third-party libs

third-party/README.md

@@ -0,0 +1,63 @@
+# third-party/ — upstream sources for shipped support DLLs
+
+Source trees matched to the Support DLLs listed in `decomp/INVENTORY.md`.
+Used as reference when decompiling (symbol recovery, struct layouts, FLIRT-style
+matching). **Not** build inputs for anything in this repo.
+
+"Matched" here means the upstream version equals the version embedded in the
+DLL (VERSIONINFO + in-binary version strings). Compiled DLLs cannot be
+byte-matched to source without the original toolchain/flags; the archives
+themselves were verified against upstream checksums where available.
+
+| DLL(s) | Embedded version (observed) | Directory | Upstream / integrity | Match |
+|---|---|---|---|---|
+| `libeay32.dll`, `ssleay32.dll` | FileVersion `1.0.0d`; strings `OpenSSL 1.0.0d 8 Feb 2011`; PDB `...\OpenLibrary\openssl-1.0.0d\out32dll\` | `openssl-1.0.0d/` | `openssl.org/source/old/1.0.0/openssl-1.0.0d.tar.gz`, SHA-1 `32ca934f380a547061ddab7221b1a34e4e07e8d5` (matches official `.sha1`); SHA-256 `92511d1f…6320db` | Exact release |
+| `libcurl_x64.dll`, `libcurl_Win32.dll`, `libcurld_x64.dll`, `libcurld_Win32.dll` | FileVersion `7.21.4`; strings `libcurl/7.21.4` | `curl-7.21.4/` | git tag `curl-7_21_4` (commit `827f0a31…`) via GitHub archive, SHA-256 `1dd41d4b…eb3240`. Official release tarball no longer downloadable (404). | Exact tag; see note |
+| `BugTrapU-x64.dll` | FileVersion `1.3.3466.24114`; PDB `...\OpenLibrary\BugTrap\Win32\Bin\BugTrap.pdb` | `BugTrap-1.3-57bd515/` | `github.com/bchavez/BugTrap` commit `57bd515` (earliest public import, `1.3.3718.38316`) | **Closest available, NOT exact** |
+| `dbghelp.dll` | Microsoft, Debugging Tools for Windows `6.12.0002.633` | `mingw-w64-dbghelp-63ebe6c/` | `github.com/mingw-w64/mingw-w64` commit `63ebe6cd…` (master HEAD, retrieved 2026-10-14): `include/dbghelp.h`, `lib-common/dbghelp.def` (x64), `lib32/dbghelp.def`, licence files | **Header + export list only, not an implementation** |
+
+Notes:
+- **curl**: the git tag differs from a release tarball only by generated files
+  (configure, Makefiles) and `maketgz` version stamping. I applied the version
+  stamp only (`LIBCURL_VERSION` → `"7.21.4"` in `include/curl/curlver.h`,
+  `CURL_VERSION` in `src/version.h`); `LIBCURL_TIMESTAMP` left as `"DEV"`
+  because the real release timestamp is unknown.
+- **BugTrap**: no public source for build 3466 found. Export comparison: the
+  shipped DLL's 83 `BT_*` exports (82 shared) equal `source/BugTrap.h` of 57bd515 except the
+  DLL exports `BT_GetErrorString` (not in header) and the header declares
+  `BT_SetTerminate` (not exported). Treat API/structs as approximate.
+- The `debug` (`libcurld_*`) and Win32 variants share the same source version.
+- **dbghelp (mingw-w64)**: clean-room, public-domain/ZPL headers, not
+  Microsoft's. All 205 named exports of the shipped `dbghelp.dll` appear in
+  `lib-common/dbghelp.def`. Header is a modern superset of the 6.12 API, so
+  struct versions/sizes may differ from 2010-era definitions. mingw-w64 has no
+  dbghelp implementation; an open implementation exists in Wine
+  (`dlls/dbghelp/`, LGPL-2.1).
+
+## No public source (not included)
+
+| DLL | Observed identity | Reason |
+|---|---|---|
+| `dbghelp.dll` | Microsoft, Debugging Tools for Windows `6.12.0002.633` | Proprietary implementation; clean-room header included (see table above). |
+| `hasp_windows_x64_95595.dll` | SafeNet Sentinel LDK RuntimelessAPI `6.3.1.28566` | Proprietary; `hasp_api.h` ships only in the vendor-licensed Sentinel LDK SDK. Bundles trio and hamsterdb internally (observed strings). |
+| `XTrap4Server.dll` / `20100731_521_XTrap4Server.dll` | no VERSIONINFO | Proprietary anti-cheat (WiseLogic XTrap); no public SDK. |
+| `ApexProxy.dll`, `ApexProxyMain.dll` | no VERSIONINFO | Proprietary (Apex anti-cheat); no public SDK. |
+| `XLSLogin.dll` | no VERSIONINFO | Unknown origin; no public source identified. |
+
+Vendor attributions for XTrap (WiseLogic) and Apex are inferred from DLL
+names, not corroborated by decompilation.
+
+## Acquisition routes for the remaining libraries
+
+| DLL | Route | Notes |
+|---|---|---|
+| `dbghelp.dll` | Windows SDK / WDK 7.1 "Debugging Tools for Windows" (official `dbghelp.h` + `.lib`); Microsoft public symbol server `msdl.microsoft.com/download/symbols` for the PDB | Public PDB gives Ghidra near-complete function names. Wine `dlls/dbghelp/` (LGPL-2.1) is an open reimplementation if implementation code is wanted. |
+| `hasp_windows_x64_95595.dll` | Thales Sentinel LDK SDK (free evaluation after registration) for `hasp_api.h` | `95595` is the vendor ID; the runtimeless DLL is generated per vendor, so this exact build is obtainable only from the publisher. Modern `hasp_*` C API is largely backward-compatible with 6.3. |
+| `XTrap4Server.dll` | Publisher-licensed SDK under NDA only; vendor appears inactive | Practical path: recover interface from the 22 KB DLL's exports + server call sites (REA/Ghidra). |
+| `ApexProxy.dll`, `ApexProxyMain.dll` | Publisher-licensed SDK only | Same as XTrap; `ApexProxyMain` has a `Ver: %s Build: %s` string as a starting point. |
+| `XLSLogin.dll` | Unknown | Identify first: exports/imports/PDB path/signer via `rea_inspect_with_objdump`. |
+
+Policy: commit only redistributable material (upstream OSS, mingw-w64
+headers). Vendor SDKs obtained under licence must stay out of git. Interfaces
+reconstructed from binaries go in `decomp/<dll>/` with an `evidence.md`
+ledger; they describe static interface only, not runtime behavior.