# Heartbeat interval used by the DLL.
HeartbeatSeconds=5

# 1 = server sends KICK after an alert. 0 = log only.
KickOnAlert=1

# Only this ItzyGuard.dll client version is allowed.
# Increase this when you want to force players to update their client guard.
RequiredClientVersion=0.2.0

# Extra client-side checks sent by the guard server.
# VM check is optional because many legitimate test/live environments can be virtualized.
CheckMainText=0
CheckMainFile=1
CheckSpeedhack=1
CheckVirtualMachine=0

# ProcessScanner: collect process telemetry, review unknown hashes, and optionally enforce blocked hashes.
ProcessScannerEnabled=1
ProcessAutoClassify=1
AiProcessAnalysisEnabled=1
AiProcessModel=gpt-4.1-nano
AiAutoApplySafe=1
AiAutoApplySuspicious=1
AiAutoReviewBatchSize=5
# AI never auto-applies Blocked. Use the ProcessScanner review window to confirm blocked hashes.
KickOnBlockedProcess=1
LogSafeProcesses=0
ProcessLogRetentionDays=30

# main.exe may apply legitimate startup patches/hooks after the DLL is loaded.
# After this warmup, .text changes are reported for investigation.
MainTextWarmupSeconds=30
# Keep this off unless your exact client build has been proven stable across normal player PCs.
# A memory-only .text change can be caused by antivirus, EDR, overlays, or delayed client patches.
StrikeOnMainTextModified=0
# Temp/AppData module DLLs can be created by protectors, launchers, overlays, or EDR products.
# Keep this off unless your exact client/launcher stack has been proven clean and stable.
StrikeOnSuspiciousModulePath=0

# Strike system: if the same HWID/IP is detected this many times inside the window, it is treated as a permanent ban.
StrikeBanThreshold=3
StrikeWindowHours=24

# Minimum time the client splash stays visible during startup checks.
# 3000 = 3 seconds. Set 0 to close it as soon as checks finish.
[Splash]
MinimumVisibleMs=3000

# Reconnect window used after the client was already accepted by the guard server.
# If the guard server restarts, the DLL retries instead of closing the game instantly.
# Set ReconnectGraceSeconds=0 to restore instant fail-closed behavior.
[Network]
ListenPort=55999
ReconnectGraceSeconds=60
ReconnectRetrySeconds=5

# Local Fast Flood Mitigation protects GuardServer before authentication and can
# monitor GameServer/ConnectServer TCP ports without source code or client hooks.
# Run ItzyGuardServer as Administrator for WFP kernel DROP. Without that permission,
# the internal GuardServer accept gate remains active automatically.
# Restart ItzyGuardServer after changing any FastFlood setting.
FastFloodMitigationEnabled=1
FastFloodKernelDropEnabled=1
FastFloodPreAuthTimeoutSeconds=5
FastFloodMaxPendingGlobal=256
FastFloodMaxPendingPerIp=16
FastFloodConnectionsPerSecond=12
FastFloodConnectionBurst=24
FastFloodBlockSeconds=300
# Change this comma-separated list if the server uses different public TCP ports.
FastFloodProtectedTcpPorts=55901,44405
FastFloodTcpPollMilliseconds=500
FastFloodMaxConnectionsPerIp=128
FastFloodMaxSynReceivedPerIp=24

# Pre-auth scan protection for RDP/HTTP/SSH probes that hit the guard port.
# The block is in-memory and resets when the guard server restarts.
ScanProtectionEnabled=1
ScanBlockThreshold=3
ScanWindowMinutes=10
ScanBlockMinutes=1440
ScanBlockUnknownPreAuth=1
ScanUnknownBlockThreshold=10
