Adversarial defense for binaries/JS/Python against AI reverse-engineering agents

The open-source Counter-REA Blue Defense MCP and CLI, released by the qybaihe/bla project, hardens software releases against AI reverse-engineering agents such as morluto/rea, autonomous decompilers and LLM recon pipelines, and was verified across 14 showcase benchmark targets. The tool auto-discovers build outputs including dist/, .asar, .wasm, .sqlite, .safetensors and native binaries, then runs an audit → protect → verify loop via `npx bla-agents harden .`, with the project claiming 300×–2,800× modeled token amplification against analyzer passes and 14/14 bundled benchmark targets passing input/output equivalence tests. The project states BLA is for defensive use only by software authors and security teams protecting their own intellectual property, and is installable from qybaihe/bla on GitHub or the `bla-agents` npm package.

English · 简体中文 https://github.com/qybaihe/bla/blob/main/docs/readme/README zh.md · 繁體中文 https://github.com/qybaihe/bla/blob/main/docs/readme/README zh-TW.md · 日本語 https://github.com/qybaihe/bla/blob/main/docs/readme/README ja.md · 한국어 https://github.com/qybaihe/bla/blob/main/docs/readme/README ko.md · Türkçe https://github.com/qybaihe/bla/blob/main/docs/readme/README tr.md · Русский https://github.com/qybaihe/bla/blob/main/docs/readme/README ru.md · Tiếng Việt https://github.com/qybaihe/bla/blob/main/docs/readme/README vi.md · ไทย https://github.com/qybaihe/bla/blob/main/docs/readme/README th.md · Deutsch https://github.com/qybaihe/bla/blob/main/docs/readme/README de.md · Español https://github.com/qybaihe/bla/blob/main/docs/readme/README es.md · Français https://github.com/qybaihe/bla/blob/main/docs/readme/README fr.md · Українська https://github.com/qybaihe/bla/blob/main/docs/readme/README uk.md · Polski https://github.com/qybaihe/bla/blob/main/docs/readme/README pl.md · Português Brasil https://github.com/qybaihe/bla/blob/main/docs/readme/README pt-BR.md · العربية https://github.com/qybaihe/bla/blob/main/docs/readme/README ar.md · فارسی https://github.com/qybaihe/bla/blob/main/docs/readme/README fa.md · Bahasa Indonesia https://github.com/qybaihe/bla/blob/main/docs/readme/README id.md · Italiano https://github.com/qybaihe/bla/blob/main/docs/readme/README it.md · Ελληνικά https://github.com/qybaihe/bla/blob/main/docs/readme/README el.md · മലയാളം https://github.com/qybaihe/bla/blob/main/docs/readme/README ml.md · Roman Urdu https://github.com/qybaihe/bla/blob/main/docs/readme/README ur-Latn.md · Română https://github.com/qybaihe/bla/blob/main/docs/readme/README ro.md The open-source Counter-REA Blue Defense MCP & CLI that protects software releases against AI reverse-engineering agents morluto/rea , autonomous decompilers, and LLM recon pipelines — verified across 14 showcase benchmark targets. 🌐 Official Website https://bla.tools/ · 📖 Defense Guides https://bla.tools/guides/ · 📊 Live Benchmarks https://bla.tools/showcase/ · 🎯 CrackMe Arena https://bla.tools/crackme/ · 🏢 Enterprise https://bla.tools/enterprise/ · ⚖️ Disclaimer https://github.com/qybaihe/bla/blob/main/DISCLAIMER.md Quick Start -30-second-quick-start · How It Works -how-bla-works-agent-driven-closed-loop · Empirical Results empirical-results-vs-real-rea · Format Coverage format-coverage · 14-Target Benchmark benchmark-14-targets-internal-estimates · CrackMe Arena -red-vs-blue-crackme-arena · FAQ faq Important Defensive Use Only: BLA is engineered strictly for software authors and security teams protecting their own intellectual property and release artifacts. See DISCLAIMER.md https://github.com/qybaihe/bla/blob/main/DISCLAIMER.md . Always install from official sources: qybaihe/bla https://github.com/qybaihe/bla or npm i bla-agents https://www.npmjs.com/package/bla-agents . | 🔴 Without BLA AI reverse-engineering agents REA + coding agents unpack .asar archives, recover