DM

DeMalware-RETRO

Enterprise Security Documentation

Partner Portal | Upload Report | Store | Sign In

01/ JVM Agent Architecture

DeMalware-RETRO operates as a **boot-level JVM Agent** (`-javaagent`), executing directly beneath the Minecraft server software (Spigot, Paper, Folia, or Purpur). By intercepting class streams at the classloader boundary via OW2 ASM bytecode instrumentation, it detects and neutralizes security threats before they load into active server memory.

💡 Standard Startup Parameter:

-javaagent:plugins/DeMalware-RETRO.jar -XX:+DisableAttachMechanism -Djdk.attach.allowAttachSelf=false

02/ config.yml Parameter Reference

This file is generated automatically inside your plugin data directory. Modify the settings below to balance enforcement security and custom third-party integrations.

enabled: true BOOLEAN

If set to false, all bytecode heuristics and dynamic security filters are bypassed. Defaults to true.

block-mode: true BOOLEAN

When a severe backdoor or exploit is detected:
• true: Instantly stubs out the malicious class payload in memory (throwing a SecurityException) and halts the threat.
• false: Allows the class to load but generates warnings in console and triggers alerts.

whitelisted-packages LIST

A list of package namespaces to bypass heuristic scans. Use this to prevent false positives on trusted core libraries.

whitelisted-packages:
  - "org.bukkit"
  - "org.spigotmc"
  - "dev.ajaretro.demalware"
console-only-op: true BOOLEAN

If enabled, operators (`/op`) can **only** be granted directly from the physical host machine server terminal. Any in-game commands or plugin calls attempting to grant OP status are automatically blocked.

rules: {...} OBJECT

Fine-tune individual scanning heuristics. Setting a rule to `false` disables bytecode inspections for that specific threat category:

  • force-op: Intercepts plugin classes attempting to invoke OP grants dynamically.
  • shell-exec: Blocks runtime process spawn invocations (`Runtime.exec` or `ProcessBuilder`).
  • jar-injector: Intercepts classes loading/compiling dynamic jars in runtime.
  • unsafe-reflection: Audits or blocks low-level Java Unsafe memory manipulators.

03/ Auto-Setup Pipeline (`/api/setup-agent`)

For game hosting networks running **Pterodactyl** or virtualized Docker containers, you can automate DeMalware deployments using our shell bootstrapper.

Automated Installation Script Command:

curl -s "https://license.ajaretro.dev/api/setup-agent?api_key=YOUR_API_KEY&node_name=ServerNode" | bash

Query Parameters:

Parameter Type Description
api_key string (Required) Your 96-character B2B API key.
node_name string (Optional) Custom name to register this server instance. Defaults to "B2B Server Node".
block_mode boolean (Optional) Initial configuration block-mode state. Defaults to `true`.

04/ Partner REST API Reference

Hosting partners can fully automate client onboarding, license provisions, and IP whitelist modifications by sending JSON payloads from their billing panels (e.g. WHMCS).

POST https://license.ajaretro.dev/api/b2b/create-license

Creates a new customer license under your quota. If the customer email doesn't have an account, the system automatically registers a dashboard account, sets a temporary password, and sends them their license credentials.

Headers:

X-Partner-Key: your_b2b_api_key

Request Body:

{
    "email": "client@bisect.com",
    "name": "Node-6",
    "product": "demalware"
}

Response (200 OK):

{
    "status": "success",
    "license_key": "DM-B2B-A6C7E2F899A1",
    "email": "client@bisect.com"
}
POST https://license.ajaretro.dev/api/b2b/delete-license

Deletes a customer license and reclaims the slot quota back into your pool.

Headers:

X-Partner-Key: your_b2b_api_key

Request Body:

{
    "license_key": "DM-B2B-A6C7E2F899A1"
}

Response (200 OK):

{
    "status": "success",
    "message": "License deleted and quota slot freed"
}
POST https://license.ajaretro.dev/api/partner/whitelist-ips

Updates allowed node IP ranges (supports comma-separated exact IPs and CIDR subnet blocks like 10.0.0.0/24).

Headers:

X-Partner-Key: your_b2b_api_key

Request Body:

{
    "ips": "162.141.0.31, 10.0.0.0/24"
}

Response (200 OK):

{
    "status": "success"
}
GET https://license.ajaretro.dev/api/b2b/check-quota

Checks the remaining B2B license slots quota available on your partner account.

Headers:

X-Partner-Key: your_b2b_api_key

Response (200 OK):

{
    "status": "success",
    "partner_id": 4,
    "quota": 100,
    "used_quota": 45,
    "available_quota": 55
}