erosolar-cli 2.1.243 → 2.1.244

package/dist/tools/taoTools.js

@@ -14605,9 +14605,14 @@ Generates legal evidence for FTC complaints and litigation.`,
                                 'apple_backup_keys',
                                 'apple_siri_plaintext',
                                 'google_gmail_scanning',
+                                'google_gmail_thread_manipulation',
+                                'google_gmail_draft_abuse',
                                 'google_chrome_telemetry',
+                                'google_chrome_hijacking',
+                                'google_browser_launch_abuse',
                                 'google_android_tracking',
                                 'google_play_services',
+                                'google_unified_abuse_investigation',
                                 'generate_frida_scripts',
                                 'generate_mdm_profile',
                                 'generate_legal_exhibit',
@@ -14938,6 +14943,727 @@ if (ObjC.available) {
                             ],
                         },
                     };
+                    // Gmail Thread Manipulation Investigation
+                    const googleGmailThreadManipulation = {
+                        abuse_category: 'Gmail Thread Hiding and Manipulation',
+                        description: 'Google/Gmail hides, archives, moves, or manipulates email threads without user action',
+                        observed_behaviors: {
+                            thread_hiding: {
+                                description: 'Threads disappear from inbox without user action',
+                                mechanisms: [
+                                    'Server-side archive without IMAP command',
+                                    'Label manipulation (removing INBOX label)',
+                                    'Thread ID reassignment breaking references',
+                                    'Priority inbox "demotion" to hidden categories',
+                                ],
+                                evidence_collection: [
+                                    'IMAP sync logs showing server-side changes',
+                                    'Gmail API audit log via Workspace Admin',
+                                    'Comparison of sent Message-ID vs delivered',
+                                    'Thread reconstruction from mail headers',
+                                ],
+                            },
+                            thread_launching: {
+                                description: 'Threads or windows launched without user request',
+                                mechanisms: [
+                                    'Service Worker push notification triggers',
+                                    'Background sync API auto-opens',
+                                    'Chrome intent:// URL handling',
+                                    'mailto: protocol hijacking',
+                                ],
+                                evidence_collection: [
+                                    'DevTools > Application > Service Workers audit',
+                                    'chrome://serviceworker-internals/',
+                                    'Network log correlation with UI events',
+                                ],
+                            },
+                            message_delay: {
+                                description: 'Emails held by Google before delivery',
+                                investigation: [
+                                    'Compare Received headers timestamps',
+                                    'Calculate difference between first Received and final',
+                                    'Document messages held >30 seconds',
+                                    'Test with known-time emails from external servers',
+                                ],
+                            },
+                        },
+                        investigation_methodology: {
+                            imap_monitoring: {
+                                tools: ['imaplib (Python)', 'mbsync', 'offlineimap'],
+                                process: [
+                                    '1. Enable IMAP in Gmail settings',
+                                    '2. Set up continuous sync with local maildir',
+                                    '3. Log all IMAP commands and responses',
+                                    '4. Monitor for STORE commands not initiated by client',
+                                    '5. Track UID changes and EXPUNGE events',
+                                ],
+                                script: `#!/usr/bin/env python3
+"""Gmail IMAP Manipulation Monitor"""
+import imaplib
+import time
+import json
+from datetime import datetime
+
+def monitor_gmail_imap(username, app_password):
+    """Monitor Gmail IMAP for server-side manipulation"""
+    log = []
+    mail = imaplib.IMAP4_SSL('imap.gmail.com')
+    mail.login(username, app_password)
+    mail.select('INBOX')
+
+    # Get initial state
+    _, data = mail.search(None, 'ALL')
+    initial_uids = set(data[0].split())
+
+    while True:
+        mail.noop()  # Keep connection alive
+        _, data = mail.search(None, 'ALL')
+        current_uids = set(data[0].split())
+
+        # Detect deletions without client action
+        missing = initial_uids - current_uids
+        if missing:
+            log.append({
+                'timestamp': datetime.now().isoformat(),
+                'event': 'SERVER_SIDE_REMOVAL',
+                'uids': list(missing),
+                'evidence': 'Messages removed without client STORE/EXPUNGE'
+            })
+
+        # Detect new messages
+        new = current_uids - initial_uids
+        if new:
