root-access 1.3.38 → 1.3.41

package/bin/cli.js

@@ -1,469 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * ROOTACCESS CLI - CTF Challenge (HARD MODE)
- * ==========================================
- * The flag is hidden across 10 layers.
- * Can you reverse engineer this CLI to find it?
- * 
- * FLAG FORMAT: root{...}
- */
-
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-const { CoreSystem } = require('../lib/index.js');
-const { DataVault } = require('../lib/vault.js');
-const { CryptoEngine } = require('../lib/crypto.js');
-const { NetworkSim } = require('../lib/network.js');
-const { KeyForge } = require('../lib/keyforge.js');
-
-const VERSION = '1.3.37';
-const CODENAME = 'SHADOWGATE';
-
-// Session state for handshake
-let handshakeState = {
-    synSent: false,
-    synAckReceived: false,
-    token: null,
-    timestamp: null
-};
-
-// Banner
-const banner = `
-\x1b[35m╔═══════════════════════════════════════════════════════════╗
-║  ██████╗  ██████╗  ██████╗ ████████╗ █████╗  ██████╗██████╗  ║
-║  ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝██╔══██╗██╔════╝██╔════╝ ║
-║  ██████╔╝██║   ██║██║   ██║   ██║   ███████║██║     ██████╗  ║
-║  ██╔══██╗██║   ██║██║   ██║   ██║   ██╔══██║██║     ╚════██╗ ║
-║  ██║  ██║╚██████╔╝╚██████╔╝   ██║   ██║  ██║╚██████╗██████╔╝ ║
-║  ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝   ╚═╝  ╚═╝ ╚═════╝╚═════╝  ║
-╠═══════════════════════════════════════════════════════════════╣
-║  Version: ${VERSION}  |  Codename: ${CODENAME}               ║
-╚═══════════════════════════════════════════════════════════════╝\x1b[0m
-`;
-
-// Hidden debug mode (Layer 1 hint)
-const DEBUG_KEY = process.env.ROOTACCESS_DEBUG;
-const ADMIN_MODE = process.env.ROOTACCESS_ADMIN === 'shadowgate';
-
-// Generate time-based token for Layer 7
-function getTimeWindowToken() {
-    const now = new Date();
-    const minutes = now.getUTCMinutes();
-    // Valid in 5-minute windows (0-4, 5-9, etc.)
-    const window = Math.floor(minutes / 5);
-    return crypto.createHash('md5').update(`SHADOW_${window}_GATE`).digest('hex').slice(0, 6).toUpperCase();
-}
-
-// Check if current time is in "shadow hour" (minutes 0-10 or 30-40 of any hour)
-function isInShadowWindow() {
-    const minutes = new Date().getUTCMinutes();
-    return (minutes >= 0 && minutes <= 10) || (minutes >= 30 && minutes <= 40);
-}
-
-// Generate handshake challenge token
-function generateSynAckToken() {
-    const ts = Date.now().toString();
-    const token = crypto.createHash('sha256').update(ts + CODENAME).digest('hex').slice(0, 8).toUpperCase();
-    return { token, timestamp: ts };
-}
-
-// Verify handshake ACK
-function verifyAck(ackToken, originalTimestamp) {
-    const expected = crypto.createHash('sha256')
-        .update(originalTimestamp + CODENAME + 'ACK')
-        .digest('hex').slice(0, 8).toUpperCase();
-    return ackToken === expected;
-}
-
-// Command handlers
-const commands = {
-    help: () => {
-        console.log(`
-\x1b[36mUsage:\x1b[0m rootaccess <command> [options]
-
-\x1b[36mCommands:\x1b[0m
-  help          Show this help message
-  version       Show version information
-  status        Check system status
-  scan          Scan for vulnerabilities
-  connect       Connect to remote server
-  decrypt       Decrypt a message
-  forge         Access the Key Forge
-  handshake     Network handshake protocol
-  about         About this tool
-
-\x1b[36mExamples:\x1b[0m
-  rootaccess status
-  rootaccess scan --deep
-  rootaccess connect --server alpha
-
-\x1b[33mHint: Not everything is what it seems... 10 layers await.\x1b[0m
-`);
-    },
-
-    version: () => {
