Protect & stamp

Rewrite, link, seal.

Protection is a two-tool story: virtualize marked functions at build time, then stamp the linked image so runtime integrity has something to trust.

frontera-protect

Rewrites marked functions into rolling-key VM stubs that embed encrypted bytecode and callfrontera_rkvm_run. On first entry, stubs also callfrontera_at_start() once (unless FRONTERA_SKIP_AT).

frontera-protect [--seed N] [-o out.cpp] input.cpp
frontera-stamp <binary>

Function markers (equivalent):

[[frontera::protect]]
int returnLicense() { /* ... */ }

// frontera:protect
int returnLicense() { /* ... */ }

/* frontera:protect */
int returnLicense() { /* ... */ }

• --seed sets the base encryption seed (default 0xA2B31E07).
• If a marked function fails to compile through the protect pipeline, the original source may be left unchanged—verify protect output in CI.
• Prefer the cxx-frontera.sh / CMake wrappers over calling the CLI alone.

frontera-stamp

After link, frontera-stamp <binary> hashes the file with the digest payload bytes treated as zeros and writes the SHA-256 intofrontera_at_digest_slot (magic FRNTRADG / trailGDARTNRF). Runtime self-check uses the same convention.

Integrity model

• On-disk: SHA-256 of the executable with slot digest bytes zeroed, compared to the stamped payload.
• In-memory: hash of self-exe r-x mappings; first successful check establishes a baseline.
• VM: CPUID / DMI / cpuinfo scoring; high confidence triggers hard exit.
• Debugger: phomo watches ptrace ATTACH / SEIZE / POKETEXT when BPF is available.

What Frontera is not

• No TOML/YAML policy file for allowed paths or remote telemetry.
• No frontera_report() network channel—failures are local.
• MBA C string APIs and disk JIT are weaker for antitamper than[[frontera::protect]] / opaque MBA headers.