115 lines
8.2 KiB
Markdown
115 lines
8.2 KiB
Markdown
# third-party/ — upstream sources for shipped support DLLs
|
||
|
||
Source trees matched to the Support DLLs listed in `decomp/INVENTORY.md`.
|
||
Used as reference when decompiling (symbol recovery, struct layouts, FLIRT-style
|
||
matching). **Not** build inputs for anything in this repo.
|
||
|
||
"Matched" here means the upstream version equals the version embedded in the
|
||
DLL (VERSIONINFO + in-binary version strings). Compiled DLLs cannot be
|
||
byte-matched to source without the original toolchain/flags; the archives
|
||
themselves were verified against upstream checksums where available.
|
||
|
||
| DLL(s) | Embedded version (observed) | Directory | Upstream / integrity | Match |
|
||
|---|---|---|---|---|
|
||
| `libeay32.dll`, `ssleay32.dll` | FileVersion `1.0.0d`; strings `OpenSSL 1.0.0d 8 Feb 2011`; PDB `...\OpenLibrary\openssl-1.0.0d\out32dll\` | `openssl-1.0.0d/` | `openssl.org/source/old/1.0.0/openssl-1.0.0d.tar.gz`, SHA-1 `32ca934f380a547061ddab7221b1a34e4e07e8d5` (matches official `.sha1`); SHA-256 `92511d1f…6320db` | Exact release |
|
||
| `libcurl_x64.dll`, `libcurl_Win32.dll`, `libcurld_x64.dll`, `libcurld_Win32.dll` | FileVersion `7.21.4`; strings `libcurl/7.21.4` | `curl-7.21.4/` | git tag `curl-7_21_4` (commit `827f0a31…`) via GitHub archive, SHA-256 `1dd41d4b…eb3240`. Official release tarball no longer downloadable (404). | Exact tag; see note |
|
||
| `BugTrapU-x64.dll` | FileVersion `1.3.3466.24114`; PDB `...\OpenLibrary\BugTrap\Win32\Bin\BugTrap.pdb` | `BugTrap-1.3-57bd515/` | `github.com/bchavez/BugTrap` commit `57bd515` (earliest public import, `1.3.3718.38316`) | **Closest available, NOT exact** |
|
||
| `dbghelp.dll` | Microsoft, Debugging Tools for Windows `6.12.0002.633` | `mingw-w64-dbghelp-63ebe6c/` | `github.com/mingw-w64/mingw-w64` commit `63ebe6cd…` (master HEAD, retrieved 2026-10-14): `include/dbghelp.h`, `lib-common/dbghelp.def` (x64), `lib32/dbghelp.def`, licence files | **Header + export list only, not an implementation** |
|
||
|
||
Notes:
|
||
- **curl**: the git tag differs from a release tarball only by generated files
|
||
(configure, Makefiles) and `maketgz` version stamping. I applied the version
|
||
stamp only (`LIBCURL_VERSION` → `"7.21.4"` in `include/curl/curlver.h`,
|
||
`CURL_VERSION` in `src/version.h`); `LIBCURL_TIMESTAMP` left as `"DEV"`
|
||
because the real release timestamp is unknown.
|
||
- **BugTrap**: no public source for build 3466 found. Export comparison: the
|
||
shipped DLL's 83 `BT_*` exports (82 shared) equal `source/BugTrap.h` of 57bd515 except the
|
||
DLL exports `BT_GetErrorString` (not in header) and the header declares
|
||
`BT_SetTerminate` (not exported). Treat API/structs as approximate.
|
||
- The `debug` (`libcurld_*`) and Win32 variants share the same source version.
|
||
- **dbghelp (mingw-w64)**: clean-room, public-domain/ZPL headers, not
|
||
Microsoft's. All 205 named exports of the shipped `dbghelp.dll` appear in
|
||
`lib-common/dbghelp.def`. Header is a modern superset of the 6.12 API, so
|
||
struct versions/sizes may differ from 2010-era definitions. mingw-w64 has no
|
||
dbghelp implementation; an open implementation exists in Wine
|
||
(`dlls/dbghelp/`, LGPL-2.1).
|
||
|
||
## No public source (not included)
|
||
|
||
| DLL | Observed identity | Reason |
|
||
|---|---|---|
|
||
| `dbghelp.dll` | Microsoft, Debugging Tools for Windows `6.12.0002.633` | Proprietary implementation; clean-room header included (see table above). |
|
||
| `hasp_windows_x64_95595.dll` | SafeNet Sentinel LDK RuntimelessAPI `6.3.1.28566` | Proprietary; `hasp_api.h` ships only in the vendor-licensed Sentinel LDK SDK. Bundles trio and hamsterdb internally (observed strings). |
|
||
| `XTrap4Server.dll` / `20100731_521_XTrap4Server.dll` | no VERSIONINFO | Proprietary anti-cheat (WiseLogic XTrap); no public SDK. |
|
||
| `ApexProxy.dll`, `ApexProxyMain.dll` | no VERSIONINFO | Proprietary (Apex anti-cheat); no public SDK. |
|
||
| `XLSLogin.dll` | no VERSIONINFO | Unknown origin; no public source identified. |
|
||
|
||
## Statically linked: TinyXML
|
||
|
||
TinyXML is not a separate DLL; it is compiled into the server EXEs.
