> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/csharp-document/other-func/remap-engine.md).

# Remap Engine

The Dynamic Code Remap Engine protects critical executable sections from memory dumping, hooking, and in-place byte patching.

## Technical Mechanism

When an executable starts up, traditional tools can attach and read memory pages with `ReadProcessMemory` or place hooks with `VirtualProtect` + JMP instructions.

{% stepper %}
{% step %}

### Allocate shadow memory

Allocates a private, non-contiguous shadow memory region via `NtAllocateVirtualMemory`.
{% endstep %}

{% step %}

### Remap critical code

Duplicates critical executable function blocks into the shadow region and re-points internal call tables.
{% endstep %}

{% step %}

### Protect original pages

Marks original code pages with `PAGE_NOACCESS` or guard page flags.
{% endstep %}

{% step %}

### Handle unauthorized access

Catches any unauthorized access attempts via a structured VEH filter, identifying the offending memory dumper, and terminating execution.
{% endstep %}
{% endstepper %}

## C# Implementation

```csharp
using System;
using qPapelEasyAuth;

public class IntegrityMonitor
{
    public static void VerifyMemoryIntegrity()
    {
        // Executes continuous integrity check against shadow remap pages
        bool integrityIntact = qPapelEasyAuth.qPapelEasyAuth.VerifyMemoryState();

        if (!integrityIntact)
        {
            Console.WriteLine("[!] ALERT: Memory integrity violation detected. Code section modified.");
            Environment.Exit(1);
        }
        else
        {
            Console.WriteLine("[+] Memory Remap State: Clean & Verified.");
        }
    }
}
```

## Protection Characteristics

* **Anti-Dump**: Reconstructors like Scylla fail to dump valid import tables and section pointers.
* **Hook Invalidation**: Mid-function hooks placed on the original page trigger access violations trapped by the security core.
* **Kernel Syscall Execution**: Uses internal syscall stubs rather than standard Win32 APIs to prevent API hooking frameworks (e.g. MinHook, EasyHook, Detours).

{% hint style="info" %}
Dynamic remapping operates transparently under `qPapelPacker` without requiring manual memory allocation in your C# code.
{% endhint %}