powershell

# totle_monitor.ps1
# Realtime continuous port monitor - no timeout
# Usage: powershell -ExecutionPolicy Bypass -File .\totle_monitor.ps1
# Options: -TargetPort 8443

param(
    [int]$TargetPort = 8443,
    [string]$LogDir  = "$env:USERPROFILE\Desktop"
)

$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$logFile   = Join-Path $LogDir "totle_monitor_$timestamp.txt"
$script:totalReq = 0

# ------------------------------------------------------------------
# Log function
# ------------------------------------------------------------------
function Write-Log ([string]$Text = "", [string]$Color = "White") {
    Write-Host $Text -ForegroundColor $Color
    try {
        $Text | Out-File -FilePath $logFile -Append -Encoding UTF8 -ErrorAction Stop
    } catch {}
}

function Write-Sep ([string]$Char = "=", [int]$Len = 60, [string]$Color = "Cyan") {
    Write-Log ($Char * $Len) $Color
}

# ------------------------------------------------------------------
# Module analysis (run once per PID)
# ------------------------------------------------------------------
function Analyze-Modules ([System.Diagnostics.Process]$Proc) {
    $netKeywords = @(
        "winhttp",
        "wininet",
        "ws2_32",
        "mswsock",
        "schannel",
        "clr",
        "coreclr",
        "totle"
    )

    $found = New-Object System.Collections.Generic.List[object]

    try {
        foreach ($mod in $Proc.Modules) {
            $modName = $mod.ModuleName
            foreach ($kw in $netKeywords) {
                if ($modName -match [regex]::Escape($kw)) {
                    $obj = [PSCustomObject]@{
                        Module = $modName
                        Path   = $mod.FileName
                        Tag    = $kw
                    }
                    $found.Add($obj)
                    break
                }
            }
        }
    } catch {}

    Write-Log "  [Modules]" "DarkGray"
    if ($found.Count -eq 0) {
        Write-Log "    (none)" "Gray"
        return
    }

    foreach ($item in $found) {
        $color = "Gray"
        if ($item.Tag -eq "totle")                   { $color = "Green"   }
        elseif ($item.Tag -match "wininet|winhttp")   { $color = "Yellow"  }
        elseif ($item.Tag -match "clr|coreclr")       { $color = "Magenta" }

        $line = "    [{0,-10}] {1}" -f $item.Tag, $item.Module
        Write-Log $line $color
    }

    # Verdict
    $hasWinInet  = $found | Where-Object { $_.Tag -eq "wininet" }
    $hasWinHttp  = $found | Where-Object { $_.Tag -eq "winhttp" }
    $hasCLR      = $found | Where-Object { $_.Tag -match "clr|coreclr" }
    $hasWs2      = $found | Where-Object { $_.Tag -eq "ws2_32" }
    $noHighLevel = (-not $hasWinInet) -and (-not $hasWinHttp) -and (-not $hasCLR)

    Write-Log "  [Verdict]" "DarkGray"
    if ($hasWinInet) { Write-Log "    WinInet   -> proxy VALID"         "Green"  }
    if ($hasWinHttp) { Write-Log "    WinHTTP   -> proxy VALID"         "Green"  }
    if ($hasCLR)     { Write-Log "    .NET CLR  -> proxy via DefaultProxy" "Yellow" }
    if ($hasWs2 -and $noHighLevel) {
        Write-Log "    ws2_32 direct socket -> proxy INVALID" "Red"
        Write-Log "    -> ETW / WFP required"                 "Red"
    }
}

# ------------------------------------------------------------------
# Print new connection
# ------------------------------------------------------------------
function Show-Connection ($Conn, [System.Diagnostics.Process]$Proc, [bool]$IsNew) {
    $script:totalReq++
    $ts    = Get-Date -Format "yyyy-MM-dd HH:mm:ss.fff"
    $label = if ($IsNew) { "NEW" } else { "CHG" }

