import urllib.request
import json
import time
from datetime import datetime, timezone
from collections import Counter
from colorama import init, Fore, Back, Style

init(autoreset=True)

# === CONFIG ===
START_TXID = "88617a44b501b2aa2ed1001a94fccbafb126578c5c2e696b20ae91dcc2a93e0a"
API_BASE = "https://mempool.space/api"
HEADERS = {"User-Agent": "Mozilla/5.0"}


def fetch_json(url):
    for _ in range(3):
        try:
            req = urllib.request.Request(url, headers=HEADERS)
            with urllib.request.urlopen(req, timeout=15) as response:
                return json.loads(response.read().decode())
        except:
            time.sleep(1)
    return None


def find_spending_tx(address, txid, vout_index):
    """Trace the next hop by looking for the input spending this specific UTXO."""
    txs = fetch_json(f"{API_BASE}/address/{address}/txs")
    if not txs:
        return None
    for tx in txs:
        for vin in tx.get("vin", []):
            if vin.get("txid") == txid and vin.get("vout") == vout_index:
                return tx.get("txid")
    return None


def print_hop(step, txid, date, outputs_info, next_tx):
    """Print each hop in a tree structure"""
    print(f"\n{Fore.BLUE}{Style.BRIGHT}[Hop #{step:02d}]{Style.RESET_ALL} {Fore.GREEN}{Style.BRIGHT}{date}")
    print(f" ╰─ Transaction: {Fore.WHITE}{Style.BRIGHT}{txid}")

    for i, out in enumerate(outputs_info):
        is_last = i == len(outputs_info) - 1
        branch = "├──" if not is_last else "└──"

        role_color = Fore.YELLOW if out["role"] == "CHANGE" else Fore.MAGENTA
        print(f"    {branch} [{role_color}{Style.BRIGHT}{out['role']}{Style.RESET_ALL}] {out['value']:>10.4f} BTC")
        print(f"    {' ' if is_last else '│'}   Destination: {out['addr']}")

        if out["role"] == "CHANGE" and next_tx:
            print(f"    {' ' if is_last else '│'}   {Fore.CYAN}{Style.BRIGHT}>>> {next_tx}")


current_txid = START_TXID
step = 1
peel_history = []

print("\n" + " " * 20 + f"{Back.BLUE}{Fore.WHITE}{Style.BRIGHT} BLOCKCHAIN FORENSIC: PEEL CHAIN ANALYSIS ")

while current_txid:
    tx_data = fetch_json(f"{API_BASE}/tx/{current_txid}")
    if not tx_data:
        break

    block_time = tx_data["status"].get("block_time")
    dt_str = (
        datetime.fromtimestamp(block_time, timezone.utc).strftime("%Y-%m-%d")
        if block_time
        else "Unconfirmed"
    )

    vouts = tx_data.get("vout", [])
    max_val = max(out.get("value", 0) for out in vouts)

    outputs_summary = []
    next_hop = None

    for i, out in enumerate(vouts):
        addr = out.get("scriptpubkey_address", "Unknown")
        val = out.get("value", 0) / 1e8

        role = "CHANGE" if out.get("value", 0) == max_val else "PEEL"
        spender = find_spending_tx(addr, current_txid, i)

        if role == "CHANGE" and spender:
            next_hop = spender

        if role == "PEEL":
            peel_history.append({"txid": current_txid, "date": dt_str, "address": addr, "value": val})

        outputs_summary.append({"role": role, "value": val, "addr": addr})

    print_hop(step, current_txid, dt_str, outputs_summary, next_hop)

    if next_hop:
        current_txid = next_hop
        step += 1
        time.sleep(0.3)
    else:
        break

print("\n" + " " * 21 + f"{Back.WHITE}{Fore.BLACK}{Style.BRIGHT} FORENSIC SUMMARY AND ANALYSIS RESULTS ")

destinations = [p["address"] for p in peel_history]
if destinations:
    most_common_addr = Counter(destinations).most_common(1)[0][0]

    last_tx_to_target = None
    for p in reversed(peel_history):
        if p["address"] == most_common_addr:
            last_tx_to_target = p
            break

    total_peeled = sum(p["value"] for p in peel_history if p["address"] == most_common_addr)

    print(f"[*] Analysis of Peel Pattern:")
    print(f"    - Primary Target Address: {most_common_addr}")
    print(f"    - Total Funds Peeled:    {total_peeled:.4f} BTC")
    print(f"    - Frequency:             {destinations.count(most_common_addr)} times in this chain")

    print(f"\n[*] The last traceable transaction related to this crypto peeling chain is:")
    print(f"    {Fore.GREEN}{Style.BRIGHT}TXID: {last_tx_to_target['txid']}")
    print(f"    {Fore.GREEN}{Style.BRIGHT}Date: {last_tx_to_target['date']}")

    flag_date = datetime.strptime(last_tx_to_target["date"], "%Y-%m-%d").strftime("%m/%d/%Y")
    print(f"\n[!] Suggested Flag Components:")
    print(f"    Hash:     {last_tx_to_target['txid']}")
    print(f"    Date:     {flag_date}")
else:
    print("[!] No systematic peel behavior detected.")

