> For the complete documentation index, see [llms.txt](https://easyauth.papelship.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://easyauth.papelship.com/csharp-document/other-func/security-protection-flags.md).

# Security Protection Flags

Protection Flags control which security heuristics, kernel mitigations, memory integrity checkers, and anti-tamper routines run inside the native security core.

## `ProtectionFlags` Enum

In C#, protection flags are defined as bitwise flags:

```csharp
namespace qPapelEasyAuth
{
    [Flags]
    public enum ProtectionFlags : uint
    {
        None              = 0,
        Crc32             = 1 << 0,  // Continuous memory code section CRC32 verification
        InjectionMonitor  = 1 << 1,  // Detect remote thread creation & DLL injection
        NetworkHooks      = 1 << 2,  // Monitor Winsock (ws2_32.dll) for proxy hooks
        LoaderHooks       = 1 << 3,  // Detect LdrLoadDll and ntdll.dll hooking
        ManualMap         = 1 << 4,  // Scans for unlinked / manual-mapped executable memory pages
        AntiDebug         = 1 << 5,  // Thread hiding, PEB flags, hardware breakpoints, VEH hooks
        VmpChecks         = 1 << 6,  // Checks VMProtect / VXLang virtualization state
        Honeypot          = 1 << 7,  // Synthetic decoy functions and delayed bans
        Crc32Obf          = 1 << 8,  // Polymorphic checksum hashing
        All               = Crc32 | InjectionMonitor | NetworkHooks | LoaderHooks | ManualMap | AntiDebug | VmpChecks | Honeypot
    }
}
```

## Configuring Protection Options

{% tabs %}
{% tab title="Standard Recommended (All Flags)" %}

```csharp
var config = new EasyAuthConfig
{
    Flags = ProtectionFlags.All,
    HoneypotDelayMs = 5000,
    VmpMode = false,
    ClientVersion = "2.0.0",
    WatchdogIntervalMs = 500,
    HwidMethod = "disk"
};

qPapelEasyAuth.qPapelEasyAuth.SetConfig(config);
```

{% endtab %}

{% tab title="Developer / Debug Mode" %}

```csharp
// Disable anti-debugging during local development in Visual Studio
var config = new EasyAuthConfig
{
    Flags = ProtectionFlags.Crc32 | ProtectionFlags.InjectionMonitor | ProtectionFlags.NetworkHooks,
    HoneypotDelayMs = 0,
    ClientVersion = "2.0.0"
};

qPapelEasyAuth.qPapelEasyAuth.SetConfig(config);
```

{% endtab %}
{% endtabs %}

## Detailed Flag Descriptions

### `ProtectionFlags.Crc32`

Computes an initial hash of the executable's `.text` code section at startup and verifies memory pages periodically. Any runtime memory patch (e.g. `0x90 NOP`, JMP hooks, software breakpoints `0xCC INT 3`) triggers immediate detection.

### `ProtectionFlags.AntiDebug`

* Checks `PEB.BeingDebugged` and `PEB.NtGlobalFlag`.
* Queries `NtQueryInformationProcess` with `ProcessDebugPort`, `ProcessDebugObjectHandle`, and `ProcessDebugFlags`.
* Hides the main thread and background watchdog threads via `NtSetInformationThread(ThreadHideFromDebugger)`.
* Inspects CPU Debug Registers (`DR0`, `DR1`, `DR2`, `DR3`, `DR7`) via hardware context sampling.

### `ProtectionFlags.InjectionMonitor`

Tracks suspicious thread creations targeting the process address space from external handles, catching remote injection utilities before payloads initialize.

### `ProtectionFlags.LoaderHooks` & `NetworkHooks`

Verifies export tables and preamble bytes of `ntdll.dll`, `kernel32.dll`, `kernelbase.dll`, and `ws2_32.dll` to prevent tools like HTTP Debugger Pro or Fiddler from intercepting TLS sockets.

{% hint style="info" %}
In production releases, always enable `ProtectionFlags.All` and package the executable using `qPapelPacker`.
{% endhint %}