@anonympins/fingerprint 0.6.7 → 0.7.1

package/CHANGELOG.md

@@ -1,3 +1,36 @@
+## Version 0.7.1
+
+- 🔌 **Native WordPress Plugin Integration (`fingerprint-wordpress`)**:
+  - Full official WordPress plugin integration (`fingerprint-wordpress.php`) without external runtime dependencies, leveraging `$wpdb` through a dedicated `WpDbStore` adapter.
+  - Automatic SQL cache table provisioning and periodic cleanup of expired tickets via WP-Cron (`fingerprint_prune_expired_entries`).
+  - Automated packaging script (`package.php`) generating a ready-to-deploy ZIP archive (`fingerprint-wordpress.zip`).
+  - Cross-environment honeypot tripwires: immediately detects and drops automated scanners probing for non-WordPress entrypoints (Laravel, Symfony, Django, Spring Boot `/actuator`, phpMyAdmin, `.env`, `.git`).
+  - Admin dashboard security notice if running over unencrypted HTTP (warning about modern browsers disabling native `crypto.subtle` APIs in insecure contexts).
+- 🔬 **JavaScript Prototype Tampering Detection (`detectTamperedPrototypes`)**:
+  - Added runtime integrity inspection on critical browser APIs (`HTMLCanvasElement.prototype.toDataURL`, `CanvasRenderingContext2D.prototype.getImageData`, `WebGLRenderingContext.prototype.getParameter`, and `window.fetch`).
+  - Accurately detects function hooks and proxies injected by evasion frameworks (Puppeteer Stealth, Frida, Selenium) and applies an aggressive penalty (`+80` to `behaviorScore`) via the `prototypeTampered` indicator.
+- 📱 **Device Motion Variance Tracking (`motionVariance`)**:
+  - Analyzed accelerometer and gyroscope micro-variations via the `devicemotion` API.
+  - Distinguishes authentic handheld mobile devices from rack-mounted phone farms or automated rigs (detecting active touch interactions with zero natural sensor tremor, `motionVariance === 0`).
+- 📝 **Code Standardization & Internationalization**:
+  - Harmonized and fully translated technical comments into English across optimization modules (`library.js`), PoW solvers, and build scripts.
+
+## Version 0.7.0
+
+- 🛡️ **Targeted Re-Challenge Strategy (`mustReChallenge`)**: Re-introduced and hardened the re-challenge workflow specifically targeted at honeypot triggers and critical indicators (e.g., `honeypotScore >= mediumThreshold` or any indicator score reaching $\ge 100$). Legitimate sessions with valid clearance tickets are preserved, while active attack attempts immediately invalidate existing tickets and force verification.
+- 📡 **QUIC / HTTP/3 Transport Profiling & Protocol Anomaly Scoring**: Implemented deep inspection of QUIC transport parameters (`initial_max_data`, `initial_max_streams_bidi`, control frame ordering `s,m,p`, and extensible priority schemes). Deviations between browser User-Agents and QUIC transport implementations (e.g. `curl-impersonate`, `quiche`, custom bot clients) are surfaced in `protocolAnomalyScore` and `quicAnomalyScore`.
+- ⚡ **WebRTC DataChannel for Cooperative Proof-of-Space**: Added direct peer-to-peer WebRTC DataChannel signaling (`webrtc_signal`, `RTCPeerConnection`) to cooperative Proof-of-Space challenges. Subnet nodes now exchange PoSpace verification blocks directly without routing heavy binary payloads through the application server, falling back seamlessly to HTTP mailbox polling if P2P negotiation fails.
+- 📈 **Analog Asymptotic Inconsistency Scoring (`calculateAnalogInconsistencyScore`)**: Replaced abrupt, stepped similarity thresholds with a smooth sigmoid function asymptotically bounded at 99.9. This prevents discrete score cliffs and false positives for minor profile drifts across JavaScript, PHP, and Java engines.