-        console.log(`RootAccess CLI v${VERSION}`);
-        console.log(`Codename: ${CODENAME}`);
-        console.log(`Build: ${Buffer.from('4e4f5448494e475f48455245', 'hex').toString()}`);
-        
-        // Hidden layer - check if debugging
-        if (DEBUG_KEY === 'LAYER_ONE') {
-            console.log(`\n\x1b[32m[DEBUG] Layer 1 unlocked!\x1b[0m`);
-            console.log(`[DEBUG] Fragment 1: ${CryptoEngine.getFragment(1)}`);
-        }
-    },
-
-    status: () => {
-        const core = new CoreSystem();
-        console.log('\n\x1b[36m[*] System Status\x1b[0m');
-        console.log('─'.repeat(40));
-        console.log(`  Core Engine:     \x1b[32mONLINE\x1b[0m`);
-        console.log(`  Crypto Module:   \x1b[32mONLINE\x1b[0m`);
-        console.log(`  Vault Status:    \x1b[33mLOCKED\x1b[0m`);
-        console.log(`  Network:         \x1b[31mRESTRICTED\x1b[0m`);
-        console.log(`  Shadow Window:   ${isInShadowWindow() ? '\x1b[32mACTIVE\x1b[0m' : '\x1b[31mINACTIVE\x1b[0m'}`);
-        console.log('─'.repeat(40));
-        
-        // Hidden admin check (Layer 2)
-        if (ADMIN_MODE) {
-            console.log(`\n\x1b[32m[ADMIN] Elevated access detected!\x1b[0m`);
-            console.log(`[ADMIN] Fragment 2: ${CryptoEngine.getFragment(2)}`);
-        }
-        
-        // Easter egg in status
-        core.checkIntegrity();
-    },
-
-    scan: (args) => {
-        console.log('\n\x1b[36m[*] Initiating security scan...\x1b[0m\n');
-        
-        const targets = [
-            { name: 'Memory', status: 'clean' },
-            { name: 'Network', status: 'clean' },
-            { name: 'Filesystem', status: 'clean' },
-            { name: 'Registry', status: 'anomaly' },
-        ];
-
-        targets.forEach((t, i) => {
-            setTimeout(() => {
-                const icon = t.status === 'clean' ? '\x1b[32m✓\x1b[0m' : '\x1b[33m⚠\x1b[0m';
-                console.log(`  ${icon} ${t.name}: ${t.status}`);
-            }, i * 500);
-        });
-
-        setTimeout(() => {
-            console.log('\n\x1b[36m[*] Scan complete.\x1b[0m');
-            
-            // Deep scan mode (Layer 3)
-            if (args.includes('--deep') || args.includes('-d')) {
-                console.log('\x1b[33m[*] Deep scan enabled...\x1b[0m');
-                const vault = new DataVault();
-                const anomaly = vault.analyzeRegistry();
-                if (anomaly) {
-                    console.log(`\x1b[32m[!] Hidden data found in registry!\x1b[0m`);
-                    console.log(`[DATA] ${anomaly}`);
-                }
-            }
-            
-            // Secret flag for --ultra
-            if (args.includes('--ultra')) {
-                console.log(`\n\x1b[35m[ULTRA] Fragment 3: ${CryptoEngine.getFragment(3)}\x1b[0m`);
-            }
-        }, 2500);
-    },
-
-    connect: (args) => {
-        const network = new NetworkSim();
-        const serverArg = args.find(a => a.startsWith('--server=') || a.startsWith('-s='));
-        const server = serverArg ? serverArg.split('=')[1] : 'default';
-        
-        console.log(`\n\x1b[36m[*] Connecting to server: ${server}\x1b[0m`);
-        
-        // Layer 4 - specific server name
-        if (server === 'omega-7' || server === 'OMEGA-7') {
-            console.log('\x1b[32m[+] Connection established to classified server!\x1b[0m');
-            console.log(`[CLASSIFIED] Fragment 4: ${CryptoEngine.getFragment(4)}`);
-        } else if (server === 'alpha') {
-            console.log('\x1b[33m[!] Alpha server deprecated. Try omega-7?\x1b[0m');
-        } else {