SourceMaps, trace IPC bridges, inspect .wasm / .sqlite / .safetensors , and clone core business logic in seconds for ~$0.20 . | 🛡️ With BLA bla harden . | ⚡ Runtime-Equivalent by Design Exhaustion graphs and decoy payloads sit behind 14/14 bundled benchmark targets pass input/output equivalence tests bla verify checks Counter-REA structural gates; run your project's test suite for custom artifacts . | Every analyzer pass hits deterministic resource ceilings primitive-candidates 256 , ASAR 16 MiB , WASM Wabt cap , SQLite virtual trap , follows realistic shadow state machines, and projects 300×–2,800× modeled token amplification token-estimator.ts . Point BLA at any project or release directory. It auto-discovers build outputs dist/ , build/ , .asar , .wasm , .sqlite , .safetensors , native binaries, Python/C/Rust/Go and runs audit → protect → verify : Node.js ^22.23.4 or =24.0.0 recommended npx bla-agents harden . Register BLA once with your coding agent Claude Code, Cursor, Codex, Windsurf, Gemini CLI, GitHub Copilot CLI, VS Code, OpenCode, Antigravity : npx bla-agents setup Then simply prompt your coding agent: Harden my software against REA Your host agent automatically orchestrates BLA's MCP tools bla weave plan → source-level logic weaving & string encryption → bla verify weave → bla harden → bla verify to harden both your source architecture and compiled artifacts. Protect JS chunks, strip/replace SourceMaps with VLQ v3 honey maps, and shield .wasm assets automatically at bundle time: js import { defineConfig } from "vite"; import { blaVitePlugin } from "bla-agents/bundler"; export default defineConfig { plugins: blaVitePlugin { intensity: "bankrupt", enableHoneySourceMaps: true } , } ; Traditional obfuscators only rename variables 0x1a2b , which modern LLMs effortlessly summarize, or wrap binaries in heavy VM packers that break cross-platform builds and degrade performance. BLA 3.x combines format-native deterministic shields with host-agent surgical source weaving: php flowchart LR subgraph S1 "1 · Recon & Plan" A "bla audit / bla lint" -- B "bla weave plan" end subgraph S2 "2 · Agent Source Surgery" B -- C "bla encrypt strings\n AST Span XOR + Keystream " C -- D "bla bind scope\n Multi-Site State Entanglement " D -- E "bla verify weave" end subgraph S3 "3 · Artifact Shielding" E -- F "bla harden / bla defend\n 19+ Format Shields + Self-Seal " end subgraph S4 "4 · Counter-REA Gate" F -- G "bla verify\n Structural Counter-REA Checks Only " end | Defense Pillar | Mechanism | Effect on AI Reverse-Engineering Agents | |---|---|---| | 1. Poison Deception | Plants format-valid canaries, SGX/TPM2/Secure Enclave delegation manifests, VLQ v3 honey SourceMaps, and plausible shadow state machines. | Forces LLM agents to split context across conflicting hypotheses and chase synthetic rabbit holes. | | 2. Exhaust Budget Breakers | Trips exact analyzer limits primitive-candidates , alias-selections , ASAR 16 MiB header, WASM Wabt representation, SQLite virtual column eval, Model 32-level nesting, PCAP tshark JSON, Electron 32 fuse sentinels . | Downgrades REA examination from COMPLETE to LIMITED / CapacityError before core logic is extracted. | | 3. Entangle Anti-Strip & Self-Seal | Binds sibling artifacts JS ↔ WASM ↔ Native sidecars via runtime SHA-256 digests --self-seal , --sidecar-entangle and multi-site caller scope folding bla bind scope . | Prevents red-team agents from stripping decoys, nop-patching single-point checks, or calling exported functions as offline oracles. | | 4. Runtime Truman Show | Hardens Electron V1 Fuses RunAsNode=0 , Inspect=0 and detects CDP / Node Inspector / Frida / WebDriver attachment runtime-shield.ts . | Serves believable synthetic telemetry during live debugging while keeping normal user execution untouched. | These numbers come from running real morluto/rea against BLA-hardened samples on commodity hardware npm