ApiSeal
Lock SDK API endpoints behind Anti-RE — strip the gate and the client cannot call the API.
INFO
Why it exists
Reverse engineers often dump the auth base URL from the binary and replay init/license without your protection stack. ApiSeal stores the endpoint as XOR-masked bytes and only decrypts after AntiRe.Gate() arms a runtime token. Remove or NOP the gate without arming → Resolve() returns empty → every request fails closed.
Client flow
new Client(url)→Bind(url)(plaintext field cleared)AntiRe.Gate()success →Arm()- HTTP post uses
Resolve()only — never a stored plain URL DieSilent/ gate failure →Disarm()
// C#
using var app = new LibreAuthV2(name, owner, url, pub);
if (!AntiRe.Gate()) return;
await app.InitAsync(...);
// Python
client = LibreAuthV2(name, owner, url, pub)
if not gate():
return
client.init(...)
WARN
Order matters: Bind then Gate. Arming before Bind is a no-op; call Gate again after constructing the client.
Shared API
| Call | Role |
|---|---|
Bind(url) | Seal endpoint material |
Arm() | Gate/Pulse success only |
Disarm() | Tamper / kill / gate fail |
Resolve() | URL or empty if locked |
PathV2() | Obfuscated /api/v2/ for MAC canonical |
Modules by language
| SDK | File |
|---|---|
| C# / WPF / VB / Unity | ApiSeal.cs |
| C++ | api_seal.hpp |
| Python / PHP / JS / TS / Go / Java / Rust / Ruby / Perl / Lua | api_seal.* / ApiSeal.* / api-seal.* |
| React / Vue | BFF only — never in the browser |
Opaque ship
Needles, trip codes, and API path blobs are sealed in the SDK. That still leaves method names and IL readable on .NET until you run an obfuscator.
- C# / WPF / VB / Unity — ConfuserEx / Obfuscar / IL2CPP
- C++ — SecureLoader + strip PDB
- Go —
garble -literals· Rust — strip + LTO · Java — ProGuard/R8 - Python — Nuitka · JS/TS — javascript-obfuscator or BFF-only
คู่มือผู้ค้า: Ship Opaque
Limits
- Not a substitute for commercial packers — raises RE cost; server policy remains authoritative
LA_ANTIRE=0skips tool checks but still Arms so local/dev traffic works- Ship with Hash Check,
min_client_build, Redis heartbeat, and SessionGate
INFO