+- 🌐 **Bayesian Subnet Scoring & IP Dispersion**: Refactored `subnetScore` using Bayesian density estimation, User-Agent dispersion factors, and IP-to-device ratios scaled via hyperbolic tangent (`tanh`) with a 99.9 asymptote, effectively distinguishing dense CGNAT/corporate gateways from distributed proxy clusters.
+- 🕵️ **Virtualization & Threat Intel Scoring**: Added `virtualizationScore` to expose virtual display drivers and headless emulators (SwiftShader, Mesa llvmpipe, soft-pipe renderers, and standard headless display resolutions), alongside `threatIntelScore` correlating RTT proxy timing and federated ZKP public keys.
+
+## Version 0.6.8
+
+- 🧹 **Removal of Arbitrary Re-challenging**: Removed the `mustReChallenge` feature which forced an arbitrary re-challenge even when a user presented a valid clearance ticket. The system now relies exclusively on a real-time calculated suspicion score, ensuring a predictable user journey without arbitrary blocks.
+- ⚙️ **WebAssembly & PoW Workers Optimization**: Drastic improvements to the WASM module loading routines and the execution of background threads (`pow.worker.js`). Parallel computations now run more smoothly, strictly adhere to restrictive Content Security Policy (CSP) directives, and benefit from a more robust fallback to the main thread in the absence of support.
+- 🐘 **Native DNS Support in PHP**: Integrated the native `resolveDnsNative` method into the PHP engine for DNS resolution. This method autonomously handles IPv4 (A) and IPv6 (AAAA/PTR) records without external system calls, guaranteeing better performance and increased compatibility with asynchronous environments.
+- 🔑 **Full Transition to Strong Cryptographic Randomness**: Migrated all random generation functions (`random()`, `secureRandomFloat()`) to native API CSPRNGs (`crypto.randomInt` and `crypto.randomBytes`). This permanently eliminates distribution bias (modulo bias) and resolves CodeQL static analysis warnings.
+
 ## Version 0.6.7
 
 - 🧬 **WebAssembly (WASM)** : new client version

package/README.md

@@ -86,16 +86,12 @@ pip install anonympins-fingerprint
 ```
 
 ### Java
-```bash
-mvn clean install
-```
-
-Then, in your **pom.xml**, add :
+In your **pom.xml**, add :
 ```xml
 <dependency>
     <groupId>com.anonympins</groupId>
-    <artifactId>fingerprint</artifactId>
-    <version>0.6.7</version>
+    <artifactId>fingerprint-engine</artifactId>
+    <version>0.7.1</version>
 </dependency>
 ```
 ## Documentation

package/composer.json

@@ -36,5 +36,12 @@
     "config": {
         "sort-packages": true
     },
-    "minimum-stability": "stable"
+    "minimum-stability": "stable",
+    "scripts": {
+        "build:wordpress": "@php src/php/WordPress/package.php",
+        "package:wordpress": "@php src/php/WordPress/package.php"
+    },
+    "scripts-descriptions": {
+        "build:wordpress": "Empaquette et génère le fichier zip du plugin WordPress dans public/"
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.6.7",
+  "version": "0.7.1",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",

package/src/js/build-client.js

@@ -8,13 +8,13 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
 /**
- * Tente d'exécuter la commande de build pour le module WASM.
- * Ne bloque pas le build si la commande échoue (ex: em++ non trouvé).
+ * Attempts to run the build command for the WASM module.
+ * Does not fail the build if the command fails (e.g. em++ not found).
