IronLock v2.0 — Exemples

from tools.license_generator import generate_ecc_keypair, save_keypair

# Génère une paire ECC P-384
private_pem, public_pem = generate_ecc_keypair()

# Sauvegarde sur disque (chmod 600 automatique sur Unix)
save_keypair(
    private_pem,
    public_pem,
    private_path = "private_key.pem",
    public_path  = "public_key.pem",
)

# Afficher la clé publique à embarquer dans loader.py
print(public_pem)

from tools.license_generator import generate_rsa_keypair, save_keypair

# RSA-2048 — v1 uniquement
private_pem, public_pem = generate_rsa_keypair(key_size=2048)
save_keypair(private_pem, public_pem,
             "private_rsa_v1.pem", "public_rsa_v1.pem")

# Dans core/loader.py — rétro-compat
# IRONLOCK_PUBLIC_KEY_RSA_V1 = open("public_rsa_v1.pem").read()

import hashlib
from core.crypto_engine import CryptoEngine, build_master_secret

# Construction du secret maître (fingerprint + secret licence)
fingerprint    = "sha256-fingerprint-64-chars"
licence_secret = "hex-secret-64-chars"

master_secret = build_master_secret(fingerprint, licence_secret)
engine        = CryptoEngine(master_secret)

# Chiffrement AES-256-GCM (auto-sélectionné si AES-NI présent)
result = engine.encrypt_file("monapp.exe", "payload.ironenc")

print(f"Algo      : {result['algo']}")
print(f"Original  : {result['size_original']:,} bytes")
print(f"Chiffré   : {result['size_encrypted']:,} bytes")
print(f"Chunks    : {result['chunks_count']}")
print(f"Hash orig : {result['hash_original']}")

from core.crypto_engine import CryptoEngine, build_master_secret

master_secret = build_master_secret("fingerprint", "secret")

# Forcer ChaCha20-Poly1305 (timing-safe sans AES-NI)
engine = CryptoEngine(master_secret, prefer_chacha=True)

result = engine.encrypt_file("payload.py", "payload.ironenc")
print(f"Algo : {result['algo']}")  # ChaCha20-Poly1305

# Le déchiffrement est automatiquement dirigé vers le bon algo
# via le champ ALGO (0x02) dans le header du .ironenc

from core.crypto_engine import CryptoEngine, build_master_secret

master_secret = build_master_secret("fingerprint", "licence_secret")
engine        = CryptoEngine(master_secret)

try:
    payload_bytes = engine.decrypt_to_memory("payload.ironenc")
    print(f"[+] Déchiffré : {len(payload_bytes):,} bytes")
    print(f"[+] Type      : {payload_bytes[:4].hex()}")  # MZ, ELF, PK...
    # → Exécuter en mémoire
except ValueError as e:
    print(f"[!] Échec : {e}")  # Tampered / mauvaise clé
finally:
    # Effacement mémoire best-effort
    payload_bytes = bytes(len(payload_bytes)) if 'payload_bytes' in dir() else None

from core.crypto_engine import CryptoEngine, build_master_secret

# IDENTIQUE à l'exemple 05 — le moteur détecte automatiquement
master_secret = build_master_secret("old_fingerprint_v1", "old_v1_secret")
engine        = CryptoEngine(master_secret)

# payload_v1.ironenc commence par "IRONLK1" → CBC legacy branch
data = engine.decrypt_to_memory("payload_v1.ironenc")

# Vérifier la version du package
with open("payload.ironenc", "rb") as f:
    magic = f.read(7)
    print(f"Format : v1 CBC" if magic == b"IRONLK1" else "Format : v2 GCM")

import secrets
from core.crypto_engine import derive_master_key, _ARGON2_AVAILABLE

print(f"Argon2id disponible : {_ARGON2_AVAILABLE}")

salt       = secrets.token_bytes(32)
passphrase = b"mon_secret_machine"

# Argon2id (m=64Mo, t=3, p=4)
master_key = derive_master_key(passphrase, salt)
print(f"Clé dérivée : {master_key.hex()}")
print(f"Longueur    : {len(master_key)} bytes (256-bit)")

# Si argon2-cffi absent → fallback PBKDF2-SHA256 300K auto

from core.crypto_engine import derive_master_key, derive_session_key
import secrets

salt       = secrets.token_bytes(32)
master_key = derive_master_key(b"master_secret", salt)

