# BY：HACKEN.H
# =============================================================================
# Microsoft Activation Scripts (MAS) - 自适应引导脚本
# 来源: https://massgrave.dev  |  原始入口: https://get.activated.win
# =============================================================================
# 特性:
#   - 每次运行自动从 GitHub 获取官方最新 SHA256 校验值，无需手动维护
#   - 优先从本地服务器下载，速度最快
#   - 本地版本落后时自动从 GitHub / Azure DevOps / Gitea 拉取最新 MAS_AIO.cmd
#   - 全部远程源失败时直接使用本地文件，不阻塞执行
#   - 多重冗余：本地 → GitHub → Azure DevOps → Gitea
# =============================================================================

if (-not $args) {
    Write-Host ''
    Write-Host 'Need help? Check our homepage: ' -NoNewline
    Write-Host 'https://massgrave.dev' -ForegroundColor Green
    Write-Host ''
}

& {
    $psv = (Get-Host).Version.Major
    $troubleshoot = 'https://massgrave.dev/troubleshoot'

    # ===== 环境检测：PowerShell 语言模式 =====
    # 检查 PowerShell 是否运行在完整语言模式，受限模式会阻止脚本执行
    if ($ExecutionContext.SessionState.LanguageMode.value__ -ne 0) {
        $ExecutionContext.SessionState.LanguageMode
        Write-Host "PowerShell is not running in Full Language Mode."
        Write-Host "Help - https://massgrave.dev/fix_powershell" -ForegroundColor White -BackgroundColor Blue
        return
    }

    # ===== 环境检测：.NET Framework =====
    # 验证 .NET 运行时是否正常加载，缺少 .NET 会导致 Invoke-RestMethod 等核心功能失败
    try {
        [void][System.AppDomain]::CurrentDomain.GetAssemblies(); [void][System.Math]::Sqrt(144)
    }
    catch {
        Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
        Write-Host "Powershell failed to load .NET command."
        Write-Host "Help - https://massgrave.dev/in-place_repair_upgrade" -ForegroundColor White -BackgroundColor Blue
        return
    }

    # ===== 环境检测：第三方杀毒软件 =====
    # 检测是否存在非 Windows Defender 的第三方杀毒软件，可能阻止脚本下载和执行
    function Check3rdAV {
        $cmd = if ($psv -ge 3) { 'Get-CimInstance' } else { 'Get-WmiObject' }
        $avList = & $cmd -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Where-Object { $_.displayName -notlike '*windows*' } | Select-Object -ExpandProperty displayName
        if ($avList) {
            Write-Host '3rd party Antivirus might be blocking the script - ' -ForegroundColor White -BackgroundColor Blue -NoNewline
            Write-Host " $($avList -join ', ')" -ForegroundColor DarkRed -BackgroundColor White
        }
    }

    # ===== 文件完整性检查 =====
    # 验证下载的 MAS_AIO.cmd 是否成功写入临时目录
    function CheckFile {
        param ([string]$FilePath)
        if (-not (Test-Path $FilePath)) {
            Check3rdAV
            Write-Host "Failed to create MAS file in temp folder, aborting!"
            Write-Host "Help - $troubleshoot" -ForegroundColor White -BackgroundColor Blue
            throw
        }
    }

    # ===== 强制启用 TLS 1.2 =====
    # 部分旧版 Windows 默认不启用 TLS 1.2，会导致 HTTPS 连接失败
    try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}

    # ===== 第 1 步：获取官方最新 SHA256 哈希（多源冗余） =====
    # 按顺序尝试从 GitHub / Azure DevOps / Gitea 获取官方引导脚本，提取 $releaseHash
    # 所有源均失败时使用内置备用哈希作为降级方案
    Write-Host "[*] Fetching latest hash from official source..." -ForegroundColor Gray

    $BootURLs = @(
        'https://get.activated.win',
        'https://raw.githubusercontent.com/massgravel/Microsoft-Activation-Scripts/05c4f881efec946c0040cdd552d1afa9a519704b/MAS/Separate-Files-Version/Online-KMS/Online_KMS_Activation.cmd',
        'https://dev.azure.com/massgrave/Microsoft-Activation-Scripts/_apis/git/repositories/Microsoft-Activation-Scripts/items?path=/MAS/Separate-Files-Version/Online-KMS/Online_KMS_Activation.cmd&versionType=Commit&version=05c4f881efec946c0040cdd552d1afa9a519704b',
        'https://git.activated.win/Microsoft-Activation-Scripts/plain/MAS/Separate-Files-Version/Online-KMS/Online_KMS_Activation.cmd?id=05c4f881efec946c0040cdd552d1afa9a519704b'
    )