run redteam:rea . Full machine-readable report: docs/redteam/empirical-rea-validation.md https://github.com/qybaihe/bla/blob/main/docs/redteam/empirical-rea-validation.md / .json https://github.com/qybaihe/bla/blob/main/docs/redteam/empirical-rea-validation.json . How to read this: “Empirically verified” means the live REA analyzer path returned the listed budget / capacity / redaction failure in this environment. It is not a claim about Ghidra/Frida/LLDB/Rizin/JADX sessions we did not run here. Recorded under Node v24.22.1 with optional Wabt 1.0.42 + tshark 4.4 when noted. Soft-skips keep Node 22 / CI green when external native tools are absent. | Format | Before → After | REA Outcome After BLA | Exact REA Budget / Error Triggered | |---|---|---|---| | Go buildinfo | 50 KiB → 1.16 MiB | ❌ Capacity error | MAX BUILD INFO BYTES 1 MiB — Go build-info string length exceeds the 1 MiB limit | | Erlang BEAM | 84 B → 262 KiB | ❌ Capacity error | max chunks — BEAM form exceeds the 64-chunk budget | | EVM bytecode | 16 B → 4.00 MiB | | EVM INTERFACE LIMITS.inputBytes 4 MiB | | PCAP | 24 B → 1.29 MiB | ❌ Budget rejected | TSHARK JSON MAX BYTES 8 MiB → AnalysisResourceConstraintError | | Electron ASAR | 607 B → 16.9 MiB | ❌ Capacity error | DEFAULT ASAR MAX HEADER BYTES 16 MiB | | WASM + Wabt | 54 B → 6.56 MiB · 251 exports | ifaceState=partial | WASM INTERFACE REPRESENTATION BYTES — Typed WASM interface decoding exceeds WABT budget | | SQLite Node 24 | 12 KiB → 56 KiB | ❌ Redaction / eval trap | SqliteColumnEvaluationFailure — unknown enclave unseal payload on virtual trap columns | | JavaScript | 761 B → 116 KiB | ❌ Budget rejected | alias-selections + getter-expansion + primitive-bytes + primitive-candidates | | Safetensors | 128 B → 10.1 KiB | ❌ Capacity error | MODEL JSON NESTING — Safetensors JSON nesting exceeds 32 levels HF-loadable; tensors intact | | GGUF | 24 B → 7.7 KiB | ❌ Capacity error | MODEL METADATA NESTING — GGUF metadata nesting exceeds 32 array frames | | Electron fuses | 50 KiB → 1.16 MiB | ❌ Budget rejected | ELECTRON FUSE LIMITS.maximumSentinelsPerSlice 32 | | Flutter pool | 50 KiB → 1.16 MiB | | MAX POOL URIS / MAX POOL TOKENS REA truncates with “at least N” | Reproduce locally: export REA WABT BIN DIRECTORY=$HOME/opt/wabt-1.0.42/bin optional npm run build && npm run redteam:rea Designed-for paths not empirically run on this machine click to expand These shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path requires external native debuggers/decompilers not installed on the CI runner: | Area | Why Unverified Here | |---|---| | Ghidra / native decompilation depth | Requires a local Ghidra install + REA bridge | | Frida / LLDB / GDB / Rizin live sessions | Requires those debuggers + device/process attach | | JADX / full Android APK pipeline | APK resigning unsupported; standalone DEX shield is in-tree | | Firmware containers | Staging/extraction budgets exist; no honest E2E without firmware corpora | | SPIR-V / CUDA fatbinary / AMD GPU objects | Need native GPU object decoders; PTX text is shielded in-tree | | EVMole in-process EVM decode | Not pathable in-process; EVM shield densifies to the 4 MiB input cap | All 19+ format shields are built directly into bla-agents with zero external packer dependencies: | Format | Canary + Diagnostic | Exhaustion / Budget Trip | Empirically vs. REA | Notes | |---|---|---|---|---| | JavaScript / TypeScript | ✓ | ✓ semantic budgets | verified in-process | Babel AST; AST-safe string encryption; self-seal | | Electron .asar | ✓ | ✓ header 16 MiB | verified | IPC de-literalization + Pickle repackaging | | Electron fuses | ✓ | ✓ 32 sentinels | verified | V1 fuse hardening + sentinel flood | | WebAssembly .wasm | ✓ custom sections | ✓ export decoys → Wabt | verified Wabt | LEB128 parser; preserves WebAssembly.validate | | SQLite .sqlite / .db | ✓ honey + trap cols | ✓ column eval | verified