# Deux clés distinctes depuis la même clé maître
enc_key  = derive_session_key(master_key, b"encryption")   # 32B
hmac_key = derive_session_key(master_key, b"hmac")          # 32B
auth_key = derive_session_key(master_key, b"server-auth",   # 64B custom
                               length=64)

print(f"enc_key  : {enc_key.hex()[:32]}...")
print(f"hmac_key : {hmac_key.hex()[:32]}...")
print(f"auth_key : {auth_key.hex()[:32]}...")

from core.fingerprint import (
    collect_all_sources, generate_fingerprint,
    generate_fingerprint_components,
)

# Collecte des 12 sources (v2)
sources    = collect_all_sources()
fingerprint = generate_fingerprint(sources)
components  = generate_fingerprint_components(sources)

print(f"FINGERPRINT : {fingerprint}")
print(f"Sources     : {len(sources)}/12")

# Afficher les 4 nouvelles sources v2
for k in ["chassis_serial", "volume_serial",
           "cpu_features", "screen_res"]:
    print(f"  {k}: {sources[k]}")

from core.fingerprint import (
    collect_all_sources, generate_fingerprint_components,
    compute_match_score,
)

# Composants stockés dans la licence
stored_components = {
    "cpu_id": "3a7f1b2c", "mac_address": "b2c9e8f4",
    "disk_serial": "c3d0f7a5", "motherboard_uuid": "d4e1a8b6",
    "bios_serial": "e5f2b9c7", "hostname": "f6a3c0d8",
    "platform_sig": "a7b4d1e9", "cpu_timing": "b8c5e2f0",
    "chassis_serial": "c9d6f3a1", "volume_serial": "d0e7a4b2",
    "cpu_features": "e1f8b5c3", "screen_res": "f2a9c6d4",
}

# Composants actuels (machine peut avoir changé)
sources  = collect_all_sources()
current  = generate_fingerprint_components(sources)

score, total, matched = compute_match_score(stored_components, current)
TOLERANCE = 8

print(f"Score   : {score}/{total}")
print(f"Valide  : {score >= TOLERANCE}")
print(f"Matchés : {matched}")

import json, platform
from core.fingerprint import (
    collect_all_sources, generate_fingerprint,
    generate_fingerprint_components,
)

sources     = collect_all_sources()
fingerprint = generate_fingerprint(sources)
components  = generate_fingerprint_components(sources)

output = {
    "version":     "2.0",
    "fingerprint": fingerprint,
    "components":  components,    # Hashes 16B — pas les valeurs brutes
    "platform":    platform.system(),
    "sources_count": len(components),
}

with open("machine_fingerprint.json", "w") as f:
    json.dump(output, f, indent=2)

print(f"[+] machine_fingerprint.json créé ({len(components)} sources)")
print(f"[+] Envoyer ce fichier au développeur pour obtenir votre licence.")

import json
from tools.license_generator import (
    load_private_key, load_public_key,
    create_licence, sign_licence,
    package_licence, save_licence,
    verify_licence_signature,
)

# Clés ECC P-384
private_key = load_private_key("private_key.pem")
public_key  = load_public_key("public_key.pem")

# Fingerprint client (12 sources)
fp_data = json.loads(open("machine_fingerprint.json").read())

# Création de la licence
licence_data = create_licence(
    customer_name   = "Tristan Ruard",
    customer_email  = "tristan@exemple.com",
    product         = "Mon Application v2.0",
    fingerprint     = fp_data["fingerprint"],
    components      = fp_data["components"],
    duration_days   = 365,
    max_activations = 1,
    perpetual       = False,
)

# Signature ECDSA P-384
signature = sign_licence(licence_data, private_key)
package   = package_licence(licence_data, signature, private_key)

# Vérification avant envoi
valid = verify_licence_signature(package, public_key)
print(f"[+] Signature ECDSA valide : {valid}")
print(f"[+] Format : {package['format']}")
print(f"[+] ID     : {licence_data['id']}")
print(f"[+] Expire : {licence_data['expires_at']}")

save_licence(package, "licence.lic")

import json
from tools.license_generator import *

private_key = load_private_key("private_key.pem")
fp          = json.loads(open("machine_fingerprint.json").read())

licence_data = create_licence(
    customer_name = "Tristan Ruard",
    product       = "Mon Application v2.0",
    fingerprint   = fp["fingerprint"],
    components    = fp["components"],
    perpetual     = True,             # expires_at = null
    max_activations = 1,
)

print(f"expires_at : {licence_data['expires_at']}")  # None

sig = sign_licence(licence_data, private_key)
pkg = package_licence(licence_data, sig, private_key)
save_licence(pkg, "licence_perpetuelle.lic")

import json
from tools.license_generator import load_public_key, verify_licence_signature
from datetime import datetime

public_key = load_public_key("public_key.pem")
package    = json.loads(open("licence.lic").read())
data       = package["data"]