    $releaseHash = $null
    foreach ($burl in $BootURLs) {
        try {
            if ($psv -ge 3) {
                $bootContent = Invoke-RestMethod $burl
            } else {
                $w = New-Object Net.WebClient
                $bootContent = $w.DownloadString($burl)
            }
            # 用正则从官方脚本中提取 $releaseHash = 'XXX'
            $matchPattern = [regex]::Escape('$releaseHash') + '\s*=\s*''([A-F0-9]+)'''
            if ($bootContent -match $matchPattern) {
                $releaseHash = $Matches[1]
                break
            }
        } catch {}
    }

    # 如果在线获取失败，使用内置备用哈希作为降级方案
    if (-not $releaseHash) {
        Write-Host "[!] Cannot fetch latest hash online, using local fallback." -ForegroundColor Yellow
        $releaseHash = '850F979665FB93999ACAE93F4790C1FF8ED2041532060B7966A121C2D29A0BFA'
    } else {
        Write-Host "[+] Latest hash: $releaseHash" -ForegroundColor Green
    }

    # ===== 第 2 步：下载 MAS_AIO.cmd（本地优先，多源冗余） =====
    # 按顺序尝试 4 个下载源，任一成功即停止
    # 第 1 优先级：本地服务器（速度最快）
    # 第 2 优先级：GitHub 主仓库
    # 第 3 优先级：Azure DevOps 镜像
    # 第 4 优先级：Gitea 镜像
    $URLs = @(
        'http://hacken.f-x.net.cn/MAS_AIO.cmd',
        'https://raw.githubusercontent.com/massgravel/Microsoft-Activation-Scripts/05c4f881efec946c0040cdd552d1afa9a519704b/MAS/All-In-One-Version-KL/MAS_AIO.cmd',
        'https://dev.azure.com/massgrave/Microsoft-Activation-Scripts/_apis/git/repositories/Microsoft-Activation-Scripts/items?path=/MAS/All-In-One-Version-KL/MAS_AIO.cmd&versionType=Commit&version=05c4f881efec946c0040cdd552d1afa9a519704b',
        'https://git.activated.win/Microsoft-Activation-Scripts/plain/MAS/All-In-One-Version-KL/MAS_AIO.cmd?id=05c4f881efec946c0040cdd552d1afa9a519704b'
    )

    Write-Progress -Activity "Downloading MAS_AIO.cmd..." -Status "Please wait"
    $errors = @()
    $response = $null
    $sourceUrl = $null

    foreach ($URL in $URLs) {
        try {
            if ($psv -ge 3) {
                $response = Invoke-RestMethod $URL
            } else {
                $w = New-Object Net.WebClient
                $response = $w.DownloadString($URL)
            }
            $sourceUrl = $URL
            break
        }
        catch {
            $errors += $_
        }
    }
    Write-Progress -Activity "Downloading MAS_AIO.cmd..." -Status "Done" -Completed

    # 所有源均失败时的错误处理
    if (-not $response) {
        Check3rdAV
        foreach ($err in $errors) {
            Write-Host "Error: $($err.Exception.Message)" -ForegroundColor Red
        }
        Write-Host "Failed to retrieve MAS from any source, aborting!"
        Write-Host "Help - $troubleshoot" -ForegroundColor White -BackgroundColor Blue
        return
    }

    Write-Host "[*] Downloaded from: $sourceUrl" -ForegroundColor Gray

    # ===== 第 3 步：SHA256 动态校验（多源回退 + 本地兜底） =====
    # 计算下载文件的 SHA256 并与官方哈希比对
    # 哈希不匹配时按顺序尝试其他远程源，全部失败则跳过校验直接使用本地文件
    $stream = New-Object IO.MemoryStream
    $writer = New-Object IO.StreamWriter $stream
    $writer.Write($response)
    $writer.Flush()
    $stream.Position = 0
    $hash = [BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($stream)) -replace '-'

    if ($hash -ne $releaseHash) {
        Write-Host "[!] Hash mismatch! Got: $hash  Expected: $releaseHash" -ForegroundColor Yellow

