FrameRow @(@{ T = '  Nie odczytuje hasel, kont launcherow ani danych osobowych.'; C = 'White' })
    Render-FrameRow @(@{ T = ('  Oficjalne zrodlo: ' + $EndpointUrl); C = 'Yellow' })
    Render-FrameRow @(@{ T = ''; C = 'Gray' })
    Render-FrameRow @(@{ T = '  Administracja BOMBAMC nigdy nie prosi o Twoje haslo ani e-mail.'; C = 'DarkGray' })
    Render-FrameDivider 'DarkGray'
    Render-FrameRow @(
        @{ T = '  ID Sesji: '; C = 'DarkGray' }, @{ T = (Fit-Text $SId 12); C = 'Yellow' },
        @{ T = 'Token: '; C = 'DarkGray' },    @{ T = (Fit-Text $AuthToken 20); C = 'Yellow' },
        @{ T = $StartTime.ToString('yyyy-MM-dd HH:mm:ss'); C = 'DarkGray' }
    ) 'DarkGray'
    Render-FrameRow @(@{ T = ('  Sprawdz autentycznosc: ' + $EndpointUrl + '/weryfikacja'); C = 'DarkGray' }) 'DarkGray'
    Render-FrameBottom 'DarkGray'
    Write-Host ''
}

# -----------------------------------------------------------------------------
#  [SEKCJA 3] DEFINICJE BAZY SYGNATUR CHEATOW
# -----------------------------------------------------------------------------
$SIGNATURES = @(
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Nursultan';            Level = 'H'; Pattern = 'nursultan' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Ventura Client';       Level = 'H'; Pattern = 'eu/venturaclient/misc/misc/GameAccessor.classPK' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Azure (peleryna)';     Level = 'H'; Pattern = '/assets/anamvmnt/textures/capes/custom/azure.png' },
    # Korzenie pakietow klientow. Kazdy z nich jest podciagiem setek wariantow
    # z surowych list (np. 'su/catlean' zawiera sie w 2403 wzorcach Catleana),
    # wiec wykrywa dokladnie to samo przy 2403 razy mniejszym koszcie skanu.
    # Wszystkie zweryfikowane na czystym kliencie: zero trafien.
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Catlean';              Level = 'H'; Pattern = 'su/catlean' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Meteor Client';        Level = 'H'; Pattern = 'meteordevelopment/meteorclient' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Vanadium';             Level = 'H'; Pattern = 'nl/vanadium' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Vanadium (JNI)';       Level = 'H'; Pattern = 'nl_vanadium' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Vanadium (vanahui)';   Level = 'H'; Pattern = 'vanahui' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Ventura (pakiet)';     Level = 'H'; Pattern = 'venturaclient' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Ventura (candyman)';   Level = 'H'; Pattern = 'candyman/' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'ThunderHack';          Level = 'H'; Pattern = 'ThunderHack' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Aristois';             Level = 'H'; Pattern = 'aristois' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'BleachHack';           Level = 'H'; Pattern = 'BleachHack' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Wurst';                Level = 'H'; Pattern = 'Wurst' },
    # Cheat nazwany tak samo jak anticheat Grim (celowo, dla zmylki).
    # Samo slowo "grim" jest bezuzyteczne jako sygnatura - to zwykle slowo
    # i trafia w czystym kliencie. Uzywamy korzenia jego pakietu.
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Grim (cheat)';         Level = 'H'; Pattern = 'sixfive/' },
    # Nazwy projektow wydobyte z surowych list (assets/<nazwa>/, handler$..$<nazwa>$,
    # dev/<nazwa>/, <nazwa>:textures/) i zweryfikowane na czystym kliencie.
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Nerith';               Level = 'H'; Pattern = 'nerith' },
    # 'jnic' bez kotwicy ma 4 znaki - taki ciag malych liter trafia sie w kazdym
    # dluzszym tekscie base64 i w danych binarnych. Uzywamy form z separatorem.
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Vanadium (jnic /)';    Level = 'H'; Pattern = 'dev/jnic/' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Vanadium (jnic .)';    Level = 'H'; Pattern = 'dev.jnic.' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Vanadium (jnicLoader)'; Level = 'H'; Pattern = 'jnicLoader' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Kausel';               Level = 'H'; Pattern = 'kausel' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Dqrkis';               Level = 'H'; Pattern = 'dqrkis' },
    # USUNIETE: 'failedtion'. W calym zrodle wystepowalo RAZ, jako 'failedtion/codecs',
    # w regionie czystych smieci binarnych obok tablicy znakow czcionki i kodu Java2D.
    # To sklejka dwoch sasiednich ciagow ('...failed' + 'serialization/codecs'),
    # a nie nazwa klienta - nie ma czego wykrywac.
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Anamvmnt';             Level = 'H'; Pattern = 'anamvmnt' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Meteor (pakiet)';      Level = 'H'; Pattern = 'meteordevelopment' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Starscript (Meteor)';  Level = 'L'; Pattern = 'starscript' },
    # Crack (np. zlamana wersja Grima). UWAGA: samo '.crack' jest bezuzyteczne -
    # trafia w waniliowe klucze Minecrafta (block.minecraft.cracked_nether_bricks,
    # item.wolf_armor.crack, block.sniffer_egg.crack), czyli u kazdego gracza.
    # Dzialaja tylko formy z separatorem sciezki/archiwum - zweryfikowane czyste.
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Crack (katalog)';      Level = 'L'; Pattern = '/crack/' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Crack (plik w jarze)'; Level = 'L'; Pattern = '.crackPK' },
    @{ Cat = 'KLIENCI CHEATOW';   Name = 'Crack (pakiet)';       Level = 'L'; Pattern = '.crack.' },
    @{ Cat = 'HOOKI I MIXINY';    Name = 'Mixin renderFire';     Level = 'H'; Pattern = 'renderFire(Lorg/spongepowered/asm/mixin/injection/callback/CallbackInfo;)V' },
    @{ Cat = 'HOOKI I MIXINY';    Name = 'sendMovementPackets';  Level = 'H'; Pattern = 'Lnet/minecraft/client/network/ClientPlayerEntity;sendMovementPackets()V' },
    @{ Cat = 'HOOKI I MIXINY';    Name = 'Shader blur GUI';      Level = 'H'; Pattern = 'GUI_BEFORE_PRE_BLUR0v' },
    # USUNIETE: 'jose4j', 'getX509CertificateSha256Thumbprint', 'EcdsaSECP256K1UsingSha256'.
    # To nazwy z biblioteki jose4j (JSON Web Token) - w zrodlowych listach wystepuja
    # jako 'org/jose4j/jwe/...', czyli zwykla sciezka biblioteki. Zawieraja ja
    # launchery logujace sie na konto Microsoft, dlatego trafialy w proces java.exe
    # launchera na wielu komputerach. Obecnosc tej biblioteki niczego nie dowodzi.
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'setWasTouchingWaterH'; Level = 'H'; Pattern = 'setWasTouchingWaterH' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'uv_quad_color';        Level = 'L'; Pattern = 'uv_quad_color' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'IORegistryEntry';      Level = 'H'; Pattern = 'IORegistryEntryGetChildEntry' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'Sygnatura #1';         Level = 'H'; Pattern = 'LLLeLLCLLL23L3' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'Sygnatura #2';         Level = 'H'; Pattern = 'i4fCf.G5.MyZdu^Z2l' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'Sygnatura #3';         Level = 'H'; Pattern = 'BW_s_QfMHBRVQSGKa]Z' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'Sygnatura #4';         Level = 'H'; Pattern = 'DqFETsH_bDCOcsu' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'Sygnatura #5';         Level = 'H'; Pattern = 'yHKHMAYcdi' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'Sygnatura #6';         Level = 'L'; Pattern = 'tWJ]yX' },
    @{ Cat = 'SYGNATURY PAMIECI'; Name = 'Sygnatura #7';         Level = 'L'; Pattern = 'aaa.bbb' }
)