    Write-Sep "=" 60 "Cyan"
    Write-Log "[$label #$($script:totalReq)] $ts" "Cyan"
    Write-Sep "=" 60 "Cyan"
    Write-Log "  [Local]   $($Conn.LocalAddress):$($Conn.LocalPort)"   "White"
    Write-Log "  [Remote]  $($Conn.RemoteAddress):$($Conn.RemotePort)" "Yellow"
    Write-Log "  [State]   $($Conn.State)"                             "White"
    Write-Log "  [PID]     $($Conn.OwningProcess)"                     "White"
    Write-Log "  [Process] $($Proc.Name)"                              "Yellow"
    Write-Log "  [Path]    $($Proc.Path)"                              "Gray"

    try {
        $mem = [math]::Round($Proc.WorkingSet64 / 1MB, 1)
        Write-Log "  [Memory]  $mem MB" "Gray"
    } catch {}

    Write-Log ""
    Analyze-Modules -Proc $Proc
    Write-Log ""
}

# ------------------------------------------------------------------
# Print state change
# ------------------------------------------------------------------
function Show-StateChange ([string]$Key, [string]$OldState, [string]$NewState) {
    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss.fff"
    $color = if ($NewState -eq "Established") { "Green" } else { "DarkYellow" }
    Write-Log "[$ts] STATE  $Key  $OldState -> $NewState" $color
    try {
        "[$ts] STATE  $Key  $OldState -> $NewState" |
            Out-File -FilePath $logFile -Append -Encoding UTF8 -ErrorAction Stop
    } catch {}
}

# ==================================================================
# MAIN
# ==================================================================
Write-Sep "=" 60 "Cyan"
Write-Log " totle realtime monitor" "Cyan"
Write-Log " Target port : $TargetPort"                "Cyan"
Write-Log " Log file    : $logFile"                   "Cyan"
Write-Log " Stop        : Ctrl+C"                     "Cyan"
Write-Sep "=" 60 "Cyan"
Write-Log ""

# -- Snapshot of existing connections at startup -------------------
$prevConns = @{}

$initConns = Get-NetTCPConnection -RemotePort $TargetPort -ErrorAction SilentlyContinue
if ($initConns) {
    foreach ($c in $initConns) {
        $key = "$($c.LocalPort)-$($c.RemoteAddress)-$($c.RemotePort)"
        $prevConns[$key] = $c.State
    }
    Write-Log "[*] $($initConns.Count) existing connection(s) on port $TargetPort at startup" "DarkGray"
} else {
    Write-Log "[*] No existing connections on port $TargetPort" "DarkGray"
}

Write-Log "[*] Monitoring ... (Ctrl+C to stop)" "Green"
Write-Log ""

# -- Realtime loop -------------------------------------------------
try {
    while ($true) {
        Start-Sleep -Milliseconds 300

        $currentConns = @{}

        try {
            $conns = Get-NetTCPConnection -RemotePort $TargetPort -ErrorAction SilentlyContinue
            if ($conns) {
                foreach ($conn in $conns) {
                    $key = "$($conn.LocalPort)-$($conn.RemoteAddress)-$($conn.RemotePort)"
                    $currentConns[$key] = $conn.State

                    # New connection
                    if (-not $prevConns.ContainsKey($key)) {
                        $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
                        if ($proc) {
                            Show-Connection -Conn $conn -Proc $proc -IsNew $true
                        }
                    } else {
                        # State changed
                        if ($prevConns[$key] -ne $conn.State) {
                            Show-StateChange -Key $key `
                                -OldState $prevConns[$key] `
                                -NewState $conn.State
                        }
                    }
                }
            }
        } catch {}

        # Detect closed connections
        foreach ($key in $prevConns.Keys) {
            if (-not $currentConns.ContainsKey($key)) {
                $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss.fff"
                Write-Log "[$ts] CLOSED $key" "DarkGray"
            }
        }

        $prevConns = $currentConns
    }
} finally {
    Write-Log ""
    Write-Sep "=" 60 "Yellow"
    Write-Log "[*] Monitor stopped. Total captured: $($script:totalReq)" "Yellow"
    Write-Log "[*] Log saved: $logFile" "Yellow"
    Write-Sep "=" 60 "Yellow"
}