================================================================================
                    LICENSE_CLIENT.H SECURITY REFERENCE
                    Tarih: 2025-12-05
                    SAKLA! Kimseyle paylaşma!
================================================================================

NAMESPACE MAPPINGS (Binary'deki -> Gerçek Anlam)
================================================================================

_CBW     ->  White-Box Cryptography (Anahtar parçalama)
_DA      ->  Anti-Dump Protection (PE header silme)
_CT      ->  Timing Check (Zamanlama saldırısı tespiti)
_IFC     ->  Control Flow Integrity (Stack canary, opaque predicates)
_IA      ->  Anti-Inject (DLL injection tespiti)
_CS      ->  Self-Check (Text section CRC kontrolü)
_PA      ->  Anti-Patch (Fonksiyon hook tespiti)
_PC      ->  Certificate Pinning (SSL sertifika doğrulama)
_tP      ->  Pattern System (XOR encoded pattern'ler)

STRUCT MAPPINGS (Binary'deki -> Gerçek Anlam)
================================================================================

_FK      ->  Key Fragment (Anahtar parçası struct'ı)
_KS      ->  Secure Key (V9M3_SIGN için güvenli anahtar sınıfı)
_KT      ->  Secure TOTP Key (TOTP secret için güvenli anahtar sınıfı)
_FP      ->  Function Prolog / Pattern Fragment

VARIABLE MAPPINGS - White-Box Crypto (Binary'deki -> Gerçek Anlam)
================================================================================

g_1A, g_2A, g_3A   ->  V9M3_SIGN key fragments (XOR encoded)
g_1M               ->  XOR masks for V9M3_SIGN
g_1B, g_2B, g_3B, g_4B  ->  TOTP key fragments (VGK4SS_T0TP_S3CR3T_K3Y_2025)
g_2M, g_3M, g_4M, g_5M  ->  XOR masks for TOTP fragments

VARIABLE MAPPINGS - Certificate Pinning (Binary'deki -> Gerçek Anlam)
================================================================================

g_1HP, g_2HP, g_3HP, g_4HP, g_5HP, g_6HP  ->  Certificate hash parts (Base64, XOR)
g_1X, g_2X, g_3X, g_4X, g_5X, g_6X        ->  XOR keys for hash parts
g_7PV, g_8PV, g_9PV                        ->  Decoy data (fake hashes)

FUNCTION MAPPINGS (Binary'deki -> Gerçek Anlam)
================================================================================

_tr      ->  Reconstruct TOTP Key (_reconstructTotpKey)
_kr      ->  Reconstruct V9M3_SIGN Key (_reconstructKey)
_Tg      ->  Generate TOTP token (_generateTOTP)
_mh      ->  HMAC-SHA256 (_hMac)
_pcv     ->  Verify Certificate Pin (_verifyCertPin)
_icv     ->  Verify Code Integrity (_verifyCodeIntegrity)
_csm     ->  Master Security Check (_masterSecurityCheck)
_si      ->  Initialize Security (_initSecurity)
_tc      ->  Check Timing (_checkTiming)
_tm      ->  Monitor Timing (_monitorTiming)
_dic     ->  Check Injected DLLs (_checkInjectedDlls)
_hnv     ->  Verify Not Hollowed (_verifyNotHollowed)
_av      ->  Verify All patches (_verifyAll)
_fr      ->  Register Function for monitoring (_registerFunc)
_arv     ->  Validate Return Address (_validateRetAddr)
_hcr     ->  Reconstruct Cert Hash (_reconstructCertHash)

DLL DETECTION FUNCTIONS (Binary'deki -> Gerçek Anlam)
================================================================================

_eh      ->  Has Hook Exports (MinHook, Detours check)
_ps      ->  Has Suspicious Patterns (memory scan)
_psi     ->  Is From Suspicious Path
_hi      ->  Is Hooked (JMP/CALL detection)

CFI - Control Flow Integrity (Binary'deki -> Gerçek Anlam)
================================================================================

g_CS     ->  Stack Canary (g_StackCanary)
_ci      ->  Init Canary (_initCanary)
_to      ->  Opaque True - always true predicate
_fo      ->  Opaque False - always false predicate

TIMING CHECK (Binary'deki -> Gerçek Anlam)
================================================================================

g_CL     ->  Last Check timestamp (g_LastCheck)
g_CC     ->  Check Count (g_CheckCount)
g_S      ->  Suspicious flag (g_Suspicious)

SELF CHECK (Binary'deki -> Gerçek Anlam)
================================================================================

g_C      ->  Text Section CRC (g_TextSectionCRC)
g_B      ->  Text Base address (g_TextBase)
g_S      ->  Text Size (g_TextSize)