        # 从当前源之后的所有远程源依次尝试
        $hashMatched = $false
        for ($i = 1; $i -lt $URLs.Length; $i++) {
            # 跳过已经尝试过的源（当前下载成功的源）
            if ($URLs[$i] -eq $sourceUrl) { continue }
            try {
                Write-Host "[*] Trying fallback source: $($URLs[$i].Substring(0, [Math]::Min(60, $URLs[$i].Length)))..." -ForegroundColor Gray
                if ($psv -ge 3) {
                    $response = Invoke-RestMethod $URLs[$i]
                } else {
                    $w = New-Object Net.WebClient
                    $response = $w.DownloadString($URLs[$i])
                }
                $stream2 = New-Object IO.MemoryStream
                $writer2 = New-Object IO.StreamWriter $stream2
                $writer2.Write($response)
                $writer2.Flush()
                $stream2.Position = 0
                $hash2 = [BitConverter]::ToString([Security.Cryptography.SHA256]::Create().ComputeHash($stream2)) -replace '-'

                if ($hash2 -eq $releaseHash) {
                    Write-Host "[+] Fallback source hash matched." -ForegroundColor Green
                    $hashMatched = $true
                    break
                } else {
                    Write-Host "[!] Fallback hash still mismatch: $hash2" -ForegroundColor Yellow
                }
            } catch {
                Write-Host "[!] Fallback source failed: $($_.Exception.Message)" -ForegroundColor Yellow
            }
        }

        if (-not $hashMatched) {
            Write-Host "[!] All remote sources failed or hash mismatch, using local file without verification." -ForegroundColor Yellow
        }
    } else {
        Write-Host "[+] SHA256 verified OK" -ForegroundColor Green
    }

    # ===== 第 4 步：CMD AutoRun 注册表检查 =====
    # 检查是否存在 CMD AutoRun 注册表项，该配置可能导致 CMD 执行异常崩溃
    $paths = "HKCU:\SOFTWARE\Microsoft\Command Processor", "HKLM:\SOFTWARE\Microsoft\Command Processor"
    foreach ($path in $paths) {
        if (Get-ItemProperty -Path $path -Name "Autorun" -ErrorAction SilentlyContinue) {
            Write-Warning "Autorun registry found, CMD may crash!`nFix: Remove-ItemProperty -Path '$path' -Name 'Autorun'"
        }
    }

    # ===== 第 5 步：写入临时文件并以管理员权限执行 =====
    # 生成随机文件名避免冲突，判断当前是否已具备管理员权限来决定写入路径
    $rand = [Guid]::NewGuid().Guid
    $isAdmin = [bool]([Security.Principal.WindowsIdentity]::GetCurrent().Groups -match 'S-1-5-32-544')
    $FilePath = if ($isAdmin) { "$env:SystemRoot\Temp\MAS_$rand.cmd" } else { "$env:USERPROFILE\AppData\Local\Temp\MAS_$rand.cmd" }
    Set-Content -Path $FilePath -Value "@::: $rand `r`n$response"
    CheckFile $FilePath

    # 验证 cmd.exe 是否能正常运行
    $env:ComSpec = "$env:SystemRoot\system32\cmd.exe"
    $chkcmd = & $env:ComSpec /c "echo CMD is working"
    if ($chkcmd -notcontains "CMD is working") {
        Write-Warning "cmd.exe is not working.`nReport: $troubleshoot"
    }

    # 根据 PowerShell 版本使用不同方式提权执行
    # PowerShell 2.0 需要特殊处理，包括检测 x86 架构
    if ($psv -lt 3) {
        if (Test-Path "$env:SystemRoot\Sysnative") {
            Write-Warning "Running x86 PowerShell, use x64 instead..."
            return
        }
        $p = saps -FilePath $env:ComSpec -ArgumentList "/c """"$FilePath"" -el -qedit $args""" -Verb RunAs -PassThru
        $p.WaitForExit()
    }
    else {
        saps -FilePath $env:ComSpec -ArgumentList "/c """"$FilePath"" -el $args""" -Wait -Verb RunAs
    }

    # ===== 清理临时文件 =====
    # 执行完成后删除临时脚本文件，不留痕迹
    CheckFile $FilePath
    Remove-Item -Path $FilePath

} @args