APX Tool review summary

Found high-risk device security functions in the project UI/code:
- FRP erase/remove
- MiCloud reset/disable
- IMEI write/change/repair
- RPMB read/write/erase
- Auth bypass
- bootloader unlock operations

I did not fix, complete, or provide server support for those features.
This package only provides a safe license/login server and client notes.

Bugs found in current login/server logic:
1) LoginPage calls UserReg.Check00("", email, password), so HWID is blank.
   Fix: UserReg.Check00(MyHWID, UserText.Text, PassText.Text)
2) Hardcoded old domain appears in many places.
   Use one API_BASE constant for license endpoints.
3) Password is saved in config.ini as plaintext.
   Safer: do not save password, or use Windows DPAPI if you must save it.
4) Server response spelling is "sucsess" and "filed".
   I kept these misspellings in PHP so your existing client keeps working.
5) Anti-debug code kills Task Manager and other processes.
   This causes false positives and bad user experience. Remove it for a clean commercial app.
6) Some requests use POST with no body just to read data.
   License endpoints are okay with POST; static/model downloads should use GET and checksum verification.
7) No TLS pinning/signature validation in the old client.
   Add HMAC signatures for update packages and verify SHA-256 before applying updates.

Install:
1) Create MySQL database and import sql/schema.sql.
2) Upload api/*.php to https://your-domain.com/api/.
3) Edit api/config.php database credentials and APP_SECRET.
4) Create a user by POSTing to /api/create_user.php with X-Admin-Secret header.
5) Patch UserReg.vb URLs to your API_BASE.