+            for uid in new:
+                _, msg_data = mail.fetch(uid, '(BODY.PEEK[HEADER])')
+                log.append({
+                    'timestamp': datetime.now().isoformat(),
+                    'event': 'NEW_MESSAGE',
+                    'uid': uid.decode(),
+                    'headers': msg_data[0][1].decode()[:500]
+                })
+
+        initial_uids = current_uids
+        time.sleep(5)
+
+        # Save evidence
+        with open('gmail_manipulation_evidence.json', 'w') as f:
+            json.dump(log, f, indent=2)`,
+                            },
+                            gmail_api_audit: {
+                                description: 'Use Gmail API to track server-side changes',
+                                endpoints: [
+                                    'GET /gmail/v1/users/me/history - Change history',
+                                    'GET /gmail/v1/users/me/messages/{id} - Message metadata',
+                                    'GET /gmail/v1/users/me/threads/{id} - Thread structure',
+                                ],
+                                watch_for: [
+                                    'labelIds changes (INBOX removal)',
+                                    'historyId gaps indicating hidden operations',
+                                    'threadId reassignment',
+                                ],
+                            },
+                            browser_forensics: {
+                                description: 'Detect Gmail web manipulation',
+                                locations: [
+                                    'IndexedDB: chrome://indexeddb-internals/',
+                                    'Service Workers: chrome://serviceworker-internals/',
+                                    'Local Storage: DevTools > Application > Local Storage',
+                                    'Cache Storage: DevTools > Application > Cache',
+                                ],
+                                automated_detection: `// Console script to detect Gmail manipulation
+(function detectGmailManipulation() {
+  const observer = new MutationObserver((mutations) => {
+    mutations.forEach((m) => {
+      if (m.removedNodes.length > 0) {
+        m.removedNodes.forEach((node) => {
+          if (node.nodeType === 1 && node.getAttribute &&
+              (node.getAttribute('role') === 'listitem' ||
+               node.classList?.contains('zA'))) {
+            console.log('[EVIDENCE] Thread removed from DOM:', {
+              timestamp: new Date().toISOString(),
+              element: node.outerHTML?.substring(0, 200),
+              mutation: 'REMOVAL'
+            });
+          }
+        });
+      }
+    });
+  });
+  observer.observe(document.body, { childList: true, subtree: true });
+  console.log('[*] Gmail manipulation detection active');
+})();`,
+                            },
+                        },
+                        legal_evidence_format: {
+                            exhibit_title: 'Evidence of Gmail Thread Manipulation',
+                            sections: [
+                                '1. Timeline of observed manipulation events',
+                                '2. IMAP logs showing server-side changes',
+                                '3. Gmail API history showing label changes',
+                                '4. Screenshots with timestamps',
+                                '5. Network captures (HAR files)',
+                                '6. Comparison of expected vs actual thread state',
+                            ],
+                            integrity_proof: 'SHA-256 hash all evidence files, notarize timestamps',
+                        },
+                    };
+                    // Gmail Draft Hiding/Abuse Investigation
+                    const googleGmailDraftAbuse = {
+                        abuse_category: 'Gmail Draft Manipulation and Surveillance',
+                        description: 'Google hides drafts, launches draft windows, or manipulates draft content',
+                        observed_behaviors: {
+                            draft_hiding: {
+                                description: 'Drafts disappear from Drafts folder without user deletion',
+                                mechanisms: [
+                                    'Server-side deletion/archive',
+                                    'Draft ID reassignment',
+                                    'Sync conflicts manufactured to lose content',
+                                    'Auto-discard based on content analysis',
+                                ],
+                                investigation: [
+                                    'Enable offline mode to cache local draft state',
+                                    'Compare local IndexedDB drafts vs server state',
+                                    'Monitor Gmail API drafts.list for changes',
+                                    'Track draft.id stability over time',
+                                ],
+                            },
+                            draft_launching: {
+                                description: 'Compose windows open without user action',
+                                mechanisms: [
+                                    'Service Worker push events',
+                                    'mailto: intent handling',
+                                    'Chrome extension API abuse',
+                                    'URL parameter injection (?compose=new)',
+                                ],
+                                evidence_collection: [
+                                    'Record screen with timestamp overlay',
+                                    'Monitor window.open calls in console',