|
||
|
||
- **Identity (observed):**
|
||
- 9 `TiXml*` RTTI classes appear in 14 of the 16 server EXEs. The two
|
||
`SMMonitoring` EXEs have none.
|
||
- In `Agent_Release_x64.exe`, the 12 TinyXML error-table strings and
|
||
`Failed to open file` appear contiguously at file offset `0x11d570`.
|
||
- There is no version string in the binary.
|
||
- **Version (inference from the error table):**
|
||
- The binary contains `Memory allocation failed.`. TinyXML 2.6.x removed that
|
||
entry; 2.5.1–2.5.3 have it, and their error tables are identical.
|
||
- So it is 2.5.1–2.5.3, but which one is unresolved. `tinyxml.h` and
|
||
`tinyxmlparser.cpp` differ between those releases, and the code has not been
|
||
compared.
|
||
- 2.5.0 couldn't be fetched, and pre-2.5 releases were not checked.
|
||
- **Directory:** `tinyxml-2.5.3/` holds the latest 2.5.x release, unmodified.
|
||
- Source: `sourceforge.net/projects/tinyxml`, file `tinyxml_2_5_3.zip`.
|
||
- SHA-256: `143590aa5930c1326315fb9fe3c0aab316a43751a44582dedd69331004b2c6a1`.
|
||
- **Match:** closest available, not confirmed exact.
|
||
- **Licence:** zlib, so it's fine to commit.
|
||
- **Use:** class layouts and the parser source let you label TinyXML functions
|
||
in the decompiled output, via the class records' method tables and the error
|
||
strings above.
|
||
|
||
## Statically linked: ProudNet (Nettention) — local-only headers
|
||
|
||
ProudNet is not a separate DLL; it is linked into the server EXEs.
|
||
|
||
- **Identity (observed):** in `Agent_Release_x64.exe`, RTTI and assert
|
||
strings name `Proud::CNetServerImpl`, `Proud::CNetClientImpl`, RMI stubs
|
||
and proxies, and `GET /PNReport/ReportError.php`. There is no version string
|
||
in the binary. VS2010 build, so likely an early-2010s ProudNet (inference).
|
||
Other EXEs not yet checked.
|
||
- **Public material:** `github.com/Nettention/ProudNet` contains prebuilt libs
|
||
and headers only. There is no public implementation source.
|
||
- **Licence:** proprietary EULA. It forbids redistribution and
|
||
reverse-engineering (§1.2b), treats the software as confidential (§3), and
|
||
is governed by Korean law (§7–8). **Do not commit any ProudNet files.**
|
||
- **Local copy (gitignored):** `_local/proudnet-1.8.00001/`. It holds
|
||
`ProudNet/include/` (187 headers) plus `ProudNet-License-En.txt`, from tag
|
||
`ProudNetLibSetup-1.8.00001` (commit `c70f23f9…`, May 2023). Fetched at the
|
||
user's direction for local naming reference only.
|
||
- **Match:** not version-matched; 1.8 is about a decade newer than the build.
|
||
Only 18 of 63 `Proud::` RTTI classes in the Agent appear in these headers;
|
||
the rest are internal `*Impl` types. Verify any struct layout against the
|
||
decompiled code before relying on it.
|
||
- To re-fetch:
|
||
`git archive ProudNetLibSetup-1.8.00001 ProudNet/include ProudNet-License-En.txt`
|
||
from that repo into `_local/proudnet-1.8.00001/`.
|
||
|
||
Vendor attributions for XTrap (WiseLogic) and Apex are inferred from DLL
|
||
names, not corroborated by decompilation.
|
||
|
||
## Acquisition routes for the remaining libraries
|
||
|
||
| DLL | Route | Notes |
|
||
|---|---|---|
|
||
| `dbghelp.dll` | Windows SDK / WDK 7.1 "Debugging Tools for Windows" (official `dbghelp.h` + `.lib`); Microsoft public symbol server `msdl.microsoft.com/download/symbols` for the PDB | Public PDB gives Ghidra near-complete function names. Wine `dlls/dbghelp/` (LGPL-2.1) is an open reimplementation if implementation code is wanted. |
|
||
| `hasp_windows_x64_95595.dll` | Thales Sentinel LDK SDK (free evaluation after registration) for `hasp_api.h` | `95595` is the vendor ID; the runtimeless DLL is generated per vendor, so this exact build is obtainable only from the publisher. Modern `hasp_*` C API is largely backward-compatible with 6.3. |
|
||
| `XTrap4Server.dll` | Publisher-licensed SDK under NDA only; vendor appears inactive | Practical path: recover interface from the 22 KB DLL's exports + server call sites (REA/Ghidra). |
|
||
| `ApexProxy.dll`, `ApexProxyMain.dll` | Publisher-licensed SDK only | Same as XTrap; `ApexProxyMain` has a `Ver: %s Build: %s` string as a starting point. |
|
||
| `XLSLogin.dll` | Unknown | Identify first: exports/imports/PDB path/signer via `rea_inspect_with_objdump`. |
|
||
|
||
Policy: commit only redistributable material (upstream OSS, mingw-w64
|
||
headers). Vendor SDKs obtained under licence must stay out of git. Interfaces
|
||
reconstructed from binaries go in `decomp/<dll>/` with an `evidence.md`
|
||
ledger; they describe static interface only, not runtime behavior.
|