Hardening — Anti-Cheat · Anti-RE · Anti-Inject

Production-grade client protection for LibreAuth — maximize bypass resistance in your build.

Three-Layer Overview

Wire — MITM / Fake API Protection

1. Verify X-Signature-Ed25519 + timestamp before parsing JSON — see Response Signing
2. Send 35-char enckey on init → AES-encrypted body
3. Do not embed Application Secret in the client — use Ed25519 public key only
4. HTTPS only · pin certificate in native client when possible

Hash Check — Binary Patch Protection

1. Build release → LibreAuth Protect L3 seal / obfuscate → then compute MD5
2. Client sends hash= on every init call
3. Even a 1-byte jmp/nop patch → MD5 changes → server rejects

Fix errors: Hash troubleshooting

Reverse Engineering — Making RE Harder

Server protects the wire · but attackers can open the exe in x64dbg if the client is not hardened:

Anti-Inject — DLL / Hook / Debugger Protection

Attackers often inject DLLs or attach debuggers to bypass auth — hardening.hpp runs multi-layer runtime checks:

• Debugger — attached debuggers and remote debugging
• Breakpoints — hardware breakpoint registers
• Loaded modules — suspicious injected DLLs and hook libraries
• Process scan — known analysis and tampering tools
• Window scan — tool windows when enabled
• VM detect — virtual machine environments (configurable threshold)
• Emulator detect — hosts/DNS hijack, local fake API ports, known bypass tool artifacts, BlueStacks/Nox/LDPlayer processes
• DNS freshness — trust.hpp compares system DNS vs 1.1.1.1/8.8.8.8 before every API call

1. Call la_guard::RunChecksWithUrl(apiUrl) before init() and every 30–60 seconds
2. Inspect fail reason: la_guard::FailName(la_guard::LastFail())
3. Development on a VM: contact your maintainer for dev-build guidance
4. Call check() heartbeat alongside the guard loop

Anti Fake API — Local Auth Bypass

Local emulators redirect traffic to 127.0.0.1:5000 — server never sees those requests. Defense is client-side:

• trust.hpp — block localhost URLs, require HTTPS, detect DNS hijack (system vs fresh resolver)
• hardening.hpp — detect emulator processes, UDP:53 hijacker, loopback listeners on 5000/443
• /api/1.4/ + wire token — fake servers must implement LibreAuth wire (harder)
• Hash check + IntegrityGuard on server — blocks patched binaries when they hit real API

Multi-language Hardening

API surface matches C++: RunChecks(blockVm), RunChecksWithUrl, LastFail / FailName, optional ExeMd5Hex / Hwid. Every SDK exposes RunChecks; non-Windows hosts return true (same as C++ #else).

• Native RE resistance (canonical) — sdk/cpp/hardening.hpp + shield.hpp (+ optional sdk/cpp/kernel/)
• Enterprise C++ pack — vendor lock, forced Guard in .lib, SecureLoader L3 — C++ Pack guide
• Full native Windows heuristics — sdk/csharp/Hardening.cs · sdk/python/hardening.py
• Windows heuristics (all other SDKs) — PHP, JS/TS, Go, Java, Rust, Perl, Ruby — process/window/module/emulator/VM probes aligned with C++ lists (via native APIs or tasklist / PowerShell where needed)

Kernel-driver parity remains C++ only. Call RunChecks before Init/Login on Windows clients.

C++ — Hardening Snippet

Minimal client bootstrap using the public headers hardening.hpp + libreauth.hpp (DNS freshness comes from trust.hpp, pulled in by hardening.hpp):

#include "hardening.hpp"
#include "libreauth.hpp"

int main() {
    const char* api = "https://your-host/api/1.4/";
    if (!la_guard::RunChecksWithUrl(api)) {
        return 1;
    }

    la::Client app("MyApp", "OWNER_ID_10", "1.0", api);
    app.Init(la_guard::ExeMd5Hex());
    app.License("KEY", la_guard::Hwid());

    while (running) {
        if (!la_guard::RunChecksWithUrl(api)) break;
        Sleep(45000);
    }
    return 0;
}

Files: sdk/cpp/hardening.hpp · sdk/cpp/shield.hpp · sdk/cpp/trust.hpp · sdk/cpp/bind.hpp · C++ setup · C++ Pack (Enterprise)

C++ — Optional Kernel Guard (advanced)

An OPTIONAL WDM sample driver (sdk/cpp/kernel/) adds a kernel vantage point that usermode cannot spoof: kernel-debugger detection and soft ObRegisterCallbacks protection of the loader's own PID. The usermode bridge sdk/cpp/kernel_bridge.hpp fails soft — if the driver is absent the loader continues with the usermode hardening.hpp guard only (no tamper).

• What it does — LA_IOCTL_QUERY returns KD debugger flags; LA_IOCTL_REGISTER_PID shields the loader PID from usermode TerminateProcess / WriteProcessMemory / suspend. KernelMode / System callers always pass through.
• Tamper response — on a post-auth trip the loader's ReportTamperThenDie best-effort LogError + Ban (blacklists HWID/IP/user via the PHP Ban endpoint) then GuardAbort. Pre-auth trips abort only (no session yet).
• Not malware — no object hiding, no SSDT hooks, no global Task Manager block, no service install from the loader, DEMAND_START only.
• Signing — lab: bcdedit /set testsigning on (never ship test-signed). Production: EV code-signing + Microsoft WHQL/attestation. The loader does not install or auto-start the driver.

Build/steps: sdk/cpp/kernel/README.md · bridge: sdk/cpp/kernel_bridge.hpp

C# / Unity / WPF

• Obfuscate with ConfuserEx / Dotfuscator / commercial .NET obfuscator + LA1 gate
• Check Debugger.IsAttached + Environment.GetEnvironmentVariable for profilers
• Use LibreAuth.cs · verify signature before trusting response
• Unity: IL2CPP build is harder to RE than Mono · do not store keys in plain ScriptableObject

FiveM / Lua

• Client Lua is always modifiable — use auth as a gate only
• Critical logic (give item, teleport) must be validated server-side in the resource
• Use libreauth.lua for license gate · heartbeat check()

Pre-Release Checklist