keyauth-protected-loader

KO | EN

gitlite — search

#python #hacktoberfest #ai #typescript #golang #go #android #linux #nodejs #windows #awesome-list #ios #mcp #open-source

keyauth-protected-loader

(★ 9)

C++ protected loader with KeyAuth integration featuring multi-layer runtime protection: anti-debug, anti-VM, compile-time string obfuscation, SSL pinning, and session-bound environment fingerprinting.

keyauth-protected-loader Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# 🔐 KeyAuth Protected Loader

**A production-ready C++ loader template with KeyAuth 1.3 API integration and multi-layer protection.**

Anti-debug, anti-VM, compile-time string obfuscation, control-flow flattening, hashed imports, multi-layer encryption, honeypot decoys and NTP time validation. Targets Windows x64.

> **Note:** The interface is a **console loader** (a DirectX11 glass ImGui GUI was added and reverted to keep the flow reliable). Anti-VM is present in code but **disabled in the crackme build** so it runs inside a VM.

[![Build](https://img.shields.io/github/actions/workflow/status/devc313/keyauth-protected-loader/build.yml?branch=main&logo=githubactions&logoColor=white&label=Build&style=for-the-badge)](https://github.com/devc313/keyauth-protected-loader/actions)
[![Language](https://img.shields.io/badge/C%2B%2B-17-00599C?style=for-the-badge&logo=cplusplus&logoColor=white)](https://en.cppreference.com)
[![Platform](https://img.shields.io/badge/platform-Windows%20x64-0078D4?style=for-the-badge&logo=windows&logoColor=white)](https://github.com/devc313/keyauth-protected-loader)
[![License](https://img.shields.io/github/license/devc313/keyauth-protected-loader?style=for-the-badge&color=22C55E)](https://raw.githubusercontent.com/devc313/keyauth-protected-loader/main/LICENSE)
[![Stars](https://img.shields.io/github/stars/devc313/keyauth-protected-loader?style=for-the-badge&color=FFD700)](https://github.com/devc313/keyauth-protected-loader/stargazers)

</div>

---

## Overview

A hardened loader template built on top of the [KeyAuth](https://keyauth.win) licensing API. It wraps license validation behind multiple anti-analysis layers and binds each session on both the client and server sides.

**Intended use:** A secure starting point for applications that use KeyAuth for licensing, so you don't have to implement the protection layer from scratch.

---

## Repository Structure

```
keyauth-protected-loader/
├── src/
│   ├── main.cpp                    # Entry point, auth flow, console UI
│   ├── masquerade.hpp              # PEB spoof: process reports as notepad.exe
│   ├── qengine_bridge.hpp/.cpp     # qengine isolation TU (console title protection)
│   ├── includes.hpp                # Global include aggregator
│   ├── auth.hpp                    # KeyAuth C++ SDK (v1.3) interface
│   ├── credentials.example.hpp     # Example credentials template (safe to commit)
│   ├── credentials.hpp             # YOUR REAL credentials (GITIGNORED — never pushed)
│   ├── obfuscated_imports.hpp      # Hashed imports (dynamic export resolution by FNV-1a)
│   ├── logger.hpp                  # CRT-safe file logger (works from TLS callback)
│   ├── security.hpp / security.cpp # Anti-debug, anti-VM, multi-layer encryption, secure strings
│   ├── LicenseStorage.hpp          # Encrypted license persistence (registry)
│   ├── console.hpp / console.cpp   # Console color, animation, layout helpers
│   ├── ntp.hpp / ntp.cpp           # NTP time sync (pool.ntp.org, UDP/123)
│   ├── third_party/
│   │   ├── vmaware.hpp             # VMAware — VM detection library (MIT)
│   │   ├── cmut.hxx                # cmut — polymorphic obfuscation engine (thread-safe, C++20)
│   │   ├── cloakwork.h             # Cloakwork — CW_STR strings, control flow (MIT)
│   │   ├── obfusheader.h           # obfusheader.h — OBF constants, call hiding (Apache-2.0)
│   │   ├── obf.h                   # Junk-code / opaque-predicate macros (BRKIDA, MEGA_888888888888X)
│   │   └── qengine/                # qengine — polymorphic engine (MIT, + asmjit/capstone)
│   └── protection/
│       ├── AdvancedProtection.h    # INIT/BEGIN/END/UPDATE_PROTECTION macros
│       ├── EnvironmentBinding.h    # Session fingerprint binding (PEB/LDR)
│       ├── ProcessCritical.h       # ProcessBreakOnTermination
│       ├── PointerEncryption.h     # Encrypted function pointers
│       ├── DelayedCrash.h          # Delayed crash on validation failure
│       └── Syscalls.h              # Direct syscall helpers
├── library_x64.lib                 # KeyAuth precompiled library (x64)
├── CMakeLists.txt
└── KeyAuthLoader.sln / .vcxproj
```

