server-re/third-party

third-party/ — upstream sources for shipped support DLLs

Source trees matched to the Support DLLs listed in decomp/INVENTORY.md. Used as reference when decompiling (symbol recovery, struct layouts, FLIRT-style matching). Not build inputs for anything in this repo.

"Matched" here means the upstream version equals the version embedded in the DLL (VERSIONINFO + in-binary version strings). Compiled DLLs cannot be byte-matched to source without the original toolchain/flags; the archives themselves were verified against upstream checksums where available.

DLL(s)	Embedded version (observed)	Directory	Upstream / integrity	Match
libeay32.dll, ssleay32.dll	FileVersion 1.0.0d; strings OpenSSL 1.0.0d 8 Feb 2011; PDB ...\OpenLibrary\openssl-1.0.0d\out32dll\	openssl-1.0.0d/	openssl.org/source/old/1.0.0/openssl-1.0.0d.tar.gz, SHA-1 32ca934f380a547061ddab7221b1a34e4e07e8d5 (matches official .sha1); SHA-256 92511d1f…6320db	Exact release
libcurl_x64.dll, libcurl_Win32.dll, libcurld_x64.dll, libcurld_Win32.dll	FileVersion 7.21.4; strings libcurl/7.21.4	curl-7.21.4/	git tag curl-7_21_4 (commit 827f0a31…) via GitHub archive, SHA-256 1dd41d4b…eb3240. Official release tarball no longer downloadable (404).	Exact tag; see note
BugTrapU-x64.dll	FileVersion 1.3.3466.24114; PDB ...\OpenLibrary\BugTrap\Win32\Bin\BugTrap.pdb	BugTrap-1.3-57bd515/	github.com/bchavez/BugTrap commit 57bd515 (earliest public import, 1.3.3718.38316)	Closest available, NOT exact
dbghelp.dll	Microsoft, Debugging Tools for Windows 6.12.0002.633	mingw-w64-dbghelp-63ebe6c/	github.com/mingw-w64/mingw-w64 commit 63ebe6cd… (master HEAD, retrieved 2026-10-14): include/dbghelp.h, lib-common/dbghelp.def (x64), lib32/dbghelp.def, licence files	Header + export list only, not an implementation

Notes:

• curl: the git tag differs from a release tarball only by generated files (configure, Makefiles) and maketgz version stamping. I applied the version stamp only (LIBCURL_VERSION → "7.21.4" in include/curl/curlver.h, CURL_VERSION in src/version.h); LIBCURL_TIMESTAMP left as "DEV" because the real release timestamp is unknown.
• BugTrap: no public source for build 3466 found. Export comparison: the shipped DLL's 83 BT_* exports (82 shared) equal source/BugTrap.h of 57bd515 except the DLL exports BT_GetErrorString (not in header) and the header declares BT_SetTerminate (not exported). Treat API/structs as approximate.
• The debug (libcurld_*) and Win32 variants share the same source version.
• dbghelp (mingw-w64): clean-room, public-domain/ZPL headers, not Microsoft's. All 205 named exports of the shipped dbghelp.dll appear in lib-common/dbghelp.def. Header is a modern superset of the 6.12 API, so struct versions/sizes may differ from 2010-era definitions. mingw-w64 has no dbghelp implementation; an open implementation exists in Wine (dlls/dbghelp/, LGPL-2.1).

No public source (not included)

DLL	Observed identity	Reason
dbghelp.dll	Microsoft, Debugging Tools for Windows 6.12.0002.633	Proprietary implementation; clean-room header included (see table above).
hasp_windows_x64_95595.dll	SafeNet Sentinel LDK RuntimelessAPI 6.3.1.28566	Proprietary; hasp_api.h ships only in the vendor-licensed Sentinel LDK SDK. Bundles trio and hamsterdb internally (observed strings).
XTrap4Server.dll / 20100731_521_XTrap4Server.dll	no VERSIONINFO	Proprietary anti-cheat (WiseLogic XTrap); no public SDK.
ApexProxy.dll, ApexProxyMain.dll	no VERSIONINFO	Proprietary (Apex anti-cheat); no public SDK.
XLSLogin.dll	no VERSIONINFO	Unknown origin; no public source identified.

Statically linked: TinyXML

TinyXML is not a separate DLL; it is compiled into the server EXEs.

• Identity (observed):
  • 9 TiXml* RTTI classes appear in 14 of the 16 server EXEs. The two SMMonitoring EXEs have none.
  • In Agent_Release_x64.exe, the 12 TinyXML error-table strings and Failed to open file appear contiguously at file offset 0x11d570.
  • There is no version string in the binary.
• Version (inference from the error table):
  • The binary contains Memory allocation failed.. TinyXML 2.6.x removed that entry; 2.5.1–2.5.3 have it, and their error tables are identical.
  • So it is 2.5.1–2.5.3, but which one is unresolved. tinyxml.h and tinyxmlparser.cpp differ between those releases, and the code has not been compared.
  • 2.5.0 couldn't be fetched, and pre-2.5 releases were not checked.
• Directory: tinyxml-2.5.3/ holds the latest 2.5.x release, unmodified.
  • Source: sourceforge.net/projects/tinyxml, file tinyxml_2_5_3.zip.
  • SHA-256: 143590aa5930c1326315fb9fe3c0aab316a43751a44582dedd69331004b2c6a1.
• Match: closest available, not confirmed exact.
• Licence: zlib, so it's fine to commit.
• Use: class layouts and the parser source let you label TinyXML functions in the decompiled output, via the class records' method tables and the error strings above.

Statically linked: ProudNet (Nettention) — local-only headers

ProudNet is not a separate DLL; it is linked into the server EXEs.