# --- Sygnatury Doomsday (surowe wzorce pamieci) ------------------------------
# Single-quoted here-string: wszystko literalnie (backtick, $, ", ' bez escapowania).
# Kazda linia = jeden szukany ciag. Duplikaty usuwane w czasie dzialania.
$DOOMSDAY = @'
xVl,#WK
#@_]D$f7+:!s
8\cW!0voReLAd;
Dwm2V[Kw
]yBU]Ick
+$_s&BL P
pkohge\_
^Dk_gZblK
![D'W7&
YS<3]_$],4 1_dNp&q
:b_feVh8WbFW
HOEHv3xZ
OV$\@jgxo&q1Wv\EW(
xiO_kZEdFglDch
hn#^K=9e52ijC
i2nkhYbY
CkN^dlN32F
&)<j"haVWOJx
4(hN8Bx]L?;l",
f8784xiskN"ne^V
[TNxWnxPMCbondnQ[Y
jM'[A+Ax0"_%y1MCu
CEy>KpT!\%*
XLwOSiLwav
-7=5TxR+d6[3j]
xrp6#_h^
N#h$C\Y[L<\w
q[HlxCjGqOteW\FdaTD
mVQtRYJCLk
QEfOGhLDM
ClUbCwMCJ^ZAId
n,[*aeje
9Lr?[*"
WdKtG\n[YB_\a
dNaGBibtWfaqO
JxkgkyPQS
r[R[HZKclxU
R]jntXLF]
Wb[TloBx
dFyrkeI
yokosJiM
"U`,kGZ8G@URL
rKo4mNjg<(!Y^fI^DJ
=n>V$dB
NW+I+:Lm1TI*mtv&(
3]3+b^sq
JZ^A\WH[HL[
JDRvLaSjiw),b
a*e2mJhy
bxi[wI_srfBl
OPobmcf[MP
JvHCS"*M36a7 (@jHQ
T>2W,EpwdbH
aimx'J teX&
qdBR&.via
Wi[CNhp`[G
IGmEr_AWn\
ZOBCi#o
-CTjSrSV>uj1Z Ex h(
wcmlSiv[mE`Uyp
E[YcZADEJdZBS
ElBjGpSAMDVa
iaDpJPivdmXGDZ`
R,CEpZl:.MF$j
AtcQpWYE`UhnGt
/ZC8sXuRkJ6i5S9*q
dn1!O_;
"!J(#Z(
BkQsWTYbqOVP
AJteTVHW
?,#/HS2*a2&AyF]
K[Se83$u8M r0$[\a
c:V=$K"P#+QO<`Hf=J[
xnAcY]eqGJDtSdmjhJt
a6?%C1)a
50!mFty,B`6H[F`ib
_f7EB@=SCtE(km
?df&F'c<r!0?uWZ
!'umTmjN0hiWu-
:w/p'6`WA$.V@MB>
3D"YKaL-X<u;
HoJ>CE0?
VTm\ZWTPN^ueY
ynAFC`vqR
hrdS`E_AdP
y)Y#$/#]
BxhbHNt`g
cs8?hbJ)/W)
YOFXguQiDUs
EbpHlUWjlDPvlcRT
L;;<**<>L<
3KlFEF %
HsvYmnXJbrvk^EM`
.`]2S'8P*\
BXM7LE9K
7CTqc(K-i[e]6RH
8iPyo?L!?8+;uH&U
-csV1xiXfWlVHR\a9M
^NOJXfrg
vTqLhqmjemo`
avuKOfIUmAEUQ
uJtxDyLtJ`Mh
TU\vebgkJdfH
!&cWI2d'<m@m"sT03Ky
&ueGp?j?+BX%
\WJ;B9Y!so+-i
UnJUh`Fa_W
(RYor`Id%&8e_W6A
FaypNWKaeAJK[BGY
#p's"RCk
Mh\`CfHWyWaDlStk
#;Nq[2<
UdWmF:MFJK'W,aO4
mPC#M[c
aIVJiy\
WMZSCnYnUYWO
#"x#SY&s
dcGQ^xPsaQJ
Rlr]aLg
9guHdM,"l
K6LaM6t:AU
\VIFDCpHe
nBmtQifkPA`O_hJq\
+0!E4JZ3K$.8d
'@

