@echo off
setlocal DisableDelayedExpansion
chcp 65001 >nul 2>&1
title 网络痕迹 + 系统缓存清理工具

set "NCC_LOG=%TEMP%\_ncc_debug.log"
goto :main

rem ===========================================================================
rem  子程序
rem ===========================================================================

:log
>>"%NCC_LOG%" echo [%TIME%] %*
exit /b 0

:try_write
rem 单独放在子程序里, 由调用方用 >nul 2>&1 包住。
rem 直接在调用处写 >>"%file" 时, cmd 的"拒绝访问"提示走 stdout, 2>nul 拦不住,
rem 会在屏幕上直接冒出 Access is denied. 干扰使用者。
>>"%~1" echo probe
exit /b 0

rem ===========================================================================
rem  主流程
rem ===========================================================================

:main
call :log "==== start ==== ver=[%OS% %SystemRoot%] account=[%USERNAME%]"

rem ---------------------------------------------------------------------------
rem  权限探测 (四项独立探测, 详见 README)
rem    1) 能否写入 System32     —— 纯内建, 不依赖任何 exe
rem    2) 能否写入 ProgramFiles —— 纯内建, 兜底 (某些杀软会保护 System32)
rem    3) fltmc                 —— 系统自带命令
rem    4) net session           —— 系统自带命令
rem    任意一项成功即视为管理员; 四项全失败才判定为非管理员。
rem    探测结果会打印在窗口上, 万一判断有误可以立刻看出来, 不必翻日志。
rem ---------------------------------------------------------------------------
set "IS_ADMIN=0"
set "P_SYS32=0"
set "P_PROGFIL=0"
set "P_FLTMAC=0"
set "P_NETSESS=0"

set "_ncc_probe=%SystemRoot%\System32\__ncc_probe_%RANDOM%.tmp"
>nul 2>&1 call :try_write "%_ncc_probe%"
if exist "%_ncc_probe%" set "P_SYS32=1"
del /f /q "%_ncc_probe%" >nul 2>&1

set "_ncc_probe=%ProgramFiles%\__ncc_probe_%RANDOM%.tmp"
>nul 2>&1 call :try_write "%_ncc_probe%"
if exist "%_ncc_probe%" set "P_PROGFIL=1"
del /f /q "%_ncc_probe%" >nul 2>&1

fltmc >nul 2>&1
if not errorlevel 1 set "P_FLTMAC=1"

net session >nul 2>&1
if not errorlevel 1 set "P_NETSESS=1"

if "%P_SYS32%"=="1" set "IS_ADMIN=1"
if "%P_PROGFIL%"=="1" set "IS_ADMIN=1"
if "%P_FLTMAC%"=="1" set "IS_ADMIN=1"
if "%P_NETSESS%"=="1" set "IS_ADMIN=1"

call :log "probe System32=%P_SYS32% ProgFiles=%P_PROGFIL% fltmc=%P_FLTMAC% netsession=%P_NETSESS% -> IS_ADMIN=%IS_ADMIN%"

if "%IS_ADMIN%"=="1" goto :run_full

rem 已在提权后的实例中却仍探测失败 -> 断路器生效, 直接降级, 绝不再次派生
if defined NCC_ELEVATED goto :run_partial

goto :need_admin

rem ---------------------------------------------------------------------------
:need_admin
call :log "need_admin: attempting elevation"
cls
echo.
echo   当前账户不是管理员, 正在请求管理员权限 ...
echo.
echo     权限探测结果: System32=%P_SYS32%  ProgramFiles=%P_PROGFIL%  fltmc=%P_FLTMAC%  netsession=%P_NETSESS%
echo     (1=成功, 0=失败; 四项全为 0 才判定为非管理员)
echo.
echo     - 若弹出「用户账户控制」框, 请输入管理员密码
echo     - 若没有管理员密码, 会自动改为「部分清理」模式继续
echo     - 远程桌面下 UAC 弹窗可能不显示, 属正常现象
echo.
echo   正在等待, 请不要关闭本窗口 ...
echo.
set "NCC_ELEVATED=1"
powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $p = Start-Process -FilePath '%~f0' -Verb RunAs -Wait -PassThru -ErrorAction Stop; exit $p.ExitCode } catch { exit 1223 }"
set "RC=%errorlevel%"
call :log "need_admin: elevation exit=%RC%"