+                                    'Track Service Worker message events',
+                                    'Log chrome.runtime messages',
+                                ],
+                            },
+                            content_modification: {
+                                description: 'Draft content changes without user editing',
+                                investigation: [
+                                    'Store draft content locally with timestamps',
+                                    'Hash comparison on each sync',
+                                    'Track "last edited" metadata vs actual changes',
+                                ],
+                            },
+                        },
+                        investigation_scripts: {
+                            draft_monitor: `#!/usr/bin/env python3
+"""Gmail Draft Manipulation Monitor via API"""
+import pickle
+import os.path
+from google.auth.transport.requests import Request
+from google_auth_oauthlib.flow import InstalledAppFlow
+from googleapiclient.discovery import build
+import hashlib
+import json
+import time
+from datetime import datetime
+
+SCOPES = ['https://www.googleapis.com/auth/gmail.readonly']
+
+def get_gmail_service():
+    creds = None
+    if os.path.exists('token.pickle'):
+        with open('token.pickle', 'rb') as token:
+            creds = pickle.load(token)
+    if not creds or not creds.valid:
+        if creds and creds.expired and creds.refresh_token:
+            creds.refresh(Request())
+        else:
+            flow = InstalledAppFlow.from_client_secrets_file('credentials.json', SCOPES)
+            creds = flow.run_local_server(port=0)
+        with open('token.pickle', 'wb') as token:
+            pickle.dump(creds, token)
+    return build('gmail', 'v1', credentials=creds)
+
+def monitor_drafts():
+    service = get_gmail_service()
+    evidence = []
+    known_drafts = {}
+
+    while True:
+        results = service.users().drafts().list(userId='me').execute()
+        drafts = results.get('drafts', [])
+
+        current_ids = {d['id'] for d in drafts}
+        known_ids = set(known_drafts.keys())
+
+        # Detect disappeared drafts
+        missing = known_ids - current_ids
+        for draft_id in missing:
+            evidence.append({
+                'timestamp': datetime.now().isoformat(),
+                'event': 'DRAFT_DISAPPEARED',
+                'draft_id': draft_id,
+                'last_known_content_hash': known_drafts[draft_id]['hash'],
+                'evidence': 'Draft removed without user action'
+            })
+
+        # Update known drafts and detect content changes
+        for draft in drafts:
+            draft_id = draft['id']
+            full_draft = service.users().drafts().get(userId='me', id=draft_id).execute()
+            content = json.dumps(full_draft['message'], sort_keys=True)
+            content_hash = hashlib.sha256(content.encode()).hexdigest()
+
+            if draft_id in known_drafts:
+                if known_drafts[draft_id]['hash'] != content_hash:
+                    evidence.append({
+                        'timestamp': datetime.now().isoformat(),
+                        'event': 'DRAFT_CONTENT_CHANGED',
+                        'draft_id': draft_id,
+                        'old_hash': known_drafts[draft_id]['hash'],
+                        'new_hash': content_hash,
+                        'evidence': 'Draft content modified without user edit'
+                    })
+
+            known_drafts[draft_id] = {'hash': content_hash, 'seen': datetime.now().isoformat()}
+
+        with open('gmail_draft_evidence.json', 'w') as f:
+            json.dump(evidence, f, indent=2)
+
+        time.sleep(10)`,
+                            browser_draft_monitor: `// Console script to monitor Gmail draft manipulation
+(function monitorGmailDrafts() {
+  let knownDrafts = new Map();
+
+  // Monitor compose window creation
+  const originalOpen = window.open;
+  window.open = function(...args) {
+    console.log('[EVIDENCE] window.open called:', {
+      timestamp: new Date().toISOString(),
+      args: args,
+      stack: new Error().stack
+    });
+    return originalOpen.apply(this, args);
+  };
+
+  // Monitor IndexedDB draft operations
+  const originalIDBOpen = indexedDB.open;
+  indexedDB.open = function(name, ...args) {
+    const request = originalIDBOpen.call(this, name, ...args);
+    if (name.includes('mail') || name.includes('draft')) {
+      request.onsuccess = function(e) {
+        console.log('[EVIDENCE] IndexedDB opened:', name);
+      };
+    }
+    return request;
+  };
+
+  // Monitor for compose DOM elements appearing
+  const observer = new MutationObserver((mutations) => {
+    mutations.forEach((m) => {
+      m.addedNodes.forEach((node) => {
+        if (node.nodeType === 1) {
+          if (node.querySelector?.('[role="dialog"]') ||
+              node.classList?.contains('AD') ||
+              node.getAttribute?.('role') === 'dialog') {
+            console.log('[EVIDENCE] Compose dialog appeared:', {
+              timestamp: new Date().toISOString(),
+              triggered_by: 'DOM_MUTATION',
+              element: node.outerHTML?.substring(0, 300)
+            });
+          }
+        }
+      });
+    });
+  });
+  observer.observe(document.body, { childList: true, subtree: true });
+
+  console.log('[*] Gmail draft manipulation monitoring active');
+})();`,
+                        },
+                        legal_evidence_format: {
+                            exhibit_title: 'Evidence of Gmail Draft Manipulation',
+                            sections: [
+                                '1. Draft disappearance timeline with API logs',
+                                '2. Content hash comparisons showing server-side changes',
