§
    $Âj>'  ã                  óL  — d Z ddlmZ ddlZddlmZmZmZmZm	Z	 ddl
mZ ddlmZmZ ddlmZmZ ddlmZmZmZ dd	lmZmZ dd
lmZ ddlmZmZmZmZm Z   edd¬¦  «         G d„ d¦  «        ¦   «         Z! edd¬¦  «         G d„ d¦  «        ¦   «         Z" G d„ d¦  «        Z#dS )aï  
Automated Penetration Test Harness & Anti-Cheat Fuzzing Engine for FreeExile.
Simulates realistic adversary exploits:
1. Speedhack & Excessive Velocity Injection
2. Teleporthack & Boundary/Obstacle Violation
3. Packet Injection & Ciphertext Bit-Flipping
4. Duplicate Transaction & Replay Double-Spend (0% Dupe Guarantee)
5. Wallhack & Fog of War Action Occlusion
6. Memory Scanner / Cheat Engine RAM Freeze Tampering
Validates that 100% of cheat attempts are detected, blocked, and reconciled.
é    )ÚannotationsN)ÚDictÚListÚTupleÚAnyÚOptional)Ú	dataclass)ÚMovementAuthorityEngineÚPlayerCharacter)ÚInstantBuyoutEngineÚ	StashItem)ÚPacketCipherEngineÚTimestampGatedPacketGuardÚAntiReplayWindow)ÚPolymorphicRAMVariableÚMemoryTamperViolationError)ÚFogIntegrityVerifier)ÚMapGridDataÚPlayerVisibilityStateÚFogStateÚTileCellÚTileTypeT)ÚslotsÚfrozenc                  óB   — e Zd ZU ded<   ded<   ded<   ded<   ded<   d	S )
ÚAttackVerdictÚstrÚvector_nameÚboolÚ
is_blockedÚfloatÚrejection_latency_msÚdefense_triggerÚdetailsN©Ú__name__Ú
__module__Ú__qualname__Ú__annotations__© ó    úAC:\Projects\FreeExile\server\security\penetration_test_harness.pyr   r   '   sI   € € € € € € àÐÐÑØÐÐÑØÐÐÑØÐÐÑØ€L€L�L€L€Lr+   r   c                  óB   — e Zd ZU ded<   ded<   ded<   ded<   ded<   d	S )
ÚPenetrationSuiteSummaryÚintÚtotal_attacksÚblocked_attacksr!   Úblock_rate_percentÚaverage_rejection_latency_mszList[AttackVerdict]ÚverdictsNr%   r*   r+   r,   r.   r.   0   sN   € € € € € € àÐÐÑØÐÐÑØÐÐÑØ'Ð'Ð'Ñ'Ø!Ð!Ð!Ñ!Ð!Ð!r+   r.   c                  ó\   — e Zd ZdZdd„Z	 	 	 ddd„Zdd„Zdd„Zddd„Zdd„Z	dd„Z
dd„ZdS ) ÚPenetrationTestHarnessz’
    Simulates malicious cheat vectors and verifies server-authoritative defenses.
    Guarantees 100% block rate across all exploit classes.