# Dopisanie sygnatur Doomsday do listy (dedup wzgledem juz istniejacych, Ordinal)
$__seen = New-Object 'System.Collections.Generic.HashSet[string]'
foreach ($__s in $SIGNATURES) { [void]$__seen.Add($__s.Pattern) }
$__all = New-Object System.Collections.ArrayList
foreach ($__s in $SIGNATURES) { [void]$__all.Add($__s) }
$__dn = 0
foreach ($__line in ($DOOMSDAY -split "`n")) {
    $__p = $__line -replace "`r$", ''
    if ($__p.Length -eq 0) { continue }
    if (-not $__seen.Add($__p)) { continue }
    $__dn++
    [void]$__all.Add(@{
        Cat     = 'DOOMSDAY'
        Name    = ('Doomsday #{0}' -f $__dn)
        Level   = $(if ($__p.Length -lt 8) { 'L' } else { 'H' })
        Pattern = $__p
        Bulk    = $true
    })
}
# --- Poszlaki -----------------------------------------------------------------
# Wzorce wydobyte z surowych zrzutow pamieci cheatow. Kazdy przeszedl test na
# czystym kliencie (zero trafien), ma strukture artefaktu Javy/Minecrafta i nie
# zawiera sladu popularnych modow. Mimo to wchodza WYLACZNIE jako poszlaki
# (zolte PODEJRZANE) - pochodza z jednego zrzutu i nie sa dowodem same w sobie.
$POSZLAKI = @'
Ldev/jnic/LDQFbx/G;
Ldev/jnic/LDQFbx/U;
Ldev/jnic/LDQFbx/B;
Ldev/jnic/LDQFbx/f;
Ldev/jnic/LDQFbx/w;
Ldev/jnic/LDQFbx/C;
frames/0132.png?
Ldev/jnic/LDQFbx/n;
*mnopqrstuvwf/0
sounds/patchern.ogg
!25G/CFGPWZGfmpGj
!25G/ILG?Y\GVwzGf
jdk/proxy3/$Proxy59
block/christmas_hat
/2D<FIDCY\Dfy|Dv
textures/hat.png
/'$25X.EHXdvyXs
sounds/roxmboff.ogg
/2o)BEo<RUofpsom
9<p/ILpFXXpbnqp{
/register_key?key=
sounds/roxmbon.ogg
/9<Y4NQYGbeY\ssYsY
sounds/daszek.ogg
1\/N?FcUgO]NX
,/r9FIr=TWraknr
failedtion/codecs
/checktest?data=
nl/cU$$Lambda
assets/nerith/PK
/getlist?data=
sounds/baka.ogg
//TBNQTH]`TouuT
nl/g.classPK
nl/cU.classPK
nl/f.classPK
nl/h.classPK
58T/EHTRYYTiooT
nl.vanadium.mixin.
nl/cT.classPK
58l/EHlRYYldqql
nl.vanadium.mixin
/velaris/native
/assets/nerith
/sounds/a.ogg
/nl/cU.class
/nl/cT.class
dev/jnic/LDQFbx/JNICLoader.classPK
/dev/jnic/LDQFbx/JNICLoader.class
nerith:textures/particle/snowflake1.png
nerith:textures/jumpcircle/vajfon.png
dev/jnic/LDQFbx/G.classPK
dev/jnic/LDQFbx/JNICLoader
dev/jnic/LDQFbx/w.classPK
dev/jnic/LDQFbx/R.classPK
dev/jnic/LDQFbx/N.classPK
dev/jnic/LDQFbx/f.classPK
ClN)QS/"V<K^CiJeUQ9<ZgG_C
dev/jnic/LDQFbx/W.classPK
dev/jnic/LDQFbx/U.classPK
dev/jnic/LDQFbx/C.classPK
handler$zbf001$dqrkis$onAttack
dev/jnic/LDQFbx/B.classPK
nl.vanadium.mixin.LivingEntityAccessor
assets/minecraft/sounds/roxmbon.oggPK
dev/jnic/LDQFbx/c.classPK
assets/minecraft/sounds/baka.oggPK
assets/minecraft/sounds/patchern.oggPK
(Ldev/jnic/LDQFbx/C;II)V
nl.vanadium.mixin.KeyboardInputMixin
assets/minecraft/sounds/daszek.oggPK
dev/jnic/LDQFbx/n.classPK
dev/jnic/LDQFbx/F.classPK
assets/minecraft/sounds/roxmboff.oggPK
handler$zbb000$dqrkis$onRenderHotbarEnd
(Ldev/jnic/LDQFbx/C;B)V
textures/particle/snowflake1.png
/assets/minecraft/shaders/core/blur.vsh
FireworkRocketEntityMixin.java
handler$zzk000$dqrkis$onSendPacket
nerith-client-refmap.jsonPK
(Ldev/jnic/LDQFbx/C;)V
(Ldev/jnic/LDQFbx/B;B)V
nerith:textures/jumpcircle/circle3.png
nerith:textures/jumpcircle/circle2.png
(Ldev/jnic/LDQFbx/B;)V
assets/nerith/textures/arrows/ar1.pngPK
nl.vanadium.mixin.CobwebBlockMixin
client-nerith-client-refmap.jsonPK
nerith:textures/jumpcircle/circle6.png
/ModuleList.classhri<TE
kausel/technologies/obfuscation/PK
nerith:textures/targetesp/glow.png
handler$znm000$nerith-client$onKey
assets/minecraft/sounds.jsonPK
/client-nerith-client-refmap.json
assets/minecraft/shaders/program/PK
/assets/minecraft/sounds/patchern.ogg
/assets/minecraft/sounds/roxmboff.ogg
assets/nerith/textures/jumpcircle/PK
/nerith-client-refmap.json
/assets/minecraft/sounds/roxmbon.ogg
/assets/minecraft/sounds/daszek.ogg
InGameOverlayRendererMixin.java
assets/minecraft/shaders/core/arc.vshPK
nl.vanadium.mixin.ChatScreenMixin
/assets/minecraft/sounds/baka.ogg
handler$zbb001$dqrkis$onRender
nerith:textures/particle/heart1.png
nerith:textures/jumpcircle/circle.png
assets/nerith/textures/christmas.pngPK
handler$znl000$nerith-client$onRemoved
/assets/minecraft/shaders/core/blur.fsh
CobwebBlockMixin.java
textures/particle/heart1.png
assets/minecraft/blockstates/PK
LEType.javas/Pan4ur/T
hpack/Decoder#7/HeaderTable
assets/minecraft/shaders/include/PK
nerith-client.client.mixins.jsonPK
/assets/nerith/textures/arrows/ar1.png
textures/jumpcircle/circle2.png
nl.vanadium.mixin.EntityRendererMixin
nl.vanadium.mixin.HeldItemRendererMixin
nerith-client.mixins.jsonPK
assets/minecraft/shaders/core/arc.fshPK
nl.vanadium.mixin.KeyboardMixin
nl.vanadium.mixin.MinecraftClientMixin
assets/nerith/textures/killeffect/PK
textures/jumpcircle/circle4.png
/assets/minecraft/shaders/core/arc.json
handler$zoa000$nerith-client$hurt
/assets/minecraft/sounds.json
nl.vanadium.mixin.ClientConnectionMixin
/assets/minecraft/shaders/program
/assets/minecraft/shaders/core/arc.vsh
InGameOverlayRendererMixin
kausel/technologies/PK
/assets/nerith/textures/christmas.png
nl.vanadium.mixin.LivingEntityMixin
textures/particle/star1.png
assets/minecraft/models/item/PK
/assets/minecraft/shaders/program/core
textures/jumpcircle/circle.png
assets/nerith/textures/particle/PK
nl/ExampleMixin.classPK
handler$znl000$nerith-client$onRender
assets/minecraft/shaders/core/PK
handler$zni000$nerith-client$onRender
/assets/nerith/textures/jumpcircle
assets/minecraft/sounds/PK
[Ldev/jnic/LDQFbx/c;
assets/nerith/textures/hat.pngPK
[Ldev/jnic/LDQFbx/F;
/nerith-client.client.mixins.json
/nerith-client.mixins.json
handler$znk001$nerith-client$tick
com.slither.velaris.mixin
assets/minecraft/shaders/PK
assets/nerith/textures/targetesp/PK
assets/minecraft/textures/item/PK
textures/targetesp/glow.png
/assets/minecraft/shaders/core/arc.fsh
FireworkRocketEntityMixin
