#!/bin/bash
#===============================================================================
#
# DIRECTORY:
#   /home/*/.local/share/nautilus/scripts/05b-macOS/
# OR
#   /home/*/.gnome2/nautilus-sctipts/05b-macOS/ (deprecated)
#
# FILE:
#   01-E01-find-installation-and-version
#
# USAGE:
#   Right klick on an EWF image (.E01) and
#   choose this nautilus script from the context menu.
#
# OPTIONS:
#   none
#
# DESCRIPTION:
#   Shows/stores partition with macOS installation inkl. version.
#
# REQUIREMENTS:
#   bash, zenity, awk, sleuthkit, grep and (my own) print_plist_entry.py
#
# BUGS:
#   ---
#
# NOTES:
#   Tested on
#   - Debian 8+
#   - Arch Linux
#
# AUTHOR:
#   Patrick Neumann, patrick@neumannsland.de
#
# COMPANY:
#   (privately)
#
# VERSION:
#   0.9 (beta)
#
# LINK TO THE MOST CURRENT VERSIONS:
#   https://
#
# CREATED:
#   16.11.2020
#
# COPYRIGHT (C):
#   2015-2020 - Patrick Neumann
#
# LICENSE:
#   This program is free software: you can redistribute it and/or modify
#   it under the terms of the GNU General Public License as published by
#   the Free Software Foundation, either version 3 of the License, or
#   (at your option) any later version.
#
# WARRANTY:
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#   GNU General Public License for more details.
#
#   You should have received a copy of the GNU General Public License
#   along with this program. If not, see <http://www.gnu.org/licenses/>.
#
# TODO:
#   - ServerVersion.plist
#
# HISTORY:
#   0.9 - Patrick Neumann - Initial (public) release
#
#===============================================================================

#-------------------------------------------------------------------------------
# Additional supported Distribution(s) (add before Library!).
#-------------------------------------------------------------------------------
SUPPORTED_OSR="arch"

#-------------------------------------------------------------------------------
# Check for library (casualscripter_nautilus-scripts_functions.sh).
#-------------------------------------------------------------------------------
readonly LIBRARY="${0%/*/*}/.casualscripter_nautilus-scripts_functions.sh"
if [ ! -f "${LIBRARY}" ] ; then
  zenity --error \
         --text \
         "ERROR: casualscripter_nautilus-scripts_functions.sh MISSING!"
  exit 1
fi

source "${LIBRARY}"

#-------------------------------------------------------------------------------
# Checks (see library "casualscripter_nautilus-scripts_functions.sh").
#-------------------------------------------------------------------------------
check_dep "${AWK_BIN}" "awk"
check_dep "${FSSTAT_BIN}" "sleuthkit"
check_dep "${GREP_BIN}" "grep"
check_dep "${ICAT_BIN}" "sleuthkit"
check_dep "${IFIND_BIN}" "sleuthkit"
check_dep "${MMLS_BIN}" "sleuthkit"

# https://raw.githubusercontent.com/casualscripter/debian-stuff
check_dep "${PPEPY_BIN}" "print_plist_entry.py"

check_ext "${SOURCE}" "[eE]01"

check_tmp

#-------------------------------------------------------------------------------
# A little bit of configuration before the looping.
#-------------------------------------------------------------------------------
readonly SYSTEMVERSION_PLIST="${TMP}/SystemVersion.plist"
readonly MACOSVERSION="${TMP}/macOS-version.txt"

#-------------------------------------------------------------------------------
# "The" loop...
#-------------------------------------------------------------------------------
if [ ! -f "${MACOSVERSION}" ] ; then
  for offset in $( ${MMLS_BIN} -aM "${SOURCE}" \
                   | ${GREP_BIN} --extended-regexp "^[[:digit:]]+:.*" \
                   | ${AWK_BIN} '{ print $3; }' ) ; do

    echo -e -n "Partition (mmls line):\n  " >> "${MACOSVERSION}"
    ${MMLS_BIN} -aM "${SOURCE}" \
    | ${AWK_BIN} '$3=="'"${offset}"'" { print $0; }' \
    >> "${MACOSVERSION}"

    fsstat1="$( ${FSSTAT_BIN} -o "${offset}" "${SOURCE}" 2>/dev/null )"
    ${FSSTAT_BIN} -o "${offset}" "${SOURCE}"
    