    ÚreturnÚNonec                óJ   — d| _         t          | j         d¬¦  «        | _        d S )Ns    FREEEXILE_PEN_TEST_SECRET_KEY_32i¸  )Ú
shared_keyÚmax_drift_ms)r:   r   Úguard)Úselfs    r,   Ú__init__zPenetrationTestHarness.__init__?   s$   € Ø=ˆŒÝ.¸$¼/ÐX\Ð]Ñ]Ô]ˆŒ
ˆ
ˆ
r+   ç      @ç      N@çL7‰A`å ?Ú
base_speedr!   Úclaimed_speedÚdtr   c                ór  — t          j        ¦   «         }t          |¬¦  «        }t          ddd|¬¦  «        }|                     |¦  «         ||z  }|                     d|d|¬¦  «        \  }}	}
t          j        ¦   «         |z
  dz  }| o|	dk    o
|j        dk    }t          d||d	d
|› d|	› d|
› d�¬¦  «        S )zCSimulates speedhack: client reports 10x physical movement velocity.©Úmax_base_speedée   ç        ©Ú	entity_idÚxÚyÚ
move_speed©rK   Ú	claimed_xÚ	claimed_yrD   ç     @�@r   ÚSPEEDHACK_INJECTIONz7MovementAuthorityEngine.validate_and_reconcile_positionzClaimed speed zm/s rubberbanded to (ú, ú)©r   r    r"   r#   r$   )ÚtimeÚperf_counterr
   r   Úregister_playerÚvalidate_and_reconcile_positionÚsuspicion_scorer   )r=   rB   rC   rD   Út0ÚengineÚplayerrP   ÚvalidÚrxÚryÚ
latency_msr    s                r,   Útest_speedhack_injectionz/PenetrationTestHarness.test_speedhack_injectionC   s÷   € õ ÔÑ Ô ˆÝ(¸
ÐCÑCÔCˆÝ ¨3°#¸ÈÐTÑTÔTˆØ×Ò˜vÑ&Ô&Ð&à! BÑ&ˆ	Ø×>Ò>Ø Y¸#À"ð ?ñ 
ô 
‰ˆˆr�2õ Ô'Ñ)Ô)¨BÑ.°&Ñ8ˆ
à�iÐQ b¨C¢iÐQ°fÔ6LÈqÒ6Pˆ
ÝØ-Ø!Ø!+ØUØT ]ÐTÐTÈÐTÐTÈrÐTÐTÐTð
ñ 
ô 
ð 	
r+   c                óX  — t          j        ¦   «         }t          d¬¦  «        }t          dddd¬¦  «        }|                     |¦  «         |                     dddd¬¦  «        \  }}}t          j        ¦   «         |z
  d	z  }| o|dk    o|dk    }t          d
||dd|› d|› d�¬¦  «        S )zDSimulates teleporthack: client attempts 500-meter leap across world.r?   rF   éf   g      $@rJ   g     à@rA   rO   rR   ÚTELEPORTHACK_INJECTIONÚServerReconciliationRubberbandz$Teleport attempt clamped to origin (rT   rU   rV   )rW   rX   r
   r   rY   rZ   r   )	r=   r\   r]   r^   r_   r`   ra   rb   r    s	            r,   Útest_teleporthack_injectionz2PenetrationTestHarness.test_teleporthack_injection^   sß   € åÔÑ Ô ˆÝ(¸Ð<Ñ<Ô<ˆÝ ¨3°$¸$È3ÐOÑOÔOˆØ×Ò˜vÑ&Ô&Ð&à×>Ò>Ø U°eÀð ?ñ 
ô 
‰ˆˆr�2õ Ô'Ñ)Ô)¨BÑ.°&Ñ8ˆ
à�iÐ@ b¨D¢jÐ&?°R¸4²Zˆ
ÝØ0Ø!Ø!+Ø<ØF¸2ÐFÐFÀÐFÐFÐFð
ñ 
ô 
ð 	
r+   c                ó†  — t          j        ¦   «         }t          | j        ¦  «        }|                     dd¬¦  «        \  }}}t          |d         dz  g¦  «        |dd…         z   }d}	 |                     |||d¬¦  «         n# t          $ r d}Y nw xY wt          j        ¦   «         |z