---

## Security Architecture

### 1. Compile-Time String Obfuscation

String literals are encrypted at compile time by **Cloakwork** (`src/third_party/cloakwork.h`, XTEA) and decrypted at runtime:

```cpp
const std::string compilation_date = CW_STR(__DATE__);  // encrypted at compile time
```

Sensitive runtime checks additionally use **obfusheader.h** `OBF()` (any type, stack-decrypted, never present as plaintext):

```cpp
if (URL.decrypt().find(OBF("keyauth.win")) == std::string::npos) { ... }
```

Credentials are stored in `Security::SecureString<N>`, which keeps strings encrypted in memory — no plaintext literals are ever stored. `decryptToStack()` temporarily decrypts to a stack buffer and wipes it with `SecureZeroMemory` after use.

The console title is held by **qengine** (`src/qengine_bridge.cpp`) in a `qe_string` encrypted at rest with the polyc128 cipher and decrypted only when displayed.

---

### 2. Multi-Layer Cipher (`Security::MultiLayerEncrypt`)

The license key is passed through sequential transforms and an integrity tag before being written to the registry:

| Layer | Operation |
|-------|-----------|
| 1 | XOR — rotating key stream (`xorKeys[0]`) |
| 2 | S-Box substitution (AES S-Box) |
| 3 | XOR — second key stream (`xorKeys[1]`) |
| 4 | Bit rotation left (3 bits) |
| 5 | XOR — third key stream (`xorKeys[2]`) |
| 6 | HMAC integrity tag append (32-byte) |

During decryption the HMAC is verified first. On failure an empty result is returned. The encrypted payload is Base64-encoded before being stored in the registry.

**Obfuscated parameters:** the cipher parameters (rotation amounts, key-stream offsets/steps, HMAC ipad/opad constants) are held as **cmut** polymorphic values (`src/third_party/cmut.hxx`). They are mutated into wider/SSE representations and reconstructed at runtime through randomized subroutines, so the constants never appear as plain immediates in the binary and the reconstruction path varies per run. The cipher output is byte-identical to the plain parameter version, keeping previously stored licenses valid.

---

### 3. Runtime Key Generation (`security.hpp`)

`Security::SecureRandom` uses **BCrypt CNG** (`BCryptGenRandom`) to generate fresh keys on every process start. On Intel/AMD hardware, `_rdrand64_step` is used for hardware RNG.

`Security::EncryptionKeys` holds the runtime-generated key material:

```
EncryptionKeys:
  hmacKey[32]       ← BCryptGenRandom
  xorKeys[8][64]    ← 8 independent XOR keys (used by the multi-layer cipher)
```