if "%RC%"=="1223" goto :run_partial
if "%RC%"=="1" goto :child_failed
exit /b %RC%

rem ---------------------------------------------------------------------------
:child_failed
call :log "child_failed: elevated run returned %RC%"
echo.
echo   [异常] 提权窗口中的清理未能正常结束 (退出码 %RC%)
echo          详情见该窗口中的输出, 或诊断日志:
echo          %NCC_LOG%
echo.
pause
exit /b %RC%

rem ---------------------------------------------------------------------------
:run_full
call :log "run: FULL mode (elevated)"
set "MODE="
call :execute
goto :finish

rem ---------------------------------------------------------------------------
:run_partial
call :log "run: PARTIAL mode (not elevated)"
set "MODE=-Partial"
call :execute
goto :finish

rem ---------------------------------------------------------------------------
:execute
cls
set "B64=%TEMP%\_ncc_payload.b64"
set "PS1=%TEMP%\_ncc_payload.ps1"
{{CHUNKS}}

if not exist "%B64%" goto :payload_failed
set "PSIZE=0"
for %%A in ("%B64%") do set "PSIZE=%%~zA"
if "%PSIZE%"=="0" goto :payload_failed
call :log "execute: payload bytes=%PSIZE% mode=[%MODE%]"

powershell -NoProfile -ExecutionPolicy Bypass -Command "$b=[IO.File]::ReadAllText($env:TEMP+'\_ncc_payload.b64');$s=[Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(($b -replace '\s','')));[IO.File]::WriteAllText($env:TEMP+'\_ncc_payload.ps1',$s,(New-Object Text.UTF8Encoding($true)));& ($env:TEMP+'\_ncc_payload.ps1') %MODE%"
set "RC=%errorlevel%"
call :log "execute: powershell exit=%RC%"
del /f /q "%B64%" >nul 2>&1
del /f /q "%PS1%" >nul 2>&1
exit /b %RC%

rem ---------------------------------------------------------------------------
:payload_failed
call :log "payload_failed: cannot write payload to [%TEMP%]"
echo.
echo   [失败] 无法写入临时载荷文件, 请检查 %TEMP% 是否可写 / 磁盘空间。
echo          诊断日志: %NCC_LOG%
echo.
echo   按任意键关闭 . . .
pause
exit /b 1

rem ---------------------------------------------------------------------------
rem  收尾
rem
rem  退出码约定 (由 PowerShell 主体返回):
rem    0 = 全部成功
rem    2 = 已完成, 但有失败项    -> 倒计时后自动关闭, 不阻塞
rem    1 = 致命错误 / 载荷写不进去 -> 必须停下来等人看
rem
rem  成功或有失败项时倒计时自动关闭, 但保留"按任意键立即关闭"的能力,
rem  免得又变成"窗口一闪就没, 什么都来不及看"。
rem ---------------------------------------------------------------------------
:finish
if "%RC%"=="1" goto :fatal
if not "%RC%"=="0" goto :had_failures

echo.
echo   诊断日志: %NCC_LOG%
call :autoclose
exit /b 0

:had_failures
echo.
echo   [注意] 有项目未能完成, 原因见上方"失败明细"; 详情见诊断日志
echo.
echo   诊断日志: %NCC_LOG%
call :autoclose
exit /b 2

:fatal
echo.
echo   [异常] PowerShell 未正常结束 (退出码 %RC%)
echo.
echo   诊断日志: %NCC_LOG%
echo.
echo   按任意键关闭 . . .
pause
exit /b %RC%

rem ---------------------------------------------------------------------------
rem  倒计时后自动关闭。choice 不可用时回退到 ping 延时。
rem ---------------------------------------------------------------------------
:autoclose
echo   {{AUTOCLOSE_SECONDS}} 秒后自动关闭, 按任意数字键可立即关闭 ...
choice /c 0123456789 /n /t {{AUTOCLOSE_SECONDS}} /d 0 /m "" >nul 2>&1
if errorlevel 1 ping -n {{AUTOCLOSE_SECONDS_PING}} 127.0.0.1 >nul 2>&1
exit /b 0