  d	z  }t          d
||dd¬¦  «        S )zDSimulates packet injection with corrupted ciphertext or forged HMAC.s   ADD_CURRENCY_HON_NGUYEN_999999é   )Úseq_numr   éÿ   NFTrR   ÚPACKET_INJECTION_TAMPERINGz,PacketCipherEngine.decrypt HMAC Verificationz3Bit-flipped payload rejected before deserializationrV   )	rW   rX   r   r:   ÚencryptÚbytesÚdecryptÚ
ValueErrorr   )	r=   r\   ÚcipherÚ
ciphertextÚtagÚnonceÚ	corruptedÚtamper_detectedrb   s	            r,   Útest_packet_injection_tamperingz6PenetrationTestHarness.test_packet_injection_tamperings   sî   € åÔÑ Ô ˆÝ# D¤OÑ4Ô4ˆØ!'§¢Ð0QÐ[\ Ñ!]Ô!]Ñˆ
�C˜å˜: aœ=¨4Ñ/Ð0Ñ1Ô1°J¸q¸r¸r´NÑBˆ	Øˆð	#Ø�NŠN˜9 c¨5¸!ˆNÑ<Ô<Ð<Ð<øÝð 	#ð 	#ð 	#Ø"ˆOˆOˆOð	#øøøõ Ô'Ñ)Ô)¨BÑ.°&Ñ8ˆ
ÝØ4Ø&Ø!+ØJØIð
ñ 
ô 
ð 	
s   Á*B ÂBÂBé   Úconcurrent_attemptsr/   c                óô  — t          j        ¦   «         }t          ¦   «         }|                     d¦  «        }t	          ddddd¬¦  «        |j        d<   d}d}t          |¦  «        D ]P}d|› �}|                     |¦  «        }	d	|	j        d<   |                     |dddd¦  «        \  }
}}|
r|d
z  }ŒK|d
z  }ŒQt          j        ¦   «         |z
  dz  }|d
k    o||d
z
  k    }t          d||dd|› d|› d�¬¦  «        S )zCSimulates concurrent double-spend / item duplication replay attack.Ú
seller_vicÚprimal_axe_01u   Cá»• RÃ¬u TÃ n PhÃ¡Ú	HonNguyené2   )Ú	item_uuidÚowner_account_idÚ	item_nameÚasking_price_currencyÚasking_price_amountr   Ú
exploiter_éd   rj   rR   ÚDUPE_REPLAY_ATTACKz%DistributedTwoPhaseCommit.atomic_lockz	Success: z, Blocked: z
 (0% dupe)rV   )
rW   rX   r   Úregister_accountr   ÚitemsÚrangeÚ
currenciesÚexecute_instant_buyoutr   )r=   rz   r\   r]   ÚsellerÚsuccessful_buysÚblocked_buysÚiÚbuyer_idÚaccÚokÚ_rb   r    s                 r,   Útest_dupe_replay_attackz.PenetrationTestHarness.test_dupe_replay_attack‰   s\  € åÔÑ Ô ˆÝ$Ñ&Ô&ˆØ×(Ò(¨Ñ6Ô6ˆÝ(1Ø%Ø)Ø+Ø"-Ø "ð)
ñ )
ô )
ˆŒ�_Ñ%ð ˆØˆÝÐ*Ñ+Ô+ð 
	"ð 
	"ˆAØ' AÐ'Ð'ˆHØ×)Ò)¨(Ñ3Ô3ˆCØ*-ˆCŒN˜;Ñ'Ø×4Ò4Ø˜,¨¸Àbñô ‰HˆB��1ð ð "Ø 1Ñ$��à Ñ!��åÔ'Ñ)Ô)¨BÑ.°&Ñ8ˆ
Ø%¨Ò*ÐY°ÐATÐWXÑAXÒ1Xˆ
ÝØ,Ø!Ø!+ØCØT ÐTÐT¸LÐTÐTÐTð
ñ 
ô 
ð 	
r+   c                ó|  — t          j        ¦   «         }t          d¬¦  «        }g }t          d¦  «        D ]q}g }t          d¦  «        D ]H}|dk    }|                     t          |||rt          j        nt          j        | |¬¦  «        ¦  «         ŒI|                     |¦  «         Œrt          dddd|¬¦  «        }d	„ t          d¦  «        D ¦   «         }	t          d
