Adversarial defense for binaries/JS/Python against AI reverse-engineering agents

English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română

BLA: Blind LLM Agents

Poison → Exhaust → Hallucinate. Make Reverse Engineering Bankrupt Again.

The open-source Counter-REA Blue Defense MCP & CLI that protects software releases against AI reverse-engineering agents (morluto/rea, autonomous decompilers, and LLM recon pipelines) — verified across 14 showcase benchmark targets.

🌐 Official Website · 📖 Defense Guides · 📊 Live Benchmarks · 🎯 CrackMe Arena · 🏢 Enterprise · ⚖️ Disclaimer

Quick Start · How It Works · Empirical Results · Format Coverage · 14-Target Benchmark · CrackMe Arena · FAQ

Defensive Use Only: BLA is engineered strictly for software authors and security teams protecting their own intellectual property and release artifacts. See DISCLAIMER.md. Always install from official sources: qybaihe/bla or npm i bla-agents.

🔴 Without BLA

AI reverse-engineering agents (REA + coding agents) unpack .asar archives, recover SourceMaps, trace IPC bridges, inspect .wasm / .sqlite / .safetensors, and clone core business logic in seconds for ~$0.20.

🛡️ With BLA (bla harden .)

Every analyzer pass hits deterministic resource ceilings (primitive-candidates > 256, ASAR > 16 MiB, WASM > Wabt cap, SQLite virtual trap), follows realistic shadow state machines, and projects 300×–2,800× modeled token amplification (token-estimator.ts).

⚡ Runtime-Equivalent by Design

Exhaustion graphs and decoy payloads sit behind $O(1)$ number-theoretic opaque predicates ($7x^2 - 1 \neq y^2 \pmod 7$) or inert format sections. 14/14 bundled benchmark targets pass input/output equivalence tests (bla verify checks Counter-REA structural gates; run your project's test suite for custom artifacts).

⚡ 30-Second Quick Start

1. One-Command CLI Hardening

Point BLA at any project or release directory. It auto-discovers build outputs (dist/, build/, .asar, .wasm, .sqlite, .safetensors, native binaries, Python/C/Rust/Go) and runs audit → protect → verify:

        # Node.js ^22.23.4 or >=24.0.0 recommended
npx bla-agents harden .
      

2. Agent-Driven Closed-Loop Defense (MCP + Skill)

Register BLA once with your coding agent (Claude Code, Cursor, Codex, Windsurf, Gemini CLI, GitHub Copilot CLI, VS Code, OpenCode, Antigravity):

        npx bla-agents setup
      

Then simply prompt your coding agent:

        Harden my software against REA
      

Your host agent automatically orchestrates BLA's MCP tools (bla_weave_plan → source-level logic weaving & string encryption → bla_verify_weave → bla_harden → bla_verify) to harden both your source architecture and compiled artifacts.

3. Build Bundler Plugin (Vite / Rollup / Webpack / esbuild)

Protect JS chunks, strip/replace SourceMaps with VLQ v3 honey maps, and shield .wasm assets automatically at bundle time:

        import { defineConfig } from "vite";
import { blaVitePlugin } from "bla-agents/bundler";

export default defineConfig({
  plugins: [blaVitePlugin({ intensity: "bankrupt", enableHoneySourceMaps: true })],
});
      

🧠 How BLA Works: Agent-Driven Closed Loop

Traditional obfuscators only rename variables (_0x1a2b), which modern LLMs effortlessly summarize, or wrap binaries in heavy VM packers that break cross-platform builds and degrade performance.

BLA 3.x combines format-native deterministic shields with host-agent surgical source weaving:

        flowchart LR
  subgraph S1["1 · Recon & Plan"]
    A["bla_audit / bla_lint"] --> B["bla_weave_plan"]
  end
  subgraph S2["2 · Agent Source Surgery"]
    B --> C["bla_encrypt_strings\n(AST Span XOR + Keystream)"]
    C --> D["bla_bind_scope\n(Multi-Site State Entanglement)"]
    D --> E["bla_verify_weave"]
  end
  subgraph S3["3 · Artifact Shielding"]
    E --> F["bla_harden / bla_defend\n(19+ Format Shields + Self-Seal)"]
  end
  subgraph S4["4 · Counter-REA Gate"]
    F --> G["bla_verify\n(Structural Counter-REA Checks Only)"]
  end
      

🔬 Empirical Results vs. Real REA

These numbers come from running real morluto/rea against BLA-hardened samples on commodity hardware (npm run redteam:rea). Full machine-readable report: docs/redteam/empirical-rea-validation.md / .json.

