#!/usr/local/bin/perl

my $activator_cache = "/var/mobile/Library/Caches/libactivator.plist";
my @files = qw< /--early-boot /var/root/test.app /private/var/tmp/crw /private/var/tmp/cr /private/var/tmp/st_data >;
my @found = ();

if($ARGV[0]){
    init();
    exit;
}


sub init_activator {
    unless(`activator get LAMessageListeners`){
        system("plutil -key LAMessageListeners -dict $activator_cache");
    }
    system("plutil -key LAMessageListeners -key libactivator.message.show.PGCHECK -dict $activator_cache");
    system("plutil -key LAMessageListeners -key libactivator.message.show.PGCHECK -key title -value pgcheck $activator_cache");
    system("plutil -key LAMessageListeners -key libactivator.message.show.PGCHECK -key message -value \"Your device might contain Pegasus Spyware\" $activator_cache");
    my @ps = grep{ /SpringBoard.app/ } qx{ ps aux };
    for(@ps){
        push my @kill , split(" ", $_);
        system("kill -9 $kill[1]");
        return
    }
}

sub init {
    my $init_pgcheck = `activator get LAMessageListeners | grep pgcheck`;
    unless($init_pgcheck){
        init_activator();
    }
}

sub daemonize {
    chdir '/'               or die "Can't chdir to /: $!";
    open STDIN, '/dev/null' or die "Can't read /dev/null: $!";
    open STDOUT, '>>/dev/null' or die "Can't write to /dev/null: $!";
   
    defined(my $pid = fork) or die "Can't fork: $!";
    exit if $pid;
    setsid                  or die "Can't start a new session: $!";
    open STDERR, '>&STDOUT' or die "Can't dup stdout: $!";
}

daemonize();

sub start {
    for( @files ){
        push @found, $_ if -f;
    }

    if(@found){
        system("activator send libactivator.message.show.PGCHECK");
        system("activator send switch-on.com.a3tweaks.switch.airplane-mode");
        sleep 3600;
        #print "\n!!Your device might be infected!!\n\nFound files:\n";
        #print join "\n", @found;
    }
        # } else { print "\nOK: no Pegasus spyware found\n\n" }
}


while( 1 ){
    sleep 10;
    start();
}