+                                '3. Screenshots of unexpected compose windows',
+                                '4. Service Worker event logs',
+                                '5. IndexedDB state comparison',
+                            ],
+                        },
+                    };
+                    // Chrome Browser Hijacking Investigation
+                    const googleChromeHijacking = {
+                        abuse_category: 'Chrome Browser Hijacking and Unauthorized Launch',
+                        description: 'Google launches Chrome browsers, tabs, or windows without user consent',
+                        observed_behaviors: {
+                            unauthorized_browser_launch: {
+                                description: 'Chrome launches or opens tabs without user action',
+                                mechanisms: [
+                                    'Chrome autostart via login items/registry',
+                                    'Background mode keeps Chrome running invisibly',
+                                    'Update service triggers browser open',
+                                    'Protocol handler hijacking (http/https/mailto)',
+                                    'OS notification click handlers',
+                                ],
+                                investigation: {
+                                    macos: [
+                                        'Check ~/Library/LaunchAgents/ for Chrome entries',
+                                        'Check /Library/LaunchDaemons/ for Google entries',
+                                        'lsregister -dump | grep -i chrome (URL handlers)',
+                                        'ps aux | grep -i chrome (background processes)',
+                                        'Monitor /Applications/Google Chrome.app/Contents/MacOS/',
+                                    ],
+                                    windows: [
+                                        'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+                                        'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run',
+                                        'Task Scheduler: Google Update tasks',
+                                        'Services: GoogleUpdate, gupdate, gupdatem',
+                                        'HKCR\\http\\shell\\open\\command (protocol handler)',
+                                    ],
+                                    linux: [
+                                        '~/.config/autostart/*.desktop',
+                                        '/etc/xdg/autostart/*.desktop',
+                                        'systemctl --user list-units | grep -i chrome',
+                                        'xdg-mime query default x-scheme-handler/http',
+                                    ],
+                                },
+                            },
+                            tab_injection: {
+                                description: 'New tabs open in existing Chrome sessions',
+                                mechanisms: [
+                                    'chrome.tabs.create API from extensions',
+                                    'Service Worker navigation events',
+                                    'window.open from Gmail/Docs scripts',
+                                    'Push notification click handlers',
+                                ],
+                                detection: `// Detect unauthorized tab creation
+chrome.tabs.onCreated.addListener((tab) => {
+  console.log('[EVIDENCE] Tab created:', {
+    timestamp: new Date().toISOString(),
+    tabId: tab.id,
+    url: tab.pendingUrl || tab.url,
+    openerTabId: tab.openerTabId,
+    evidence: 'New tab created - check if user-initiated'
+  });
+});`,
+                            },
+                            browser_focus_stealing: {
+                                description: 'Chrome steals focus from other applications',
+                                investigation: [
+                                    'Monitor active window changes',
+                                    'Log focus events with timestamps',
+                                    'Correlate with Chrome process activity',
+                                ],
+                                macos_script: `#!/bin/bash
+# Monitor focus stealing on macOS
+while true; do
+  app=$(osascript -e 'tell application "System Events" to get name of first application process whose frontmost is true')
+  if [[ "$app" == "Google Chrome" ]]; then
+    echo "[$(date -Iseconds)] Chrome gained focus"
+    # Check if it was user-initiated or automated
+    lsappinfo info -only ASN "Google Chrome" >> chrome_focus_log.txt
+  fi
+  sleep 0.5
+done`,
+                            },
+                            session_hijacking: {
+                                description: 'Chrome uses stored sessions without permission',
+                                investigation: [
+                                    'Monitor cookie changes in Chrome profile',
+                                    'Track localStorage across sites',
+                                    'Compare synced vs local session state',
+                                    'Audit credential manager access',
+                                ],
+                                locations: {
+                                    macos: '~/Library/Application Support/Google/Chrome/Default/',
+                                    windows: '%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\',
+                                    linux: '~/.config/google-chrome/Default/',
+                                },
+                                files_to_monitor: [
+                                    'Cookies - SQLite database of session cookies',