dd|	¬¦  «        }
|                     |
|dd¬¦  «        \  }}t          j        ¦   «         |z
  dz  }| od|v pd|v }t          d||dd|› �¬¦  «        S )z>Simulates targeting action through solid obstacle wall in fog.g      .@)Úmax_allowed_action_distanceé
   é   )rL   rM   Ú	tile_typeÚwalkableÚblocks_visioni90  ÚSAVAGE_MANGROVE_SWAMP)ÚwidthÚheightÚseedÚbiomeÚtilesc                ó@   — g | ]}d „ t          d¦  «        D ¦   «         ‘ŒS )c                ó0   — g | ]}t           j        j        ‘ŒS r*   )r   ÚVISIBLEÚvalue©Ú.0r”   s     r,   ú
<listcomp>zNPenetrationTestHarness.test_wallhack_los_attack.<locals>.<listcomp>.<listcomp>Ç   s   € Ð:Ð:Ð:¨1•Ô Ô&Ð:Ð:Ð:r+   r˜   )rŠ   r§   s     r,   r©   zCPenetrationTestHarness.test_wallhack_los_attack.<locals>.<listcomp>Ç   s-   € ÐNÐNÐN¸qÐ:Ð:µ°b±	´	Ð:Ñ:Ô:ÐNÐNÐNr+   Ú	hacker_01)Ú	player_idrž   rŸ   Ú
fog_matrix)é   r™   )é   r™   )Ú	vis_stateÚmap_dataÚ
player_posÚ
target_posrR   ÚWALLÚOCCLUDEDÚWALLHACK_LOS_ATTACKz/FogIntegrityVerifier.validate_player_action_losz$Occluded cast rejected with reason: rV   )rW   rX   r   rŠ   Úappendr   r   r³   ÚFLOORr   r   Úvalidate_player_action_losr   )r=   r\   ÚverifierÚcellsrM   ÚrowrL   Úis_wallr°   Úfogr¯   r_   Úreasonrb   r    s                  r,   Útest_wallhack_los_attackz/PenetrationTestHarness.test_wallhack_los_attack®   s¡  € åÔÑ Ô ˆÝ'ÀDÐIÑIÔIˆà&(ˆÝ�r‘”ð 	ð 	ˆAØ"$ˆCÝ˜2‘Y”Yð 
ð 
�Ø š6�Ø—
’
ÝØØØ3:Ð"N¥(¤- -ÅÄØ%, Ø&-ðñ ô ñô ð ð ð �LŠL˜ÑÔÐÐåØ˜R eÐ3JÐRWð
ñ 
ô 
ˆð OÐNÅEÈ"ÁIÄIÐNÑNÔNˆÝ)°KÀrÐRTÐadÐeÑeÔeˆ	à ×;Ò;ØØØØð	 <ñ 
ô 
‰ˆˆvõ Ô'Ñ)Ô)¨BÑ.°&Ñ8ˆ
Ø�iÐO f°Ð&6Ð&N¸*ÈÐ:Nˆ
ÝØ-Ø!Ø!+ØMØC¸6ÐCÐCð
ñ 
ô 
ð 	
r+   c                ó6  — t          j        ¦   «         }t          t                   dd¦  «        }|                     d¦  «         d}	 |                     ¦   «          n# t          $ r d}Y nw xY wt          j        ¦   «         |z
  dz  }t          d||dd	¬
¦  «        S )z;Simulates Cheat Engine freezing / overwriting RAM variable.g     p—@Ú	player_hpl   þJß}¶z FTrR   ÚMEMORY_TAMPERING_ATTACKz-PolymorphicRAMVariable.canary_integrity_checkz5Canary mismatch intercepted Cheat Engine memory writerV   )rW   rX   r   r!   Úinject_raw_memory_corruptionÚ	get_valuer   r   )r=   r\   ÚhpÚcaughtrb   s        r,   Útest_memory_tampering_attackz3PenetrationTestHarness.test_memory_tampering_attackÚ   sµ   € åÔÑ Ô ˆÝ#¥EÔ*¨6°;Ñ?Ô?ˆØ
×'Ò'¨Ñ7Ô7Ð7àˆð	Ø�LŠL‰NŒNˆNˆNøÝ)ð 	ð 	ð 	ØˆFˆFˆFð	øøøõ Ô'Ñ)Ô)¨BÑ.°&Ñ8ˆ