textures/targetesp/quadstapple.png
handler$znh000$nerith-client$tick
nl.vanadium.mixin.GameRendererMixin
assets/nerith/textures/arrows/PK
/assets/nerith/textures/killeffect
nl.vanadium.mixin.InGameHudMixin
textures/targetesp/trianglestapple.png
/nl/ExampleMixin.class
assets/minecraft/fonts/PK
/assets/nerith/textures/hat.png
/kausel/technologies
/kausel.accesswidener
nl.vanadium.mixin.EntityMixin
nl.vanadium.mixin.ItemMixin
nl.vanadium.mixin.MouseMixin
item/christmas/christmas_hat_layer
assets/minecraft/items/PK
/assets/nerith/textures/targetesp
/assets/nerith/textures/arrows
assets/nerith/textures/PK
/assets/minecraft/fonts
assets/minecraft/fonts/
item/christmas/christmas_hat
/assets/nerith/textures
mM8M18cZMm5u0smh4DugzeApIC3XA/dKQ2TC+XTLxz7N8AqXojoVl2+nRfPXoOTH
LaO+Br9c0iXnVaYePuT/BgD+TySyn6Hqm6735UuFNPwFeRrfLxSiQnt7OX/d4nZ6
AQAYX/vvh6zS4CmtIzQpGK8EX1QF4SSrKBIn3D4YLscevJ+HJWM1qHIHvNnuIUo4
WIoK3/OWATHJED1WdOr2U8CP07O9OnRQPwPfzzNHbYG3Wg0DI/Yj1t58KTlQPGfs
@:QPONMLKJIHGFEDCBA@?>=<;:98765/.-,(&%$#"
AoIBAQCwuKqr9ohNhVqDFOgzV8wI94cemJL4BI9+yvNNrCX7hbvF+Bed/IsFYc7n
//W1H3JcN+VvbP2Puq0Glrsl+2VTAgMBAAGjMjAwMA8GA1UdEQQIMAaHBJI7fuAw
OgXdn2XTnJqlJxsadPswuF7EkOnPu4YjaiPucJmdX4uZ5Km+LWLWs/8Pr9sqX+OH
>HEXJHMJ8=<E,NCO="V"C21=970+1)<!<68857546<*9IA/E30
/org/freedesktop/dbus/exceptions/InvalidBusNameException.class
dev/jnic/lib/ad56f049-35f9-4bfd-a7a4-b0489ecd3a4e.datPK
handler$zoc000$nerith-client$injectAfterMatrixPushHandPosition
handler$zoc000$nerith-client$injectBeforeRenderCrossBowItem
handler$zni000$nerith-client$onRenderStatusEffectOverlay
assets/minecraft/shaders/program/core/blur.jsonPK
assets/nerith/textures/jumpcircle/vajfon.pngPK
assets/nerith/textures/particle/snowflake1.pngPK
handler$zbb000$dqrkis$onSetOverlayMessage
handler$znh000$nerith-client$onPushOutOfBlocksHook
handler$zoe000$nerith-client$vnd_fakeHackerSmooth
handler$zog000$nerith-client$renderLabelIfPresent
handler$znj000$nerith-client$renderFireOverlayHook
handler$zoa000$nerith-client$hookShowFloatingItem
nl.vanadium.mixin.FireworkRocketEntityMixin
kausel/technologies/obfuscation/Exclude.classPK
assets/minecraft/models/block/christmas_hat.jsonPK
kausel/technologies/obfuscation/Include.classPK
assets/nerith/textures/jumpcircle/circle2.pngPK
assets/nerith/textures/particle/dollar1.pngPK
/assets/nerith/textures/particle/snowflake1.png
assets/nerith/textures/killeffect/sigma.pngPK
assets/nerith/textures/jumpcircle/circle3.pngPK
assets/minecraft/shaders/core/blur.jsonPK
assets/nerith/textures/killeffect/akise2.pngPK
handler$zoc000$nerith-client$injectBeforeRenderItem
handler$zoi000$nerith-client$onEntityCollisionHook
assets/minecraft/blockstates/christmas_hat.jsonPK
assets/minecraft/shaders/core/blur.vshPK
/assets/nerith/textures/jumpcircle/vajfon.png
assets/nerith/textures/jumpcircle/sva.pngPK
handler$zoj000$nerith-client$attackEntityPost
nl.vanadium.mixin.ClientPlayerInteractionManagerMixin
)Lkausel/technologies/obfuscation/Include;
assets/nerith/textures/jumpcircle/circle4.pngPK
assets/nerith/textures/jumpcircle/circle6.pngPK
assets/nerith/textures/jumpcircle/circle5.pngPK
assets/minecraft/shaders/program/core/round.jsonPK
/kausel/technologies/obfuscation/Exclude.class
assets/minecraft/models/item/christmas_hat.jsonPK
assets/minecraft/textures/item/christmas/testhead.pngPK
handler$zoj000$nerith-client$attackEntityPre
assets/minecraft/shaders/include/common.glslPK
assets/nerith/textures/particle/bubble1.pngPK
assets/nerith/textures/particle/leaves1.pngPK
assets/nerith/textures/jumpcircle/circle.pngPK
handler$znl000$nerith-client$onMouseClicked
assets/nerith/textures/killeffect/frag.pngPK
assets/minecraft/shaders/core/blur.fshPK
/assets/minecraft/models/block/christmas_hat.json
/kausel/technologies/obfuscation/Include.class
handler$zno000$nerith-client$onReceivePacket
/assets/nerith/textures/particle/dollar1.png
assets/nerith/textures/targetesp/glow.pngPK
/assets/nerith/textures/killeffect/akise2.png
/assets/nerith/textures/jumpcircle/circle3.png
assets/nerith/textures/particle/heart1.pngPK
/assets/nerith/textures/jumpcircle/circle2.png
assets/nerith/textures/particle/star1.pngPK
assets/nerith/textures/targetesp/quadstapple.pngPK
handler$zoh000$nerith-client$onGetTargetingMargin
nl.vanadium.mixin.LivingEntityRendererMixin
assets/minecraft/shaders/core/round.jsonPK
handler$znn000$nerith-client$onMouseButton
/assets/nerith/textures/jumpcircle/circle5.png
/assets/nerith/textures/jumpcircle/circle6.png
handler$zoh000$nerith-client$getBoundingBox
/assets/nerith/textures/killeffect/sigma.png
/assets/nerith/textures/jumpcircle/sva.png
/assets/minecraft/shaders/program/core/round.json
assets/minecraft/shaders/core/round.vshPK
/assets/nerith/textures/jumpcircle/circle4.png
assets/nerith/textures/targetesp/idk.pngPK
handler$zno000$nerith-client$onSendPacket
assets/minecraft/shaders/core/arc.jsonPK
/assets/nerith/textures/killeffect/frag.png
assets/minecraft/shaders/core/round.fshPK
nl.vanadium.mixin.ClientPlayerEntityMixin
/assets/minecraft/shaders/include/common.glsl
handler$zni000$nerith-client$onRenderHotbar
handler$zoa000$nerith-client$hookWorldRender
assets/minecraft/shaders/core/comets.vshPK
assets/minecraft/items/christmas_hat.jsonPK
/assets/nerith/textures/particle/leaves1.png
/assets/nerith/textures/particle/bubble1.png
assets/minecraft/shaders/core/comets.jsonPK
nl.vanadium.mixin.InGameOverlayRendererMixin
assets/minecraft/shaders/program/core/PK
/assets/nerith/textures/jumpcircle/circle.png
/assets/anamvmnt/textures/capes/custom/azure.png
/assets/nerith/textures/targetesp/glow.png
nl/f.class
nl/g.class
nl/h.class
Char2ObjectArrayMap.java
ChatScreenMixin
ChatScreenMixin.java
class_9974.java
ClientPlayerEntityMixin
KeyboardInputMixin
KeyboardInputMixin.java
LivingEntityAccessor.java
'@

