# third-party/ — upstream sources for shipped support DLLs

Source trees matched to the Support DLLs listed in `decomp/INVENTORY.md`.
Used as reference when decompiling (symbol recovery, struct layouts, FLIRT-style
matching). **Not** build inputs for anything in this repo.

"Matched" here means the upstream version equals the version embedded in the
DLL (VERSIONINFO + in-binary version strings). Compiled DLLs cannot be
byte-matched to source without the original toolchain/flags; the archives
themselves were verified against upstream checksums where available.

| DLL(s) | Embedded version (observed) | Directory | Upstream / integrity | Match |
|---|---|---|---|---|
| `libeay32.dll`, `ssleay32.dll` | FileVersion `1.0.0d`; strings `OpenSSL 1.0.0d 8 Feb 2011`; PDB `...\OpenLibrary\openssl-1.0.0d\out32dll\` | `openssl-1.0.0d/` | `openssl.org/source/old/1.0.0/openssl-1.0.0d.tar.gz`, SHA-1 `32ca934f380a547061ddab7221b1a34e4e07e8d5` (matches official `.sha1`); SHA-256 `92511d1f…6320db` | Exact release |
| `libcurl_x64.dll`, `libcurl_Win32.dll`, `libcurld_x64.dll`, `libcurld_Win32.dll` | FileVersion `7.21.4`; strings `libcurl/7.21.4` | `curl-7.21.4/` | git tag `curl-7_21_4` (commit `827f0a31…`) via GitHub archive, SHA-256 `1dd41d4b…eb3240`. Official release tarball no longer downloadable (404). | Exact tag; see note |
| `BugTrapU-x64.dll` | FileVersion `1.3.3466.24114`; PDB `...\OpenLibrary\BugTrap\Win32\Bin\BugTrap.pdb` | `BugTrap-1.3-57bd515/` | `github.com/bchavez/BugTrap` commit `57bd515` (earliest public import, `1.3.3718.38316`) | **Closest available, NOT exact** |
| `dbghelp.dll` | Microsoft, Debugging Tools for Windows `6.12.0002.633` | `mingw-w64-dbghelp-63ebe6c/` | `github.com/mingw-w64/mingw-w64` commit `63ebe6cd…` (master HEAD, retrieved 2026-10-14): `include/dbghelp.h`, `lib-common/dbghelp.def` (x64), `lib32/dbghelp.def`, licence files | **Header + export list only, not an implementation** |

Notes:
- **curl**: the git tag differs from a release tarball only by generated files
  (configure, Makefiles) and `maketgz` version stamping. I applied the version
  stamp only (`LIBCURL_VERSION` → `"7.21.4"` in `include/curl/curlver.h`,
  `CURL_VERSION` in `src/version.h`); `LIBCURL_TIMESTAMP` left as `"DEV"`
  because the real release timestamp is unknown.
- **BugTrap**: no public source for build 3466 found. Export comparison: the
  shipped DLL's 83 `BT_*` exports (82 shared) equal `source/BugTrap.h` of 57bd515 except the
  DLL exports `BT_GetErrorString` (not in header) and the header declares
  `BT_SetTerminate` (not exported). Treat API/structs as approximate.
- The `debug` (`libcurld_*`) and Win32 variants share the same source version.
- **dbghelp (mingw-w64)**: clean-room, public-domain/ZPL headers, not
  Microsoft's. All 205 named exports of the shipped `dbghelp.dll` appear in
  `lib-common/dbghelp.def`. Header is a modern superset of the 6.12 API, so
  struct versions/sizes may differ from 2010-era definitions. mingw-w64 has no
  dbghelp implementation; an open implementation exists in Wine
  (`dlls/dbghelp/`, LGPL-2.1).

