if (s.size() >= 2 && ((s.front() == '"' && s.back() == '"') || (s.front() == '\'' && s.back() == '\''))) {

s = s.substr(1, s.size() - 2);

}

static const char* kHex = "0123456789abcdef";

std::string out;

out.reserve(len * 2);

for (size_t i = 0; i < len; ++i) {

out.push_back(kHex[(bytes[i] >> 4) & 0xF]);

out.push_back(kHex[bytes[i] & 0xF]);

}

return out;

trim_ws(sig_in);

strip_quotes(sig_in);

if (sig_in.rfind("0x", 0) == 0 || sig_in.rfind("0X", 0) == 0) {

sig_in = sig_in.substr(2);

}

if (is_hex_string(sig_in) && sig_in.size() == 128) {

std::transform(sig_in.begin(), sig_in.end(), sig_in.begin(),

[](unsigned char c) { return static_cast<char>(std::tolower(c)); });

sig_hex_out = sig_in;

return true;

}

unsigned char decoded[64] = { 0 };

size_t decoded_len = 0;

if (sodium_base642bin(decoded, sizeof(decoded), sig_in.c_str(), sig_in.size(),

nullptr, &decoded_len, nullptr, sodium_base64_VARIANT_ORIGINAL) == 0 && decoded_len == 64) {

sig_hex_out = bytes_to_hex(decoded, decoded_len);

return true;

}

if (sodium_base642bin(decoded, sizeof(decoded), sig_in.c_str(), sig_in.size(),

nullptr, &decoded_len, nullptr, sodium_base64_VARIANT_URLSAFE_NO_PADDING) == 0 && decoded_len == 64) {

sig_hex_out = bytes_to_hex(decoded, decoded_len);

return true;

}

return false;

{

if (!value.empty()) {

SecureZeroMemory(value.data(), value.size());

value.clear();

value.shrink_to_fit();

}

{

uint64_t h = 0xcbf29ce484222325ULL;

for (size_t i = 0; i < len; ++i) {

h ^= static_cast<uint64_t>(data[i]);

h *= 0x100000001b3ULL;

}

return h;

{

std::string out;

out.resize(len);

for (size_t i = 0; i < len; ++i) {

out[i] = static_cast<char>(obf[i] ^ key);

}

return out;

{

std::transform(v.begin(), v.end(), v.begin(),

[](unsigned char c) { return static_cast<char>(std::tolower(c)); });

return v;

{

if (!w)

return {};

int needed = WideCharToMultiByte(CP_UTF8, 0, w, -1, nullptr, 0, nullptr, nullptr);

if (needed <= 0)

return {};

std::string out(static_cast<size_t>(needed - 1), '\0');

WideCharToMultiByte(CP_UTF8, 0, w, -1, out.data(), needed, nullptr, nullptr);

return out;

{

for (const auto& n : needles) {

if (hay.find(n) != std::string::npos)

return true;

}

return false;

{

const std::vector<std::string> bad = {

"fiddler", "mitmproxy", "charles", "httpdebugger", "proxifier",

"burpsuite", "wireshark", "tshark", "x64dbg", "x32dbg",

"ollydbg", "ida", "cheatengine", "processhacker"

};

HANDLE snap = LI_FN(CreateToolhelp32Snapshot).get()(TH32CS_SNAPPROCESS, 0);

if (snap == INVALID_HANDLE_VALUE)

return false;

PROCESSENTRY32 pe{};

pe.dwSize = sizeof(pe);

if (!Process32First(snap, &pe)) {

LI_FN(CloseHandle).get()(snap);

return false;

}

do {

std::string name = to_lower_ascii(wide_to_utf8(pe.szExeFile));

if (list_contains_any(name, bad)) {

LI_FN(CloseHandle).get()(snap);

return true;

}

} while (Process32Next(snap, &pe));

LI_FN(CloseHandle).get()(snap);

return false;

{

const std::vector<std::string> bad = {

"fiddlercore", "mitm", "charles", "httpdebugger", "proxifier",

"detours", "minhook", "easyhook", "polyhook", "bypass", "inject", "hook"

};

HMODULE mods[1024];

DWORD needed = 0;

if (!EnumProcessModules(GetCurrentProcess(), mods, sizeof(mods), &needed))

return false;

const size_t count = needed / sizeof(HMODULE);

char name[MAX_PATH]{};

for (size_t i = 0; i < count; ++i) {

if (GetModuleFileNameA(mods[i], name, MAX_PATH)) {

std::string lower = to_lower_ascii(name);

if (list_contains_any(lower, bad))

return true;

}

}

return false;

{

const std::vector<std::string> bad = {

"fiddler", "mitmproxy", "charles", "burp", "http debugger",

"x64dbg", "x32dbg", "ollydbg", "ida", "cheat engine",

"process hacker"

};

struct Ctx { const std::vector<std::string>* bad; bool hit; };

Ctx ctx{ &bad, false };

auto cb = [](HWND hwnd, LPARAM lparam) -> BOOL {

auto* c = reinterpret_cast<Ctx*>(lparam);

if (!IsWindowVisible(hwnd))

return TRUE;

char title[512]{};

GetWindowTextA(hwnd, title, sizeof(title));

if (title[0] == '\0')

return TRUE;

std::string t = to_lower_ascii(title);

if (list_contains_any(t, *c->bad)) {

c->hit = true;

return FALSE;

