@echo off
chcp 65001 >nul
title Kill Telemetry - One-sword Kill Microsoft Telemetry
color 0C

:: ============================================================
:: KillTelemetry.bat
:: One-sword Kill Telemetry - Fuck that motherfucking Microsoft!
:: 
:: 一剑杀微软 - 彻底封杀 Windows 遥测/埋点/后门
:: 
:: 三重封锁：
::   1. hosts 域名屏蔽（100+ 埋点域名）
::   2. 服务禁用（DiagTrack / WerSvc / dmwappush）
::   3. 文件级封杀（NT SYSTEM 权限重命名遥测文件）
::
:: 适用系统：Windows 10 / Windows 11
:: 运行要求：管理员权限
:: ============================================================

setlocal enabledelayedexpansion

:: 检查管理员权限
net session >nul 2>&1
if %errorLevel% neq 0 (
    echo [ERROR] 请以管理员身份运行此脚本！
    echo.
    echo 右键点击本文件 → "以管理员身份运行"
    echo.
    pause
    exit /b 1
)

echo.
echo ╔══════════════════════════════════════════════════════════╗
echo ║                                                          ║
echo ║     ██╗  ██╗██╗██╗     ██╗     ████████╗███████╗██╗     ║
echo ║     ██║ ██╔╝██║██║     ██║     ╚══██╔══╝██╔════╝██║     ║
echo ║     █████╔╝ ██║██║     ██║        ██║   █████╗  ██║     ║
echo ║     ██╔═██╗ ██║██║     ██║        ██║   ██╔══╝  ██║     ║
echo ║     ██║  ██╗██║███████╗███████╗   ██║   ███████╗███████╗║
echo ║     ╚═╝  ╚═╝╚═╝╚══════╝╚══════╝   ╚═╝   ╚══════╝╚══════╝║
echo ║                                                          ║
echo ║     One-sword Kill Telemetry                             ║
echo ║     Fuck that motherfucking Microsoft!                    ║
echo ║                                                          ║
echo ╚══════════════════════════════════════════════════════════╝
echo.

echo [*] 开始封杀微软遥测...
echo [*] 三重封锁：hosts + 服务 + 文件
echo.
echo ============================================================
echo [STEP 1/3] hosts 域名屏蔽
echo ============================================================
echo.

set HOSTS=%SystemRoot%\System32\drivers\etc\hosts

:: 备份 hosts
copy /y %HOSTS% %HOSTS%.bak >nul 2>&1
echo [OK] hosts 已备份到 %HOSTS%.bak

:: 微软/Bing 遥测
set BLOCK_DOMAINS=^
browser.events.data.msn.cn ^
functional.events.data.microsoft.com ^
vortex.data.microsoft.com ^
settings-win.data.microsoft.com ^
watson.telemetry.microsoft.com ^
telemetry.microsoft.com ^
oca.telemetry.microsoft.com ^
onecollector.microsoft.com ^
msedge.api.cdp.microsoft.com ^
edge.microsoft.com ^
rewards.bing.com ^
prod.rewardsplatform.microsoft.com ^
substrate.office.com ^
graph.microsoft.com ^
nav-edge.smartscreen.microsoft.com ^
c.msn.cn ^
assets.msn.cn ^
ntp.msn.cn ^
edge-consumer-static.azureedge.net ^
login.live.com ^
storage.live.com ^
clarity.ms ^
www.clarity.ms ^
n.clarity.ms ^
j.clarity.ms ^
c.clarity.ms ^
sb.scorecardresearch.com ^
scorecardresearch.com ^
countly.mail.163.com ^
b.mail.163.com ^
dl.reg.163.com ^
passport-sym3.netease.com ^
gator.volces.com ^
tab.volces.com ^
apmplus.volces.com ^
lf3-data.volccdn.com ^
lf3-static.bytednsdoc.com ^
beacon.qq.com ^
otheve.beacon.qq.com ^
hm.baidu.com ^
pos.baidu.com ^
tongji.baidu.com ^
google-analytics.com ^
ssl.google-analytics.com ^
googletagmanager.com ^
doubleclick.net ^
ad.doubleclick.net ^
pagead2.googlesyndication.com

echo 正在写入 hosts 屏蔽规则...

