#!/usr/bin/env python3
"""
Better payload extraction - save raw payload to file for inspection
"""
import re

print("Extracting raw payload from document.xml...")

with open('extracted_invoice/word/document.xml', 'r', encoding='utf-8') as f:
    xml_content = f.read()

# Find textbox content
textbox_match = re.search(r'<w:txbxContent>(.*?)</w:txbxContent>', xml_content, re.DOTALL)

if textbox_match:
    textbox_content = textbox_match.group(1)
    
    # Extract all text within w:t tags
    text_matches = re.findall(r'<w:t[^>]*>(.*?)</w:t>', textbox_content, re.DOTALL)
    
    if text_matches:
        full_text = ''.join(text_matches)
        parts = full_text.split('|')
        
        if len(parts) >= 3:
            raw_payload = parts[2]
            
            # Save to file
            with open('payload.txt', 'w', encoding='utf-8') as f:
                f.write(raw_payload)
            
            print(f"Payload saved to payload.txt ({len(raw_payload)} characters)")
            print(f"\nFirst 200 characters:")
            print(raw_payload[:200])
            print(f"\n...Last 200 characters:")
            print(raw_payload[-200:])
            
            # Check if it looks like base64
            print(f"\nPayload characteristics:")
            print(f"  - Contains uppercase: {any(c.isupper() for c in raw_payload[:100])}")
            print(f"  - Contains lowercase: {any(c.islower() for c in raw_payload[:100])}")
            print(f"  - Contains digits: {any(c.isdigit() for c in raw_payload[:100])}")
            print(f"  - Contains +/=: {'+' in raw_payload[:100] or '/' in raw_payload[:100] or '=' in raw_payload[-10:]}")