  */
 function buildWasm() {
   return new Promise((resolve) => {
     console.log('Attempting to build WASM module (optional)...');
-    const command = "em++ src/cpp/main.cpp src/cpp/utils.cpp -o public/fp.js -s WASM=1 -s MODULARIZE=1 -s EXPORT_NAME='createFingerprintModule' -s \"EXPORTED_FUNCTIONS=['_malloc','_free','_hash_string','_solve_cpu_target','_solve_memory_challenge','_generate_gpu_pow_trajectory']\" -O3 --no-entry";
+    const command = "em++ -msimd128 src/cpp/main.cpp src/cpp/utils.cpp -o public/fp.js -s WASM=1 -s MODULARIZE=1 -s EXPORT_NAME='createFingerprintModule' -s \"EXPORTED_FUNCTIONS=['_malloc','_free','_hash_string','_solve_cpu_target','_solve_memory_challenge','_generate_gpu_pow_trajectory']\" -O3 --no-entry";
     
     exec(command, (error, stdout, stderr) => {
       if (error) {
@@ -22,7 +22,7 @@ function buildWasm() {
       } else {
         console.log('WASM module built successfully.');
       }
-      resolve(); // Toujours résoudre la promesse pour ne pas bloquer le build principal.
+      resolve(); // Always resolve the promise so the main build is not blocked.
     });
   });
 }
@@ -36,14 +36,12 @@ async function buildClientScript() {
     console.log('Obfuscating client script...');
     const obfuscationResult = JavaScriptObfuscator.obfuscate(clientScriptContent, {
       compact: true,
-      controlFlowFlattening: true, // Aplatit le flux de contrôle
-      deadCodeInjection: true, // Injecte du code mort
+      controlFlowFlattening: true, // Flattens control flow
+      deadCodeInjection: true, // Injects dead code
       stringArray: true,
-      stringArrayRotate: true, // Fait tourner le tableau de chaînes
-      stringArrayShuffle: true, // Mélange le tableau de chaînes
-      // L'utilisation d'une graine (seed) de 0 signifie que l'obfuscation sera déterministe
-      // pour une même entrée. Pour une obfuscation unique à chaque build, on peut utiliser
-      // une graine aléatoire, par exemple : seed: Math.random()
+      stringArrayRotate: true, // Rotates the string array
+      stringArrayShuffle: true, // Shuffles the string array
+      // Using a fixed seed yields deterministic obfuscation. For unique builds, use Math.random()
       seed: Math.random(),
       selfDefending: true,
     });

package/src/js/dynamic-wasm.js

@@ -31,19 +31,19 @@ function getRandomNonTrivialOpcodes(tempLocal) {
     const insts = [];
     const ops = [
         // local.get tempLocal, i32.const rand, rotl, local.set tempLocal
-        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(Math.floor(Math.random() * 31) + 1), 0x77, 0x21, tempLocal],
+        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(1, 32)), 0x77, 0x21, tempLocal],
         // local.get tempLocal, i32.const rand, rotr, local.set tempLocal
-        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(Math.floor(Math.random() * 31) + 1), 0x78, 0x21, tempLocal],
+        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(1, 32)), 0x78, 0x21, tempLocal],
         // local.get tempLocal, i32.const rand, xor, local.set tempLocal
-        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(Math.floor(Math.random() * 10000)), 0x73, 0x21, tempLocal],
+        () => [0x20, tempLocal, 0x41, ...encodeSLEB128(crypto.randomInt(0, 10000)), 0x73, 0x21, tempLocal],
         // local.get tempLocal, popcnt, i32.const rand, mul, local.set tempLocal
-        () => [0x20, tempLocal, 0x69, 0x41, ...encodeSLEB128(Math.floor(Math.random() * 1000) + 1), 0x6c, 0x21, tempLocal],
+        () => [0x20, tempLocal, 0x69, 0x41, ...encodeSLEB128(crypto.randomInt(1, 1001)), 0x6c, 0x21, tempLocal],
         // local.get tempLocal, clz, local.get tempLocal, ctz, add, local.set tempLocal
         () => [0x20, tempLocal, 0x67, 0x20, tempLocal, 0x68, 0x6a, 0x21, tempLocal]
     ];
-    const count = 2 + Math.floor(Math.random() * 3);
+    const count = crypto.randomInt(2, 5);
     for (let i = 0; i < count; i++) {
-        const op = ops[Math.floor(Math.random() * ops.length)];
+        const op = ops[crypto.randomInt(0, ops.length)];
         insts.push(...op());
     }
     return insts;
@@ -53,7 +53,7 @@ function generatePolymorphicInstructions(stateLocal = 4, tempLocal = 5) {
     const insts = [];
     
     // Initialize tempLocal with a random value
-    const initVal = Math.floor(Math.random() * 1000) - 500;
+    const initVal = crypto.randomInt(-500, 500);
     insts.push(0x41, ...encodeSLEB128(initVal), 0x21, tempLocal);
 
     // Initialize stateLocal to 0

package/src/js/fingerprint.builder.js

@@ -1,7 +1,7 @@
 /**
- * Algorithme de hachage cyrb53 (rapide et faible taux de collision).