• Identity (observed): in Agent_Release_x64.exe, RTTI and assert strings name Proud::CNetServerImpl, Proud::CNetClientImpl, RMI stubs and proxies, and GET /PNReport/ReportError.php. There is no version string in the binary. VS2010 build, so likely an early-2010s ProudNet (inference). Other EXEs not yet checked.
• Public material: github.com/Nettention/ProudNet contains prebuilt libs and headers only. There is no public implementation source.
• Licence: proprietary EULA. It forbids redistribution and reverse-engineering (§1.2b), treats the software as confidential (§3), and is governed by Korean law (§7–8). Do not commit any ProudNet files.
• Local copy (gitignored): _local/proudnet-1.8.00001/. It holds ProudNet/include/ (187 headers) plus ProudNet-License-En.txt, from tag ProudNetLibSetup-1.8.00001 (commit c70f23f9…, May 2023). Fetched at the user's direction for local naming reference only.
• Match: not version-matched; 1.8 is about a decade newer than the build. Only 18 of 63 Proud:: RTTI classes in the Agent appear in these headers; the rest are internal *Impl types. Verify any struct layout against the decompiled code before relying on it.
• To re-fetch: git archive ProudNetLibSetup-1.8.00001 ProudNet/include ProudNet-License-En.txt from that repo into _local/proudnet-1.8.00001/.
• github.com/Nettention/ProudChatSDK (checked 2026-10-15, main = tag 1.1.0001, commit e0d9d6b8).

  • Contents: bundles ProudNet 1.8.58849: 185 headers, plus prebuilt libraries for Windows (v110/v120/v140, dll), Android, iOS and x86_64 Linux (libProudNetServer.so/.a, libProudNetClient.so/.a; __xstat → old glibc).

  • Licence: the repo's LICENSE (MIT) covers the chat SDK only; ProudNet/ keeps the same proprietary EULA (§1.2b). Nothing from it is stored in this repo.

  • Headers: identical to 1.8.00001 apart from the version banner and translated doc comments in ErrorType.h. They add one error code and give no new information beyond _local/proudnet-1.8.00001.

  • Compatibility with the 2013 ProudNet linked into DBCServer:

    Aspect	Result	Type
    PIDL proxy ABI	Matches: IRmiProxy keeps m_signature at +0x14, which the generated constructor checks against 1 (MS:0x140008e20). RmiID is still uint16_t. The PIDL compiler is incompatible and CStartServerParameter::m_(fast)encryptedMessageKeyLength strings appear in both	O
    Internal implementation	29 of DBCServer's 63 Proud:: RTTI classes are absent from the 1.8.58849 Linux libraries' symbols, e.g. CTcpLayer_C, CUdpSocket_S, CUpnp, ICompletionPortEventSink	O
    Internal net version	2013 build: 196978 (0x30172), the global at DBC:0x140344d40. It is copied into the server object at +0x220 (DBC:0x14018fa70, instruction at 0x14019018d) and into the client objects (0x1401dd3e0, 0x1401df000). In the connect handshake (DBC:0x1401a8110, NotifyServerConnectionRequestData) the server reads a credential byte array, a 16-byte protocol GUID and a 4-byte int, and accepts only if the GUID and the int equal its own. The same value appears exactly once in .data of all 16 EXEs (O). 1.8.58849: 197144 (0x30218) (CNetConfig::InternalNetVersion, rejected via NotifyProtocolVersionMismatch). The values differ by 166	O
    Licensing	1.8 also contains license and activation checks (CPNLic, NotifyLicenseMismatch)	S

  • Conclusion (I):

    • Source-level: usable as a header/ABI reference for PIDL-generated stubs and proxies.
    • Wire-level: not compatible with the original 2013 peers. The internal net versions differ (196978 vs 197144), and the 2013 handshake requires an exact match. This is O for the 2013 server side; I for the 1.8 side, which was not traced beyond the symbol name.
    • Linking: linking libProudNetServer.so into src/dbc_server would require accepting the EULA and a licence, and would give a ProudNet 1.8 server that the original binaries likely cannot talk to.

Vendor attributions for XTrap (WiseLogic) and Apex are inferred from DLL names, not corroborated by decompilation.

Acquisition routes for the remaining libraries

DLL	Route	Notes
dbghelp.dll	Windows SDK / WDK 7.1 "Debugging Tools for Windows" (official dbghelp.h + .lib); Microsoft public symbol server msdl.microsoft.com/download/symbols for the PDB	Public PDB gives Ghidra near-complete function names. Wine dlls/dbghelp/ (LGPL-2.1) is an open reimplementation if implementation code is wanted.
hasp_windows_x64_95595.dll	Thales Sentinel LDK SDK (free evaluation after registration) for hasp_api.h	95595 is the vendor ID; the runtimeless DLL is generated per vendor, so this exact build is obtainable only from the publisher. Modern hasp_* C API is largely backward-compatible with 6.3.
XTrap4Server.dll	Publisher-licensed SDK under NDA only; vendor appears inactive	Practical path: recover interface from the 22 KB DLL's exports + server call sites (REA/Ghidra).
ApexProxy.dll, ApexProxyMain.dll	Publisher-licensed SDK only	Same as XTrap; ApexProxyMain has a Ver: %s Build: %s string as a starting point.
XLSLogin.dll	Unknown	Identify first: exports/imports/PDB path/signer via rea_inspect_with_objdump.

Policy: commit only redistributable material (upstream OSS, mingw-w64 headers). Vendor SDKs obtained under licence must stay out of git. Interfaces reconstructed from binaries go in decomp/<dll>/ with an evidence.md ledger; they describe static interface only, not runtime behavior.