Hardening — Anti-Cheat · Anti-RE · Anti-Inject

Production-grade client protection for LibreAuth — maximize bypass resistance in your build.

Three-Layer Overview

Wire — MITM / Fake API Protection

1. Verify X-Signature-Ed25519 + timestamp before parsing JSON — see Response Signing
2. Send 35-char enckey on init → AES-encrypted body
3. Do not embed Application Secret in the client — use Ed25519 public key only
4. HTTPS only · pin certificate in native client when possible

Hash Check — Binary Patch Protection

1. Build release → LibreAuth Protect L3 seal / obfuscate → then compute MD5
2. Client sends hash= on every init call
3. Even a 1-byte jmp/nop patch → MD5 changes → server rejects
4. Optional panel toggle Auto-ban on Hash Reject (hash_auto_ban) — bans HWID + linked users on reject

Fix errors: Hash troubleshooting · Access controls: hash_auto_ban

Reverse Engineering — Making RE Harder

Server protects the wire · but attackers can open the exe in x64dbg if the client is not hardened:

Ship checklist — กัน RE สุดที่ระบบทำได้

ชั้นใน SDK (AntiRe.Gate · ApiSeal · Integrity · SessionGate · SecureLoader) ครบแล้ว — สิ่งที่ยังขาดตอนแจกคือ policy ฝั่งเซิร์ฟ + แพ็กเกอร์ ไม่ใช่ไฟล์ใหม่ใน repo

1. AntiRe.Boot() + Gate() ก่อน Init · ห้าม ship ด้วย LA_ANTIRE=0
2. SessionGate.Boot(build) → Init → License → MarkLicensed() → ฟังก์ชันจริงใช้ AssertEntitlement / RequireFeatureOrDie ไม่ใช่แค่ if ใน UI
3. Panel: Hash Check + อัปโหลด MD5/SHA256 ของไฟล์ที่ seal แล้ว · Min client build บัมป์ทุกปล่อย · Redis เปิด (idle TTL + check_stale)
4. Enterprise: Protocol v2 + type=feature + เปิด Require Feature Ack สำหรับฟีเจอร์แพง
5. แพ็กเกอร์ก่อนแจก — C++ SecureLoader L3 · C# ConfuserEx / Native AOT · Python Nuitka · Go garble — ไม่มีชั้นนี้สตริงใน SDK ยังอ่านได้

HasFeature ของแพ็กคีย์คืน false จนกว่าจะ MarkLicensed (license seal) · Lite ที่ไม่มี files/chat โดน 403 จากเซิร์ฟแม้แพตช์ client

Anti-Inject — DLL / Hook / Debugger Protection

Attackers often inject DLLs or attach debuggers to bypass auth — hardening.hpp / Hardening.cs runs multi-layer runtime checks:

• Debugger — attached debuggers and remote debugging
• Breakpoints — hardware breakpoint registers
• Loaded modules — suspicious injected DLLs and hook libraries (incl. fivem-dumper)
• Process scan — CE / IDA / UD / x64dbg / dumpers and known analysis tools
• Window scan — tool windows when enabled
• AI assist — optional (block_ai) — coding agents / Hermes / local LLMs (exe + install path + window title)
• VM detect — virtual machine environments (configurable threshold)
• Emulator detect — hosts/DNS hijack, local fake API ports, known bypass tool artifacts, BlueStacks/Nox/LDPlayer processes
• DNS freshness — trust.hpp compares system DNS vs 1.1.1.1/8.8.8.8 before every API call

1. Call la_guard::RunChecksWithUrl(apiUrl, blockVm, blockAi) before init() and every 30–60 seconds
2. Inspect fail reason: la_guard::FailName(la_guard::LastFail())
3. If policy.tool_auto_ban: call Ban("tool:" + fail) then exit
4. Development on a VM: LA_ALLOW_VM=1 · AI tools (Cursor/Hermes) during dev: keep block_ai OFF or LA_ALLOW_AI=1
5. Remote support (UltraViewer / TeamViewer / AnyDesk): auto-allow when process is present — skips false CheckRemoteDebuggerPresent + soft hook modules. Force with LA_ALLOW_REMOTE=1; strict with LA_ALLOW_REMOTE=0. SDK also retries canceled/timeout license HTTP under remote sessions.
6. Call check() heartbeat alongside the guard loop

Anti Fake API — Local Auth Bypass

Local emulators redirect traffic to 127.0.0.1:5000 — server never sees those requests. Defense is client-side:

• trust.hpp — block localhost URLs, require HTTPS, detect DNS hijack (system vs fresh resolver)
• hardening.hpp — detect emulator processes, UDP:53 hijacker, loopback listeners on 5000/443
• /api/1.4/ + wire token — fake servers must implement LibreAuth wire (harder)
• Hash check + IntegrityGuard on server — blocks patched binaries when they hit real API

Multi-language Hardening

API surface matches C++: RunChecks(blockVm, blockAi=false), RunChecksWithUrl, LastFail / FailName, optional ExeMd5Hex / Hwid. Every SDK exposes RunChecks; non-Windows hosts return true (same as C++ #else).