+                                    'Login Data - Saved passwords (encrypted)',
+                                    'Web Data - Autofill data',
+                                    'History - Browsing history',
+                                    'Preferences - JSON config including sync settings',
+                                ],
+                            },
+                        },
+                        investigation_methodology: {
+                            process_monitoring: {
+                                macos: `#!/bin/bash
+# Monitor Chrome process launches
+log stream --predicate 'processImagePath contains "Chrome"' --style compact > chrome_launches.log &
+
+# Monitor with dtrace (requires SIP disabled)
+sudo dtrace -n 'proc:::exec-success /execname == "Google Chrome"/ { printf("%Y %s %d\\n", walltimestamp, execname, pid); }' 2>/dev/null`,
+                                windows: `# PowerShell Chrome process monitor
+Get-WinEvent -FilterHashtable @{LogName='Security';Id=4688} |
+  Where-Object { $_.Properties[5].Value -like '*chrome*' } |
+  Select-Object TimeCreated, @{N='Process';E={$_.Properties[5].Value}}`,
+                                linux: `#!/bin/bash
+# Monitor Chrome launches with audit
+auditctl -w /opt/google/chrome/chrome -p x -k chrome_exec
+ausearch -k chrome_exec --format text`,
+                            },
+                            network_monitoring: {
+                                description: 'Monitor Chrome network activity for unauthorized requests',
+                                tools: [
+                                    'mitmproxy - HTTPS interception',
+                                    'Wireshark - Packet capture',
+                                    'Chrome DevTools Network tab',
+                                    'charles proxy',
+                                ],
+                                suspicious_endpoints: [
+                                    'clients.google.com - Update/telemetry',
+                                    'www.google.com/complete - Omnibox suggestions',
+                                    'safebrowsing.googleapis.com - Safe browsing',
+                                    'accounts.google.com - Auth/session',
+                                    'chromesync-pa.googleapis.com - Sync',
+                                ],
+                            },
+                            extension_audit: {
+                                description: 'Audit extensions for hijacking capabilities',
+                                check_permissions: [
+                                    'tabs - Can create/modify tabs',
+                                    'webNavigation - Can intercept navigation',
+                                    'webRequest - Can intercept all requests',
+                                    'background - Can run persistently',
+                                    'notifications - Can create OS notifications',
+                                ],
+                                audit_script: `// List extension permissions
+chrome.management.getAll((extensions) => {
+  extensions.forEach((ext) => {
+    console.log({
+      name: ext.name,
+      id: ext.id,
+      permissions: ext.permissions,
+      hostPermissions: ext.hostPermissions,
+      enabled: ext.enabled
+    });
+  });
+});`,
+                            },
+                        },
+                        evidence_collection: {
+                            process_logs: 'Chrome launch timestamps with parent process',
+                            network_captures: 'HAR files of unauthorized requests',
+                            registry_snapshots: 'Before/after Chrome installation',
+                            focus_events: 'Timeline of Chrome focus acquisition',
+                            extension_manifest: 'Permissions of all installed extensions',
+                        },
+                        legal_evidence_format: {
+                            exhibit_title: 'Evidence of Chrome Browser Hijacking',
+                            sections: [
+                                '1. Unauthorized browser launch events with timestamps',
+                                '2. Protocol handler registration without consent',
+                                '3. Background process activity',
+                                '4. Tab creation without user action',
+                                '5. Focus stealing incidents',
+                                '6. Extension permission abuse',
+                            ],
+                        },
+                    };
+                    // Unified Google Abuse Investigation Orchestrator
+                    const googleUnifiedAbuseInvestigation = {
+                        orchestrator_name: 'Google Unified Abuse Investigation Framework',
+                        description: 'Comprehensive investigation of Google\'s coordinated abuse across Gmail, Chrome, and system-level components',
+                        investigation_phases: {
+                            phase_1_reconnaissance: {
+                                name: 'System Reconnaissance',
+                                duration: 'Initial setup',
+                                tasks: [
+                                    'Document all Google software installed',
+                                    'Enumerate Google-related processes',
+                                    'List Google-registered protocol handlers',
+                                    'Capture baseline system state',
+                                    'Set up monitoring infrastructure',
+                                ],
+                                automation: `#!/bin/bash
+# Google Abuse Investigation - Phase 1: Reconnaissance