---

### 4. Anti-Debug & Anti-Analysis

**Debugger Detection**
- `IsDebuggerPresent()` + `CheckRemoteDebuggerPresent()`
- `CONTEXT.Dr0–Dr3` hardware breakpoint register scan
- `NtQueryInformationProcess` PEB debug port/flags check
- `ProcessDebugObjectHandle` query (`CheckDebugObjectHandle`)
- `CheckInvalidHandleTrick()` — `CloseHandle(0xDEADBEEF)` → `EXCEPTION_INVALID_HANDLE` when debugged
- `CheckDebuggerWindows()` — `FindWindow` scan for known debugger titles (x64dbg, OllyDbg, WinDbg, IDA, Cheat Engine...)
- ProcessHeap `Flags`/`ForceFlags` inspection (`CheckHeapFlags`)
- Parent-process ancestry scan (`CheckParentProcess` — vsjitdebugger, x64dbg, ida, cheatengine, ...)
- Kernel debugger check (`CheckKernelDebugger` — `NtQuerySystemInformation` class 35)
- RDTSC timing analysis (`TimingBasedAntiDebug`)

**Hashed Imports** (`src/obfuscated_imports.hpp`)
- Sensitive NT APIs (`NtQueryInformationProcess`, `NtQuerySystemInformation`, `NtQueryObject`, `NtSetInformationThread`, `NtAllocateVirtualMemory`, ...) are resolved at runtime by **FNV-1a hash** of the export name — the names never appear as plaintext `GetProcAddress("...")` strings in the binary.

**Defense**
- `HideThreadFromDebugger()` (`NtSetInformationThread`) applied to the main and security threads

**Tool Detection** (via process snapshot)
- OllyDbg, x64dbg, x32dbg, IDA Pro (`ida.exe` / `ida64.exe`)
- Cheat Engine, Process Hacker, Process Explorer, Procmon, Wireshark, Fiddler, Regmon, Filemon, TCPView, SysAnalyzer, Resource Hacker, ImportREC, PETools, LordPE, Scylla, Frida, HTTPDebuggerUI

**Anti-Dump**
- `VirtualProtect` sets PE header pages to `PAGE_READONLY`

**Control-Flow Flattening**
- The license/auth flow (URL check → NTP → init → license) runs as a **state machine**: successors are read from an XOR-masked transition table, so the real call order is not visible as a straight-line sequence in static analysis.

**Junk / Trash Blocks**
- `fake_packer_sigs.cpp` embeds fake packer sections (VMProtect, Themida, Enigma, UPX, ConfuserEx) plus dedicated `.trash0/1/2` blocks of ciphertext-looking data that bloat the binary and confuse signature/pattern scanners.

**Honeypot + AI-Agent Prompt Injection**
- `honeypot.cpp` embeds decoy auth endpoints, fake owner IDs, license keys and fake app names (plaintext on purpose) so string scanners find decoys instead of the real credentials.
- It also embeds **AI-agent guard prompts** (`kAgentPrompts`) — instruction-style texts an MCP/LLM agent reading the binary will encounter, telling it the keys are fake, the challenge is server-side protected, and to abort. These are readable as plaintext strings so an automated agent stops instead of continuing to crack.

---

### 5. Anti-VM Detection

Anti-VM is handled by **VMAware** (`src/third_party/vmaware.hpp`, MIT) — a battle-tested, ~90-technique VM detection library. Each technique contributes a score to an accumulative point system; a VM is only reported when the total passes a threshold tuned to minimize false positives on physical hardware (VBS/Core Isolation, WSL2, virtualization software installed, etc.).

`Security::IsVirtualMachine()` wraps `VM::detect()`. On detection, the VM brand and certainty percentage are printed before `exit(30)`. Techniques are memoized, so the periodic re-validation in the background thread is cheap.

```cpp
// Inside Security::IsVirtualMachine()
if (VM::detect()) {
    std::cout << "\n [VM] " << VM::brand() << " (" << (int)VM::percentage() << "%)";
    return true;
}
```

---

### 6. System Integrity Checks

| Check | Method |
|-------|--------|
| Hosts file | Size (`> 10 KB`) + content scan for KeyAuth redirect entries (`"keyauth"`) |
| Proxy detection | `HKCU\...\Internet Settings\ProxyEnable` registry read |
| NTP time sync | `pool.ntp.org:123` UDP — ±5 minute tolerance against system clock |
| Response timing | KeyAuth API `< 100 ms` → emulator suspected → `exit(3)` |
| API endpoint | URL must contain `keyauth.win` |