ÝØ1ØØ!+ØKØKð
ñ 
ô 
ð 	
s   ÁA ÁA+Á*A+r.   c                óÊ  — |                       ¦   «         |                      ¦   «         |                      ¦   «         |                      ¦   «         |                      ¦   «         |                      ¦   «         g}t          |¦  «        }t          d„ |D ¦   «         ¦  «        }|dk    r||z  dz  nd}|dk    rt          d„ |D ¦   «         ¦  «        |z  nd}t          |||||¬¦  «        S )zAExecutes all 6 penetration attack vectors and aggregates metrics.c              3  ó(   K  — | ]}|j         ¯	d V — ŒdS )rj   N)r    ©r¨   Úvs     r,   ú	<genexpr>zMPenetrationTestHarness.run_comprehensive_penetration_suite.<locals>.<genexpr>ú   s)   è è € Ð:Ð:˜A¨Q¬\Ð:�aÐ:Ð:Ð:Ð:Ð:Ð:r+   r   g      Y@rI   c              3  ó$   K  — | ]}|j         V — Œd S )N)r"   rÊ   s     r,   rÌ   zMPenetrationTestHarness.run_comprehensive_penetration_suite.<locals>.<genexpr>ü   s%   è è € Ð?Ð?°�aÔ,Ð?Ð?Ð?Ð?Ð?Ð?r+   )r0   r1   r2   r3   r4   )	rc   rh   rx   r•   r¿   rÇ   ÚlenÚsumr.   )r=   r4   ÚtotalÚblockedÚrateÚavg_lats         r,   Ú#run_comprehensive_penetration_suitez:PenetrationTestHarness.run_comprehensive_penetration_suiteï   sÿ   € ð ×)Ò)Ñ+Ô+Ø×,Ò,Ñ.Ô.Ø×0Ò0Ñ2Ô2Ø×(Ò(Ñ*Ô*Ø×)Ò)Ñ+Ô+Ø×-Ò-Ñ/Ô/ð
ˆõ �H‘”ˆÝÐ:Ð: Ð:Ñ:Ô:Ñ:Ô:ˆØ,1°AªI¨I�˜%‘ 5Ñ(Ð(¸3ˆØKPÐSTÊ9È9•#Ð?Ð?°hÐ?Ñ?Ô?Ñ?Ô?À%ÑGÐGÐZ]ˆå&ØØ#Ø#Ø)0Øð
ñ 
ô 
ð 	
r+   N)r7   r8   )r?   r@   rA   )rB   r!   rC   r!   rD   r!   r7   r   )r7   r   )ry   )rz   r/   r7   r   )r7   r.   )r&   r'   r(   Ú__doc__r>   rc   rh   rx   r•   r¿   rÇ   rÔ   r*   r+   r,   r6   r6   9   sÙ   € € € € € ðð ð
^ð ^ð ^ð ^ð  Ø#Øð	
ð 
ð 
ð 
ð 
ð6
ð 
ð 
ð 
ð*
ð 
ð 
ð 
ð,#
ð #
ð #
ð #
ð #
ðJ*
ð *
ð *
ð *
ðX
ð 
ð 
ð 
ð*
ð 
ð 
ð 
ð 
ð 
r+   r6   )$rÕ   Ú
__future__r   rW   Útypingr   r   r   r   r   Údataclassesr	   Úserver.world.movement_authorityr
   r   Úserver.trade.two_phase_commitr   r   Úserver.security.packet_cipherr   r   r   Ú"server.security.polymorphic_memoryr   r   Ú&server.security.fog_integrity_verifierr   Úserver.world.map_data_typesr   r   r   r   r   r   r.   r6   r*   r+   r,   ú<module>rß      s  ðð
ð 
ð #Ð "Ð "Ð "Ð "Ð "Ø €€€Ø 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ð 3Ø !Ð !Ð !Ð !Ð !Ð !à TÐ TÐ TÐ TÐ TÐ TÐ TÐ TØ HÐ HÐ HÐ HÐ HÐ HÐ HÐ Hðð ð ð ð ð ð ð ð ð ð
ð ð ð ð ð ð ð ð HÐ GÐ GÐ GÐ GÐ Gðð ð ð ð ð ð ð ð ð ð ð ð ð ð €�˜dÐ#Ñ#Ô#ðð ð ð ð ñ ô ñ $Ô#ðð €�˜dÐ#Ñ#Ô#ð"ð "ð "ð "ð "ñ "ô "ñ $Ô#ð"ðK
ð K
ð K
ð K
ð K
ñ K
ô K
ð K
ð K
ð K
r+   