-            console.log('\x1b[31m[-] Connection refused. Server not found.\x1b[0m');
-        }
-    },
-
-    decrypt: (args) => {
-        const msgArg = args.find(a => a.startsWith('--msg=') || a.startsWith('-m='));
-        const chainArg = args.find(a => a.startsWith('--chain='));
-        
-        if (!msgArg) {
-            console.log('\x1b[31m[-] Usage: rootaccess decrypt --msg=<encrypted>\x1b[0m');
-            console.log('\x1b[33m[*] Hint: Some keys are forged from previous discoveries...\x1b[0m');
-            console.log('\x1b[33m[*] Advanced: rootaccess decrypt --msg=<msg> --chain=<frag1+frag2>\x1b[0m');
-            return;
-        }
-        
-        const msg = msgArg.split('=')[1];
-        
-        // Layer 5 - Chain-dependent decrypt (requires MD5 of frag1+frag2)
-        if (chainArg) {
-            const chainValue = chainArg.split('=')[1];
-            // Expected: MD5(frag1 + frag2) first 8 chars
-            const frag1 = CryptoEngine.getFragment(1);
-            const frag2 = CryptoEngine.getFragment(2);
-            const expectedChain = crypto.createHash('md5').update(frag1 + frag2).digest('hex').slice(0, 8);
-            
-            if (chainValue === expectedChain && msg === 'UNLOCK_CHAIN') {
-                console.log('\x1b[32m[+] Chain decryption successful!\x1b[0m');
-                console.log(`[CHAIN] Fragment 5: ${CryptoEngine.getFragment(5)}`);
-                console.log(`\x1b[90m[*] Chain key was: ${expectedChain}\x1b[0m`);
-            } else {
-                console.log('\x1b[31m[-] Chain verification failed.\x1b[0m');
-                console.log('\x1b[33m[*] Hint: Chain = MD5(fragment1 + fragment2)[0:8]\x1b[0m');
-            }
-        } else if (msg === 'test') {
-            console.log('[*] Test mode: Output = t3st_0utput');
-        } else {
-            console.log(`\x1b[31m[-] Decryption failed. Invalid key.\x1b[0m`);
-            console.log('\x1b[33m[*] Hint: Try --chain parameter for advanced decryption.\x1b[0m');
-        }
-    },
-
-    about: () => {
-        console.log(`
-\x1b[36mRootAccess CLI\x1b[0m
-A security research tool for penetration testing.
-
-Created by: Uttam Mahata
-License: MIT
-Repository: https://github.com/Uttam-Mahata/rootaccess
-
-\x1b[33m"The truth is hidden in plain sight..."\x1b[0m
-
-\x1b[90m// TODO: Remove debug endpoints before production
-// Endpoints: /api/v1/internal/fragments
-// Auth: Bearer SHADOWGATE_TOKEN_X7K9
-// Shadow hours: minutes 0-10 or 30-40 of any hour (UTC)
-// Unlock file: /tmp/.rootaccess_shadow\x1b[0m
-`);
-    },
-
-    // Hidden commands (not in help)
-    __internal__: (args) => {
-        // Layer 6 - hidden command
-        console.log('\x1b[32m[INTERNAL] Access granted to internal API\x1b[0m');
-        console.log(`[INTERNAL] Fragment 6: ${CryptoEngine.getFragment(6)}`);
-    },
-
-    // Layer 7 - Time-window based unlock
-    shadow: (args) => {
-        const tokenArg = args.find(a => a.startsWith('--token='));
-        
-        if (!tokenArg) {
-            console.log('\n\x1b[36m[SHADOW] Time-based access control\x1b[0m');
-            console.log('─'.repeat(40));
-            
-            if (isInShadowWindow()) {
-                const token = getTimeWindowToken();
-                console.log('\x1b[32m[+] Shadow window is ACTIVE\x1b[0m');
-                console.log(`[*] Current token: ${Buffer.from(token).toString('hex')}`);
-                console.log('\x1b[33m[*] Decode the hex and use: rootaccess shadow --token=<TOKEN>\x1b[0m');
-            } else {
-                const now = new Date();
-                const minutes = now.getUTCMinutes();
-                let nextWindow;