## No public source (not included)

| DLL | Observed identity | Reason |
|---|---|---|
| `dbghelp.dll` | Microsoft, Debugging Tools for Windows `6.12.0002.633` | Proprietary implementation; clean-room header included (see table above). |
| `hasp_windows_x64_95595.dll` | SafeNet Sentinel LDK RuntimelessAPI `6.3.1.28566` | Proprietary; `hasp_api.h` ships only in the vendor-licensed Sentinel LDK SDK. Bundles trio and hamsterdb internally (observed strings). |
| `XTrap4Server.dll` / `20100731_521_XTrap4Server.dll` | no VERSIONINFO | Proprietary anti-cheat (WiseLogic XTrap); no public SDK. |
| `ApexProxy.dll`, `ApexProxyMain.dll` | no VERSIONINFO | Proprietary (Apex anti-cheat); no public SDK. |
| `XLSLogin.dll` | no VERSIONINFO | Unknown origin; no public source identified. |

## Statically linked: TinyXML

TinyXML is not a separate DLL; it is compiled into the server EXEs.

- **Identity (observed):**
  - 9 `TiXml*` RTTI classes appear in 14 of the 16 server EXEs. The two
    `SMMonitoring` EXEs have none.
  - In `Agent_Release_x64.exe`, the 12 TinyXML error-table strings and
    `Failed to open file` appear contiguously at file offset `0x11d570`.
  - There is no version string in the binary.
- **Version (inference from the error table):**
  - The binary contains `Memory allocation failed.`. TinyXML 2.6.x removed that
    entry; 2.5.1–2.5.3 have it, and their error tables are identical.
  - So it is 2.5.1–2.5.3, but which one is unresolved. `tinyxml.h` and
    `tinyxmlparser.cpp` differ between those releases, and the code has not been
    compared.
  - 2.5.0 couldn't be fetched, and pre-2.5 releases were not checked.
- **Directory:** `tinyxml-2.5.3/` holds the latest 2.5.x release, unmodified.
  - Source: `sourceforge.net/projects/tinyxml`, file `tinyxml_2_5_3.zip`.
  - SHA-256: `143590aa5930c1326315fb9fe3c0aab316a43751a44582dedd69331004b2c6a1`.
- **Match:** closest available, not confirmed exact.
- **Licence:** zlib, so it's fine to commit.
- **Use:** class layouts and the parser source let you label TinyXML functions
  in the decompiled output, via the class records' method tables and the error
  strings above.

## Statically linked: ProudNet (Nettention) — local-only headers

ProudNet is not a separate DLL; it is linked into the server EXEs.

- **Identity (observed):** in `Agent_Release_x64.exe`, RTTI and assert
  strings name `Proud::CNetServerImpl`, `Proud::CNetClientImpl`, RMI stubs
  and proxies, and `GET /PNReport/ReportError.php`. There is no version string
  in the binary. VS2010 build, so likely an early-2010s ProudNet (inference).
  Other EXEs not yet checked.
- **Public material:** `github.com/Nettention/ProudNet` contains prebuilt libs
  and headers only. There is no public implementation source.
- **Licence:** proprietary EULA. It forbids redistribution and
  reverse-engineering (§1.2b), treats the software as confidential (§3), and
  is governed by Korean law (§7–8). **Do not commit any ProudNet files.**
- **Local copy (gitignored):** `_local/proudnet-1.8.00001/`. It holds
  `ProudNet/include/` (187 headers) plus `ProudNet-License-En.txt`, from tag
  `ProudNetLibSetup-1.8.00001` (commit `c70f23f9…`, May 2023). Fetched at the
  user's direction for local naming reference only.
- **Match:** not version-matched; 1.8 is about a decade newer than the build.
  Only 18 of 63 `Proud::` RTTI classes in the Agent appear in these headers;
  the rest are internal `*Impl` types. Verify any struct layout against the
  decompiled code before relying on it.
- To re-fetch:
  `git archive ProudNetLibSetup-1.8.00001 ProudNet/include ProudNet-License-En.txt`
  from that repo into `_local/proudnet-1.8.00001/`.
- **`github.com/Nettention/ProudChatSDK` (checked 2026-10-15, `main` = tag
  `1.1.0001`, commit `e0d9d6b8`).**
  - **Contents:** bundles ProudNet **1.8.58849**: 185 headers, plus prebuilt
    libraries for Windows (v110/v120/v140, dll), Android, iOS and
    **x86_64 Linux** (`libProudNetServer.so/.a`, `libProudNetClient.so/.a`;
    `__xstat` → old glibc).
  - **Licence:** the repo's `LICENSE` (MIT) covers the chat SDK only;
    `ProudNet/` keeps the same proprietary EULA (§1.2b). Nothing from it is
    stored in this repo.
  - **Headers:** identical to 1.8.00001 apart from the version banner and
    translated doc comments in `ErrorType.h`. They add one error code and give
    no new information beyond `_local/proudnet-1.8.00001`.
  - **Compatibility with the 2013 ProudNet linked into DBCServer:**

