ShieldCore

ShieldCore is a small C++17 project that demonstrates a cross-platform protected plugin workflow:

• a host application that loads an encrypted plugin package
• integrity and signature checks around the plugin payload
• basic anti-debug checks
• optional backend validation before execution
• a packer tool that turns a dynamic library into a .plg file

The repository is structured to build on Linux, macOS, and Windows, with the current WSL/Linux build path verified in this workspace.

Project Layout

• src/host - host application, crypto helpers, integrity checks, anti-debug logic, and HTTP client
• src/plugin - sample plugin that exports Execute()
• src/tools - packer utility that creates .plg files
• include/shieldcore - shared headers
• build - generated binaries and test artifacts

Requirements

You need a C++17 compiler, make, OpenSSL, and libcurl.

Ubuntu / WSL

sudo apt update
sudo apt install build-essential make pkg-config libssl-dev libcurl4-openssl-dev

macOS

brew install openssl curl

Windows

Use either MSYS2/MinGW-w64 or a Visual Studio environment that can build C++17 projects and link against OpenSSL and libcurl.

Build

The project uses the top-level Makefile.

make release

Other useful targets:

make debug
make clean
make pack
make backend

Build outputs are written to build/.

What Gets Built

• build/hostapp or the platform-specific equivalent
• build/plugin.so, build/plugin.dylib, or build/plugin.dll
• build/packer or the platform-specific equivalent

Running

The host expects a packed plugin file:

./build/hostapp ./build/plugin.plg

An optional backend URL may be passed as the second argument:

./build/hostapp ./build/plugin.plg http://127.0.0.1:18081

For local testing, run the mock backend in another terminal:

python3 tools/mock_backend.py 18081

It accepts POST /validate and POST /activate, which matches the host client.

Packing a Plugin

The packer reads a compiled plugin, encrypts it, signs its hash, and writes a .plg file.

./build/packer ./build/plugin.so ./build/plugin.plg

On Windows and macOS, use the platform-specific plugin filename produced by the build.

Local Smoke Test

The current implementation supports a simple local test flow using PEM values from the environment.

1. Generate a test RSA keypair.
2. Export the private and public key PEMs to the environment.
3. Pack the sample plugin.
4. Run the host against the packed plugin.

Example:

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out build/test_private.pem
openssl pkey -in build/test_private.pem -pubout -out build/test_public.pem
export SHIELDCORE_PRIVATE_KEY_PEM="$(cat build/test_private.pem)"
export SHIELDCORE_PUBLIC_KEY_PEM="$(cat build/test_public.pem)"
./build/packer ./build/plugin.so ./build/plugin.plg
./build/hostapp ./build/plugin.plg

If the smoke test succeeds, the sample plugin prints:

ShieldCore plugin executed

Environment Variables

• SHIELDCORE_PRIVATE_KEY_PEM - overrides the packer private key PEM used for signing during local testing
• SHIELDCORE_PUBLIC_KEY_PEM - overrides the host public key PEM used for signature verification during local testing
• SHIELDCORE_EXPECTED_HOST_HASH - optional expected SHA256 hash for the host executable

Notes

• The design is intentionally modular so host, plugin, and tooling can be built independently.
• Release builds enable optimization flags and link-time optimization where supported.
• The current repository includes a verified WSL/Linux build path; platform-specific loader details may still require refinement depending on the target OS toolchain.