§
    ÞU»j(  ã            
       óŽ  — d Z ddlZddlZddlZej                             dej                             ej                             ej                             e	¦  «        d¦  «        ¦  «        ¦  «         ddl
mZmZ ddlmZmZ ddlmZmZ ddlmZmZ ddlmZmZ  G d	„ d
ej        ¦  «        Zedk    r ej        ¦   «          dS dS )al  
Automated Penetration & Security Fuzzing Test Suite for FreeExile.
Executes automated attack vectors:
1. Speedhack & Teleport Position Injection
2. Duplicate Transaction & Double-Spending Attacks
3. Packet Replay Attack Injection
4. Ciphertext Bit-Flipping & Tampering Attacks
5. Emulator Linear Touch Vector Bot Attacks
6. Cracked IPA Bundle Attestation Forgery
é    Nz../../server)ÚMovementAuthorityEngineÚPlayerCharacter)ÚInstantBuyoutEngineÚ	StashItem)ÚPacketCipherEngineÚAntiReplayWindow)ÚTouchBiometricsValidatorÚ
TouchPoint)ÚAppleAppAttestValidatorÚAttestationTokenc                   ó2   — e Zd Zd„ Zd„ Zd„ Zd„ Zd„ Zd„ ZdS )ÚTestPenetrationSuitec                 ó<  — t          d¬¦  «        }t          dddd¬¦  «        }|                     |¦  «         |                     dddd¬¦  «        \  }}}|                      |¦  «         |                      |d¦  «         |                      |j        d	¦  «         d
S )zLAttacker injects forged high-velocity coordinates -> Server must rubberband.g      @)Úmax_base_speediç  g      $@)Ú	entity_idÚxÚyÚ
move_speedg     @j@gL7‰A`å ?)r   Ú	claimed_xÚ	claimed_yÚdtr   N)r   r   Úregister_playerÚvalidate_and_reconcile_positionÚassertFalseÚassertEqualÚassertGreaterÚsuspicion_score)ÚselfÚengineÚpÚvalidÚrxÚrys         úFC:\Projects\FreeExile\tests\security_fuzzing\test_penetration_suite.pyÚ,test_penetration_speedhack_injection_blockedzATestPenetrationSuite.test_penetration_speedhack_injection_blocked   sµ   € å(¸Ð<Ñ<Ô<ˆÝ c¨T°TÀcÐJÑJÔJˆØ×Ò˜qÑ!Ô!Ð!ð ×>Ò>ØØØØð	 ?ñ 
ô 
‰ˆˆr�2ð 	×Ò˜ÑÔÐØ×Ò˜˜TÑ"Ô"Ð"Ø×Ò˜1Ô,¨aÑ0Ô0Ð0Ð0Ð0ó    c                 ón  — t          ¦   «         }|                     d¦  «        }|                     d¦  «        }|                     d¦  «        }d|j        d<   d|j        d<   t          ddddd¬	¦  «        }||j        d<   |                     ddddd¦  «        \  }}}|                      |¦  «         |                     ddddd¦  «        \  }}	}|                      |¦  «         |                      d|j        ¦  «         |  	                    d|j        ¦  «         |  	                    d|j        ¦  «         d