• Native RE resistance (canonical) — sdk/cpp/hardening.hpp + shield.hpp (+ optional sdk/cpp/kernel/)
• Enterprise C++ pack — vendor lock, forced Guard in .lib, SecureLoader L3 — C++ Pack guide
• Full native Windows heuristics — sdk/csharp/Hardening.cs · sdk/python/hardening.py
• Windows heuristics (all other SDKs) — PHP, JS/TS, Go, Java, Rust, Perl, Ruby — process/window/module/emulator/VM probes aligned with C++ lists (via native APIs or tasklist / PowerShell where needed)

Kernel-driver parity remains C++ only. Call RunChecks before Init/Login on Windows clients.

C++ — Hardening Snippet

Minimal client bootstrap using the public headers hardening.hpp + libreauth.hpp (DNS freshness comes from trust.hpp, pulled in by hardening.hpp):

#include "hardening.hpp"
#include "libreauth.hpp"

int main() {
    const char* api = "https://your-host/api/v2/";
    if (!la_guard::RunChecksWithUrl(api, true, false)) {
        return 1;
    }

    la::v2::Client app("MyApp", "OWNER_ID_10", api, "SIGN_PUB_HEX");
    auto init = app.Init(la_guard::ExeMd5Hex());
    la_auth::ApplyInitPolicy(init);
    app.License("KEY", la_guard::Hwid());

    while (running) {
        bool blockAi = la_auth::BlockAi();
        if (!la_guard::RunChecksWithUrl(api, true, blockAi)) {
            if (la_auth::ToolAutoBan()) {
                app.Ban(std::string("tool:") + la_guard::FailName(la_guard::LastFail()));
            }
            break;
        }
        Sleep(45000);
    }
    return 0;
}

Files: sdk/cpp/hardening.hpp · sdk/cpp/shield.hpp · sdk/cpp/trust.hpp · sdk/cpp/bind.hpp · C++ setup · C++ Pack (Enterprise)

C++ — Optional Kernel Guard (advanced)

An OPTIONAL WDM sample driver (sdk/cpp/kernel/) adds a kernel vantage point that usermode cannot spoof: kernel-debugger detection and soft ObRegisterCallbacks protection of the loader's own PID. The usermode bridge sdk/cpp/kernel_bridge.hpp fails soft — if the driver is absent the loader continues with the usermode hardening.hpp guard only (no tamper).

• What it does — LA_IOCTL_QUERY returns KD debugger flags; LA_IOCTL_REGISTER_PID shields the loader PID from usermode TerminateProcess / WriteProcessMemory / suspend. KernelMode / System callers always pass through.
• Tamper response — on a post-auth trip the loader's ReportTamperThenDie best-effort LogError + Ban (blacklists HWID/IP/user via the PHP Ban endpoint) then GuardAbort. Pre-auth trips abort only (no session yet).
• Not malware — no object hiding, no SSDT hooks, no global Task Manager block, no service install from the loader, DEMAND_START only.
• Signing — lab: bcdedit /set testsigning on (never ship test-signed). Production: EV code-signing + Microsoft WHQL/attestation. The loader does not install or auto-start the driver.

Build/steps: sdk/cpp/kernel/README.md · bridge: sdk/cpp/kernel_bridge.hpp

C# / Unity / WPF

• Obfuscate with ConfuserEx / Dotfuscator / commercial .NET obfuscator + LA1 gate
• Check Debugger.IsAttached + Environment.GetEnvironmentVariable for profilers
• Use LibreAuth.cs · verify signature before trusting response
• Unity: IL2CPP build is harder to RE than Mono · do not store keys in plain ScriptableObject

FiveM / Lua

• Client Lua is always modifiable — use auth as a gate only
• Critical logic (give item, teleport) must be validated server-side in the resource
• Use libreauth.lua for license gate · heartbeat check()

Pre-Release Checklist