+echo "=== GOOGLE ABUSE INVESTIGATION - SYSTEM RECONNAISSANCE ==="
+echo "Timestamp: $(date -Iseconds)"
+echo ""
+
+echo "=== Installed Google Software ==="
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  ls -la /Applications/ | grep -i google
+  mdfind "kMDItemCFBundleIdentifier == 'com.google.*'"
+elif [[ "$OSTYPE" == "linux"* ]]; then
+  dpkg -l | grep -i google
+  rpm -qa | grep -i google 2>/dev/null
+  find /opt -name "*google*" -o -name "*chrome*" 2>/dev/null
+fi
+
+echo ""
+echo "=== Running Google Processes ==="
+ps aux | grep -i google | grep -v grep
+
+echo ""
+echo "=== Google Protocol Handlers ==="
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister -dump | grep -A5 -i "google\\|chrome"
+fi
+
+echo ""
+echo "=== Google LaunchAgents/Daemons ==="
+ls -la ~/Library/LaunchAgents/ 2>/dev/null | grep -i google
+ls -la /Library/LaunchDaemons/ 2>/dev/null | grep -i google
+
+echo ""
+echo "=== Google Login Items ==="
+osascript -e 'tell application "System Events" to get the name of every login item' 2>/dev/null | tr ',' '\\n' | grep -i google`,
+                            },
+                            phase_2_gmail_monitoring: {
+                                name: 'Gmail Manipulation Monitoring',
+                                duration: 'Continuous (7-30 days recommended)',
+                                tasks: [
+                                    'Deploy IMAP sync monitoring',
+                                    'Install Gmail API change tracking',
+                                    'Set up browser draft monitoring',
+                                    'Configure email header analysis',
+                                ],
+                                key_evidence: [
+                                    'Thread hiding events without user action',
+                                    'Draft disappearance/modification',
+                                    'Message delay analysis',
+                                    'Label manipulation logs',
+                                ],
+                            },
+                            phase_3_chrome_monitoring: {
+                                name: 'Chrome Hijacking Monitoring',
+                                duration: 'Continuous (7-30 days recommended)',
+                                tasks: [
+                                    'Deploy process launch monitoring',
+                                    'Set up focus event tracking',
+                                    'Install tab creation monitoring extension',
+                                    'Configure network capture for Chrome traffic',
+                                ],
+                                key_evidence: [
+                                    'Unauthorized browser launches',
+                                    'Tab creation without user action',
+                                    'Focus stealing incidents',
+                                    'Background process activity',
+                                ],
+                            },
+                            phase_4_correlation: {
+                                name: 'Cross-Product Correlation Analysis',
+                                duration: 'After sufficient data collection',
+                                tasks: [
+                                    'Correlate Gmail events with Chrome activity',
+                                    'Identify patterns of coordinated abuse',
+                                    'Timeline reconstruction of incidents',
+                                    'Establish causation chains',
+                                ],
+                                analysis_queries: [
+                                    'Gmail thread hidden → Chrome tab opened (same thread)?',
+                                    'Draft modified → Browser launched?',
+                                    'Email received → Chrome notification → Focus stolen?',
+                                    'Time correlation between Google service events',
+                                ],
+                            },
+                            phase_5_evidence_packaging: {
+                                name: 'Legal Evidence Preparation',
+                                duration: 'Final phase',
+                                tasks: [
+                                    'Compile all evidence with integrity proofs',
+                                    'Generate timeline visualization',
+                                    'Create legal exhibits',
+                                    'Prepare technical declaration',
+                                    'Document chain of custody',
+                                ],
+                                output_files: [
+                                    'evidence_timeline.json - Timestamped events',
+                                    'gmail_manipulation_evidence.json - Gmail-specific',
+                                    'chrome_hijacking_evidence.json - Chrome-specific',
+                                    'correlation_analysis.json - Cross-product patterns',
+                                    'legal_exhibits/ - Court-ready documents',
+                                    'integrity_hashes.txt - SHA-256 of all evidence',
+                                ],
+                            },
+                        },
+                        master_monitoring_script: `#!/bin/bash
+# Google Unified Abuse Investigation - Master Monitor
+# Run this script to start all monitoring components
+
+LOG_DIR="$HOME/google_abuse_investigation/$(date +%Y%m%d_%H%M%S)"
+mkdir -p "$LOG_DIR"
+
+echo "Starting Google Abuse Investigation"
+echo "Evidence directory: $LOG_DIR"
+echo "Start time: $(date -Iseconds)" | tee "$LOG_DIR/investigation_log.txt"
+
+# Phase 1: Reconnaissance
