Gamble Client
Sign in

Loader transparency

Trust the receipt.
Verify the loader.

Gamble’s standalone JAR is a small authenticated bootstrap. It downloads the protected client on each launch, verifies the signed artifact, and defines it directly in Fabric/Knot memory.

Checking signed production lineage…

Live release ledger

Signed at the source.

These records come from the production API and are verified in this browser against Gamble’s public Ed25519 key.

WINDOWS / X64Verifying…
Version
—
Release SHA-256
—
Core SHA-256
—
Source commit
—
LINUX / X86-64Verifying…
Version
—
Release SHA-256
—
Core SHA-256
—
Source commit
—
Signing key 617acff9930c4e68 Loading public key…

Private local check

Drop in your JAR.

Your file never leaves this browser. The verifier reads the embedded signed provenance, fingerprints every immutable loader entry, and checks that your personalized loader uses the released executable core.

  • Custom filename and mod-list name are allowed.
  • Custom icon and one-time enrollment are excluded from the core hash.
  • Loader classes and resources are included; native authorization code stays inside the verified client payload.

WAITING_FOR_FILE

No bytes have been read.

Scanner context

What the alerts actually mean.

Automated scanners are useful signals, not verdicts. We publish the exact findings instead of hiding the behavior that makes the memory loader work.

RATTER SCANNERWINDOWS 1.4.17 · SCAN 12152

0 high severity 1 static finding

054-bin · verified client download

The only match is the protected client download used for verified in-memory loading. Ratter's extra log marks that rule as non-obfuscation and shows no dynamic result, but its generic regex headline still calls the archive a RAT.

SPYGLASSWINDOWS 1.4.17

Limited indicators

25 flags across 9 files

The remaining categories map to authenticated upload/download traffic, Fabric/Knot reflection, local loader state, and system compatibility checks. The public Windows loader contains no native executable, script, subprocess, or shell-command payload.

01

Download

Gets the current authorized client after access and device checks.

02

Verify

Rejects payload bytes that do not match the server’s Ed25519-signed manifest and SHA-256.

03

Memory load

Defines verified classes into Fabric/Knot without dropping a client JAR or payload cache.

04

Runtime guard

Rechecks signed runtime policy after authorization. Its native library stays in the verified client payload, not the public loader JAR.

Plain-language limitation: A signature proves artifact identity and integrity; it does not ask you to blindly trust software. Keep your loader current, compare its signed core here, and treat unexpected signature failures as a stop condition.