Anti-Tamper
How LibreAuth protects sessions — and what your client must do.
INFO
Panel toggles explained in detail: Access Controls — maps 1:1 to Settings → Access Controls in your panel.
Protection Layers
| Feature | Description |
|---|---|
| Ed25519 signing | Client verifies response authenticity |
| AES encryption | Encrypted wire body with enckey |
| Anti-Tamper | IP bind, replay block, HWID session lock |
| Hash Check | Exe MD5 must match server whitelist |
| Nonce Chain | One-time nonce per request |
| Token File Check | Validate token + thash on init (C++) |
Client Requirements
- Send
hash=MD5 of exe on init when hash check is enabled - Use correct Ed25519 public key from
initresponse - Send same
hwidon login, license, and check - Return
noncefrom init on every subsequent request - Call
check()periodically - Obfuscate strings in binary — see Hardening Guide
Common Errors
| Message | Fix |
|---|---|
| Hash required / E04 | Send hash on init |
| E05 | Exe MD5 mismatch — hash troubleshooting |
| Invalid nonce / E11 | Update SDK · send nonce on every request after init |
| Session IP mismatch / E10 | Reconnect from same network |
| Duplicate request / E12 | Don't replay captured requests — wait before retrying |
| HWID session mismatch / E13 | Send same hwid on all requests |
INFO
Native hardening: Hardening Guide · Signing: Response Signing