#!/usr/bin/env python3
"""Dump typed_count / visit_count from the Chrome History DB to prove poisoning."""
import sqlite3, sys, os

profile = sys.argv[1] if len(sys.argv) > 1 else "/tmp/chrome-poc-profile"
db = os.path.join(profile, "Default", "History")
print("History DB:", db)
# Copy DB + sidecar files so we can read it even if Chrome left a lock.
import shutil, tempfile
tmp = tempfile.mkdtemp()
for ext in ("", "-wal", "-shm", "-journal"):
    src = db + ext
    if os.path.exists(src):
        shutil.copy(src, os.path.join(tmp, "History" + ext))
con = sqlite3.connect(os.path.join(tmp, "History"))
cur = con.cursor()

print("\n=== urls table (url, visit_count, typed_count, hidden) ===")
for row in cur.execute(
    "SELECT url, visit_count, typed_count, hidden FROM urls ORDER BY url"):
    print("  %-50s visit=%d typed=%d hidden=%d" % row)

print("\n=== segments / segment_usage ===")
try:
    for row in cur.execute(
        "SELECT s.name, SUM(su.visit_count) FROM segments s "
        "LEFT JOIN segment_usage su ON su.segment_id = s.id GROUP BY s.id"):
        print("  segment=%-40s usage=%s" % row)
except sqlite3.OperationalError as e:
    print("  (segments query failed: %s)" % e)

print("\n=== visits for goog1e-login (transition decoded) ===")
CORE = {0:"LINK",1:"TYPED",2:"AUTO_BOOKMARK",3:"AUTO_SUBFRAME",4:"MANUAL_SUBFRAME",
        5:"GENERATED",6:"AUTO_TOPLEVEL",7:"FORM_SUBMIT",8:"RELOAD",9:"KEYWORD",
        10:"KEYWORD_GENERATED"}
QUAL = [(0x01000000,"FORWARD_BACK"),(0x02000000,"FROM_ADDRESS_BAR"),
        (0x04000000,"HOME_PAGE"),(0x08000000,"FROM_API"),
        (0x10000000,"CHAIN_START"),(0x20000000,"CHAIN_END"),
        (0x40000000,"CLIENT_REDIRECT"),(0x80000000,"SERVER_REDIRECT")]
for url, tr, inc in cur.execute(
    "SELECT u.url, v.transition, v.incremented_omnibox_typed_score "
    "FROM visits v JOIN urls u ON u.id=v.url "
    "WHERE u.url LIKE '%goog1e%' OR u.url LIKE '%127.0.0.1%/ok%' "
    "ORDER BY v.id"):
    tr &= 0xFFFFFFFF
    core = CORE.get(tr & 0xFF, "?")
    quals = "|".join(n for b,n in QUAL if tr & b)
    print("  %-45s 0x%08x %s|%s typed_inc=%d" % (url, tr, core, quals, inc))

# Verdict
row = cur.execute(
    "SELECT typed_count FROM urls WHERE url LIKE '%goog1e-login.com%/r'").fetchone()
phish_typed = row[0] if row else 0
row = cur.execute(
    "SELECT COALESCE(SUM(typed_count),0) FROM urls WHERE url LIKE '%127.0.0.1%'").fetchone()
ip_typed = row[0]

print("\n=== VERDICT ===")
print("  goog1e-login.com/r typed_count = %d" % phish_typed)
print("  127.0.0.1 (all)    typed_count = %d" % ip_typed)
if phish_typed >= 2 and ip_typed == 0:
    print("  >>> BUG CONFIRMED: web-driven LINK navigations forged typed_count "
          "on the phishing domain via IP-literal redirect tail.")
    sys.exit(0)
else:
    print("  >>> NOT CONFIRMED")
    sys.exit(1)