import utils


def PrintFamilyReport(familyDir):
    print("familyDirPath: " + familyDir.familyDirPath)

    sha256List = []
    walletAccessDeniedOccurrence = 0
    for sampleDir in familyDir.sampleDirList:
        sha256List.append(sampleDir.sha256)
        if 0 < sampleDir.cntWalletAccessDenied:
            walletAccessDeniedOccurrence += 1

    print("Total samplDirs: " + str(len(familyDir.sampleDirList)))
    print("walletAccessDeniedOccurrence: " + str(walletAccessDeniedOccurrence))
    print("Total distinct samples (no dupes): " + str(len(set(sha256List))))


################################## FilesystemMon Wrappers ##################################
def extractPid(line):
    pid = utils.extractStringBetween(line, "processId: ", " ")
    if pid == "":
        pid = utils.extractStringBetween(line, "procId: ", " |")
    if pid == "":
        pid = utils.extractStringBetween(line, "processId: ", "")[:-1] #cut newline

    return pid

def extractParentPid(line):
    return utils.extractStringBetween(line, "parentProcId: ", " |")

def extractProcessPath(line):
    return utils.extractStringBetween(line, "procImagePath: ", " |")

def extractParentProcessPath(line):
    return utils.extractStringBetween(line,"parentImagePath: ", "")

def extractFilePath(line):
    return utils.extractStringBetween(line, "filePath: ", "")[:-1] #cut newline

##################################################################
#combine with: isProcessCreate or isProcessTerminate
##################################################################

#get crashed PID with:
#get crashed ProcessPath with:
def isCrash(line):
    if utils.stringContainsAllSubstrings(line, ["CREATE PROCESS","procImagePath: \Device\HarddiskVolume2\Windows\SysWOW64\WerFault.exe |"]):
        return True
    return False

def isInitialSampleProcessCreated(line):
    if utils.stringContainsAllSubstrings(line, ["CREATE PROCESS",
                                                 "procImagePath: \\Device\\HarddiskVolume2\\Users\\user\\Desktop\\mysecureapplication.exe",
                                                 "parentImagePath: \\Device\\HarddiskVolume2\\PathTools\\PsExec.exe"]):
        return True
    return False

def isProcessCreate(line):
    if line.find("CREATE PROCESS") != -1:
        return True
    return False

def isProcessTerminate(line):
    if line.find("TERMINATE PROCESS") != -1:
        return True
    return False

def isIrpFileOpen(line):
    if line.find("IRP_MJ_CREATE") != -1:
        return True
    return False

def isIrpFileRead(line):
    if line.find("IRP_MJ_READ") != -1:
        return True
    return False

def isIrpFileWrite(line):
    if line.find("IRP_MJ_WRITE") != -1:
        return True
    return False

################################## WalletProtectionMiniFilter Wrappers ##################################

def extractWalletPath(line):
    return utils.extractStringBetween(line, "Wallet Path: ", "")[:-1]

def extractImageName(line):
    return utils.extractStringBetween(line, "imageName: ", "")[:-1]

def isAccessDenied(line):
    if line.find("Access denied") != -1:
        return True
    return False

def isAccessApproved(line):
    if line.find("Access approved") != -1:
        return True
    return False

################################## ClipboardHijackingProtectionMainThreadLog Wrappers ##################################



def isHijackerDetected(line):
    if line.find("Clipboard Hijacker detected") != -1:
        return True
    return False

def extractHijackerPid(line):
    return utils.extractStringBetween(line, "PID: ", "")

# only call this if PID is not 0
def extractHijackerProcessPath(line):
    return utils.extractStringBetween(line, "ProcessImagePath: ", "")

################################## HttpTrafficLog Wrappers ##################################

def extractContentLength(line):
    contentLength = utils.extractStringBetween(line, "Content-Length: ", "")
    if contentLength == "":
        contentLength = utils.extractStringBetween(line, "content-length: ", "")
    return int(contentLength)