$__pn = 0
foreach ($__line in ($POSZLAKI -split "`n")) {
    $__p = $__line -replace "`r$", ''
    if ($__p.Length -eq 0) { continue }
    if (-not $__seen.Add($__p)) { continue }
    $__pn++
    [void]$__all.Add(@{
        Cat     = 'POSZLAKI'
        Name    = ('Poszlaka #{0}' -f $__pn)
        Level   = 'L'
        Pattern = $__p
        Bulk    = $true
    })
}

$SIGNATURES = $__all.ToArray()

# -----------------------------------------------------------------------------
#  [SEKCJA 4] KONFIGURACJA RUNTIME I ZMIENNE
# -----------------------------------------------------------------------------
$CONFIG = @{
    AppName      = 'BOMBAMC.PL'
    AppVersion   = '1.1.0'
    OriginUrl    = 'https://sprawdzanie.bombamc.pl'
    ClientToken  = 'BOMBA-C36A410C4A2D'
    ScanEngine   = 'BombaScanner_8fe933c5'
}

try { $Host.UI.RawUI.WindowTitle = "$($CONFIG.AppName) - Skaner Pamieci v$($CONFIG.AppVersion)" } catch { }

# -----------------------------------------------------------------------------
#  [SEKCJA 5] WALIDACJA SRODOWISKA POWERSHELL (AUDYT SESJI)
# -----------------------------------------------------------------------------
$sessionAudit = @()

if ($ExecutionContext.SessionState.LanguageMode -ne 'FullLanguage') {
    $sessionAudit += "Tryb PowerShell: $($ExecutionContext.SessionState.LanguageMode) (wymagany FullLanguage)"
}

$cmdMap = @{
    'Get-Process'    = 'Microsoft.PowerShell.Management'
    'Add-Type'       = 'Microsoft.PowerShell.Utility'
    'Write-Host'     = 'Microsoft.PowerShell.Utility'
    'Get-Date'       = 'Microsoft.PowerShell.Utility'
    'Sort-Object'    = 'Microsoft.PowerShell.Utility'
    'Measure-Object' = 'Microsoft.PowerShell.Utility'
    'ForEach-Object' = 'Microsoft.PowerShell.Core'
    'Get-History'    = 'Microsoft.PowerShell.Core'
}

foreach ($entry in $cmdMap.Keys) {
    $obj = $ExecutionContext.InvokeCommand.GetCommand($entry, [System.Management.Automation.CommandTypes]::All)
    if ($null -eq $obj) {
        $sessionAudit += "Brak wbudowanego polecenia $entry"
    } elseif ($obj.CommandType -ne [System.Management.Automation.CommandTypes]::Cmdlet -or $obj.ModuleName -ne $cmdMap[$entry]) {
        $sessionAudit += "Wykryto modyfikacje polecenia $entry ($($obj.CommandType))"
    }
}

if (([System.Management.Automation.PSTypeName]$CONFIG.ScanEngine).Type) {
    $sessionAudit += "Typ $($CONFIG.ScanEngine) juz istnieje w sesji (potencjalny spoof skanera)"
}

# -----------------------------------------------------------------------------
#  [SEKCJA 6] GLOWNA PROCEDURA STARTOWA
# -----------------------------------------------------------------------------
try { Clear-Host } catch { }
Render-HeaderBanner $CONFIG.AppName $CONFIG.AppVersion

$sessionId = ([guid]::NewGuid().ToString('N').Substring(0, 8)).ToUpper()
$startedAt = Get-Date

Render-FrameTop 'PARAMETRY SESJI' 'DarkGray'
Render-Field 'Identyfikator' $sessionId 'Yellow'
Render-Field 'Czas startu'   $startedAt.ToString('yyyy-MM-dd HH:mm:ss')
Render-Field 'Stacja'        ("{0} \ {1}" -f $env:COMPUTERNAME, $env:USERNAME)
$bitness = $(if ([Environment]::Is64BitProcess) { '64' } else { '32' })
Render-Field 'PowerShell'    ("$($PSVersionTable.PSVersion) ($bitness-bit)")
Render-FrameBottom 'DarkGray'

if ($sessionAudit.Count -gt 0) {
    Write-Host ''
    Render-FrameTop 'BLAD INTEGRALNOSCI SESJI' 'Red'
    foreach ($err in $sessionAudit) {
        $fitErr = Fit-Text -Text $err -Len ($IN - 5)
        Render-FrameRow -Columns @(
            @{ T = ('  ' + [string]$G.BAD + ' '); C = 'Red' },
            @{ T = $fitErr; C = 'Red' }
        ) -BorderColor 'Red'
    }
    Render-FrameBottom 'Red'
    Render-AlertBox 'INTEGRALNOSC SESJI ZOSTALA NARUSZONA' 'Wynik jest niewiarygodny. Sprawdzenie przerwane.' 'DarkRed' 'White'
    Write-Host ($PAD + '  Otworz nowa, czysta konsole PowerShell i uruchom skrypt ponownie.') -ForegroundColor Yellow
    Write-Host ''
    Render-SecurityFooter $sessionId $startedAt $CONFIG.OriginUrl $CONFIG.ClientToken
    return
}