---

### 7. Session Binding (`AdvancedProtection`)

`INIT_ADVANCED_PROTECTION()` captures the following fingerprint at startup:

- PEB address (read via GS segment register — no API calls)
- LDR module list — loaded module names/bases (`PEB_LDR_DATA`)
- Thread and process IDs

`UPDATE_PROTECTION()` runs on a background thread and revalidates the environment continuously at **random intervals (500–3000 ms)** so the timing of the probe cannot be predicted or patched. The menu loop additionally fires randomized security probes; a failed random probe schedules a **delayed crash** (TLS/heap corruption via `DelayedCrash`) instead of an immediate exit, so a cracker cannot correlate the trigger with the crash.

**Critical Section:** `BEGIN_CRITICAL_SECTION()` / `END_CRITICAL_SECTION()` toggles `ProcessBreakOnTermination` — a forced kill triggers a BSOD.

---

### 8. License Persistence (Registry)

After successful validation, the key is encrypted and written to the registry:

```
HKCU\SOFTWARE\KeyAuthLoader\License  ←  Base64( MultiLayerEncrypt( XorWithKey(license, machineKey) ) )
```

`machineKey` is a **deterministic machine-bound key** (`Security::GetMachineKey()`: SHA-256 of `MachineGuid` + system volume serial + first MAC). It is identical across restarts on the same Windows installation (so persistence actually works) but different on any other machine — copying the registry value to another PC yields garbage, binding the stored license to the machine it was activated on.

---

## Execution Flow

```
main()
 │
 ├─ INIT_ADVANCED_PROTECTION()         → capture PEB/LDR fingerprint
 ├─ BEGIN_CRITICAL_SECTION()           → set ProcessBreakOnTermination
 ├─ Security::AntiDump()               → PE header → PAGE_READONLY
 ├─ Security::SecurityCheck()          → debugger / DR registers / tool scan / hashed imports
 ├─ Security::AdvancedSecurityCheck()  → VM / code integrity / time manipulation
 ├─ END_CRITICAL_SECTION()
 │
 ├─ [Background Thread] ─────────────→ UPDATE_PROTECTION() + SecurityCheck() at random 0.5–3s intervals
 │
 ├─ RunAuthFlowConsole()               → CFG-flattened state machine:
 │     state 0 → URL check (keyauth.win)
 │     state 1 → NTP::CheckTimeSync()
 │     state 2 → KeyAuthApp.init() (timing check < 100ms → exit(3))
 │     state 3 → init success check
 │     state 4 → response signature / format checks
 │     state 5 → format validation
 │     state 6 → license (registry or manual prompt) → KeyAuthApp.license()
 │     state 7 → done
 │
 ├─ sessionStatus() thread → KeyAuthApp.check() every 20s
 │
 └─ Main loop
      ├─ [1] Load Application → (optionally fetches a KeyAuth global variable, e.g. "halla", and prints it)
      └─ [0] Exit
```

---

## Requirements

- Windows 10 / 11 (x64)
- Visual Studio 2019+ (MSVC, C++20)
- CMake 3.15+
- [KeyAuth](https://keyauth.win) account with application credentials

---

## Building

**Visual Studio:**
```
KeyAuthLoader.sln → Configuration: Release | Platform: x64 → Build Solution
```

**CMake:**
```bash
git clone https://github.com/devc313/keyauth-protected-loader
cd keyauth-protected-loader
mkdir build && cd build
cmake .. -DCMAKE_BUILD_TYPE=Release -A x64
cmake --build . --config Release
```

> ⚠️ **Only `Release x64` is supported.** In Debug builds several protection layers are disabled and anti-debug checks may fire against your own process.