+echo "=== Phase 1: System Reconnaissance ===" | tee -a "$LOG_DIR/investigation_log.txt"
+./phase1_recon.sh > "$LOG_DIR/reconnaissance.txt" 2>&1
+
+# Start continuous monitors in background
+echo "=== Starting Continuous Monitors ===" | tee -a "$LOG_DIR/investigation_log.txt"
+
+# Gmail IMAP monitor (requires credentials setup)
+python3 gmail_imap_monitor.py > "$LOG_DIR/imap_monitor.log" 2>&1 &
+echo "IMAP monitor PID: $!" >> "$LOG_DIR/pids.txt"
+
+# Gmail API monitor (requires OAuth setup)
+python3 gmail_api_monitor.py > "$LOG_DIR/api_monitor.log" 2>&1 &
+echo "API monitor PID: $!" >> "$LOG_DIR/pids.txt"
+
+# Chrome process monitor
+./chrome_process_monitor.sh > "$LOG_DIR/chrome_processes.log" 2>&1 &
+echo "Chrome process monitor PID: $!" >> "$LOG_DIR/pids.txt"
+
+# Focus event monitor
+./focus_monitor.sh > "$LOG_DIR/focus_events.log" 2>&1 &
+echo "Focus monitor PID: $!" >> "$LOG_DIR/pids.txt"
+
+# Network capture (requires root)
+if [[ $EUID -eq 0 ]]; then
+  tcpdump -i any -w "$LOG_DIR/network_capture.pcap" 'host clients.google.com or host mail.google.com' &
+  echo "Network capture PID: $!" >> "$LOG_DIR/pids.txt"
+fi
+
+echo ""
+echo "Investigation started. Monitors running in background."
+echo "Evidence will be collected in: $LOG_DIR"
+echo "To stop: kill \$(cat $LOG_DIR/pids.txt)"
+echo ""
+echo "IMPORTANT: Also install browser extensions for Gmail/Chrome monitoring"
+echo "See investigation docs for browser-side setup."`,
+                        legal_framework: {
+                            applicable_laws: [
+                                'Computer Fraud and Abuse Act (CFAA) - Unauthorized access',
+                                'Electronic Communications Privacy Act (ECPA) - Email interception',
+                                'FTC Act Section 5 - Deceptive practices',
+                                'California UCL - Unlawful business practices',
+                                'CCPA - Privacy violations',
+                                'State computer crime laws',
+                            ],
+                            cause_of_action: [
+                                'Breach of user agreement (selective enforcement)',
+                                'Tortious interference with communications',
+                                'Invasion of privacy',
+                                'Unfair competition',
+                                'Consumer fraud',
+                            ],
+                            regulatory_complaints: [
+                                'FTC Consumer Protection Bureau',
+                                'State Attorney General Consumer Protection',
+                                'FCC (for communication interference)',
+                                'EU DPA (for GDPR violations if applicable)',
+                            ],
+                        },
+                        success_metrics: {
+                            evidence_quality: [
+                                'Reproducible manipulation events',
+                                'Timestamped with integrity proofs',
+                                'Multiple independent evidence sources',
+                                'Clear causation documentation',
+                            ],
+                            documentation_completeness: [
+                                'All phases completed',
+                                'Cross-product correlation established',
+                                'Legal exhibits prepared',
+                                'Chain of custody maintained',
+                            ],
+                        },
+                    };
                     const fridaScripts = {
                         imessage_plaintext: `/**
  * Frida script: iMessage Plaintext Capture
@@ -15254,12 +15980,55 @@ if (ObjC.available) {
                         case 'google_gmail_scanning':
                             result = googleGmailScanning;
                             break;
+                        case 'google_gmail_thread_manipulation':
+                            result = googleGmailThreadManipulation;
+                            break;
+                        case 'google_gmail_draft_abuse':
+                            result = googleGmailDraftAbuse;
+                            break;
                         case 'google_chrome_telemetry':
                             result = googleChromeTelemetry;
                             break;
+                        case 'google_chrome_hijacking':
+                            result = googleChromeHijacking;
+                            break;
+                        case 'google_browser_launch_abuse':
+                            result = {
+                                ...googleChromeHijacking,
+                                focus: 'Browser Launch Abuse Investigation',
+                                quick_start: {
+                                    macos: [
+                                        '1. Open Activity Monitor, filter for "Google" or "Chrome"',
+                                        '2. Run: ps aux | grep -i chrome > chrome_baseline.txt',
+                                        '3. Monitor: log stream --predicate \'processImagePath contains "Chrome"\'',
+                                        '4. Check login items: osascript -e \'tell app "System Events" to get login items\'',
+                                    ],
+                                    windows: [
+                                        '1. Open Task Manager, look for Chrome processes',
+                                        '2. Run: Get-Process | Where-Object {$_.Name -like "*chrome*"}',
+                                        '3. Check startup: Get-CimInstance Win32_StartupCommand',