from Crypto.Cipher import ChaCha20

key = bytes.fromhex("FACDF7458D8483B214197A7245AAD45C4FF297E4B90293027234E3C35DEA9069")
nonce = b"meow-warez:3"

cipher = ChaCha20.new(key=key, nonce=nonce)

payloads = [
    "fa0c",
    "9d9a9df41db7a363727adc8c9a3f4cc36e231754a17b6a780ac603deafde8849be3443287ad330",
    "b1dd93",
    "9464",
    "3fab20aaef1831d34fe92c95b67983",
    "7a76c9b15a758caeb724a90359395fd9dc21f965bce3f43e21b3fd0f244c84363b7184239e52ec6b7695663a7702e18268b03cb6c6d39dddd1ce66a4f05a88d98a62ecb387bdf0cb050e7234d7cd9fd0bbf7c55124563f0a164e4b4e599f19fb47b6852edca9c4619a0072f135245d005c76adfea9f1d4a3b64e38a30af6df168bc63aad535b55d2ad42ad1e9277848e5ef75c0e6dc9c652f281eb3395d140f9b0718e19a7505d2df6bd5e60ea020a8e1b2e0be26c4b69bc545ca108243fb5139638d27c6126ab5b849ac42a8a4c2679c9759adfffefb8067f0e16af8dc38474274906063e22c24265d86bc8392fc72a3af67908aef6a697b4685263dee35695b14dd6875cf513a85d50a5c0332ef3bb6c44ba597db767273eb0f4b3274aee885d4ee91f1da12407f1b866b49fa0f877f17d446aaba87ade9a3c722781475f80b11f6b0d5f5ca963822c35e093fe199a162cab396f437dc88ee600fff448d6258ec2ee07ae3bdae5aed393ec6b623bfae7198fbc784f62a1c53b51c6ce9d89d956dc04e099aaa7238116e8f97fd70c172b8225191b3f552d8f750b77b155f8f3a23a37a3000e77f78594ea8597221b2e3c825b5f6fd51e533c87d7521053234b1e70b7921bf48d2846dbb365e7505a9239b5a25c03ee693428ca75fdaf4b02c447b586ad6b112a3dd0b82df6a4902e00f3f6e4c085776c0683b1d60d1c3bd31e5ae2ec2a4cddaabaf23ae4d232b9a84a2a57afb79d81c4f88cbe9f7a5baf1ed0617f9e56895561d0ed1b9840c763e594adf0579f3e162168d5dbd479b00bbeea51091c9cbab405dfdeb1afac3dc0cf6b5140b9f63c6874997f238fcfb46097196247007c3727ab8ddc6ad85a1464bf2054bc05260daa7ffadf55659c70c905170331264dd197e0741514785137",
    "00121c58f60d6e0cd4c7193546ca68d8e71cf7c6d73128b2141bb1cf5544420cd00667b9808ee450964212553218eb044e74c08c5c073f6efaed585d4277fbcc8ef198f1a818bd95d83ab9",
    "5d5c0ab782f4c58882ff02dd82",
    "edfd02cefbef7c35366f213d1a2a7761142adb2361f09ed46497ec7c2901de9491a2eb3d7945b604d5ca7c5af714c4179a3d8c88449aecd6d3d9fb2a2c294c6ec519a0cfa677d2514f5419cf26946a3ee6d590bc19431ebfe6ca1a7ccb8877013f12a33997689f9d598d96f8f024acb5639726f0db7b420dea78f62145da2327d25dd4f491d447b5325d649bbb962a09cff4d4a4d337af0d234104b09e8eb810660ed588cf901f27d9468a3dc6d9ca01ca77830b451fd291d6794b0c4afd542307e96528be50d6cdd946f89200b743724ab2aa4552cfb79da00285a1e760cc955b061834c7a2a67568f1fb55122953f357285c421a22dbb015c1b9e93799bf1c3e3cd7d27d0c23e8a4317773fc8216c8d65921e11b3bd93ef8452e95a322f5a9fbbcd11497d8c4f1d46f453901296e5d2cff2be9e05b12729439dfee2a125ab7ae43bbcd3bfc285aaf2e704bc92b6c97ec3a902f2955fe8666f4dc62d9fbc243fd5c55513f529a6580b6bbc115897e367b1d137fc17c7799811fe6e57397a34016989ec7b909161e4f7b315d103ec9ffa8f81deaec170734f074f7a380741ed35cd603789a0fde8c9303307ae8f3395fb260b35d254639066cda00d0dd9f12765bc936d3f0dbba401f1efdbd385af8f1",
    "ce3f001be699efd0b2703dae23f0b81f69a4664ae82ab2708187da90c88bfd7502",
    "8d9a033b7730a01c8bd227e3feb1b10b136174ce821ef4f31b8f037a47d812ccf4b3524bfde32142f814d5a11e3b39d794df297480fb0cbe08efde67c8",
    "aaafb853a4933bfd5fe7b2c08a15ef4afef96d9f26",
    "11a8b1c5f23855d56684f503ce1742d22cd6887feb23d0d11ef7807a6b6d89d937bd4390f4d945c45919b56cf2c3ca417a454bc406787dea48465ca15644fb1ee35d5a55b2",
    "80f765d211969582bbf3d6441218",
    "8b9166c15951479ae07245ec8a50f9",
    "62e8c86a"
]

for i, p in enumerate(payloads):
    dec = cipher.decrypt(bytes.fromhex(p))
    print(dec.decode('utf-8', errors='ignore'))

import Evtx.Evtx as evtx

input = "Challenge.evtx"
output = "Challenge.xml"

with open(output, 'w', encoding='utf-8') as f_out:
    f_out.write('<?xml version="1.0" encoding="utf-8"?>\n')
    f_out.write('<Events>\n')

    with evtx.Evtx(input) as log:
        count = 0
        for record in log.records():
            f_out.write(record.xml() + '\n')
            count += 1