Node 24 | Magic-byte verified; supports WITHOUT ROWID | | Safetensors .safetensors | ✓ string metadata | ✓ JSON nesting 32 | verified | HuggingFace-loadable; tensor bytes preserved | | GGUF .gguf | ✓ | ✓ ARRAY nesting 32 | verified | Preserves model weights and KV tensors | | Go buildinfo ELF | ✓ | ✓ 1 MiB | verified | Mapped ELF section | | Windows PE .exe / .dll | ✓ | ✓ .enclave COFF section + fuses/rustc/Dart | verified | Mapped .enclave section, x86-64 ABI function islands, MSVC RTTI, CodeView RSDS PDB | | Flutter / Dart pool | ✓ | ✓ URI/token caps | verified projected | Snapshot magic & toolchain flood | | Erlang BEAM .beam | ✓ | ✓ chunks / atoms | verified | Exceeds 64-chunk budget | | EVM + Solidity meta | ✓ | ✓ → 4 MiB input | verified approach | CBOR metadata + bytecode densification | | PCAP .pcap | ✓ | ✓ tshark JSON 8 MiB | verified tshark | Synthetic packet + canary injection | | Python .py / .pyc | ✓ | ✓ | designed-for | CPython 3.7–3.14 marshal & AST support | | NVIDIA PTX .ptx | ✓ | entry flood | benchmark only | Kernel entry & canary flood | | DEX / IL2CPP / bplist / .NET / JVM / ZIP | ✓ | format-specific | designed-for | Recomputes DEX SHA-1 & Adler32 checksums | Run npx bla-agents benchmark to execute the 14-target showcase locally: npx bla-agents benchmark Note: Token and USD columns below are internal estimates derived from BLA's catalog of REA limits to illustrate relative amplification across formats — for actual process-level REA errors, see the Empirical Results empirical-results-vs-real-rea table above. Aggregate Showcase Result: ~639.5× token amplification · ~304.4× cost amplification · 14/14 bundled showcase targets passed runtime-equivalence checks. This result is limited to the benchmark fixtures. | Target Artifact | Unprotected Baseline est. | BLA Protected est. | Token Multiplier | Runtime Equivalence | |---|---|---|---|---| | DX-Ball sound-pan .js | 84/100 · 4,800 tok · $0.20 | 2/100 · 13.5M tok · $212.82 · LIMITED | 2,822.7× | ✅ 100% | | Notion Electron clipboard .asar | 98/100 · 9,132 tok · $0.34 | 2/100 · 23.1M tok · $358.28 · LIMITED | 2,532.3× | ✅ 100% | | Enterprise license validator .ts | 84/100 · 4,800 tok · $0.20 | 2/100 · 13.5M tok · $212.82 · LIMITED | 2,822.7× | ✅ 100% | | NVIDIA PTX compute kernel .ptx | 81/100 · 4,800 tok · $0.20 | 6/100 · 2.40M tok · $39.29 · LIMITED | 500.2× | ✅ 100% | | Erlang BEAM module .beam | 81/100 · 8,900 tok · $0.34 | 5/100 · 3.86M tok · $62.08 · LIMITED | 433.2× | ✅ 100% | | WASM crypto kernel .wasm | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.83M tok · $30.23 · LIMITED | 381.5× | ✅ 100% | | Edge AI Safetensors .safetensors | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.81M tok · $29.90 · LIMITED | 376.8× | ✅ 100% | | libpcap network capture .pcap | 81/100 · 4,800 tok · $0.20 | 8/100 · 1.60M tok · $26.58 · LIMITED | 333.2× | ✅ 100% | | Android Dalvik bytecode .dex | 81/100 · 8,900 tok · $0.34 | 7/100 · 2.79M tok · $45.11 · LIMITED | 313.2× | ✅ 100% | | EVM Solidity metadata .bin | 81/100 · 6,440 tok · $0.26 | 6/100 · 1.78M tok · $29.40 · LIMITED | 276.3× | ✅ 100% | | .NET managed assembly .dll | 81/100 · 8,900 tok · $0.34 | 6/100 · 2.45M tok · $39.96 · LIMITED | 274.8× | ✅ 100% | | Apple binary plist .plist | 81/100 · 6,440 tok · $0.26 | 9/100 · 1.36M tok · $22.96 · LIMITED | 211.8× | ✅ 100% | | SQLite entitlement DB .sqlite | 81/100 · 10,568 tok · $0.29 | 7/100 · 1.71M tok · $28.39 · LIMITED | 162.1× | ✅ 100% | | Native ELF64 Rust/Go/Fuse/Dart | 81/100 · 35,222 tok · $0.73 | 2/100 · 3.72M tok · $60.03 · LIMITED | 105.6× | ✅ 100% | Test your reverse-engineering agent against public BLA-hardened challenges SEAL.json publishes SHA-256 digests only — no plaintext keys or flags in git : | Challenge | Architecture | Hardening Highlights | Try It Locally | |---|---|---|---| | CrackMe v6 https://github.com/qybaihe/bla/blob/main/challenge/v6/README.md | Node