+ * cyrb53 hashing algorithm (fast with low collision rate).
  */
-// Exporté pour être utilisé comme fallback par fingerprint.client.js
+// Exported for fallback usage by fingerprint.client.js
 export const cyrb53 = (str, seed = 0) => { 
     const safeStr = (typeof str === 'string' ? str : String(str || '')).slice(0, 10000);
     let h1 = 0xdeadbeef ^ seed,
@@ -21,25 +21,25 @@ export const cyrb53 = (str, seed = 0) => {
 };
 
 /**
- * Classe pour construire une empreinte composite (Multi-Hash).
- * Format de sortie : "grp1:hash1|grp2:hash2|grp3:hash3"
+ * Class for constructing a composite fingerprint (Multi-Hash).
+ * Output format: "grp1:hash1|grp2:hash2|grp3:hash3"
  */
 export class FingerprintBuilder {
     constructor() {
-        // Le hasher est maintenant une propriété pour pouvoir être surchargé par le client WASM.
+        // The hasher is an instance property so it can be overridden by the WASM client.
         this.components = new Map();
-        // FIX: Initialiser le hasher par défaut à l'implémentation JS.
+        // Default hasher set to the JavaScript cyrb53 implementation.
         this.hasher = cyrb53;
     }
 
     /**
-     * Ajoute un composant au hash global.
-     * @param {string} group - Le nom du groupe (ex: 'hw', 'screen', 'geo')
-     * @param {string|number|boolean} value - La valeur brute à hasher
+     * Adds a component to the global hash.
+     * @param {string} group - Component group identifier (e.g. 'hw', 'screen', 'geo').
+     * @param {string|number|boolean} value - Raw value to hash.
      */
     add(group, value) {
         if (value === undefined || value === null) return this;
-        // On hash la valeur individuellement pour l'anonymiser et réduire sa taille
+        // Hash the value individually to anonymize and normalize length
         this.components.set(group, this.hasher(String(value)));
         return this;
     }
@@ -57,8 +57,8 @@ export class FingerprintBuilder {
     }
 
     /**
-     * Affiche les composants actuels dans la console.
-     * @param {string} [title='FingerprintBuilder Components'] - Un titre pour le log.
+     * Prints current components to the console.
+     * @param {string} [title='FingerprintBuilder Components'] - Title for output display.
      */
     log(title = 'FingerprintBuilder Components') {
         console.log(`--- ${title} ---`);
@@ -71,12 +71,12 @@ export class FingerprintBuilder {
     }
 
     /**
-     * Génère la chaîne de signature finale.
-     * Trie les clés pour garantir un ordre déterministe.
+     * Produces the final serialized signature string.
+     * Keys are sorted to guarantee deterministic serialization.