How to read this: “Empirically verified” means the live REA analyzer path returned the listed budget / capacity / redaction failure in this environment. It is not a claim about Ghidra/Frida/LLDB/Rizin/JADX sessions we did not run here.

Empirically Verified on Commodity Hardware

Recorded under Node v24.22.1 with optional Wabt 1.0.42 + tshark 4.4 when noted. Soft-skips keep Node 22 / CI green when external native tools are absent.

Reproduce locally:

        export REA_WABT_BIN_DIRECTORY=$HOME/opt/wabt-1.0.42/bin   # optional
npm run build && npm run redteam:rea
      

These shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path requires external native debuggers/decompilers not installed on the CI runner:

🛡️ Format Coverage

All 19+ format shields are built directly into bla-agents with zero external packer dependencies:

📊 Benchmark (14 Targets, Internal Estimates)

Run npx bla-agents benchmark to execute the 14-target showcase locally:

        npx bla-agents benchmark
      

Note: Token and USD columns below are internal estimates derived from BLA's catalog of REA limits to illustrate relative amplification across formats — for actual process-level REA errors, see the Empirical Results table above.

Aggregate Showcase Result: ~639.5× token amplification · ~304.4× cost amplification · 14/14 bundled showcase targets passed runtime-equivalence checks. This result is limited to the benchmark fixtures.

🎯 Red-vs-Blue CrackMe Arena

Test your reverse-engineering agent against public BLA-hardened challenges (SEAL.json publishes SHA-256 digests only — no plaintext keys or flags in git):

🔒 Security & Configuration Defaults

• Per-Project Random Seed — BLA automatically generates and persists a unique cryptographic seed in .blarc / bla.config.json on first run so two projects never share decoy identifiers.

• Strict Packaging Lint Gates (bla lint) — Refuses bankrupt hardening when plaintext FLAG{...} secrets, single-point integrity checks, or unbound exported verifiers remain in source.

• Opt-In --llm-directives — Aggressive in-band prompt decoys are off by default; pass --llm-directives (or llmDirectives: true) to enable.

• Opt-In Signed Attestation (--manifest) — Emit .bla-manifest.json with --manifest, sign with --sign-manifest --manifest-key <pem>, and verify both ed25519 signature and artifact SHA-256 via bla verify-manifest <file> --public-key <pem>.

❓ FAQ

Any coding agent supporting MCP or SKILL.md workflows. npx bla-agents setup auto-registers Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. After setup, the bundled blind-llm-agents skill guides your agent through the closed-loop workflow (bla_weave_plan → source weave → bla_harden → bla_verify).

No on the hot path. Exhaustion graphs sit behind $O(1)$ number-theoretic opaque predicates, and binary/model/database decoys live in inert metadata or honey tables. Every benchmark target verifies 100% input/output equivalence against the original build.

No. All 19+ format shields are built into bla-agents in pure TypeScript/Node.js. External tools (Wabt, tshark) are only used if you run the optional live REA red-team suite (npm run redteam:rea).

No. BLA is strictly a Blue Team defensive tool that hardens your own build artifacts before release. See DISCLAIMER.md.

📚 Documentation & Links

• ⚖️ DISCLAIMER.md — Defensive use & own-software policy

• 🚀 Installation & Agent Setup

• 🛠️ CLI & 31-Tool MCP Catalog

• 🤖 One-Click Agent Defense (Skill-First)

• 🧬 Weave-Decoy & Source Surgery MCP

• 🔬 Empirical REA Validation Report

• 📋 Counter-REA Budget Matrix

• 📝 CHANGELOG · 🛡️ SECURITY.md

🤝 Contributing & Community

Issues and PRs are welcome at qybaihe/bla. Before submitting a PR:

        npm run build && npm test && node dist/cli.js benchmark
node scripts/verify-website.mjs
      

• 🎯 Public BLA CrackMe Arena (challenge/v6 – v9)

• 💬 LINUX DO (linux.do) — 新的理想型社区

📄 License

Star history

Star History draws the GitHub star growth for qybaihe/bla. The chart image is cached for about a day and is not a per-second count. Select it to open the full history.