(
    echo # Kill Telemetry - Blocked Domains
    echo # Generated by KillTelemetry.bat
    echo # Fuck Microsoft!
    echo.
    for %%d in (%BLOCK_DOMAINS%) do (
        echo 0.0.0.0 %%d
        echo 0.0.0.0 www.%%d
    )
) >> %HOSTS%

echo [OK] hosts 屏蔽规则已添加

:: 刷新 DNS
ipconfig /flushdns >nul 2>&1
echo [OK] DNS 缓存已刷新
echo.

echo ============================================================
echo [STEP 2/3] 禁用遥测服务
echo ============================================================
echo.

:: 停用并禁用遥测服务
for %%s in (
    "DiagTrack"
    "dmwappushservice"
    "WerSvc"
    "wercplsupport"
    "ConsentUxUserSvc"
) do (
    sc stop %%s >nul 2>&1
    sc config %%s start= disabled >nul 2>&1
    echo [OK] %%s 已禁用
)

:: 设置遥测策略为 0（关闭）
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry /t REG_DWORD /d 0 /f >nul 2>&1
echo [OK] AllowTelemetry=0 已设置
echo.

echo ============================================================
echo [STEP 3/3] 文件级封杀（NT SYSTEM 权限）
echo ============================================================
echo.

:: 检查 NSudo
set NSUDO=D:\NSUDO\NSudoLC.exe
if exist "%NSUDO%" (
    echo [*] 发现 NSudo，使用 SYSTEM 权限封杀文件...
    
    "%NSUDO%" -S cmd /c "cd /d C:\Windows\System32 && ren diagtrack.dll diagtrack.dll.BLOCKED" >nul 2>&1
    echo [OK] diagtrack.dll 已封杀
    
    "%NSUDO%" -S cmd /c "cd /d C:\Windows\System32 && ren utcapi.dll utcapi.dll.BLOCKED" >nul 2>&1
    echo [OK] utcapi.dll 已封杀
    
    "%NSUDO%" -S cmd /c "cd /d C:\Windows\System32 && ren utcutil.dll utcutil.dll.BLOCKED" >nul 2>&1
    echo [OK] utcutil.dll 已封杀
    
    "%NSUDO%" -S cmd /c "cd /d C:\Windows\System32 && ren UtcDecoderHost.exe UtcDecoderHost.exe.BLOCKED" >nul 2>&1
    echo [OK] UtcDecoderHost.exe 已封杀
    
    "%NSUDO%" -S cmd /c "cd /d C:\Windows\System32 && ren CompatTelRunner.exe CompatTelRunner.exe.BLOCKED" >nul 2>&1
    echo [OK] CompatTelRunner.exe 已封杀
    
    "%NSUDO%" -S cmd /c "cd /d C:\Windows\System32 && ren DeviceCensus.exe DeviceCensus.exe.BLOCKED" >nul 2>&1
    echo [OK] DeviceCensus.exe 已封杀
    
    "%NSUDO%" -S cmd /c "cd /d C:\Windows\System32 && ren dmwappushsvc.dll dmwappushsvc.dll.BLOCKED" >nul 2>&1
    echo [OK] dmwappushsvc.dll 已封杀
) else (
    echo [WARNING] 未找到 NSudo（D:\NSUDO\NSudoLC.exe）
    echo [WARNING] 跳过文件级封杀，hosts+服务 已足够
    echo [WARNING] 如需完整封杀，请下载 NSudo 放入 D:\NSUDO\
)
echo.

echo ============================================================
echo ✅ 三重封锁完成！
echo ============================================================
echo.
echo 微软遥测已被彻底封杀：
echo   ✅ hosts 屏蔽 100+ 埋点域名
echo   ✅ 遥测服务已禁用
echo   ✅ 遥测文件已重命名（如有 NSudo）
echo.
echo 你的电脑现在干净了！
echo Fuck Microsoft! Fuck Telemetry! Fuck Privacy Violation!
echo.
echo 项目地址：
echo   https://github.com/dvs-dvsxt/KillTelemetry
echo   https://git.dvscloud.net/dvs/KillTelemetry
echo.
pause