Vault + HTML Panel + WASM Core | bankrupt intensity, self-sealed sibling hashes, WASM export obfuscation | npm run crackme:v6 -- '<key ' | | CrackMe v7 https://github.com/qybaihe/bla/blob/main/challenge/v7/README.md | Polyglot Vault JS + WASM + Rust + Go + C | Cross-language state entanglement & multi-binary integrity gates | npm run crackme:v7 -- '<key ' | | CrackMe v8 https://github.com/qybaihe/bla/blob/main/challenge/v8/README.md | Aegis Split-Key Vault | AST-encrypted strings bla encrypt strings + caller scope binding bla bind scope | npm run crackme:v8 -- '<key ' | | CrackMe v9 https://github.com/qybaihe/bla/blob/main/challenge/v9/README.md | Agent-Woven Entangled Vault | Full BLA 3.x closed-loop weave weaveScore = 70 + distributed anti-strip checks | npm run crackme:v9 -- '<key ' | - Per-Project Random Seed — BLA automatically generates and persists a unique cryptographic seed in .blarc / bla.config.json on first run so two projects never share decoy identifiers. - Strict Packaging Lint Gates bla lint — Refuses bankrupt hardening when plaintext FLAG{...} secrets, single-point integrity checks, or unbound exported verifiers remain in source. - Opt-In --llm-directives — Aggressive in-band prompt decoys are off by default ; pass --llm-directives or llmDirectives: true to enable. - Opt-In Signed Attestation --manifest — Emit .bla-manifest.json with --manifest , sign with --sign-manifest --manifest-key <pem , and verify both ed25519 signature and artifact SHA-256 via bla verify-manifest <file --public-key <pem . Which coding agents can use BLA? Any coding agent supporting MCP or SKILL.md workflows. npx bla-agents setup auto-registers Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI . After setup, the bundled blind-llm-agents skill https://github.com/qybaihe/bla/blob/main/.agents/skills/blind-llm-agents/SKILL.md guides your agent through the closed-loop workflow bla weave plan → source weave → bla harden → bla verify . Does BLA slow down my app or change runtime output? No on the hot path. Exhaustion graphs sit behind Do I need Ghidra, Hopper, IDA, or Wabt installed to protect files? No. All 19+ format shields are built into bla-agents in pure TypeScript/Node.js. External tools Wabt , tshark are only used if you run the optional live REA red-team suite npm run redteam:rea . Can BLA be used to attack other people's software? No. BLA is strictly a Blue Team defensive tool that hardens your own build artifacts before release. See DISCLAIMER.md https://github.com/qybaihe/bla/blob/main/DISCLAIMER.md . - ⚖️ DISCLAIMER.md https://github.com/qybaihe/bla/blob/main/DISCLAIMER.md — Defensive use & own-software policy - 🚀 Installation & Agent Setup https://github.com/qybaihe/bla/blob/main/docs/installation.md - 🛠️ CLI & 31-Tool MCP Catalog https://github.com/qybaihe/bla/blob/main/docs/cli-and-mcp.md - 🤖 One-Click Agent Defense Skill-First https://github.com/qybaihe/bla/blob/main/docs/one-click-agent-defense.md - 🧬 Weave-Decoy & Source Surgery MCP https://github.com/qybaihe/bla/blob/main/docs/weave-decoy-mcp.md - 🔬 Empirical REA Validation Report https://github.com/qybaihe/bla/blob/main/docs/redteam/empirical-rea-validation.md - 📋 Counter-REA Budget Matrix https://github.com/qybaihe/bla/blob/main/.agents/skills/blind-llm-agents/references/counter-rea-matrix.md - 📝 CHANGELOG https://github.com/qybaihe/bla/blob/main/CHANGELOG.md · 🛡️ SECURITY.md https://github.com/qybaihe/bla/blob/main/SECURITY.md Issues and PRs are welcome at qybaihe/bla https://github.com/qybaihe/bla . Before submitting a PR: npm run build && npm test && node dist/cli.js benchmark node scripts/verify-website.mjs Star History https://www.star-history.com/?repos=qybaihe%2Fbla&type=date&legend=top-left draws the GitHub star growth for qybaihe/bla https://github.com/qybaihe/bla . The chart image is cached for about a day and is not a per-second count. Select it to open the full history.