Function Overview

• settings.exe
  Contains endpoint URLs (master server address/port), feature flags, VPN-list paths, etc.
• gui/client.exe
  Launches the GUI, retrieves hardware ID, loads token, contacts the master server (register/login/heartbeat) and displays status.
• gui/register_form.exe
  User registration form (username, password, CAPTCHA) → sends username + password-hash + hardware ID to the master, stores returned token.
• gui/login_form.exe
  Login form (username, password, hardware ID + optional token) → sends to master, handles response and firewall rule changes.
• net/tcp_client.exe
  TLS-secured connector to the master server: all control messages (register, login, update-check, heartbeat) including hardware ID/token.
• auth/token_handler.exe
  Securely stores token (bound to hardware ID), loads and validates it before each request.
• auth/register_service.exe
  Builds and sends registration requests to the master, saves initial token.
• auth/login_service.exe
  Builds and sends login requests to the master, processes new token and access status.
• update/checker.exe
  Queries master for current version and signature hash, compares with local version.
• update/patcher.exe
  Launches an external updater (patcher.exe) with URL + hash from the master, monitors download and installation.
• anticheat/file_hash_checker.exe
  Compares local game-file hashes against a trusted manifest (including hardware ID).
• anticheat/memory_scanner.exe
  Scans process memory for suspicious cheat patterns.
• anticheat/cheat_reporter.exe
  Reports cheat suspicions (IP, hardware ID, token) via TCP to the master; master forwards reports to all ServerSecure instances.
• anticheat/logger.exe
  Produces structured logs, PCAPs and hex-dumps with timestamps and hardware ID.

Project Structure

project_root/
├── client/
│   ├── settings.exe
│   ├── gui/
│   │   ├── client.exe
│   │   ├── register_form.exe
│   │   └── login_form.exe
│   ├── net/
│   │   └── tcp_client.exe
│   ├── auth/
│   │   ├── token_handler.exe
│   │   ├── register_service.exe
│   │   └── login_service.exe
│   ├── update/
│   │   ├── checker.exe
│   │   └── patcher.exe
│   └── anticheat/
│       ├── file_hash_checker.exe
│       ├── memory_scanner.exe
│       ├── cheat_reporter.exe
│       └── logger.exe
│
├── serversecure/
│   ├── settings.exe
│   ├── control/
│   │   ├── server.exe
│   │   └── dispatcher.exe
│   ├── firewall/
│   │   ├── firewall.exe
│   │   └── utils.exe
│   ├── vpn_guard/
│   │   ├── block_vpn.exe
│   │   └── vpn_utils.exe
│   ├── admin/
│   │   ├── console.exe
│   │   └── rbac.exe
│   └── net/
│       └── master_client.exe
│
├── masterserver/
│   ├── settings.exe
│   ├── db/
│   │   ├── databasehandler.exe
│   │   └── create_db.exe
│   ├── net/
│   │   └── master_api.exe
│   ├── admin/
│   │   ├── console.exe
│   │   └── rbac.exe
│   └── masterserver.exe
│
└── common/
    ├── config.exe
    └── utils.exe

ServerSecure

• settings.exe
  Configuration for master-server URL, whitelists, firewall rules, etc.
• control/server.exe
  TLS listener: receives master commands and performs heartbeat.
• control/dispatcher.exe
  Routes commands thread-safely with rate-limits.
• firewall/firewall.exe
  Blocks by default; opens UDP for approved IDs via iptables/nftables.
• firewall/utils.exe
  IP/HW-ID validators and detailed firewall logs.
• vpn_guard/block_vpn.exe
  Bans VPN IPs via GeoIP and lists, reports to master.
• vpn_guard/vpn_utils.exe
  Loads VPN lists; provides GeoIP lookups.
• admin/console.exe
  Sends signed admin commands to master.
• admin/rbac.exe
  Validates admin token permissions.
• net/master_client.exe
  Sends cheat reports and ban requests; syncs whitelist.

Master Server

• settings.exe
  Database URL, server list, ports, flags.
• db/databasehandler.exe
  CRUD for users, tokens, bans; audit logs.
• db/create_db.exe
  Creates schema tables for Users, Tokens, Bans.
• net/master_api.exe
  HTTP/2 TLS listener with endpoints: `/register`, `/login`, `/cheat_report`, `/sync`, `/ban`, `/unban`, `/banlist`, `/stats`.
• admin/console.exe
  CLI for global admin tasks.

Security Measures

1. Transport Security

TLS everywhere

• Mutual-TLS for all TCP comms with AEAD ciphers (TLS 1.3).
• Client certificate pinning to prevent MitM.

UDP Whitelisting

• Only Master-approved IPs can send/receive UDP game traffic.

2. Authentication & Authorization

Centralized Auth

• Short-lived tokens (JWT/opaque) bound to hardware ID.
• Tokens signed, rotated, include expiry/audience claims.

Hardware-linked Tokens

• Prevents token reuse on other machines.

RBAC

• Role-Based Access Control for admin CLIs.

3. Credential & Secret Handling

Password Hashing

• bcrypt/Argon2 with per-user salt and cost factor.

Secure Token Storage

• AES-GCM encryption at rest on client and server.

Config Separation

• Secrets via env vars or vault, not in code.

4. Network Segmentation & Firewall

Firewall Module

• iptables/nftables rules auto-managed by ServerSecure.
• Revokes rules on logout/timeout.

VPN Detection

• GeoIP/list updates, auto-ban and report.

Provider Isolation

• Each game provider behind its own instance.

5. Integrity & Patch Security

Code Signing

• All binaries signed; client verifies before update.

Atomic Updates

• Temp download, hash check, swap; rollback on failure.

6. Anti-Cheat & Monitoring

File & Memory Scans

• Hash check against manifest; memory signature scans.

Logging

• Timestamps, hardware IDs, optional HMAC chaining.

PCAP & Forensics

• Short packet capture on suspicion.

7. Rate-Limiting & DoS Protection

Per-IP/HW-ID Limits

• Rate limits on auth, patch, heartbeat.

Connection Caps

• Limits per heartbeat to detect orphan nodes.

8. Logging, Auditing & Alerts

Audit DB

• Centralized logs from all nodes.

Alerting Integration

• Prometheus/Grafana alerts on key metrics.

Immutable Logs

• Append-only storage (WORM) for compliance.

9. Data Protection

Encrypted DB Connections

• TLS for all database traffic.

Field Encryption

• Sensitive fields encrypted at rest.