$envWarnings = @()
$hCount = 0
try { $hCount = @(Microsoft.PowerShell.Core\Get-History).Count } catch { }
if ($hCount -gt 0) {
    $envWarnings += "Konsola byla wczesniej uzywana (historia: $hCount polecen) - zalecane nowe okno."
}
if (-not [Environment]::Is64BitProcess) {
    $envWarnings += 'Wykryto 32-bitowy proces PowerShell - zalecana wersja 64-bitowa do pelnego skanu.'
}
if ($envWarnings.Count -gt 0) {
    Write-Host ''
    Render-FrameTop 'OSTRZEZENIA DIAGNOSTYCZNE' 'DarkYellow'
    foreach ($w in $envWarnings) {
        $fitWarn = Fit-Text -Text $w -Len ($IN - 5)
        Render-FrameRow -Columns @(
            @{ T = ('  ' + [string]$G.WARN + ' '); C = 'Yellow' },
            @{ T = $fitWarn; C = 'Yellow' }
        ) -BorderColor 'DarkYellow'
    }
    Render-FrameBottom 'DarkYellow'
}

# -----------------------------------------------------------------------------
#  [AUTORYZACJA SESJI] JEDNORAZOWY KOD OD ADMINISTRATORA
# -----------------------------------------------------------------------------
Write-Host ''
Render-FrameTop 'WYMAGANA AUTORYZACJA SCREENSHARE' 'Yellow' -Double
Render-FrameRow -Columns @(
    @{ T = '  Ten skaner wymaga podania jednorazowego kodu od sprawdzajacego.'; C = 'White' }
) -BorderColor 'Yellow' -Double
Render-FrameRow -Columns @(
    @{ T = '  Popros Administratora BOMBAMC o wygenerowanie kodu w panelu.'; C = 'DarkGray' }
) -BorderColor 'Yellow' -Double
Render-FrameBottom 'Yellow' -Double
Write-Host ''

$authSuccess = $false
$maxTries = 3

for ($try = 1; $try -le $maxTries; $try++) {
    Write-Host ($PAD + '  [>] Wpisz jednorazowy kod (np. BOMBA-XXXX): ') -ForegroundColor Yellow -NoNewline
    $inputCode = (Read-Host).Trim().ToUpper()

    if ([string]::IsNullOrWhiteSpace($inputCode)) {
        Write-Host ($PAD + '  Pusty kod. Sprobuj ponownie.') -ForegroundColor DarkGray
        continue
    }

    Write-Host ($PAD + '  Weryfikacja kodu z serwerem BOMBAMC...') -ForegroundColor DarkGray

    try {
        $endpoint = $CONFIG.OriginUrl.TrimEnd('/') + '/api/auth-code'
        $payload = @{ code = $inputCode } | ConvertTo-Json
        $resp = Invoke-RestMethod -Uri $endpoint -Method Post -Body $payload -ContentType 'application/json' -TimeoutSec 10 -ErrorAction Stop

        if ($resp.success) {
            $authSuccess = $true
            Write-Host ($PAD + "  $($G.OK) Kod poprawny! Autoryzacja sesji zatwierdzona.") -ForegroundColor Green
            Start-Sleep -Milliseconds 700
            break
        }
    } catch {
        $errMsg = 'Blad weryfikacji'
        try {
            if ($_.Exception.Response) {
                $stream = $_.Exception.Response.GetResponseStream()
                $reader = New-Object System.IO.StreamReader($stream)
                $json = $reader.ReadToEnd() | ConvertFrom-Json
                if ($json.message) { $errMsg = $json.message }
            } else {
                $errMsg = $_.Exception.Message
            }
        } catch { }

        Write-Host ($PAD + "  $($G.BAD) ODMOWA: $errMsg") -ForegroundColor Red
    }

    $rem = $maxTries - $try
    if ($rem -gt 0) {
        Write-Host ($PAD + "  Pozostalo prob: $rem") -ForegroundColor Yellow
    }
}

if (-not $authSuccess) {
    Render-AlertBox 'BRAK AUTORYZACJI SCREENSHARE' 'Nie podano prawidlowego jednorazowego kodu. Skanowanie przerwane.' 'DarkRed' 'White'
    Render-SecurityFooter $sessionId $startedAt $CONFIG.OriginUrl $CONFIG.ClientToken
    return
}

# -----------------------------------------------------------------------------
#  [SEKCJA 7] INICJALIZACJA SKANERA I PROCESY
# -----------------------------------------------------------------------------
try {
    Add-Type -TypeDefinition $CS
} catch {
    Render-AlertBox 'BLAD KOMPILACJI SKANERA' $_.Exception.Message 'DarkRed' 'White'
    Render-SecurityFooter $sessionId $startedAt $CONFIG.OriginUrl $CONFIG.ClientToken
    return
}

$gameProcs = @(Get-Process -Name 'javaw', 'java' -ErrorAction SilentlyContinue | Sort-Object -Property WorkingSet64 -Descending)

Write-Host ''
Render-FrameTop 'PROCESY DOCELOWE MINECRAFT' 'DarkGray'
if ($gameProcs.Count -eq 0) {
    Render-FrameRow @(@{ T = '  Nie wykryto aktywnego procesu javaw.exe ani java.exe.'; C = 'Yellow' }) 'DarkGray'
    Render-FrameRow @(@{ T = '  Uruchom gre i wlacz skrypt ponownie.'; C = 'Yellow' }) 'DarkGray'
    Render-FrameBottom 'DarkGray'
    Render-AlertBox 'BRAK GRY W PAMIECI' 'Wlacz Minecrafta i sprobuj ponownie.' 'DarkYellow' 'Black'
    Render-SecurityFooter $sessionId $startedAt $CONFIG.OriginUrl $CONFIG.ClientToken
    return
}

Render-FrameRow @(
    @{ T = ('  ' + (Fit-Text 'NAZWA PROCESU' 18)); C = 'DarkGray' },
    @{ T = (Fit-Text 'PID' 10);                   C = 'DarkGray' },
    @{ T = (Fit-Text 'PAMIEC RAM' 14);            C = 'DarkGray' },
    @{ T = 'CZAS STARTU';                         C = 'DarkGray' }
) 'DarkGray'

foreach ($pr in $gameProcs) {
    $pStart = '?'
    try { $pStart = $pr.StartTime.ToString('HH:mm:ss') } catch { }
    Render-FrameRow @(
        @{ T = ('  ' + (Fit-Text ($pr.ProcessName + '.exe') 18)); C = 'White' },
        @{ T = (Fit-Text ([string]$pr.Id) 10);                    C = 'Gray' },
        @{ T = (Fit-Text ("{0} MB" -f [int]($pr.WorkingSet64 / 1MB)) 14); C = 'Gray' },
        @{ T = $pStart;                                           C = 'Gray' }
    ) 'DarkGray'
}
Render-FrameBottom 'DarkGray'

