"""Shared rules and recommendations for exploit mitigation analysis."""

from __future__ import annotations

from typing import Any

CONTROL_FLOW_GUARD_DESC = "Control Flow Guard"
DIGITAL_SIGNATURE_DESC = "Digital signature"

DLL_CHARACTERISTICS = {
    0x0020: "HIGH_ENTROPY_VA",  # ASLR with high entropy
    0x0040: "DYNAMIC_BASE",  # ASLR enabled
    0x0080: "FORCE_INTEGRITY",  # Force code integrity checks
    0x0100: "NX_COMPAT",  # DEP enabled
    0x0200: "NO_ISOLATION",  # No isolation
    0x0400: "NO_SEH",  # No SEH
    0x0800: "NO_BIND",  # Do not bind image
    0x1000: "APPCONTAINER",  # Image should run in AppContainer
    0x2000: "WDM_DRIVER",  # WDM driver
    0x4000: "GUARD_CF",  # Control Flow Guard enabled
    0x8000: "TERMINAL_SERVER_AWARE",  # Terminal server aware
}


def generate_recommendations(result: dict[str, Any]) -> list[dict[str, Any]]:
    """Generate security recommendations based on analysis output."""
    recommendations: list[dict[str, Any]] = []

    if not result["mitigations"].get("ASLR", {}).get("enabled"):
        recommendations.append(
            {
                "priority": "high",
                "mitigation": "ASLR",
                "recommendation": "Enable ASLR by setting /DYNAMICBASE linker flag",
                "impact": "Prevents reliable exploitation by randomizing memory addresses",
            }
        )

    if result["mitigations"].get("ASLR", {}).get("enabled") and not result["mitigations"].get(
        "ASLR", {}
    ).get("high_entropy"):
        recommendations.append(
            {
                "priority": "medium",
                "mitigation": "High Entropy ASLR",
                "recommendation": "Enable high entropy ASLR with /HIGHENTROPYVA for 64-bit builds",
                "impact": "Increases address space randomization entropy",
            }
        )

    if not result["mitigations"].get("DEP", {}).get("enabled"):
        recommendations.append(
            {
                "priority": "high",
                "mitigation": "DEP/NX",
                "recommendation": "Enable DEP by setting /NXCOMPAT linker flag",
                "impact": "Prevents code execution from data segments",
            }
        )

    if not result["mitigations"].get("CFG", {}).get("enabled"):
        recommendations.append(
            {
                "priority": "high",
                "mitigation": CONTROL_FLOW_GUARD_DESC,
                "recommendation": "Enable CFG with /GUARD:CF linker flag",
                "impact": "Protects against indirect call/jump control flow hijacking",
            }
        )

    if not result["mitigations"].get("Integrity", {}).get("enabled"):
        recommendations.append(
            {
                "priority": "medium",
                "mitigation": DIGITAL_SIGNATURE_DESC,
                "recommendation": "Sign the binary with a digital certificate",
                "impact": "Ensures code integrity and authenticity",
            }
        )

    if not result["mitigations"].get("StackCookies", {}).get("enabled"):
        recommendations.append(
            {
                "priority": "high",
                "mitigation": "Stack Cookies",
                "recommendation": "Enable stack cookies with /GS compiler flag",
                "impact": "Detects stack buffer overflows",
            }
        )

    if not result["mitigations"].get("SafeSEH", {}).get("enabled"):
        if not result.get("pe_info", {}).get("is_64bit", True):
            recommendations.append(
                {
                    "priority": "medium",
                    "mitigation": "SafeSEH",
                    "recommendation": "Enable SafeSEH with /SAFESEH linker flag (32-bit only)",
                    "impact": "Prevents SEH overwrites",
                }
            )

    if not result["mitigations"].get("Authenticode", {}).get("enabled"):
        recommendations.append(
            {
                "priority": "medium",
                "mitigation": "Code Signing",
                "recommendation": "Sign the binary with Authenticode certificate",
                "impact": "Ensures binary integrity and authenticity",
            }
        )

    return recommendations