    | Aspect | Result | Type |
    |---|---|---|
    | PIDL proxy ABI | Matches: `IRmiProxy` keeps `m_signature` at +0x14, which the generated constructor checks against 1 (`MS:0x140008e20`). `RmiID` is still `uint16_t`. The `PIDL compiler is incompatible` and `CStartServerParameter::m_(fast)encryptedMessageKeyLength` strings appear in both | O |
    | Internal implementation | 29 of DBCServer's 63 `Proud::` RTTI classes are absent from the 1.8.58849 Linux libraries' symbols, e.g. `CTcpLayer_C`, `CUdpSocket_S`, `CUpnp`, `ICompletionPortEventSink` | O |
    | Internal net version | **2013 build: 196978 (0x30172)**, the global at `DBC:0x140344d40`. It is copied into the server object at +0x220 (`DBC:0x14018fa70`, instruction at `0x14019018d`) and into the client objects (`0x1401dd3e0`, `0x1401df000`). In the connect handshake (`DBC:0x1401a8110`, `NotifyServerConnectionRequestData`) the server reads a credential byte array, a 16-byte protocol GUID and a 4-byte int, and accepts only if the GUID **and** the int equal its own. The same value appears exactly once in `.data` of all 16 EXEs (O). **1.8.58849: 197144 (0x30218)** (`CNetConfig::InternalNetVersion`, rejected via `NotifyProtocolVersionMismatch`). The values differ by 166 | O |
    | Licensing | 1.8 also contains license and activation checks (`CPNLic`, `NotifyLicenseMismatch`) | S |

  - **Conclusion (I):**
    - **Source-level:** usable as a header/ABI reference for PIDL-generated
      stubs and proxies.
    - **Wire-level:** **not** compatible with the original 2013 peers. The
      internal net versions differ (196978 vs 197144), and the 2013 handshake
      requires an exact match. This is O for the 2013 server side; I for the
      1.8 side, which was not traced beyond the symbol name.
    - **Linking:** linking `libProudNetServer.so` into `src/dbc_server`
      would require accepting the EULA and a licence, and would give a
      ProudNet 1.8 server that the original binaries likely cannot talk to.

Vendor attributions for XTrap (WiseLogic) and Apex are inferred from DLL
names, not corroborated by decompilation.

## Acquisition routes for the remaining libraries

| DLL | Route | Notes |
|---|---|---|
| `dbghelp.dll` | Windows SDK / WDK 7.1 "Debugging Tools for Windows" (official `dbghelp.h` + `.lib`); Microsoft public symbol server `msdl.microsoft.com/download/symbols` for the PDB | Public PDB gives Ghidra near-complete function names. Wine `dlls/dbghelp/` (LGPL-2.1) is an open reimplementation if implementation code is wanted. |
| `hasp_windows_x64_95595.dll` | Thales Sentinel LDK SDK (free evaluation after registration) for `hasp_api.h` | `95595` is the vendor ID; the runtimeless DLL is generated per vendor, so this exact build is obtainable only from the publisher. Modern `hasp_*` C API is largely backward-compatible with 6.3. |
| `XTrap4Server.dll` | Publisher-licensed SDK under NDA only; vendor appears inactive | Practical path: recover interface from the 22 KB DLL's exports + server call sites (REA/Ghidra). |
| `ApexProxy.dll`, `ApexProxyMain.dll` | Publisher-licensed SDK only | Same as XTrap; `ApexProxyMain` has a `Ver: %s Build: %s` string as a starting point. |
| `XLSLogin.dll` | Unknown | Identify first: exports/imports/PDB path/signer via `rea_inspect_with_objdump`. |

Policy: commit only redistributable material (upstream OSS, mingw-w64
headers). Vendor SDKs obtained under licence must stay out of git. Interfaces
reconstructed from binaries go in `decomp/<dll>/` with an `evidence.md`
ledger; they describe static interface only, not runtime behavior.