# Vérification cryptographique
valid = verify_licence_signature(package, public_key)

# Vérification expiration
exp = data.get("expires_at")
expired = (not exp) or (datetime.utcnow() > datetime.strptime(exp, "%Y-%m-%d"))

print(f"Client      : {data['customer_name']}")
print(f"Produit     : {data['product']}")
print(f"Signature   : {'✅ VALIDE' if valid else '❌ INVALIDE'}")
print(f"Expire      : {exp or 'Perpétuelle'}")
print(f"Statut      : {'❌ Expirée' if expired else '✅ Active'}")
print(f"Format      : {package['format']}")
print(f"Composants  : {len(data['components'])}/12")

# Dans core/loader.py — avant obfuscation et build

# Clé ECC P-384 principale (nouvelle, v2)
IRONLOCK_PUBLIC_KEY_PEM = """-----BEGIN PUBLIC KEY-----
MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE... (votre clé ECC)
-----END PUBLIC KEY-----"""

# Clé RSA-2048 v1 — rétro-compat
IRONLOCK_PUBLIC_KEY_RSA_V1 = """-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A... (votre ancienne clé RSA)
-----END PUBLIC KEY-----"""

# Le loader tente automatiquement :
# 1. ECDSA P-384 si format = "IRONLOCK-ECDSA-P384-SHA256-v2"
# 2. RSA-PSS     si format = "IRONLOCK-RSA-PSS-SHA256-v1"

import json
from tools.license_generator import *

private_key = load_private_key("private_key.pem")
fp          = json.loads(open("machine_fingerprint.json").read())

# Licence "Pro" avec modules avancés
lic_pro = create_licence(
    customer_name = "Tristan Ruard",
    product       = "MonApp v2.0 — Pro",
    fingerprint   = fp["fingerprint"],
    components    = fp["components"],
    duration_days = 365,
    features      = ["standard", "pro", "analytics", "export_pdf"],
)

# Dans le payload — lecture des features
# features = licence_data.get("features", [])
# if "pro" in features: enable_pro_module()
# if "analytics" in features: enable_analytics()

sig = sign_licence(lic_pro, private_key)
pkg = package_licence(lic_pro, sig, private_key)
save_licence(pkg, "licence_pro.lic")
print(f"Features : {lic_pro['features']}")

from core.anti_debug import run_security_checks

# Mode rapport (dev/test)
rapport = run_security_checks(strict=False)

checks_display = [
    ("IsDebuggerPresent",       rapport["debugger_windows"]),
    ("CheckRemoteDebugger",      rapport["debugger_remote"]),
    ("TracerPid (Linux)",         rapport["debugger_linux"]),
    ("Timing anomaly",            rapport["debugger_timing"]),
    ("NtQueryInformationProcess", rapport["nt_query_debug"]),
    ("PEB.NtGlobalFlag",          rapport["peb_flags"]),
    ("RDTSC delta",               rapport["rdtsc_timing"]),
    ("Exception handler",         rapport["exception_handler"]),
    ("CloseHandle(NULL)",          rapport["close_handle"]),
    ("Stack walk",                rapport["stack_walk"]),
]

for name, detected in checks_display:
    icon = "⚠️ DÉTECTÉ" if detected else "✅ Clean"
    print(f"  {name:<30} : {icon}")

print(f"\nProcessus debug : {rapport['debug_processes'] or 'Aucun'}")
print(f"Env debug vars  : {rapport['debug_env_vars'] or 'Aucun'}")
print(f"MENACE DÉTECTÉE : {rapport['threat_detected']}")

from core.vm_detector import detect_vm

result = detect_vm()

print(f"VM détectée  : {'⚠️ OUI' if result['is_vm'] else '✅ Non'}")
print(f"Score        : {result['score']}")
print(f"Confiance    : {result['confidence']*100:.0f}%")

if result["detections"]:
    print(f"\nIndicateurs ({len(result['detections'])}) :")
    for d in result["detections"]:
        print(f"  - {d}")
else:
    print("\nAucun indicateur de virtualisation.")