ANTI-DUMP (Binary'deki -> Gerçek Anlam)
================================================================================

g_P      ->  Protected flag (g_Protected)
_epe     ->  Erase PE Header (_erasePEHeader)
_rh      ->  Hide Regions (_hideRegions)

ANTI-INJECT (Binary'deki -> Gerçek Anlam)
================================================================================

g_OIS    ->  Original Image Size (g_OriginalImageSize)
g_OIB    ->  Original Image Base (g_OriginalImageBase)
_oc      ->  Capture Original (_captureOriginal)

SELF-CHECK (Binary'deki -> Gerçek Anlam)
================================================================================

_stc     ->  Capture Text Section (_captureTextSection)
_stv     ->  Verify Text Section (_verifyTextSection)
_23c     ->  CRC32 calculation (_crc32)

PATTERN SYSTEM (Binary'deki -> Gerçek Anlam)
================================================================================

XP       ->  Pattern XOR Key (PATTERN_XOR)
_cc      ->  Calculate Checksum (_calcChecksum)
_pd      ->  Decode Pattern (_decodePattern)

================================================================================
                         CRITICAL SECRETS
================================================================================

V9M3_SIGN Key:        "V9M3_SIGN" (9 bytes)
                      İmza doğrulama anahtarı
                      XOR ile parçalanmış: g_1A, g_2A, g_3A + g_1M masks

TOTP Secret:          "VGK4SS_T0TP_S3CR3T_K3Y_2025" (27 bytes)
                      Zaman bazlı token üretimi
                      XOR ile parçalanmış: g_1B-g_4B + g_2M-g_5M masks

Certificate Hash:     "A7hJymHehPK3R4su8FjwU0rn575wirfAxsxmW2aDa7g=" 
                      Base64 encoded SHA256
                      6 parçaya bölünmüş: g_1HP-g_6HP + g_1X-g_6X XOR keys

================================================================================
                          SERVER INFO
================================================================================

IP:     45.147.248.210
Port:   443
Path:   /opt/vgkass/server.py
Cert:   /opt/vgkass/ssl/cert.pem

================================================================================
                          VERSION INFO
================================================================================

Loader Version:  8.0.3
Version XOR:     0xCAFE8003 (LZ_VH)
Version Data:    g_VD[] array (XOR encoded)

================================================================================
                       RSA ASYMMETRIC SIGNING
================================================================================

RSA KEY PAIR:
  Private Key:   rsa_private.pem (SERVER ONLY - NEVER SHARE!)
  Public Key:    rsa_public.pem (embedded in binary)
  Key Size:      2048 bits
  Algorithm:     RSA with PKCS1v15 + SHA256

NAMESPACE:       _RSA

VARIABLES:
  g_PK           ->  Public key DER bytes (294 bytes)
  g_PKS          ->  Public key size

FUNCTIONS:
  _vrs           ->  Verify RSA Signature (raw bytes)
  _vrsB64        ->  Verify RSA Signature (Base64 encoded)

HOW IT WORKS:
  1. Server signs response data with PRIVATE key
  2. Client verifies signature with PUBLIC key
  3. Fake server CAN'T sign without private key!

SIGN DATA FORMAT:
  "{status}:{valid}:{token}:{nonce}:{issued_at}"
  Example: "ok:1:abc123:nonce456:1701792000"

================================================================================
                            NOTLAR
================================================================================

1. Binary'de tüm isimler tersine çevrilmiş durumda
   Örnek: _AD (Anti-Dump) -> _DA olarak görünür

2. Yorumlar tamamen kaldırıldı

3. VMProtect ile korunan fonksiyonlar:
   - RT (TOTP reconstruction)
   - RK (Key reconstruction)
   - T (TOTP generation)
   - VNH (Not hollowed check)
   - CID (Injected DLL check)
   - CTS (Text section capture)
   - IS (Init security)
   - VCP (Cert pin verify)

4. Compile-time XOR key: COMPILE_SEED (__TIME__ based)

================================================================================
             BU DOSYAYI GÜVENLİ BİR YERDE SAKLA!
================================================================================

================================================================================
                      STRING OBFUSCATION (OBF)
================================================================================

NAMESPACE:       _OBF

5 FARKLI OBFUSCATİON TİPİ:
--------------------------

OBF1 (_T1)  ->  🔒 ULTRA STRONG - 8 ROUND AES-STYLE
              Algorithm: S-box substitution + Position-dependent key + 8 rounds
              Components:
                - 256-byte AES-inspired S-box (_SBOX1)
                - Position XOR with round counter
                - Complex key schedule per round
                - Multi-layer mixing after each round
              Kullanım: EN KRİTİK değerler (rsa_sig)
              Seed: _S1 (__TIME__ based)
              Güç: ⭐⭐⭐⭐⭐ (En Yüksek)

