API Reference

This is the internal protocol between the VisionCheats loader and our backend. All endpoints, all encryption and all session logic are owned and operated by us, no third-party services.

Base URL

https://backend.VisionCheats.xyz/v1

Authentication

Every request (except /ping) requires a valid session token obtained from /session/open. The token is sent as a bearer header.

Token Header

Authorization: Bearer <session_token>
X-Machine-ID:  <machine_token_hash>
Content-Type:  application/json

Token Lifecycle

Request Flow

Full sequence from loader start to menu execution.

// 1. Loader derives machine token
hash = HMAC_SHA256("vm-salt-v1" + cpu_id + disk_id)

// 2. Open session
POST /v1/session/open
{ "machine": "<hash>", "loader_ver": "2.1" }
// ← { "token": "...", "expires_at": 1234567890 }

// 3. Fetch encrypted build
GET  /v1/build/latest
Authorization: Bearer <token>
// ← binary blob (AES-256-GCM, IV prepended)

// 4. Decrypt in memory
key  = PBKDF2(machine_hash + token, salt, 100000)
data = AES256GCM_Decrypt(blob, key)

// 5. Map to process memory & execute
MapViewOfFile → inject → menu live

Encryption

The build payload is encrypted server-side before dispatch. Only a loader with the correct machine token can derive the decryption key.

POST  /session/open

Opens an authenticated session for a loader instance. Returns a session token used for all subsequent requests.

Request Body

POST /v1/session/open HTTP/1.1
Host: backend.VisionCheats.xyz
Content-Type: application/json

{
  "machine":    "a3f8c12d...e7b091",
  "loader_ver": "2.1",
  "timestamp":  1725100000
}

Response

{
  "token":      "vm_sess_eyJhbGciOiJIUzI1NiJ9...",
  "expires_at": 1725186400,
  "build":      49387
}

Status Codes

GET  /build/latest

Returns the current encrypted build as a binary payload. The loader decrypts it in memory using the session-derived key.

GET /v1/build/latest HTTP/1.1
Host:          backend.VisionCheats.xyz
Authorization: Bearer vm_sess_eyJhbGciOiJIUzI1NiJ9...
X-Machine-ID:  a3f8c12d...e7b091

Response Headers

Content-Type:   application/octet-stream
X-Build:        49387
X-Payload-Size: 1241088
X-IV:          <12-byte IV, base64>

Payload Structure

[ 12 bytes IV ][ AES-256-GCM ciphertext ][ 16 bytes auth tag ]

Status Codes

GET  /ping

Unauthenticated health check. Use before opening a session to verify backend reachability.

GET /v1/ping HTTP/1.1
Host: backend.VisionCheats.xyz

Response

{
  "status": "ok",
  "build":  49387,
  "ts":     1725100042
}

POST  /session/verify

Checks whether an existing session token is still valid without consuming rate limit. Use for re-launch without re-authenticating.

POST /v1/session/verify HTTP/1.1
Authorization: Bearer <token>

{ "machine": "a3f8c12d...e7b091" }

Response

{
  "valid":      true,
  "expires_at": 1725186400,
  "build":      49387
}

Error Codes

All errors return JSON with a code and human-readable message.

{
  "error": {
    "code":    "MACHINE_BANNED",
    "message": "This machine has been permanently banned.",
    "status":  403
  }
}

Rate Limits

Limits are per machine token and reset on a rolling window.

Changelog