[kirre-bylund]

Implements T9f. A config file can now be plain JSON or obfuscated Base64, matching the other SDKs' "plain or encrypted" behaviour.

The decision I had to make, and why

"Port it" turned out to be ambiguous. Both engine SDKs use AES with a hardcoded key, and they are not compatible with each other: Unity is AES-128-CBC with an IV prefix, Unreal is AES-256-ECB with PKCS7. So there was no single thing to port — the real question was whether to take on a crypto dependency at all.

I decided against AES. AES is not in the C++ standard library, so matching either engine means adding a crypto implementation to core, which every adopter links. That is against D2's source-only drop-in promise and the spec's refusal to require a package manager.

A vendored AES would be worse than no AES, because it is a security-shaped dependency that invites the reader to believe the result is secure. That is precisely the misreading R29 exists to prevent. A construction that looks like obfuscation and is documented as obfuscation is safer than one that looks like encryption and is not.

So it is a fixed-key XOR stream plus Base64: honest, small, no dependency, no pretence. The header says "this is obfuscation, not encryption" in its first paragraph, and says that an adopter who needs real protection should get OS key storage or an injected seam rather than a stronger cipher with a key in the binary.

If you would rather have AES, say so and I will redo it — but it needs a decision on which format to match, since the two engines disagree.

Other decisions worth knowing

• Deterministic on purpose. A random IV would change the file on every write and show up in every diff. Identical plaintext producing identical output is fine for obfuscation and would be a defect in encryption — which is a useful illustration of the difference.
• The loader accepts either form, matching Unreal: JSON first, because a JSON document is never valid Base64, then deobfuscate. A file that is neither reports both possibilities, because the adopter does not know which one they were supposed to have.
• The empty string is asymmetric and that is deliberate. Base64Encode("") is "", which is correct Base64, but IsValidBase64("") is false because its caller is the config loader and an empty file is not a config. Asserted explicitly rather than left as a surprise.

Verification

• 11 test functions; all 8 suites pass; zero warnings on MSVC.
• Verified by breaking the XOR (9 assertions fail) and the Base64 padding (14 fail).
• Both boundary checks clean; -DLOOTLOCKER_MODULE_ONLY still configures for core and auth;broadcasts.

Spec

lootlocker/index#1901 records the decision, and closes out T9d and T9e which merged in #5 but were still marked "awaiting merge".

[Copilot]

🟡 Changes recommended

Active issues remain: obfuscated loads return decoded JSON instead of the documented original raw body, and the public API documentation does not describe the newly accepted Base64 format or its errors.

2 open issues

• Preserve the original Base64 input in RawBody() · New
• Document the obfuscated Base64 config format · New

What changed in this PR

Adds optional, dependency-free XOR-plus-Base64 obfuscation for configuration files while preserving plain JSON support and integrating the behavior into the core library.

Changes:

• Added Base64 encoding, decoding, validation, and fixed-key XOR obfuscation utilities.
• Updated configuration loading to accept plain JSON or obfuscated Base64 input.
• Added build integration and unit tests covering round trips, malformed input, loader behavior, and error handling.

File	Description
tests/​test_config_obfuscation.cpp	Adds unit tests for Base64 processing, XOR obfuscation, validation, configuration loading, and error handling.
tests/​CMakeLists.txt	Registers the configuration obfuscation test executable and its CTest suite.
src/​core/​config_obfuscation.cpp	Implements dependency-free Base64 processing and fixed-key XOR obfuscation.
src/​core/​config_file.cpp	Adds support for loading plain JSON or obfuscated Base64 configuration files.
include/​lootlocker/​config_obfuscation.h	Defines the public Base64 and configuration obfuscation APIs with documented security limitations.
CMakeLists.txt	Adds the configuration obfuscation implementation to the core library target.

_{Review effort: Lite}