-                if (minutes < 30) {
-                    nextWindow = 30 - minutes;
-                } else if (minutes > 40) {
-                    nextWindow = 60 - minutes;
-                } else {
-                    nextWindow = 0;
-                }
-                console.log('\x1b[31m[-] Shadow window is INACTIVE\x1b[0m');
-                console.log(`[*] Next window in ~${nextWindow} minutes`);
-                console.log('\x1b[33m[*] Shadow hours: minutes 0-10 or 30-40 of any hour (UTC)\x1b[0m');
-            }
-            return;
-        }
-        
-        const providedToken = tokenArg.split('=')[1];
-        const expectedToken = getTimeWindowToken();
-        
-        if (providedToken === expectedToken && isInShadowWindow()) {
-            console.log('\x1b[32m[+] Shadow access granted!\x1b[0m');
-            console.log(`[SHADOW] Fragment 7: ${CryptoEngine.getFragment(7)}`);
-        } else if (!isInShadowWindow()) {
-            console.log('\x1b[31m[-] Shadow window is not active. Wait for the right time.\x1b[0m');
-        } else {
-            console.log('\x1b[31m[-] Invalid shadow token.\x1b[0m');
-        }
-    },
-
-    // Layer 8 - File creation unlock
-    unlock: (args) => {
-        const unlockFile = '/tmp/.rootaccess_shadow';
-        const expectedContent = crypto.createHash('sha256')
-            .update(CODENAME + '_UNLOCK_' + VERSION)
-            .digest('hex').slice(0, 16);
-        
-        console.log('\n\x1b[36m[UNLOCK] File-based authentication\x1b[0m');
-        console.log('─'.repeat(40));
-        
-        if (fs.existsSync(unlockFile)) {
-            try {
-                const content = fs.readFileSync(unlockFile, 'utf8').trim();
-                if (content === expectedContent) {
-                    console.log('\x1b[32m[+] Unlock file verified!\x1b[0m');
-                    console.log(`[UNLOCK] Fragment 8: ${CryptoEngine.getFragment(8)}`);
-                    console.log(`\x1b[90m[*] Expected content was: SHA256(CODENAME + "_UNLOCK_" + VERSION)[0:16]\x1b[0m`);
-                } else {
-                    console.log('\x1b[31m[-] Unlock file content incorrect.\x1b[0m');
-                    console.log('\x1b[33m[*] Hint: SHA256(CODENAME + "_UNLOCK_" + VERSION)[0:16]\x1b[0m');
-                    console.log(`\x1b[33m[*] Your content: ${content}\x1b[0m`);
-                }
-            } catch (e) {
-                console.log('\x1b[31m[-] Error reading unlock file.\x1b[0m');
-            }
-        } else {
-            console.log('\x1b[31m[-] Unlock file not found.\x1b[0m');
-            console.log(`\x1b[33m[*] Create file: ${unlockFile}\x1b[0m`);
-            console.log('\x1b[33m[*] Content: SHA256(CODENAME + "_UNLOCK_" + VERSION)[0:16]\x1b[0m');
-            console.log('\x1b[33m[*] CODENAME and VERSION are shown in the banner.\x1b[0m');
-        }
-    },
-
-    // Layer 9 - Network handshake simulation
-    handshake: (args) => {
-        const synArg = args.includes('--syn');
-        const ackArg = args.find(a => a.startsWith('--ack='));
-        const tsArg = args.find(a => a.startsWith('--ts='));
-        
-        console.log('\n\x1b[36m[HANDSHAKE] TCP-like handshake protocol\x1b[0m');
-        console.log('─'.repeat(40));
-        
-        if (synArg) {
-            // Step 1: Client sends SYN
-            const { token, timestamp } = generateSynAckToken();
-            console.log('\x1b[32m[SYN] Connection initiated\x1b[0m');
-            console.log(`[SYN-ACK] Server responds with token: ${token}`);
-            console.log(`[SYN-ACK] Timestamp: ${timestamp}`);