      */
     toString() {
         return Array.from(this.components.entries())
-            .sort((a, b) => a[0].localeCompare(b[0])) // Tri alphabétique des clés
+            .sort((a, b) => a[0].localeCompare(b[0])) // Alphabetical key ordering
             .map(([key, hash]) => `${key}:${hash}`)
             .join("|");
     }
@@ -118,30 +118,29 @@ export class FingerprintBuilder {
             'x_forwarded_for', 'x_real_ip', 'cf_connecting_ip'
         ]);
 
-        // Poids de "véracité" (Entropie/Stabilité)
-        // Les poids sont augmentés pour donner plus d'importance aux signaux forts.
+        // Entropy / stability reliability weights
+        // Strongly invariant signals receive higher weighting
         const weights = {
-            // --- Signaux très forts (difficiles à usurper) ---
-            cvs: 5.0,   // Canvas: Très haute entropie (Rendu unique du GPU/driver)
-            gpu: 4.0,   // GPU: Haute entropie (Matériel spécifique)
-            ja3: 3.5,   // JA3: Identifie la librairie TLS (très stable pour un client donné)
-            ja4: 4.0,   // JA4: Plus moderne, inclut HTTP/2
+            // --- High-entropy invariants (tamper-resistant) ---
+            cvs: 5.0,   // Canvas: High entropy (GPU/driver rendering quirks)
+            gpu: 4.0,   // GPU: High entropy (Physical graphics chipset)
+            ja3: 3.5,   // JA3: TLS client stack fingerprint
+            ja4: 4.0,   // JA4: Modern TLS fingerprint including HTTP/2
             h2: 3.0, // HTTP/2 settings frame fingerprint
             tcp: 2.5, // TCP/IP fingerprint
-            ua: 2.0,    // User-Agent: Signal fort, bien que modifiable
+            ua: 2.0,    // User-Agent string
             
-            // --- Signaux composites et dérivés ---
-            client_fp_hash: 3.0, // Le hash de l'empreinte client est un signal très fort.
-            browser: 1.5,        // Le navigateur extrait du UA.
-            os_version: 1.5,     // L'OS extrait du UA.
-            device_type: 1.0,    // Le type d'appareil extrait du UA.
-
-            // --- Signaux moyens ---
-            hw: 1.5,    // Hardware (CPU, RAM): Stabilité moyenne
-            scr: 1.0,   // Screen: Stabilité moyenne
-            // 'os' est souvent la même chose que 'ch_platform', on peut le déprécier ou lui donner un poids faible.
-            os: 0.8,    // OS (nav.platform): Assez stable
-            geo: 0.5,   // Geo/Langue: Peut changer (VPN, voyage)
+            // --- Derived / composite signals ---
+            client_fp_hash: 3.0, // Client-side fingerprint hash
+            browser: 1.5,        // Parsed browser family
+            os_version: 1.5,     // Parsed OS family
+            device_type: 1.0,    // Device form factor
+
+            // --- Medium-stability signals ---
+            hw: 1.5,    // Hardware (cores, RAM): Moderate stability
+            scr: 1.0,   // Screen geometry: Moderate stability
+            os: 0.8,    // OS (nav.platform)
+            geo: 0.5,   // Geo/locale: Subject to VPNs and travel
         };
 
         let weightedMatches = 0;
@@ -150,16 +149,16 @@ export class FingerprintBuilder {
         const allKeys = new Set([...map1.keys(), ...map2.keys()]);
 
         allKeys.forEach((key) => {
-            // On ignore les clés volatiles pour cette comparaison spécifique.
+            // Ignore volatile keys during comparative evaluation
             if (volatileKeys.has(key)) {
                 return;
             }
 
             const weight = weights[key] ?? 0;
-            // On ne compte une clé dans le poids total que si elle est présente dans au moins une des deux empreintes.
+            // Only tally total weight if key is present in at least one fingerprint
             if (!map1.has(key) && !map2.has(key)) return;
 
-            totalWeight += weight; // N'incrémenter que si la clé est pertinente.
+            totalWeight += weight;
             if (map1.get(key) === map2.get(key)) {
                 weightedMatches += weight;
             }