S )zZAttacker fires 2 concurrent buyout requests for the same item -> 2PC must block duplicate.Ú
seller_vicÚbuyer_1Úbuyer_2éd   Ú	HonNguyenÚrare_dagger_uniqueu   Ã�m áº¢nh Ä�oáº£n Ä�aoé2   )Ú	item_uuidÚowner_account_idÚ	item_nameÚasking_price_currencyÚasking_price_amountN)
r   Úregister_accountÚ
currenciesr   ÚitemsÚexecute_instant_buyoutÚ
assertTruer   ÚassertInÚassertNotIn)
r   r   ÚsellerÚbuyer1Úbuyer2ÚitemÚok1Ú_Úok2Úmsgs
             r$   Ú1test_penetration_double_spend_duplication_blockedzFTestPenetrationSuite.test_penetration_double_spend_duplication_blocked,   sS  € å$Ñ&Ô&ˆØ×(Ò(¨Ñ6Ô6ˆØ×(Ò(¨Ñ3Ô3ˆØ×(Ò(¨Ñ3Ô3ˆà),ˆÔ˜+Ñ&Ø),ˆÔ˜+Ñ&åØ*Ø)Ø.Ø"-Ø "ð
ñ 
ô 
ˆð .2ˆŒÐ)Ñ*ð ×1Ò1°)¸\ÐK_ÐalÐnpÑqÔq‰	ˆˆQ�Ø�Š˜ÑÔÐð ×3Ò3°I¸|ÐMaÐcnÐprÑsÔs‰ˆˆS�!Ø×Ò˜ÑÔÐà�ŠÐ*¨F¬LÑ9Ô9Ð9Ø×ÒÐ-¨v¬|Ñ<Ô<Ð<Ø×ÒÐ-¨v¬|Ñ<Ô<Ð<Ð<Ð<r&   c                 óÆ   — t          d¬¦  «        }|                      |                     d¦  «        ¦  «         |                      |                     d¦  «        ¦  «         dS )zOAttacker intercepts valid packet and replays it -> Anti-Replay window drops it.é@   )Úwindow_sizeé*   N)r   r8   Úcheck_and_updater   )r   Úwindows     r$   Ú&test_penetration_packet_replay_blockedz;TestPenetrationSuite.test_penetration_packet_replay_blockedK   sZ   € å!¨bÐ1Ñ1Ô1ˆà�Š˜×/Ò/°Ñ3Ô3Ñ4Ô4Ð4à×Ò˜×0Ò0°Ñ4Ô4Ñ5Ô5Ð5Ð5Ð5r&   c                 ó<  — t          d¬¦  «        }|                     dd¬¦  «        \  }}}t          |d         dz  g¦  «        |dd…         z   }|                      t          ¦  «        5  |                     |||d¬¦  «         ddd¦  «         dS # 1 swxY w Y   dS )	zSAttacker flips 1 bit in transit -> Cipher engine detects corrupted HMAC and aborts.s    SHARED_SECRET_KEY_FOR_TESTING_12)Ú
shared_keys   DROP_DIVINE_LOOT_NOWé
   )Úseq_numr   é   N)r   ÚencryptÚbytesÚassertRaisesÚ
ValueErrorÚdecrypt)r   r   ÚcipherÚtagÚnonceÚ	corrupteds         r$   Ú5test_penetration_ciphertext_bitflip_tampering_blockedzJTestPenetrationSuite.test_penetration_ciphertext_bitflip_tampering_blockedS   sê   € å#Ð/RÐSÑSÔSˆØ#Ÿ^š^Ð,CÈR˜^ÑPÔPÑˆ��Uõ ˜6 !œ9 tÑ+Ð,Ñ-Ô-°°q°r°r´
Ñ:ˆ	Ø×Ò�zÑ*Ô*ð 	>ð 	>Ø�NŠN˜9 c¨5¸"ˆNÑ=Ô=Ð=ð	>ð 	>ð 	>ñ 	>ô 	>ð 	>ð 	>ð 	>ð 	>ð 	>ð 	>ð 	>øøøð 	>ð 	>ð 	>ð 	>ð 	>ð 	>s   Á*BÂBÂBc                 óZ  — t          ¦   «         }d„ t          d¦  «        D ¦   «         }|                     |¦  «        \  }}}|                      |¦  «         |                      d|                     ¦   «         v p+d|                     ¦   «         v pd|                     ¦   «         v ¦  «         dS )zWAttacker uses PC emulator / mouse bot with straight line coordinates -> AI detects bot.c           