# Intégration dans un loader personnalisé
THRESHOLD = 0.3
if result["is_vm"] and result["confidence"] > THRESHOLD:
    print("[!] Exécution en VM non autorisée.")
    import sys; sys.exit(1)

import os, sys, time, urllib.request, json
from core.anti_debug import WatchdogThread

def alert_and_exit(threat_type: str):
    # Envoyer une alerte avant arrêt
    try:
        payload = json.dumps({
            "event":   "security_threat",
            "threat":  threat_type,
            "product": "MonApp v2.0",
        }).encode()
        urllib.request.urlopen(
            "https://api.votreapp.com/security/threat",
            data=payload, timeout=3
        )
    except Exception:
        pass
    # Arrêt immédiat (contourne atexit et finally)
    os._exit(1)

# Démarrage du watchdog
watchdog = WatchdogThread(check_interval=3.0, on_threat=alert_and_exit)
watchdog.start()
print("[+] Watchdog démarré (interval=3s)")

time.sleep(30)  # Simulation exécution programme

watchdog.stop()
print("[+] Watchdog arrêté proprement")

from core.loader import run_loader
import sys

# Invocation standard — fichiers dans le même répertoire
run_loader(
    licence_path = "licence.lic",
    payload_path = "payload.ironenc",
    extra_args   = sys.argv[1:],  # Arguments du programme protégé
)

# Séquence complète automatique :
# [1] Anti-debug 12 checks (ordre aléatoire)
# [2] Anti-tamper pré-check
# [3] VM detector 15 checks
# [4] Chargement licence
# [5] Vérif signature ECDSA P-384
# [6] Vérif expiration
# [7] Serveur online (si configuré)
# [8] Fingerprint 12 sources
# [9] Matching 8/12
# [10] Déchiffrement AES-GCM mémoire
# [11] Anti-tamper loader hash
# [12] Exécution + watchdog

from core.loader import run_loader

# Hébergement cloud — VMs explicitement autorisées
run_loader(
    licence_path = "licence.lic",
    payload_path = "payload.ironenc",
    allow_vm     = True,   # Désactive VM Detector
)

# Alternative : configurer dans loader.py avant build
# ALLOW_VM = True

from core.loader import execute_payload_in_memory

# Payload Python à exécuter
code = b"""
import sys
print(f"[Payload] Python {sys.version}")
print("[Payload] Exécuté entièrement en mémoire — aucun fichier temporaire")
print("[Payload] Arguments :", sys.argv)
"""

# Exécution en mémoire — pas de fichier, pas de trace disque
execute_payload_in_memory(
    payload_bytes = code,
    payload_name  = "app.py",     # Indique le type → Python exec()
    args          = ["--mode", "prod"],
)

from tools.packager import package_program
import secrets

# Générer un master secret pour ce client (32 bytes aléatoires)
master_secret = secrets.token_bytes(32)

result = package_program(
    source        = "monapp.exe",
    product_name  = "Mon Application v2.0",
    output_dir    = "dist_client/",
    version       = "2.0.0",
    master_secret = master_secret,  # Optionnel — auto-généré si None
)

print(f"Output     : {result['output_dir']}")
print(f"Algo       : {result['payload_result']['algo']}")
print(f"Chunks     : {result['payload_result']['chunks_count']}")
print(f"Loader hash: {result['loader_hash'][:32]}...")

from tools.packager import package_program

result = package_program(
    source       = "./mon_projet_python/",  # Dossier complet
    product_name = "Suite Applicative v2.0",
    output_dir   = "dist_suite/",
)

# Le payload = ZIP contenant tout mon_projet_python/
# Le loader détecte PK magic → ZipFile → __main__.py → exec()

manifest = result["manifest"]
print(f"Original  : {manifest['payload_name']}")
print(f"Hash      : {manifest['payload_hash'][:32]}...")
print(f"Type      : ZIP → __main__.py → exec() en mémoire")

# Standard — PyArmor obf-code 2 + PyInstaller onefile
python tools/obfuscate_build.py \
  --source-dir core/ \
  --exe-name MonApplication \
  --icon resources/app.ico

# Sans compilation EXE (obfuscation seule)
python tools/obfuscate_build.py \
  --source-dir core/ \
  --skip-pyinstaller

# Onedir (démarrage plus rapide, déploiement plus facile)
python tools/obfuscate_build.py \
  --source-dir core/ \
  --exe-name MonApp \
  --onedir

## Output :
# dist_ironlock_v2_build/
# ├── MonApplication.exe           (ou ELF/Mach-O)
# └── client_package/
#     ├── MonApplication.exe
#     └── README.txt

