Dissecting a web game to re implement the physics engine and train a neural network on it. This is Bonk.io , a simple browser game where you, a circle, try to knock other circles off of a map sumo style. I've been playing this game for a few years at this point and recently had the idea of trying to train a neural network to play the game. It should be interesting since despite looking simple, the

We are in a renaissance era of reverse engineering. Defenders are going to be on the back foot until we figure out some way to cope with LLM's. Recently I've been benchmarking my JavaScript code protection against the strongest Claude model. I'm up to 22 minutes (and 170k tokens) before it can crack a small protected sample open starting from 0 knowledge. ( More about the protection scheme here )

As it turns out they don't actually want you to do this (and have some interesting ways to stop you) How I bypassed Amazon’s Kindle web DRM | Hacker News This article hit #1 on Hacker News, thanks all! TL;DR I bought my first ebook from amazon Amazon's Kindle Android app was really buggy and crashed a bunch Tried to download my book to use with a functioning reader app Realized Amazon no longer le

I lied in the title, well, sort of. Nobody explicitly asked for this but the signs were always there. LLMs don't really serve the user Have you ever really watched someone interact with an LLM for the first time? They might try a few questions to see how smart it is, hooked on the promise that it is a new, somehow better, source of information. Then when the model regurgitates a few Wikipedia-esqu

Bypassing anti-debugging detection techniques when analysing potentially malicious websites, no matter the site. ⚠️ LibreWolf currently doesn't have devtools-bypass.patch enabled (the patch required for this to work) ⚠️ You can use this patcher I wrote which will modify your existing LibreWolf installation: librewolf-hotpatcher.py GitHub Gist: instantly share code, notes, and snippets. (slightly d

Analysing Pixelmelt's Javascript Virtualisation Obfuscation - A Research Study I was asked by my friend @PixelMelt to help out with a research project he was working on, focused on the analysis of a few JavaScript obfuscators. I happily agreed to take part and was asked to analyse one of three different obfuscators: Obfuscator.io : Likely the most common JavaScript obfuscator. JS-Confuser: A newer

A good VM is a constantly changing VM Linear disassembly Your disassembler goes through decoding every opcode in the bytecode linearly. Here is an example of where linear disassembly works VM Bytecode: 0, 4, 0, 6, 1 key generated or created by attacker: 0 = op_number, 1 subsequent num argument 1 = op_add Step through bytes linearly to disassemble: op_number, 4 op_number, 6 op_add Simple, but If th

Text obfuscation with no JavaScript? How? Here is an interesting anti scraping measure that was pointed out to me by a reddit post recently. Take a look at this displayed text and then the HTML content for that exact same text. Text content HTML content The HTML appears to be a random mess of characters, this must be some JavaScript trickery right? Nope! Even when disabling JavaScript on the web p

"a lot of vm's i worked on in the past would also exploit errors to force a catch execution to continue" - Draco Error-Driven Control Flow Obfuscation JavaScript exception handling can be exploited to create non-linear code flow that confuses analysis. Given you probably don't want to make the fact that the function or operation you called is always going to throw an error, as that makes it easier

Notes on virtualization obfuscation of JavaScript. The Nature of Code "Protection" Given that no protection is impossible to break by nature of how computers work. (they must be able to see instructions to execute them) All you can really do is abstract the way the program runs. Abstraction by Virtualization One way to abstract any given program is to virtualize the code, essentially (re)compiling

JavaScript quirks that can be used for obfuscation. Functions reading themselves Comments are included when a function reads itself Which lets you include arbitrary string data inside a comment and then use it in your program. Most websites that disallow obfuscated code will likely not have automated tools that check for this. Some deobfuscators unknowingly remove comments, permanently breaking th

Usage of branch encryption in various obfuscation contexts. Usage with virtualization based obfuscation Sources: Mesh design pattern: hash-and-decrypt - Archive loski2619 on the Sneaker Development Discord This technique prevents future states of a program from being known before they are reached. In a proper implementation, an attacker wouldn't be able to infer previous states of a program it has

Did it work well and is it useful in any way? No. Is it hilarious to mess around with and does it mimic them well? Yes. Do I need like a supercomputer or something for this? For this project I used a single RTX 3090 that has 24GB of vram, during training my vram sat at around 22GB of usage. I'm using linux so for the people running windows you might want to check how much vram your system is using