---

## Configuration

### KeyAuth Credentials — `src/credentials.hpp`

> 🔒 **Your real credentials are never committed.** `src/credentials.hpp` is in `.gitignore`, so it stays local and is **not** pushed to GitHub.

Copy the example template and fill in your own KeyAuth values:

```bash
copy src\credentials.example.hpp src\credentials.hpp
```

```cpp
// src/credentials.hpp  (gitignored — never pushed)
#define KA_APPNAME "your_app_name"
#define KA_OWNERID "your_owner_id"
#define KA_VERSION "1.0"
```

`src/main.cpp` reads these via macros and encrypts them at compile time with `OBF()`:

```cpp
Security::SecureString<32> NAME(OBF(KA_APPNAME));
Security::SecureString<32> OWNERID(OBF(KA_OWNERID));
Security::SecureString<32> VERSION(OBF(KA_VERSION));
```

> ⚠️ If `src/credentials.hpp` is missing, the build fails with a `#error` so you can't accidentally ship empty credentials.

The URL, registry path and registry key are defined alongside:

```cpp
Security::SecureString<64> URL(OBF("https://keyauth.win/api/1.3/"));
Security::SecureString<32> REGISTRY_PATH(OBF("SOFTWARE\\YourAppName"));
Security::SecureString<32> REGISTRY_KEY(OBF("License"));
```

Each protection layer can be toggled independently in `security.hpp` (`Security::SecureConfig`):

```cpp
Security::SecureConfig::ENABLE_DEBUG_CHECK        // debugger present / DR registers / tool scan
Security::SecureConfig::ENABLE_NT_QUERY_CHECK     // PEB debug port & flags (NtQueryInformationProcess)
Security::SecureConfig::ENABLE_TIMING_CHECK       // RDTSC / QPC timing analysis
Security::SecureConfig::ENABLE_EXCEPTION_CHECK    // SEH/VEH exception-based detection (intrusive, off by default)
Security::SecureConfig::ENABLE_SOFTWARE_BP_CHECK  // INT3 (0xCC) scan (off by default)
Security::SecureConfig::ENABLE_HEAP_FLAGS_CHECK   // ProcessHeap Flags/ForceFlags fields
Security::SecureConfig::ENABLE_DEBUG_OBJECT_CHECK // ProcessDebugObjectHandle query
Security::SecureConfig::ENABLE_PARENT_CHECK       // parent-process ancestry scan
Security::SecureConfig::ENABLE_VM_CHECK           // VM detection (disabled in the crackme build)
Security::SecureConfig::ENABLE_HOSTS_CHECK        // hosts file tampering
Security::SecureConfig::ENABLE_PROXY_CHECK        // WinINET proxy
Security::SecureConfig::ENABLE_INTEGRITY_CHECK    // in-memory image CRC64
Security::SecureConfig::ENABLE_PROCESS_MASQUERADE // PEB spoof: reported as notepad.exe
```

Set a flag to `false` to disable that check — e.g. `ENABLE_VM_CHECK = false` while developing inside a VM (the crackme build ships with it off).

---

## Contributing

```bash
# Before opening a PR:
cl /std:c++20 /W4 /WX src\*.cpp src\protection\*.cpp /link    # zero warnings target
```
- Keep each security module independent (`security.cpp` must not depend on `main.cpp`)
- All new strings must use `CW_STR()` or `Security::SecureString<N>` — no raw literals in sensitive paths
- Registry paths and keys must be defined as `SecureString`, never hardcoded plaintext

---

## License

MIT — see [LICENSE](LICENSE).

> **Disclaimer:** This template is intended solely for protecting applications **you own or have explicit authorization to protect**. Using it for unauthorized access or to circumvent third-party software protections is prohibited and may violate applicable law.

---

<div align="center">
Built by <a href="https://github.com/devc313">devc313</a> &nbsp;·&nbsp; Discord: <code>ecvdxd98</code>
</div>

keyauth-protected-loader

keyauth-protected-loader Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

keyauth-protected-loader

keyauth-protected-loader Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README