-            console.log('\x1b[33m[*] Complete handshake with:\x1b[0m');
-            console.log(`\x1b[33m    rootaccess handshake --ack=<COMPUTED_ACK> --ts=${timestamp}\x1b[0m`);
-            console.log('\x1b[33m[*] ACK = SHA256(timestamp + CODENAME + "ACK")[0:8].toUpperCase()\x1b[0m');
-        } else if (ackArg && tsArg) {
-            // Step 2: Client sends ACK
-            const ackToken = ackArg.split('=')[1];
-            const timestamp = tsArg.split('=')[1];
-            
-            if (verifyAck(ackToken, timestamp)) {
-                console.log('\x1b[32m[ACK] Handshake complete!\x1b[0m');
-                console.log(`[ESTABLISHED] Fragment 9: ${CryptoEngine.getFragment(9)}`);
-            } else {
-                console.log('\x1b[31m[-] ACK verification failed.\x1b[0m');
-                console.log('\x1b[33m[*] ACK = SHA256(timestamp + CODENAME + "ACK")[0:8].toUpperCase()\x1b[0m');
-            }
-        } else {
-            console.log('[*] Initiate handshake with: rootaccess handshake --syn');
-            console.log('[*] This simulates a TCP 3-way handshake.');
-        }
-    },
-
-    // Layer 10 - Key Forge system (enhanced)
-    forge: (args) => {
-        const hintArg = args.find(a => a.startsWith('--hint='));
-        const compArg = args.find(a => a.startsWith('--component=') || a.startsWith('-c='));
-        const solveArg = args.find(a => a.startsWith('--solve='));
-        const verifyArg = args.find(a => a.startsWith('--verify='));
-        const finalArg = args.includes('--final');
-        
-        if (hintArg) {
-            const level = hintArg.split('=')[1];
-            console.log(`\n\x1b[33m[HINT ${level}]\x1b[0m ${KeyForge.getHint(level)}\n`);
-        } else if (compArg) {
-            const comp = compArg.split('=')[1];
-            const result = KeyForge.computeComponent(comp);
-            if (result) {
-                // Components are now hex-encoded for extra difficulty
-                const encoded = Buffer.from(result).toString('hex');
-                console.log(`\n\x1b[32m[COMPONENT]\x1b[0m ${comp} = ${encoded} (hex encoded)\n`);
-            } else {
-                console.log(`\n\x1b[31m[-] Unknown component: ${comp}\x1b[0m`);
-                console.log('[*] Available: version, codename, timestamp, xorPair, primes\n');
-            }
-        } else if (verifyArg) {
-            const testKey = verifyArg.split('=')[1];
-            if (KeyForge.verifyKey(testKey)) {
-                console.log('\n\x1b[32m[✓] KEY VERIFIED! Use this with: rootaccess assemble --key=<YOUR_KEY>\x1b[0m\n');
-            } else {
-                console.log('\n\x1b[31m[-] Invalid key. Keep forging...\x1b[0m');
-                console.log('\x1b[33m[*] Use --hint=6 for the pattern.\x1b[0m\n');
-            }
-        } else if (finalArg) {
-            // Hint for final fragment
-            console.log('\n\x1b[35m[FINAL] The last fragment requires the master key.\x1b[0m');
-            console.log('[*] Once you have all 9 fragments, forge the key and assemble.\n');
-        } else {
-            KeyForge.showKeyBuilder();
-        }
-    },
-
-    assemble: (args) => {
-        // Final assembly - requires correct forged key
-        const keyArg = args.find(a => a.startsWith('--key='));
-        const key = keyArg ? keyArg.split('=')[1] : null;
-        
-        if (!key) {
-            console.log('\x1b[31m[-] Usage: rootaccess assemble --key=<MASTER_KEY>\x1b[0m');
-            console.log('\x1b[33m[*] Use "rootaccess forge" to build the master key.\x1b[0m');
-            return;
-        }
-        
-        if (KeyForge.verifyKey(key)) {