OBF2 (_T2)  ->  🔒 ULTRA STRONG - 6 ROUND S-BOX + P-BOX
              Algorithm: S-box + P-box permutation + Multi-layer XOR
              Components:
                - 256-byte substitution box (_SBOX2)
                - 8-position P-box bit permutation
                - Position-dependent key mixing
                - 6-round encryption with carry feedback
              Kullanım: Kritik headerlar (X-Signature, X-Encrypted)
              Seed: _S2 (__TIME__ based)
              Güç: ⭐⭐⭐⭐⭐ (En Yüksek)

OBF3 (_T3)  ->  Multi-layer XOR + Permutation (5-bit + 2-bit rotate)
              Kullanım: Endpoints, JSON fields
              Seed: _S3 (__DATE__ based)
              Güç: ⭐⭐⭐⭐

OBF4 (_T4)  ->  SUB + NOT + XOR + ROL (6-bit rotate)
              Kullanım: Internal fields (_th, _tt, _td)
              Seed: _S4 (__DATE__ based)
              Güç: ⭐⭐⭐

OBF5 (_T5)  ->  Feistel cipher (4 rounds) - BAIT/DECOY
              ⚠️ BU KASITLI OLARAK ZAYIF - TUZAK OLARAK KULLANILIR
              Kullanım: Bilinen değerler (IP, User-Agent, hook names)
              Seed: _S5 (combined seed)
              Güç: ⭐⭐ (Kasıtlı zayıf)

SEED GENERATION (ULTRA COMPLEX FOR OBF1/OBF2):
  _S1 = ((__TIME__[0]*17) ^ (__TIME__[1]*31) ^ (__TIME__[3]*47)) | 0x8001
  _S2 = ((__TIME__[4]*23) ^ (__TIME__[6]*41) ^ (__TIME__[7]*59)) | 0x8003
  _S3 = (__DATE__[0] ^ __DATE__[2] ^ __DATE__[4]) | 0x07
  _S4 = (__DATE__[5] ^ __DATE__[7] ^ __DATE__[9]) | 0x0F
  _S5 = (_S1 ^ _S2 ^ _S3 ^ _S4) | 0x1F

PRNG (ENHANCED FOR OBF1/OBF2):
  Triple XorShift with carry feedback
  Position-dependent mutations
  Round-based key expansion

HELPER MACROS:
  OBF(str)       ->  Uses OBF3 (default)
  OBFn(str)      ->  Uses specific type (n = 1-5)
  OBFn_WIPE      ->  Auto-wipe on scope exit
  OBFW(str)      ->  Wide string obfuscation
  STR_HASH(str)  ->  Compile-time FNV-1a hash

STRATEGIC DISTRIBUTION (KNOWN-PLAINTEXT KORUMASII):
--------------------------------------------------
  
  🔒 OBF1 (1 kullanım) - EN GÜÇLÜ, BİLİNEMEZ:
     rsa_sig (RSA signature field)
  
  🔒 OBF2 (3 kullanım) - ÇOOK GÜÇLÜ, BİLİNEMEZ:
     X-Signature, X-Encrypted, X-Auth-Token
  
  ⚡ OBF3 (28 kullanım) - GÜÇLÜ:
     Endpoints (/status, /auth2, /challenge)
     JSON fields (token, expires_at, nonce)
     Response fields (\"e\":\", \"s\":\")
  
  ⚡ OBF4 (4 kullanım) - ORTA:
     Internal fields (_th, _tt, _td, X-File-Hash)
  
  🎣 OBF5 (35 kullanım) - BAIT/TUZAK:
     45.147.248.210 (IP - bilinen)
     Mozilla/5.0, VGKASS/1.0 (User-Agent - bilinen)
     Content-Type, Accept (HTTP headers - bilinen)
     Hook names (MH_Initialize - bilinen)

KNOWN-PLAINTEXT ATTACK STRATEGY:
--------------------------------
  Saldırgan IP adresini binary'de bulup OBF5'i kırabilir.
  AMA OBF5 sadece zaten bilinen değerler için kullanılıyor!
  
  OBF1 ve OBF2 TAMAMEN FARKLI ve ÇOK DAHA GÜÇLÜ algoritmalar:
  - S-box substitution (AES benzeri)
  - Multi-round encryption (8 veya 6 round)
  - Position-dependent key schedule
  - P-box bit permutation
  
  Saldırgan OBF5'i kırsa bile OBF1/OBF2'yi reverse edemez çünkü:
  1. Farklı algoritma
  2. Farklı S-box
  3. Known plaintext YOK (rsa_sig, X-Signature bilinmiyor)

SECURITY STRENGTH SUMMARY:
  OBF5 kırılması -> Sadece bilinen bilgi açığa çıkar (zaten bilinen)
  OBF3/OBF4 kırılması -> Orta risk
  OBF1/OBF2 kırılması -> NEREDEYSE İMKANSIZ (S-box + multi-round)

