/* dhae_marker_sig.h - magic signatures embedded in the marker bodies. Included by
 * BOTH the SDK (sdk/dhae_sdk.c) and the Dhaedalida GUI so
 * the protector can locate the markers by a code scan even when the target has
 * no PDB - an embedded byte-signature approach. The two sides must agree on
 * these constants, which is exactly why they live in one shared header.
 *
 * Each value has its high byte set, so MSVC x64 must materialize it as a
 * `movabs reg, imm64` (48 B8 + 8 little-endian bytes) directly in `.text`, with
 * NO inline assembly (which MSVC x64 does not support). The GUI scans executable
 * sections for the 8 little-endian magic bytes to find each marker function.
 *
 * TWO ENCODINGS, ONE SIGNATURE. 32-bit x86 has no 64-bit immediate at all, so
 * the trick above cannot work there - the value would come out as two `mov
 * dword` halves with an opcode byte between them, and a contiguous 8-byte scan
 * would find nothing. The 32-bit bindings therefore emit the SAME eight bytes as
 * inline DATA, jumped over:
 *
 *     x64   48 B8 <8 magic bytes> C3     movabs rax, magic ; ret
 *     x86   EB 08 <8 magic bytes> C3     jmp short $+10 ; <data> ; ret
 *
 * (Four issued markers share those two shapes -- see the constants below.)
 *
 * The magic sits at offset +2 of the marker in both cases, so ONE scanner finds
 * both: it matches the 8 bytes, never the instruction around them. See the SDK
 * README beside this file for the full contract.
 */
#ifndef DHAE_MARKER_SIG_H
#define DHAE_MARKER_SIG_H

/* FOUR ISSUED magics in TWO pairs, plus TWO RESERVED ordinals.
 * RabbitStart/RabbitEnd tag a function for VIRTUALIZATION (--rabbit); BearStart/BearEnd for the
 * STACK VM (--bear) -- a bytecode interpreter, the strongest and by far the slowest. The pairs may
 * legally NEST or INTERLEAVE inside one function, so the scanner brackets them with one state
 * machine PER PAIR rather than letting any End close any bracket.
 *
 * The low byte is the marker's ORDINAL (1..6) and the upper seven bytes are the shared namespace,
 * so they differ only in the FIRST byte in memory. That is a convenience for reading a hex
 * dump, not a scanning rule: findMarkerSites compares whole 64-bit values, which is what lets the
 * verify-bindings byte-proof lanes assert each constant literally.
 *
 * Every value keeps its HIGH BYTE SET, which is what forces MSVC x64 to materialize it as a
 * `movabs reg, imm64` rather than a sign-extended 32-bit form. A new magic MUST keep 0xD1 there.
 *
 * ⚠ APPEND, NEVER INSERT. Every binding writes its markers in this file's order, and both
 * verify-bindings scripts assert that order in the source token stream -- it is the only lane that
 * can see two adjacent copy-pasted constants swapped between their labels. Renumbering an existing
 * marker would also silently change the protection MODE of every already-built object that carries
 * the old byte.
 *
 * ⚠ AND A WITHDRAWN ORDINAL IS RESERVED PERMANENTLY, NEVER RECYCLED -- the same argument, applied
 * to the case that actually arose. Ordinals 3 and 4 were issued by an earlier SDK and are no longer
 * offered; they keep their values here, under neutral names, so nothing can hand them to a new
 * marker. Reissuing one would not merely confuse a scanner: every object already built against the
 * old SDK carries those bytes, and the protector still recognises them, so the reused ordinal would
 * silently change what protection those functions get. Closing the gap by shifting 5 and 6 down
 * would do the same thing to every object built against THIS SDK. Leave the gap. */
#define DHAE_SIG_RABBITSTART  0xD11AE5C0DE765401ULL
#define DHAE_SIG_RABBITEND    0xD11AE5C0DE765402ULL
/* Ordinals 3 and 4: RESERVED, not issued by this SDK. Kept defined because the protector still
 * DETECTS them -- an object built against an earlier SDK keeps working -- and because a value that
 * is not written down is a value someone reuses. */
#define DHAE_SIG_RESERVED3    0xD11AE5C0DE765403ULL
#define DHAE_SIG_RESERVED4    0xD11AE5C0DE765404ULL
#define DHAE_SIG_BEARSTART 0xD11AE5C0DE765405ULL
#define DHAE_SIG_BEAREND   0xD11AE5C0DE765406ULL

#endif /* DHAE_MARKER_SIG_H */