# Prérequis : pip install cython

# Cython C natif + PyInstaller
python tools/obfuscate_build.py \
  --source-dir core/ \
  --exe-name MonApp \
  --cython

## Ce que fait --cython :
# 1. Copie les .py → .pyx
# 2. Génère setup.py Cython
# 3. Compile : python setup.py build_ext --inplace
# 4. Produit : loader.pyd / fingerprint.pyd (Windows)
#              loader.so / fingerprint.so   (Linux/macOS)
# 5. PyInstaller emballe les extensions C natives
#
# Résultat : aucun bytecode Python dans le binaire final
# IDA Pro voit du code C assemblé, pas du Python

# Vérification du résultat
python -c "import loader; print('Chargé depuis .pyd/.so C natif')"

import os, hashlib, secrets, tempfile

print("═══ IronLock v2.0 — Self-Test Complet ═══\n")

# 1. Crypto Engine
from core.crypto_engine import CryptoEngine, build_master_secret, _ARGON2_AVAILABLE, _HAS_AES_NI
print(f"[Crypto] Argon2id : {'✅' if _ARGON2_AVAILABLE else '⚠️  PBKDF2'}")
print(f"[Crypto] AES-NI   : {'✅' if _HAS_AES_NI else '⚠️  ChaCha20'}")

secret = hashlib.sha256(b"test").digest()
engine = CryptoEngine(secret)
with tempfile.NamedTemporaryFile(delete=False, suffix=".bin") as f:
    f.write(os.urandom(100_000)); src = f.name
r = engine.encrypt_file(src, src + ".enc")
d = engine.decrypt_to_memory(src + ".enc")
ok = d == open(src, "rb").read()
print(f"[Crypto] AES-GCM  : {'✅' if ok else '❌'} ({r['algo']})")
os.unlink(src); os.unlink(src+".enc")

# 2. Fingerprint
from core.fingerprint import collect_all_sources, generate_fingerprint
sources = collect_all_sources()
fp      = generate_fingerprint(sources)
print(f"[Finger] Sources  : {len(sources)}/12 ({'✅' if len(sources)==12 else '⚠️'})")

# 3. Anti-debug
from core.anti_debug import run_security_checks
r = run_security_checks(strict=False)
print(f"[Debug] Threat    : {'⚠️' if r['threat_detected'] else '✅ None'}")

# 4. VM Detector
from core.vm_detector import detect_vm
v = detect_vm()
print(f"[VM]    Score     : {v['score']} ({'⚠️ VM' if v['is_vm'] else '✅ Physique'})")

# 5. Licence (sans clé privée réelle)
from tools.license_generator import generate_ecc_keypair
priv, pub = generate_ecc_keypair()
print("[Lic]   ECC P-384 : ✅ Clé générée")

print("\n═══ SELF-TEST COMPLET ═══")

"""
MIGRATION IronLock v1 → v2 — 5 étapes, zéro interruption

ÉTAPE 1 : Générer les nouvelles clés ECC P-384
"""
from tools.license_generator import generate_ecc_keypair, save_keypair
priv, pub = generate_ecc_keypair()
save_keypair(priv, pub, "private_ecc_v2.pem", "public_ecc_v2.pem")

"""
ÉTAPE 2 : Configurer loader.py v2 avec les DEUX clés
(pendant la période de transition)

IRONLOCK_PUBLIC_KEY_PEM     = open("public_ecc_v2.pem").read()
IRONLOCK_PUBLIC_KEY_RSA_V1  = open("public_rsa_v1.pem").read()  ← Ancien
FINGERPRINT_TOLERANCE       = 8  ← Ajusté pour 12 sources

ÉTAPE 3 : Rechiffrer les payloads existants
"""
from core.crypto_engine import CryptoEngine, build_master_secret
import secrets

old_secret    = build_master_secret("old_fingerprint", "old_secret")
new_secret    = build_master_secret("old_fingerprint", "new_v2_secret")

old_engine    = CryptoEngine(old_secret)
payload_bytes = old_engine.decrypt_to_memory("payload_v1.ironenc")

new_engine    = CryptoEngine(new_secret)
import tempfile, os
with tempfile.NamedTemporaryFile(delete=False) as f:
    f.write(payload_bytes); tmp = f.name
result = new_engine.encrypt_file(tmp, "payload_v2.ironenc")
os.unlink(tmp)
print(f"[+] Re-chiffré : {result['algo']}")

"""
ÉTAPE 4 : Régénérer les licences v2 (ECDSA P-384) lors des renouvellements
         Les licences RSA v1 continuent de fonctionner via rétro-compat

ÉTAPE 5 : Après expiration de TOUTES les licences v1 —
         Retirer IRONLOCK_PUBLIC_KEY_RSA_V1 du loader
         Rebuilder sans la clé RSA
"""