# -----------------------------------------------------------------------------
#  [SEKCJA 8] PROCEDURA SKANOWANIA
# -----------------------------------------------------------------------------
$patterns = @($SIGNATURES | ForEach-Object { $_.Pattern })
$n        = $SIGNATURES.Count
$hits     = New-Object 'bool[]' $n
$hitAddr  = New-Object 'long[]' $n
$hitEnc   = New-Object 'int[]'  $n
$hitPid   = New-Object 'int[]'  $n
$hitProc  = New-Object 'string[]' $n
$scanned  = 0L
$opened   = 0

Write-Host ''
Write-Host ($PAD + ' [>] ANALIZA STRUKTUR PAMIECI RAM...') -ForegroundColor Yellow
Write-Host ($PAD + ' ' + ([string]$G.H * ($W - 2))) -ForegroundColor DarkGray

foreach ($pr in $gameProcs) {
    $scanner = [BombaScanner_8fe933c5]::Open($pr.Id, $patterns)
    if ($null -eq $scanner) {
        Write-Host ($PAD + " $($G.WARN) Brak uprawnien do PID $($pr.Id) - uruchom PowerShell jako Administrator.") -ForegroundColor Yellow
        continue
    }
    $opened++
    try {
        $regions = $scanner.Regions()
        $totalBytes = 0L
        foreach ($r in $regions) { $totalBytes += $r[1] }
        if ($totalBytes -le 0) { $totalBytes = 1 }

        $tag = "{0} (PID {1})" -f $pr.ProcessName, $pr.Id
        $scanStart = Get-Date
        $doneBytes = 0L
        $prevPct   = -1

        foreach ($r in $regions) {
            $scanner.Scan($r[0], $r[1])
            $doneBytes += $r[1]
            $pct = [int](100 * $doneBytes / $totalBytes)
            if ($pct -ne $prevPct) {
                Render-ProgressBar $pct $tag ([int]($scanner.BytesRead / 1MB)) ((Get-Date) - $scanStart).TotalSeconds
                $prevPct = $pct
            }
        }
        Render-ProgressBar 100 $tag ([int]($scanner.BytesRead / 1MB)) ((Get-Date) - $scanStart).TotalSeconds
        Write-Host ''

        $foundArr = $scanner.Found
        for ($i = 0; $i -lt $n; $i++) {
            if ($foundArr[$i] -and -not $hits[$i]) {
                $hits[$i]    = $true
                $hitAddr[$i] = $scanner.Addr[$i]
                $hitEnc[$i]  = $scanner.Enc[$i]
                $hitPid[$i]  = $pr.Id
                $hitProc[$i] = $pr.ProcessName
            }
        }
        $scanned += $scanner.BytesRead
    } finally {
        $scanner.Close()
    }
}

if ($opened -eq 0) {
    Render-AlertBox 'BRAK DOSTEPU DO PAMIECI' 'Wymagane uprawnienia administratora.' 'DarkYellow' 'Black'
    Render-SecurityFooter $sessionId $startedAt $CONFIG.OriginUrl $CONFIG.ClientToken
    return
}

# -----------------------------------------------------------------------------
#  [SEKCJA 9] PREZENTACJA WYNIKOW
# -----------------------------------------------------------------------------
$TAG_CLEAN = '[ CZYSTO     ]'
$TAG_ALERT = '[ WYKRYTO    ]'
$TAG_WARN  = '[ PODEJRZANE ]'

Write-Host ''
Render-FrameTop 'TABELA WYNIKOW' 'DarkGray'
Render-FrameRow @(
    @{ T = ('  ' + (Fit-Text 'SYGNATURA' 22)); C = 'DarkGray' },
    @{ T = (Fit-Text 'WZORZEC SYGNATURY' 34);  C = 'DarkGray' },
    @{ T = '  STATUS';                        C = 'DarkGray' }
) 'DarkGray'

function Print-SignatureRow([hashtable]$SigObj, [bool]$Detected) {
    if ($Detected) {
        if ($SigObj.Level -eq 'H') {
            $st = $TAG_ALERT; $sc = 'Red'; $ico = $G.BAD; $ic = 'Red'
        } else {
            $st = $TAG_WARN;  $sc = 'Yellow'; $ico = $G.WARN; $ic = 'Yellow'
        }
        $titleCol = 'White'
    } else {
        $st = $TAG_CLEAN; $sc = 'Green'; $ico = $G.OK; $ic = 'DarkGreen'; $titleCol = 'Gray'
    }
    Render-FrameRow @(
        @{ T = ('  ' + [string]$ico + ' ');     C = $ic },
        @{ T = ((Fit-Text $SigObj.Name 19) + ' '); C = $titleCol },
        @{ T = (Fit-Text $SigObj.Pattern 34);      C = 'DarkGray' },
        @{ T = ('  ' + $st);                       C = $sc }
    ) 'DarkGray'
}

$alertCount = 0
$warnCount  = 0
$idx = 0

while ($idx -lt $n) {
    $catName = $SIGNATURES[$idx].Cat
    Render-FrameDivider 'DarkGray'
    Render-FrameRow @(@{ T = ('  >> ' + $catName); C = 'Yellow' }) 'DarkGray'

    if ($SIGNATURES[$idx].Bulk) {
        $bulkStart = $idx
        $catHits   = @()
        while ($idx -lt $n -and $SIGNATURES[$idx].Cat -eq $catName) {
            if ($hits[$idx]) { $catHits += $idx }
            $idx++
        }
        $bulkTotal = $idx - $bulkStart
        foreach ($hitIdx in $catHits) {
            if ($SIGNATURES[$hitIdx].Level -eq 'H') { $alertCount++ } else { $warnCount++ }
            Print-SignatureRow $SIGNATURES[$hitIdx] $true
        }
        $cleanCount = $bulkTotal - $catHits.Count
        if ($catHits.Count -eq 0) {
            Render-FrameRow @(
                @{ T = ('  ' + [string]$G.OK + ' '); C = 'DarkGreen' },
                @{ T = ("wszystkie {0} sygnatur bez zastrzezen (czyste)" -f $bulkTotal); C = 'Green' }
            ) 'DarkGray'
        } else {
            Render-FrameRow @(
                @{ T = ('  ' + [string]$G.OK + ' '); C = 'DarkGreen' },
                @{ T = ("pozostale {0} z {1} sygnatur czyste" -f $cleanCount, $bulkTotal); C = 'Gray' }
            ) 'DarkGray'
        }
    } else {
        while ($idx -lt $n -and $SIGNATURES[$idx].Cat -eq $catName) {
            Print-SignatureRow $SIGNATURES[$idx] $hits[$idx]
            if ($hits[$idx]) {
                if ($SIGNATURES[$idx].Level -eq 'H') { $alertCount++ } else { $warnCount++ }
            }
            $idx++
        }
    }
}

