Changelog

Commit log from ecosystem repositories.

litellm-gateway (~/.claude/infra/litellm-gateway/)

Commit	Date	Description
fee0277	2026-06-23	fix: MiMo Auto free tier — guard message, response parsing, JWT retry
5051a8f	2026-06-23	fix: API key validation + proper client ID generation
7c21249	2026-06-23	refactor: routing by Claude model tiers + thinking effort
91d3e45	2026-06-23	fix: deprecation warning (dev-dependencies → dependency-groups)
69a500a	2026-06-23	feat: initial gateway implementation

infra (~/.claude/infra/)

Commit	Date	Description
e442d26	2026-06-23	fix: track gateway as separate repo
37c3932	2026-06-23	feat: docker-compose — gateway + searxng + crawl4ai

litellm-gateway (~/.claude/infra/litellm-gateway/)

Commit	Date	Description
64f0886	2026-06-23	feat: Dockerfile for containerized deployment
fee0277	2026-06-23	fix: MiMo Auto free tier — guard message, response parsing, JWT retry
5051a8f	2026-06-23	fix: API key validation + proper client ID generation
7c21249	2026-06-23	refactor: routing by Claude model tiers + thinking effort
91d3e45	2026-06-23	fix: deprecation warning (dev-dependencies → dependency-groups)
69a500a	2026-06-23	feat: initial gateway implementation

wikifita (~/.claude/wikifita/)

Commit	Date	Description
9ae30bb	2026-06-23	feat: add CHANGELOG.md
d4f2d28	2026-06-23	init: wikifita — personal wiki, 4 initial pages

2026-06-28

Added

• fitdnuvo-denuvo-analysis — Complete analysis of Denuvo/EA SPEAR architecture in F1 25 (preloader_l.dll, F1_25.exe, EAAntiCheat, sl.interposer.dll)
• fitdnuvo-scanner — Automated PE Scanner (Python PEP 723) with 62 Denuvo fingerprint signatures + 6 structural heuristics

Findings

• Denuvo VM payload: 282MB in the .tls section of F1_25.exe (XRW flags, entropy 6.85) — normal TLS is <1KB
• Denuvo Fingerprint: 58 preloader imports mapped in 9 categories (Core VM, Anti-Debug, License, File I/O, Registry, System Info, Process Introspection, Crypto, Red Flags)
• Injection vector: sl.interposer.dll (NVIDIA Streamline) is a complete graphics API proxy (D3D11+D3D12+DXGI+Vulkan), called every frame
• EA SPEAR AntiCheat v1.0.14073350: signed by EA SPEAR AntiCheat Engineering, Redwood City, CA
• Family Sharing: LastOwner: 76561198774734292 in appmanifest — shared game, offline license requires special ticket

Tools created

• /tmp/fitdnuvo_scanner.py — PE Scanner with zero dependencies beyond stdlib
• /tmp/FitDNuvoPhase1.java — VM pattern extractor (Ghidra headless)
• /tmp/FitDNuvoPhase2.java — RNG/seed pattern detector (Ghidra headless)
• Ghidra project FitDNuvo with imported and analyzed binaries

Technical stack

• Ghidra 12.1.2 (Homebrew) + GhidraMCP 5.13.1
• chicotv: Windows 10, Ryzen 5 4500, RTX 2060, F1 25 running (PID 6312, 202 threads, 9GB RAM)
• Analyzed binaries: preloader_l.dll (46KB), sl.interposer.dll (541KB), steam_api64.dll (299KB), F1_25.exe (381MB)

2026-06-29

HANDOFF — FitDNuvo research paused

Status: Restored to original state. Standalone not functional (GPU never activated).

Progress:

• ✅ PE Scanner with 62 Denuvo signatures functional
• ✅ PE Stripper (section removal) 96.1% effective
• ✅ Preloader V4 patch (6 bytes) functional
• ✅ Goldberg Steam Emulator integrated
• ✅ SPEAR DLL stub compiled with VS 2026
• ✅ SPEAR Heartbeat stub with retry compiled
• ✅ Session 1 via PsExec (game OPENED, showed "Error")
• ✅ Python relay for SSH escape hell
• ❌ GPU never activated in standalone mode
• ❌ Port 47584 protocol not broken
• ❌ Ghidra on Windows not functional (analyzeHeadless timeout)

Files restored on chicotv:

• preloader_l.dll → original
• EAAntiCheat.GameServiceLauncher.dll → original 48MB
• steam_api64.dll → Goldberg (needs Steam Verify)
• EAAntiCheat.GameServiceLauncher.exe → stub (needs Steam Verify)

New pages:

• fitdnuvo-handoff — Complete handoff document
• fitdnuvo-standalone-chain — Initialization chain map

Fundamental findings:

• Denuvo VM is Turing-complete → ISA deterministically remappable → needs ring0 anti-cheat (SPEAR) for protection
• Port 47584 = internal handshake between components of the same process (not externally accessible)
• sl.interposer.dll (NVIDIA Streamline) = complete graphics API proxy = ideal injection vector
• Family Sharing: offline ticket needs periodic online revalidation