# boostempire_auth.py | pip install requests import requests, uuid, hashlib, platform, subprocess, sys PUBLIC_KEY = "pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" # from My Apps BASE_URL = "http://boostempire.auth" class BoostEmpireAuth: def __init__(self, app_name="MyApp"): self.app_name = app_name self.hwid = self._hwid() def _hwid(self): try: p = platform.system() if p == "Windows": raw = subprocess.check_output("wmic csproduct get uuid",shell=True).decode().split("\n")[1].strip() elif p == "Linux": raw = open("/etc/machine-id").read().strip() else: raw = subprocess.check_output(["ioreg","-rd1","-c","IOPlatformExpertDevice"]).decode() raw = [l for l in raw.split("\n") if "UUID" in l][0].split('"')[-2] except: raw = str(uuid.getnode()) return "BE-HW-" + hashlib.sha256(raw.encode()).hexdigest()[:24].upper() def login(self, key, exit_on_fail=True): try: r = requests.post(f"{BASE_URL}/api/auth", headers={"x-public-key": PUBLIC_KEY}, json={"key":key,"hwid":self.hwid,"app_name":self.app_name}, timeout=5).json() except: print("[BoostEmpire] Cannot reach auth server"); sys.exit(1) if r["success"]: d=r["data"]; print(f"[✅] {d['app']} | {d['product']} | Uses {d['uses']}/{d['max_uses']}") return True print(f"[❌] {r['message']} ({r['code']})") if exit_on_fail: sys.exit(1) return False auth = BoostEmpireAuth("MyApp") auth.login("BE-YOURLICENSEKEYHERE")

// boostempire-auth.js — zero dependencies const http=require('http'),{execSync}=require('child_process'), crypto=require('crypto'),os=require('os'); const PUBLIC_KEY='pk_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'; // from My Apps const BASE={host:'boostempire.auth:8080',port:80}; function getHWID(){ try{ let raw; if(process.platform==='win32') raw=execSync('wmic csproduct get uuid',{timeout:3000}).toString().split('\n')[1].trim(); else if(process.platform==='linux') raw=require('fs').readFileSync('/etc/machine-id','utf8').trim(); else raw=execSync('ioreg -rd1 -c IOPlatformExpertDevice').toString() .match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/)[1]; return 'BE-HW-'+crypto.createHash('sha256').update(raw).digest('hex').slice(0,24).toUpperCase(); }catch{ const mac=Object.values(os.networkInterfaces()).flat() .find(i=>!i.internal&&i.mac!=='00:00:00:00:00:00')?.mac||'unknown'; return 'BE-HW-'+crypto.createHash('sha256').update(mac).digest('hex').slice(0,24).toUpperCase(); } } function boostAuth(key,appName='MyApp'){ return new Promise((res,rej)=>{ const body=JSON.stringify({key,hwid:getHWID(),app_name:appName}); const req=http.request({...BASE,path:'/api/auth',method:'POST', headers:{'Content-Type':'application/json','x-public-key':PUBLIC_KEY, 'Content-Length':Buffer.byteLength(body)}}, r=>{let d='';r.on('data',c=>d+=c);r.on('end',()=>{ const j=JSON.parse(d); if(j.success){console.log(`[✅] ${j.data.app} | ${j.data.product}`);res(j.data);} else{console.error(`[❌] ${j.message}`);process.exit(1);} });}); req.on('error',()=>{console.error('[BE] Unreachable');process.exit(1);}); req.write(body);req.end(); }); } module.exports={boostAuth,getHWID}; // await boostAuth('BE-YOURKEYHERE','MyApp');

// POST /api/auth Header: x-public-key: pk_xxxxxxxx Body: { "key":"BE-XXX", "hwid":"BE-HW-xxxx", "app_name":"MyApp" } // ✅ Success { "success":true, "code":"OK", "data":{ "app":"MyApp", "product":"Default", "expires_at":null, "uses":1, "max_uses":5, "uses_left":4, "hwid_locked":true }} // ❌ Codes NO_PUBLIC_KEY — missing x-public-key header INVALID_PUBLIC_KEY— key doesn't match any app NO_KEY / NO_HWID — missing fields INVALID_HWID — suspicious HWID rejected INVALID_KEY — key not found in app BANNED — key banned EXPIRED — past expiry MAX_USES — used too many times HWID_MISMATCH — wrong machine RATE_LIMITED — too many requests IP_BLOCKED — IP permanently blocked // Request body fields key — license key (required) hwid — hardware ID from GenerateHWID() (required) app_name — your app name (required) real_ip — client public IP from GetRealPublicIP() (optional) cpu — CPU brand for multi-machine detection (optional) // C++ Protections in boostempire_auth.h Code Integrity — hashes exe, checks every 60s, patch = BSOD ② Import Obfuscation— dynamic API resolution, hidden from static analysis ③ Anti-Dump — PE header erased from memory at startup ④ Timing Jitter — 80-350ms server delay per auth, blocks brute-force ⑤ Stack Canary — ROP/smash detection on auth stack ⑥ Thread Anomaly — DLL injection = thread spike = BSOD ⑦ Fake Exports — ValidateLicense/CheckLicense/IsAuthenticated = BSOD ⑧ Anti-Screenshot — WDA_EXCLUDEFROMCAPTURE, black in OBS/capture ⑨ Watchdog Check — watchdog suspended = BSOD within 15s ⑩ Multi-Machine — same key 2 CPUs in 60s = permanent ban