    # if file system type is known = hfs+
    if [ -n "${fsstat1}" ] ; then
      # OS X and macOS (new)
      systemversion="$( ${IFIND_BIN} -o "${offset}" \
                                     -n "/System/Library/CoreServices/SystemVersion.plist" \
                                     "${SOURCE}" )"
      if [ "${systemversion}" = "File not found" ] ; then
        # Mac OS X (older)
        systemversion="$( ${IFIND_BIN} -o "${offset}" \
                                       -n "/System/CoreServices/SystemVersion.plist" \
                                       "${SOURCE}" )"
      fi
 
      if [ "${systemversion}" != "File not found" ] ; then
        if [ ! -f "${SYSTEMVERSION_PLIST}" ] ; then
          if ! ${ICAT_BIN} -o "${offset}" "${SOURCE}" "${systemversion}" > "${SYSTEMVERSION_PLIST}" ; then
            echo "During the execution of icat an error occurred." >> "${MACOSVERSION}"
          fi
        fi
        
        echo -n "  " >> "${MACOSVERSION}"
        ${PPEPY_BIN} "${SYSTEMVERSION_PLIST}" ProductName >> "${MACOSVERSION}"
        echo -n "  " >> "${MACOSVERSION}"
        ${PPEPY_BIN} "${SYSTEMVERSION_PLIST}" ProductVersion >> "${MACOSVERSION}"
        echo -n "  " >> "${MACOSVERSION}"
        ${PPEPY_BIN} "${SYSTEMVERSION_PLIST}" ProductBuildVersion >> "${MACOSVERSION}"
        echo >> "${MACOSVERSION}"

      else
        echo -e "  SystemVersion.plist not found.\n" >> "${MACOSVERSION}"
      fi

    else
      for block in $( ${PSTAT_BIN} -o "${offset}" "${SOURCE}" 2>/dev/null | ${AWK_BIN} '/APSB Block Number:/ { print $NF; }' ) ; do
        fsstat11="$( ${FSSTAT_BIN} -o "${offset}" -B "${block}" "${SOURCE}" 2>/dev/null )"
        # if file system type of a pool is known = apfs
        ### TODO: short info about part of container instead of partition
        if [ -n "${fsstat11}" ] ; then

          systemversion="$( ${IFIND_BIN} -o "${offset}" \
                                         -B "${block}" \
                                         -n "/System/Library/CoreServices/SystemVersion.plist" \
                                         "${SOURCE}" )"

          if [ "${systemversion}" != "File not found" ] ; then
            if [ ! -f "${SYSTEMVERSION_PLIST}" ] ; then
              if ! ${ICAT_BIN} -o "${offset}" -B "${block}" "${SOURCE}" "${systemversion}" > "${SYSTEMVERSION_PLIST}" ; then
                echo "During the execution of icat an error occurred." >> "${MACOSVERSION}"
              fi
            fi

            echo -n "  " >> "${MACOSVERSION}"
            ${PPEPY_BIN} "${SYSTEMVERSION_PLIST}" ProductName >> "${MACOSVERSION}"
            echo -n "  " >> "${MACOSVERSION}"
            ${PPEPY_BIN} "${SYSTEMVERSION_PLIST}" ProductVersion >> "${MACOSVERSION}"
            echo -n "  " >> "${MACOSVERSION}"
            ${PPEPY_BIN} "${SYSTEMVERSION_PLIST}" ProductBuildVersion >> "${MACOSVERSION}"
            echo >> "${MACOSVERSION}"

          else
            echo -e "  SystemVersion.plist not found.\n" >> "${MACOSVERSION}"
          fi

        else
          # file system is unknown! :-(
          echo -e "  ? (The Sleuth Kit does not support the filesystem!)\n" >> "${MACOSVERSION}"
        fi
      done
    fi
  done | ${ZENITY_BIN} --progress \
                       --title="find-installation-and-version" \
                       --text="Please wait..." \
                       --pulsate
fi

#-------------------------------------------------------------------------------
# Display content of the resultfile "macOS-version.txt".
#-------------------------------------------------------------------------------
display_resultfile "${MACOSVERSION}"

exit 0