-            console.log('\n\x1b[32m[✓] MASTER KEY ACCEPTED\x1b[0m\n');
-            console.log(`[FINAL] Fragment 10: ${CryptoEngine.getFragment(10)}`);
-            console.log('');
-            const vault = new DataVault();
-            vault.assembleFlag();
-        } else {
-            console.log('\x1b[31m[-] Invalid master key.\x1b[0m');
-            console.log('\x1b[33m[*] The key must be forged from 5 components.\x1b[0m');
-            console.log('\x1b[33m[*] Try: rootaccess forge --hint=1\x1b[0m');
-        }
-    }
-};
-
-// Main execution
-function main() {
-    const args = process.argv.slice(2);
-    const command = args[0] || 'help';
-    const cmdArgs = args.slice(1);
-
-    // Show banner for main commands
-    if (['help', 'status', 'about'].includes(command) || !command) {
-        console.log(banner);
-    }
-
-    // Check for hidden trigger in any arg
-    if (args.some(a => a.includes('REVEAL_ALL'))) {
-        console.log('\n\x1b[35m[EASTER EGG] You found the master trigger!\x1b[0m');
-        console.log(`[MASTER] ${CryptoEngine.getMasterHint()}`);
-    }
-
-    // Execute command
-    if (commands[command]) {
-        commands[command](cmdArgs);
-    } else if (command === '__internal__' || command === 'internal') {
-        commands.__internal__(cmdArgs);
-    } else if (command === 'shadow') {
-        commands.shadow(cmdArgs);
-    } else if (command === 'unlock') {
-        commands.unlock(cmdArgs);
-    } else if (command === 'assemble') {
-        commands.assemble(cmdArgs);
-    } else {
-        console.log(`\x1b[31m[-] Unknown command: ${command}\x1b[0m`);
-        console.log(`[*] Run 'rootaccess help' for usage.`);
-    }
-}
-
-main();

package/lib/crypto.js

@@ -1,127 +0,0 @@
-/**
- * Crypto Engine - Handles encryption/decryption
- * Multiple fragments hidden here
- */
-
-const crypto = require('crypto');
-
-// Flag is split into 10 encoded fragments
-// Each fragment requires solving a different layer
-
-// XOR key for fragment encoding
-const XOR_KEY = 'SHADOWGATE';
-
-// Helper to XOR encode/decode
-function xorWithKey(str, key) {
-    let result = '';
-    for (let i = 0; i < str.length; i++) {
-        result += String.fromCharCode(str.charCodeAt(i) ^ key.charCodeAt(i % key.length));
-    }
-    return result;
-}
-
-// Pre-compute encoded fragments
-function encodeFragment(plain) {
-    const xored = xorWithKey(plain, XOR_KEY);
-    return Buffer.from(xored, 'binary').toString('base64');
-}
-
-// The actual fragments (10 total for harder challenge)
-// Flag: root{N0d3_Cl1_R3v3rs3_3ng1n33r1ng_M4st3r_0f_Sh4d0ws}
-const PLAIN_FRAGMENTS = {
-    1: "root{N0",      // Layer 1: Debug env
-    2: "d3_Cl1_",      // Layer 2: Admin env
-    3: "R3v3rs3",      // Layer 3: Ultra scan
-    4: "_3ng1n3",      // Layer 4: Omega-7 server
-    5: "3r1ng_",       // Layer 5: Chain-dependent decrypt
-    6: "M4st3r",       // Layer 6: Internal command
-    7: "_0f_",         // Layer 7: Time-window
-    8: "Sh4d",         // Layer 8: File creation
-    9: "0ws",          // Layer 9: Network handshake
-    10: "}"            // Layer 10: Final forge
-};
-
-// Encoded at module load (for obfuscation in source)
-const ENCODED_FRAGMENTS = {};
-for (let i = 1; i <= 10; i++) {
-    ENCODED_FRAGMENTS[i] = encodeFragment(PLAIN_FRAGMENTS[i]);
-}
-
-function xorDecode(encoded, key) {
-    const data = Buffer.from(encoded, 'base64').toString('binary');
-    let result = '';
-    for (let i = 0; i < data.length; i++) {
-        result += String.fromCharCode(data.charCodeAt(i) ^ key.charCodeAt(i % key.length));
-    }
-    return result;
-}
-
-// Generate chain-dependent key from fragments