}

return TRUE;

};

EnumWindows(cb, reinterpret_cast<LPARAM>(&ctx));

return ctx.hit;

{

const char* p1 = std::getenv("HTTP_PROXY");

const char* p2 = std::getenv("HTTPS_PROXY");

const char* p3 = std::getenv("ALL_PROXY");

return (p1 && *p1) || (p2 && *p2) || (p3 && *p3);

{

const std::string host = extract_host(url);

if (host.empty())

return false;

std::string h = to_lower_ascii(host);

if (h == "localhost" || h == "127.0.0.1" || h == "::1")

return true;

ADDRINFOA hints{};

hints.ai_family = AF_UNSPEC;

hints.ai_socktype = SOCK_STREAM;

ADDRINFOA* res = nullptr;

if (getaddrinfo(host.c_str(), nullptr, &hints, &res) != 0)

return false;

bool loopback = false;

for (auto* p = res; p; p = p->ai_next) {

if (p->ai_family == AF_INET) {

auto* in = reinterpret_cast<sockaddr_in*>(p->ai_addr);

if ((ntohl(in->sin_addr.s_addr) & 0xFF000000u) == 0x7F000000u) {

loopback = true;

break;

}

}

else if (p->ai_family == AF_INET6) {

auto* in6 = reinterpret_cast<sockaddr_in6*>(p->ai_addr);

if (IN6_IS_ADDR_LOOPBACK(&in6->sin6_addr)) {

loopback = true;

break;

}

}

}

freeaddrinfo(res);

return loopback;

{

MEMORY_BASIC_INFORMATION mbi{};

if (!VirtualQuery(k_pubkey_obf1, &mbi, sizeof(mbi)))

return false;

const DWORD p = mbi.Protect;

if (p & PAGE_GUARD)

return false;

if ((p & PAGE_READWRITE) || (p & PAGE_WRITECOPY) ||

(p & PAGE_EXECUTE_READWRITE) || (p & PAGE_EXECUTE_WRITECOPY)) {

return false;

}

if (pubkey_protect_ready.load(std::memory_order_relaxed)) {

if (pubkey_protect_baseline != p)

return false;

}

return true;

{

if (!pubkey_memory_protect_ok()) {

error(oxorany("public key memory protection tampered."));

}

std::string a = decode_pubkey_hex(k_pubkey_obf1, sizeof(k_pubkey_obf1), k_pubkey_xor1);

std::string b = decode_pubkey_hex(k_pubkey_obf2, sizeof(k_pubkey_obf2), k_pubkey_xor2);

if (a != b) {

error(oxorany("public key mismatch detected."));

}

const uint64_t h = fnv1a64_bytes(reinterpret_cast<const uint8_t*>(a.data()), a.size());

pubkey_hash_seen.store(h, std::memory_order_relaxed);

if (h != k_pubkey_fnv1a) {

error(oxorany("public key integrity failed."));

}

return a;

{

if (needle.empty())

return false;

MODULEINFO mi{};

if (!GetModuleInformation(GetCurrentProcess(), LI_FN(GetModuleHandleA).forwarded_safe_cached()(nullptr), &mi, sizeof(mi)))

return false;

const uint8_t* base = reinterpret_cast<const uint8_t*>(mi.lpBaseOfDll);

const uint8_t* end = base + mi.SizeOfImage;

const uint8_t* p = base;

while (p < end) {

MEMORY_BASIC_INFORMATION mbi{};

if (!VirtualQuery(p, &mbi, sizeof(mbi)))

break;

const uint8_t* region = reinterpret_cast<const uint8_t*>(mbi.BaseAddress);

const uint8_t* region_end = region + mbi.RegionSize;

if (region_end > end)

region_end = end;

const DWORD protect = mbi.Protect;

const bool readable = (protect & PAGE_READONLY) || (protect & PAGE_READWRITE) ||

(protect & PAGE_EXECUTE_READ) || (protect & PAGE_EXECUTE_READWRITE) ||

(protect & PAGE_WRITECOPY) || (protect & PAGE_EXECUTE_WRITECOPY);

if (mbi.State == MEM_COMMIT && readable) {

const char* cbegin = reinterpret_cast<const char*>(region);

const char* cend = reinterpret_cast<const char*>(region_end);

auto it = std::search(cbegin, cend, needle.begin(), needle.end());

if (it != cend)

return true;

}

p = region_end;

}

return false;

std::string* value;

explicit ScopeWipe(std::string& v) noexcept : value(&v) {}

~ScopeWipe() noexcept { securewipe(*value); }

size_t totalSize = size * nitems;

std::string header(buffer, totalSize);

if (header.empty())

return totalSize;

// trim CRLF

while (!header.empty() && (header.back() == '\r' || header.back() == '\n')) {

header.pop_back();

}

const auto colon = header.find(':');

if (colon == std::string::npos)

return totalSize;

std::string key = header.substr(0, colon);

std::string value = header.substr(colon + 1);

while (!value.empty() && (value.front() == ' ' || value.front() == '\t')) {

value.erase(value.begin());

}

std::transform(key.begin(), key.end(), key.begin(), ::tolower);

auto* sig = static_cast<SignatureHeaders*>(userdata);

if (sig) {

if (key == "x-signature-ed25519") {

sig->signature = value;

}

if (key == "x-signature-timestamp") {

sig->timestamp = value;

}

}

return totalSize;