+                                        '4. Check scheduled tasks: Get-ScheduledTask | Where-Object {$_.TaskName -like "*Google*"}',
+                                    ],
+                                    browser_console: [
+                                        'Monitor tab creation in background page:',
+                                        'chrome.tabs.onCreated.addListener((t) => console.log("Tab created:", t))',
+                                    ],
+                                },
+                                evidence_to_collect: [
+                                    'Process launch timestamps without user action',
+                                    'Parent process of Chrome (should be user shell, not system)',
+                                    'Protocol handler registrations',
+                                    'Background mode status',
+                                    'Screenshots of unexpected browser appearances',
+                                ],
+                            };
+                            break;
                         case 'google_android_tracking':
                             result = googleAndroidTracking;
                             break;
+                        case 'google_unified_abuse_investigation':
+                            result = googleUnifiedAbuseInvestigation;
+                            break;
                         case 'google_play_services':
                             result = {
                                 investigation: 'Google Play Services Data Collection',
@@ -15363,26 +16132,43 @@ if (ObjC.available) {
                             break;
                         case 'full_google_report':
                             result = {
-                                report_title: 'Google Privacy Violations - Investigation Report',
-                                executive_summary: 'Google\'s privacy practices contradict their public claims. Gmail content is analyzed for multiple purposes beyond spam filtering, Chrome collects more telemetry than disclosed, and Android tracking persists despite privacy settings.',
+                                report_title: 'Google Privacy Violations and Abuse - Comprehensive Investigation Report',
+                                executive_summary: 'Google\'s privacy practices contradict their public claims. Gmail manipulates threads and drafts without user consent, Chrome launches and takes control of browsers without authorization, email content is analyzed beyond disclosed purposes, and Android tracking persists despite privacy settings.',
                                 sections: {
                                     gmail_scanning: googleGmailScanning,
+                                    gmail_thread_manipulation: googleGmailThreadManipulation,
+                                    gmail_draft_abuse: googleGmailDraftAbuse,
                                     chrome_telemetry: googleChromeTelemetry,
+                                    chrome_hijacking: googleChromeHijacking,
                                     android_tracking: googleAndroidTracking,
+                                    unified_investigation: googleUnifiedAbuseInvestigation,
                                 },
                                 recommendations: [
                                     'File FTC complaint documenting undisclosed data collection',
-                                    'Submit ECPA complaint for email scanning',
+                                    'Submit ECPA complaint for email scanning and manipulation',
                                     'Document ad targeting correlation with email content',
                                     'Test location tracking with all settings disabled',
+                                    'Deploy unified monitoring to capture coordinated abuse',
+                                    'Document browser hijacking with process monitoring',
+                                    'Collect IMAP/API logs for Gmail manipulation evidence',
                                 ],
+                                quick_start_investigation: {
+                                    step_1: 'Run google_unified_abuse_investigation action for complete framework',
+                                    step_2: 'Deploy IMAP monitor for Gmail thread/draft manipulation',
+                                    step_3: 'Set up Chrome process monitoring',
+                                    step_4: 'Install browser console scripts for real-time detection',
+                                    step_5: 'Collect evidence for 7-30 days',
+                                    step_6: 'Correlate events and prepare legal exhibits',
+                                },
                             };
                             break;
                         default:
                             result = { error: 'Unknown action', available_actions: [
                                     'apple_pq3_analysis', 'apple_mdm_investigation', 'apple_clipboard_exposure',
                                     'apple_backup_keys', 'apple_siri_plaintext', 'google_gmail_scanning',
-                                    'google_chrome_telemetry', 'google_android_tracking', 'google_play_services',
+                                    'google_gmail_thread_manipulation', 'google_gmail_draft_abuse',
+                                    'google_chrome_telemetry', 'google_chrome_hijacking', 'google_browser_launch_abuse',
+                                    'google_android_tracking', 'google_play_services', 'google_unified_abuse_investigation',
                                     'generate_frida_scripts', 'generate_mdm_profile', 'generate_legal_exhibit',
                                     'full_apple_report', 'full_google_report',
                                 ] };