      ó¢   — g | ]L}t          t          |d z  ¦  «        t          |d z  ¦  «        t          |dz  ¦  «        d|dz  z   d¬¦  «        ‘ŒMS )rM   é   g      .@é   g      ð?)r   r   Útimestamp_msÚmajor_radiusÚforce)r
   Úfloat)Ú.0Úis     r$   ú
<listcomp>zSTestPenetrationSuite.test_penetration_bot_linear_touch_rejected.<locals>.<listcomp>`   sh   € ð 
ð 
ð 
àõ �˜q 2™v™œ­%°°B±©-¬-ÅeÈAÐPRÉFÁmÄmÐbfÐjkÐnoÑjoÑbpÐx{Ð|Ñ|Ô|ð
ð 
ð 
r&   é   zstraight lineÚbotÚdetectedN)r	   ÚrangeÚevaluate_touch_sampler   r8   Úlower)r   Ú	validatorÚstraight_pointsÚis_humanÚscoreÚreasons         r$   Ú*test_penetration_bot_linear_touch_rejectedz?TestPenetrationSuite.test_penetration_bot_linear_touch_rejected]   s°   € å,Ñ.Ô.ˆ	ð
ð 
å˜1‘X”Xð
ñ 
ô 
ˆð #,×"AÒ"AÀ/Ñ"RÔ"RÑˆ�%˜Ø×Ò˜Ñ"Ô"Ð"Ø�Š˜¨6¯<ª<©>¬>Ð9Ðt¸UÀfÇlÂlÁnÄnÐ=TÐtÐXbÐfl×frÒfrÑftÔftÐXtÑuÔuÐuÐuÐur&   c                 ó®   — t          d¬¦  «        }|                     dd¬¦  «        }|                     |¦  «        \  }}|                      |¦  «         dS )zWAttacker installs cracked IPA with repackaged bundle ID -> Apple App Attest rejects it.zcom.freeexile.game.ios)Úexpected_bundle_idÚjailbreak_devicezcom.hack.freeexile.mod)Ú	device_idÚ	bundle_idN)r   Úgenerate_mock_attestationÚverify_attestationr   )r   rk   Úforged_tokenÚis_validr@   s        r$   Ú7test_penetration_cracked_bundle_id_attestation_rejectedzLTestPenetrationSuite.test_penetration_cracked_bundle_id_attestation_rejectedh   sf   € å+Ð?WÐXÑXÔXˆ	Ø ×:Ò:Ø(Ø.ð ;ñ 
ô 
ˆð  ×2Ò2°<Ñ@Ô@‰ˆ�!Ø×Ò˜Ñ"Ô"Ð"Ð"Ð"r&   N)	Ú__name__Ú
__module__Ú__qualname__r%   rC   rJ   rY   rp   rz   © r&   r$   r   r      sq   € € € € € ð1ð 1ð 1ð"=ð =ð =ð>6ð 6ð 6ð>ð >ð >ð	vð 	vð 	vð#ð #ð #ð #ð #r&   r   Ú__main__)Ú__doc__ÚunittestÚsysÚosÚpathÚinsertÚabspathÚjoinÚdirnameÚ__file__Úworld.movement_authorityr   r   Útrade.two_phase_commitr   r   Úsecurity.packet_cipherr   r   Úsecurity.touch_biometricsr	   r
   Úsecurity.app_attestr   r   ÚTestCaser   r{   Úmainr~   r&   r$   ú<module>r‘      sD  ðð	ð 	ð €€€Ø 
€
€
€
Ø 	€	€	€	ð „‡‚��2”7—?’? 2¤7§<¢<°´·²ÀÑ0IÔ0IÈ>Ñ#ZÔ#ZÑ[Ô[Ñ \Ô \Ð \à MÐ MÐ MÐ MÐ MÐ MÐ MÐ MØ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AØ GÐ GÐ GÐ GÐ GÐ GÐ GÐ GØ JÐ JÐ JÐ JÐ JÐ JÐ JÐ JØ IÐ IÐ IÐ IÐ IÐ IÐ IÐ IðV#ð V#ð V#ð V#ð V#˜8Ô,ñ V#ô V#ð V#ðr ˆzÒÐØ€H„M�O„O€O€O€Oð Ðr&   