<#
.SYNOPSIS
    Kills locked browser processes (tech support scam / fake virus popup) and
    suppresses the "Restore previous session" prompt so the client does not
    need to be walked through that step.

.DESCRIPTION
    Runs as SYSTEM via Gorelo. Force-kills common browser processes across all
    logged in and logged out user profiles, then patches Chrome/Edge Preferences
    files (exit_type Crashed -> Normal) and clears the Firefox session recovery
    file so neither browser offers to restore the locked tab on next launch.

.NOTES
    Author: Husky Logic
    Target: Gorelo script execution, runs as SYSTEM.
    Does NOT remove the cause of the popup (malicious redirect, adware
    extension, compromised ad network, etc). This only clears the immediate
    freeze. If a client sees this repeatedly, that is a signal to dig into
    extensions/hijacked shortcuts, not just re-run this script.
#>

$ErrorActionPreference = "SilentlyContinue"

$logPath = Join-Path $env:ProgramData "RMMScripts\BrowserUnlock\Logs"
if (-not (Test-Path $logPath)) {
    New-Item -Path $logPath -ItemType Directory -Force | Out-Null
}
$logFile = Join-Path $logPath ("BrowserUnlock_{0}.log" -f (Get-Date -Format "yyyyMMdd_HHmmss"))

function Write-Log {
    param([string]$Message)
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    "$timestamp - $Message" | Out-File -FilePath $logFile -Append
}

Write-Log "Starting browser unlock script"

$browserProcs = @("chrome", "msedge", "firefox", "iexplore")
$killedAny = $false

foreach ($proc in $browserProcs) {
    $running = Get-Process -Name $proc -ErrorAction SilentlyContinue
    if ($running) {
        Write-Log ("Found running process: {0} (Count: {1})" -f $proc, $running.Count)
        Stop-Process -Name $proc -Force -ErrorAction SilentlyContinue
        Start-Sleep -Seconds 1
        $killedAny = $true
        Write-Log ("Killed process: {0}" -f $proc)
    }
}

# Loop through actual user profile folders (script runs as SYSTEM, not as the user)
$userProfiles = Get-ChildItem "C:\Users" -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -notin @("Public", "Default", "Default User", "All Users") }

foreach ($user in $userProfiles) {

    # Chrome and Edge: patch exit_type so no "Restore pages" infobar appears
    $chromiumRoots = @(
        (Join-Path $user.FullName "AppData\Local\Google\Chrome\User Data"),
        (Join-Path $user.FullName "AppData\Local\Microsoft\Edge\User Data")
    )

    foreach ($base in $chromiumRoots) {
        if (Test-Path $base) {
            $profileDirs = Get-ChildItem $base -Directory -ErrorAction SilentlyContinue |
                Where-Object { $_.Name -eq "Default" -or $_.Name -like "Profile*" }

            foreach ($p in $profileDirs) {
                $prefFile = Join-Path $p.FullName "Preferences"
                if (Test-Path $prefFile) {
                    try {
                        $content = Get-Content $prefFile -Raw -ErrorAction Stop
                        if ($content -match '"exit_type"\s*:\s*"Crashed"') {
                            $content = $content -replace '"exit_type"\s*:\s*"Crashed"', '"exit_type":"Normal"'
                            Set-Content -Path $prefFile -Value $content -Force -ErrorAction Stop
                            Write-Log ("Patched exit_type: {0}" -f $prefFile)
                        }
                    } catch {
                        Write-Log ("Could not patch {0}: {1}" -f $prefFile, $_.Exception.Message)
                    }
                }
            }
        }
    }

    # Firefox: remove the crash recovery session so it does not prompt
    $ffProfilesRoot = Join-Path $user.FullName "AppData\Roaming\Mozilla\Firefox\Profiles"
    if (Test-Path $ffProfilesRoot) {
        Get-ChildItem $ffProfilesRoot -Directory -ErrorAction SilentlyContinue | ForEach-Object {
            $sessionFile = Join-Path $_.FullName "sessionstore-backups\recovery.jsonlz4"
            if (Test-Path $sessionFile) {
                Remove-Item $sessionFile -Force -ErrorAction SilentlyContinue
                Write-Log ("Removed Firefox recovery session: {0}" -f $sessionFile)
            }
        }
    }
}

if ($killedAny) {
    Write-Log "Browser unlock completed. Target processes were terminated and session restore suppressed."
    exit 0
} else {
    Write-Log "No target browser processes were running at time of script execution."
    exit 0
}