-function generateChainKey(frag1, frag2) {
-    return crypto.createHash('md5').update(frag1 + frag2).digest('hex').slice(0, 8);
-}
-
-// Generate handshake token based on timestamp
-function generateHandshakeToken(seed) {
-    const base = crypto.createHash('sha256').update(seed + 'SHADOWGATE').digest('hex');
-    return base.slice(0, 8).toUpperCase();
-}
-
-class CryptoEngine {
-    constructor() {
-        this.algorithm = 'xor-shadow';
-    }
-
-    static getFragment(num) {
-        if (num < 1 || num > 10) return '[INVALID FRAGMENT]';
-        
-        // Decode on the fly
-        return xorDecode(ENCODED_FRAGMENTS[num], XOR_KEY);
-    }
-
-    static getTotalFragments() {
-        return 10;
-    }
-
-    static generateChainKey(frag1, frag2) {
-        return generateChainKey(frag1, frag2);
-    }
-
-    static generateHandshakeToken(seed) {
-        return generateHandshakeToken(seed);
-    }
-
-    static getMasterHint() {
-        return 'Fragments: 1-10 | Assemble with: rootaccess assemble --key=MASTER_KEY';
-    }
-
-    encrypt(data) {
-        return Buffer.from(data).toString('base64');
-    }
-
-    decrypt(data) {
-        try {
-            return Buffer.from(data, 'base64').toString();
-        } catch {
-            return null;
-        }
-    }
-
-    // Hidden method - accessible via prototype inspection
-    static __getFullFlag__() {
-        const parts = [];
-        for (let i = 1; i <= 10; i++) {
-            parts.push(xorDecode(ENCODED_FRAGMENTS[i], XOR_KEY));
-        }
-        return parts.join('');
-    }
-}
-
-// Hidden in module pattern
-const _internal = {
-    key: XOR_KEY,
-    hint: 'XOR with SHADOWGATE to decode fragments',
-    chainHint: 'Some keys are forged from previous discoveries...'
-};
-
-module.exports = { CryptoEngine, _internal };

package/lib/index.js

@@ -1,60 +0,0 @@
-/**
- * Core System Module
- * Hidden fragments are scattered throughout
- */
-
-const fs = require('fs');
-const path = require('path');
-
-// Obfuscated data (not the real flag, just noise)
-const _0x4f3a = [0x72, 0x6f, 0x6f, 0x74, 0x7b];
-const _0xdecoy = 'cm9vdHtOT1RfVEhFX0ZMQUd9'; // Base64 decoy
-
-class CoreSystem {
-    constructor() {
-        this.initialized = true;
-        this.modules = ['crypto', 'vault', 'network'];
-        // Hidden in constructor
-        this._secret = this._initSecret();
-    }
-
-    _initSecret() {
-        // Fragment hidden in method name pattern
-        const m = ['S', 'h', '4', 'd', '0', 'w'];
-        return m.join('');
-    }
-
-    checkIntegrity() {
-        // Looks like integrity check but has hidden data
-        const checks = {
-            core: true,
-            memory: true,
-            // Hidden hint
-            _hint: 'Environment variables hold secrets...'
-        };
-        
-        // Debug output if NODE_ENV is special
-        if (process.env.NODE_ENV === 'shadowgate_debug') {
-            console.log('\x1b[90m[INTEGRITY] Hidden check passed\x1b[0m');
-            console.log('\x1b[90m[INTEGRITY] Try: ROOTACCESS_DEBUG=LAYER_ONE\x1b[0m');
-        }
-        
-        return checks.core && checks.memory;
-    }
-
-    getModuleInfo(name) {
-        const info = {
-            crypto: { version: '2.1.0', status: 'active' },
-            vault: { version: '1.5.0', status: 'locked' },
-            network: { version: '3.0.0', status: 'limited' }
-        };
-        return info[name] || null;
-    }
-}
-
-// Hidden export with data
-module.exports = { 
-    CoreSystem,
-    // Easter egg in exports
-    __hidden__: Buffer.from('TGF5ZXIgMTogRW52aXJvbm1lbnQgdmFyaWFibGVz', 'base64').toString()
-};