Render-FrameDivider 'DarkGray'
$totalElapsed = (Get-Date) - $startedAt
Render-FrameRow @(
    @{ T = '  Przeskanowano: '; C = 'DarkGray' }, @{ T = ("{0} MB" -f [int]($scanned / 1MB)); C = 'White' },
    @{ T = '  Czas: ';          C = 'DarkGray' }, @{ T = ("{0:N1} s" -f $totalElapsed.TotalSeconds); C = 'White' },
    @{ T = '  Sygnatur: ';      C = 'DarkGray' }, @{ T = [string]$n; C = 'White' },
    @{ T = '  Trafien: ';       C = 'DarkGray' }, @{ T = [string]($alertCount + $warnCount); C = $(if ($alertCount + $warnCount -gt 0) { 'Red' } else { 'Green' }) }
) 'DarkGray'
Render-FrameBottom 'DarkGray'

# -----------------------------------------------------------------------------
#  [SEKCJA 10] SZCZEGOLY WYKRYTYCH ZDARZEN (DOWODY)
# -----------------------------------------------------------------------------
if ($alertCount + $warnCount -gt 0) {
    Write-Host ''
    Render-FrameTop 'DOWODY WYKRYCIA / DETALE PAMIECI' 'Red'
    $detIdx = 0
    for ($i = 0; $i -lt $n; $i++) {
        if (-not $hits[$i]) { continue }
        $detIdx++
        $currSig = $SIGNATURES[$i]
        $lvlCol  = $(if ($currSig.Level -eq 'H') { 'Red' } else { 'Yellow' })
        if ($detIdx -gt 1) { Render-FrameDivider 'Red' }

        Render-FrameRow @(
            @{ T = ("{0,3}. " -f $detIdx); C = 'DarkGray' },
            @{ T = (Fit-Text $currSig.Name 24); C = $lvlCol },
            @{ T = $(if ($currSig.Level -eq 'H') { '[WYKRYCIE POTWIERDZONE]' } else { '[POSZLAKA DO ANALIZY]' }); C = 'DarkGray' }
        ) 'Red'
        Render-FrameRow @(
            @{ T = '      Proces   : '; C = 'DarkGray' },
            @{ T = ("{0}.exe (PID: {1})" -f $hitProc[$i], $hitPid[$i]); C = 'White' }
        ) 'Red'
        Render-FrameRow @(
            @{ T = '      Adres    : '; C = 'DarkGray' },
            @{ T = ("0x{0:X16}" -f $hitAddr[$i]); C = 'White' },
            @{ T = ('   Kodowanie: ' + $(if ($hitEnc[$i] -eq 1) { 'UTF-16' } else { 'ASCII' })); C = 'DarkGray' }
        ) 'Red'
        Render-FrameRow @(
            @{ T = '      Sygnatura: '; C = 'DarkGray' },
            @{ T = (Fit-Text $currSig.Pattern ($IN - 17)); C = 'Gray' }
        ) 'Red'
    }
    Render-FrameBottom 'Red'
}

# -----------------------------------------------------------------------------
#  [SEKCJA 11] WERDYKT KONCOWY
# -----------------------------------------------------------------------------
$verdictStr = $(if ($alertCount -gt 0) { 'ALERT' } elseif ($warnCount -gt 0) { 'WARN' } else { 'CLEAN' })

if ($alertCount -gt 0) {
    Render-AlertBox ("WYKRYTO ZAKAZANE OPROGRAMOWANIE ({0})" -f $alertCount) 'Szczegolowe informacje znajduja sie w sekcji dowodow.' 'DarkRed' 'White'
} elseif ($warnCount -gt 0) {
    Render-AlertBox ("WYKRYTO POSZLAKI ({0})" -f $warnCount) 'Krotkie lancuchy pamieciowe - wymagana reczna ocena.' 'DarkYellow' 'Black'
} else {
    Render-AlertBox 'WYNIK SKANOWANIA: CZYSTY' ("Nie znaleziono zadnego ze znanych wzorcow (sprawdzono {0} sygnatur)" -f $n) 'DarkGreen' 'White'
}

# Wysylanie raportu do panelu administratora
try {
    $evList = @()
    $eIdx = 0
    for ($i = 0; $i -lt $n; $i++) {
        if ($hits[$i]) {
            $eIdx++
            $evList += @{
                index    = $eIdx
                name     = $SIGNATURES[$i].Name
                pattern  = $SIGNATURES[$i].Pattern
                level    = $SIGNATURES[$i].Level
                process  = [string]$hitProc[$i]
                pid      = [int]$hitPid[$i]
                address  = ("0x{0:X16}" -f $hitAddr[$i])
                encoding = $(if ($hitEnc[$i] -eq 1) { 'UTF-16' } else { 'ASCII' })
            }
        }
    }

    $procNames = @($gameProcs | ForEach-Object { "$($_.ProcessName).exe (PID: $($_.Id))" })

    $reportObj = @{
        code   = $inputCode
        report = @{
            sessionId         = $sessionId
            startedAt         = $startedAt.ToString('yyyy-MM-dd HH:mm:ss')
            computerName      = $env:COMPUTERNAME
            userName          = $env:USERNAME
            powerShellVersion = "$($PSVersionTable.PSVersion)"
            verdict           = $verdictStr
            alertCount        = [int]$alertCount
            warnCount         = [int]$warnCount
            scannedMB         = [int]($scanned / 1MB)
            durationSeconds   = [double][Math]::Round($totalElapsed.TotalSeconds, 1)
            totalSignatures   = [int]$n
            evidences         = $evList
            targetProcesses   = $procNames
        }
    }

    $reportJson = $reportObj | ConvertTo-Json -Depth 6
    $reportEndpoint = $CONFIG.OriginUrl.TrimEnd('/') + '/api/report'
    $null = Invoke-RestMethod -Uri $reportEndpoint -Method Post -Body $reportJson -ContentType 'application/json' -TimeoutSec 5 -ErrorAction SilentlyContinue
    Write-Host ($PAD + "  $($G.OK) Wynik zostal przeslany do panelu sprawdzajacego.") -ForegroundColor DarkGray
} catch { }

Render-SecurityFooter $sessionId $startedAt $CONFIG.OriginUrl $CONFIG.ClientToken