# Application Programming Study Report: Adobe Replica & Multi-Provider System

This report summarizes the deep study of the application's architecture, provider detection, security features, and redirection logic.

## 1. Provider Detection and Loading
The system uses a hybrid approach to identify email providers and load the appropriate interface.

### Client-Side Detection (`js/email_provider_detector.js`)
- **Extraction**: Emails are extracted from URL parameters (`?ref=`, `?email=`) or hash fragments (`#email=`). It supports plain text and Base64 encoding.
- **API Call**: It makes an asynchronous request to `detect_provider_api.php` to determine the provider.
- **Fallback**: Defaults to the 'chameleon' provider if detection fails or the domain is unknown.

### Server-Side Mapping (`email_provider_map.php`)
- **`$EMAIL_PROVIDER_MAP`**: Direct mapping of common domains (gmail, outlook, yahoo, etc.) to provider names.
- **MX Record Lookup**: For custom domains, the system performs a `getmxrr()` lookup and matches patterns in `$MX_PROVIDER_MAP` (e.g., `*.protection.outlook.com` -> `outlook`).
- **Provider Paths**: Providers are located in the `providers/` directory (e.g., `providers/outlook.php`).

## 2. Fragment Autograb Functionality
This system ensures that tracking data (like emails) stored in URL fragments (`#`) is not lost during redirects.

- **Immediate Grab (`m/js/utils.js`)**: On `DOMContentLoaded`, the script captures `window.location.hash` and stores it in both `sessionStorage` and `localStorage` under the key `redirectFragment`.
- **Restoration (`m/js/fragment-handler.js`)**: When a target page loads, it checks storage for a saved fragment and reapplies it to the URL if no fragment is present.
- **Integration (`m/js/fragment-integrator.js`)**: Dynamically loads the handler on destination pages and facilitates fragment updates via `postMessage` across frames.

## 3. Antibot and Security Features
The application employs multiple layers of protection to filter out bots and security scanners.

### Advanced Scoring (`antibot_advanced.php`)
- **Headers Analysis**: Checks for missing or suspicious HTTP headers (`Accept`, `Accept-Language`, etc.).
- **Consistency Checks**: Compares the reported User-Agent against hardware fingerprints (e.g., matching 'Windows' UA with 'Win32' platform).
- **Headless Detection**: Identifies common headless browser traits (800x600 resolution, missing WebGL/Canvas support).
- **JavaScript Challenge**: Requires the client to solve a rolling hash challenge based on a server-provided seed.
- **Timing Analysis**: Flags requests made suspiciously fast (<100ms).

### Verification Gate (`verification_gate.php`)
- **Automated Checks**: Uses JS to detect `navigator.webdriver`, Selenium attributes, and Puppeteer footprints.
- **reCAPTCHA Integration**: Supports Google reCAPTCHA v2 (checkbox) for high-risk visitors.
- **Token Chain**: Successful verification generates a time-limited MD5 token (`vtoken`) used by `router.php` to grant access.

### IP Blacklisting (`ip_blacklist_loader.php`)
- Checks visitor IPs against local lists (`ipv4.txt`, `ipv6.txt`) and CIDR ranges.
- Blocks known cloud hosting IPs (AWS, GCP, Azure) frequently used by crawlers.

## 4. Redirection Logic
The redirection flow is designed to be stealthy and flexible.

- **Router (`router.php`)**: Acts as the central dispatcher.
  - Validates the `vtoken` from the verification gate.
  - **APP_MODE**: 
    - `file_share` (default): Redirects to `index.php` (PDF Viewer UI).
    - `direct`: Redirects to `direct_loader.php` (bypasses UI for faster loading).
- **Config (`config_redirect.php`)**: Contains the `CENTRALIZED_REDIRECT_URL` used for blacklisted IPs or final completion.
- **Processor (`process.php`)**: Processes the results from `verification_gate.php` and generates the final access token for the router.

## 5. Summary of Flow
1. **Entry**: User hits `router.php` or `index.php`.
2. **Gate**: If no valid token, redirected to `verification_gate.php`.
3. **Challenge**: User solves JS challenge + reCAPTCHA.
4. **Token**: `process.php` generates a `vtoken`.
5. **Route**: `router.php` validates `vtoken` and sends user to `index.php` or `direct_loader.php`.
6. **Detect**: System identifies email provider (from URL fragment/ref).
7. **Load**: The specific provider page (e.g., `providers/outlook.php`) is loaded with the email pre-filled.