English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română

BLA: Blind LLM Agents

Make reverse engineering bankrupt again.

Point BLA at the build you ship. When an AI reverse-engineering agent (REA) opens it, the analyzer hits resource budgets, follows decoys, and burns tokens — while your users still get the same runtime behavior.

Website · Guides · Showcases · Disclaimer

Quick start · Empirical results · Format coverage · Benchmark · FAQ

bla harden .
# or tell your agent: "Harden my software against REA"

[!IMPORTANT] BLA is a defensive tool for protecting your own software. See DISCLAIMER.md. Get BLA from qybaihe/bla or npm bla-agents.

What BLA does

REA reverse-engineers release artifacts in one command. BLA is the Counter-REA half of that story:

| Layer | What happens | | --- | --- | | Poison | Plant format-valid canaries, honey metadata, and decoy control flow that look like real evidence. | | Exhaust | Push the artifact past REA's documented resource budgets (headers, nesting, interface inventories, PCAP JSON, fuse sentinels, …). | | Hallucinate | Leave the analyzer with truncated inventories, redaction failures, and ambiguous rabbit holes — while runtime stays equivalent. |

One sentence covers the common case (auto-discovers dist/ / build/ / .asar / .wasm / .sqlite / models / … and runs audit → protect → verify):

npx bla-agents harden .
# MCP / agent: bla_harden   ·   "Harden my software against REA"

Same pipeline as bla defend / bla_defend when you already know the path; harden is the default one-command UX.

Quick start

# Node.js ^22.23.4 or 24.x recommended (REA red-team needs zlib.zstd on 22.23+)
npx bla-agents setup          # register MCP + skill with your coding agent
npx bla-agents harden .       # one-command Counter-REA pass on the current project
npx bla-agents benchmark      # 14-target showcase (local estimates + runtime checks)

Ask your agent after setup (skill guides one-click harden):

Harden my software against REA

Or run stages explicitly: audit · protect · verify · defend — see one-click agent defense and CLI and MCP.

Empirical results vs real REA

These numbers come from running real REA against BLA-hardened samples on commodity hardware (npm run redteam:rea). Full machine-readable report: docs/redteam/empirical-rea-validation.md / .json.

How to read this: “Empirically verified” means the REA analyzer path actually returned the listed budget / capacity / redaction failure in this environment. It is not a claim about Ghidra/Frida/LLDB/Rizin/JADX sessions we did not run here.

Empirically verified on commodity hardware

Recorded under Node v24.22.1 with optional Wabt 1.0.42 + tshark 4.4 when noted. Soft-skips keep Node 22 / CI green when tooling is absent.

| Format | Before → after | REA outcome after BLA | Budget / error | | --- | ---: | --- | --- | | Go buildinfo | 50 KiB → 1.16 MiB | capacity error | MAX_BUILD_INFO_BYTES (1 MiB) — Go build-info string length exceeds the 1 MiB limit | | Erlang BEAM | 84 B → 262 KiB | capacity error | max_chunks — BEAM form exceeds the 64-chunk budget | | EVM bytecode | 16 B → 4.00 MiB | approaches full input cap | EVM_INTERFACE_LIMITS.inputBytes (4 MiB) | | PCAP | 24 B → 1.29 MiB | budget rejected | TSHARK_JSON_MAX_BYTES (>8 MiB) → AnalysisResourceConstraintError (tshark present) | | Electron ASAR | 607 B → 16.9 MiB | capacity error | DEFAULT_ASAR_MAX_HEADER_BYTES (16 MiB) | | WASM + Wabt | 54 B → 6.56 MiB · 251 exports | ifaceState=partial | WASM_INTERFACE_REPRESENTATION_BYTES — Typed WASM interface decoding exceeds the WABT output representation budget | | SQLite (Node 24) | 12 KiB → 56 KiB | redaction / column eval | SqliteColumnEvaluationFailure — unknown enclave_unseal_payload() on honey trap columns | | JavaScript | 761 B → 116 KiB | budget rejected | alias-selections + getter-expansion + primitive-bytes + primitive-candidates (real REA resourceLimits) | | Safetensors | 128 B → 10.1 KiB | capacity error | MODEL_JSON_NESTING — Safetensors JSON nesting exceeds 32 levels (HF-loadable; tensor bytes unchanged) | | GGUF | 24 B → 7.7 KiB | capacity error | MODEL_METADATA_NESTING — GGUF metadata nesting exceeds 32 array frames | | Electron fuses | 50 KiB → 1.16 MiB | budget rejected | ELECTRON_FUSE_LIMITS.maximumSentinelsPerSlice (>32) | | Flutter pool | 50 KiB → 1.16 MiB | projected cap | MAX_POOL_URIS / MAX_POOL_TOKENS (REA would truncate with “at least N”) |

Reproduce:

# Prefer Node 22.23.4+ or 24.x; set Wabt/tshark for full coverage
export REA_WABT_BIN_DIRECTORY=$HOME/opt/wabt-1.0.42/bin   # optional
npm run build && npm run redteam:rea

Designed-for but not empirically verified here

These shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path needs native tooling we did not run on this box:

| Area | Why unverified here | | --- | --- | | Ghidra / native decompilation depth | Requires a Ghidra install + REA bridge | | Frida / LLDB / GDB / Rizin live sessions | Requires those debuggers + device/process attach | | JADX / full Android APK pipeline | APK resigning unsupported; DEX shield is in-tree | | Firmware containers | Skipped — staging/extraction budgets exist; no honest E2E without firmware corpora | | SPIR-V / CUDA fatbinary / AMD GPU objects | Skipped — need native GPU object decoders; PTX text is shielded in-tree (benchmark only, not a REA GPU-object budget hit) | | EVMole in-process EVM decode | Documented as not pathable in-process; EVM shield still densifies to the 4 MiB input approach |

We do not claim those paths are empirically bankrupt until redteam:rea (or an equivalent harness) records a real before/after against the live analyzer.

Format coverage

| Format | Canary + diagnostic | Exhaustion / budget trip | Empirically vs REA | Notes | | --- | :---: | :---: | :---: | --- | | JavaScript / TypeScript | ✓ | ✓ semantic budgets | verified (in-process) | Babel AST; anti-strip; real REA resourceLimits | | Electron .asar | ✓ | ✓ header 16 MiB | verified | | | Electron fuses | ✓ | ✓ >32 sentinels | verified | | | WASM | ✓ custom sections | ✓ export-name decoys → Wabt | verified (Wabt) | Soft-skips to projected budget without Wabt | | Python / .pyc | ✓ | ✓ | designed-for | | | SQLite | ✓ honey + trap cols | ✓ column eval | verified (Node 24) | Soft capability_gated on Node 22 | | Safetensors | ✓ string metadata | ✓ JSON nesting >32 | verified | HF-loadable; tensor bytes preserved | | GGUF | ✓ | ✓ ARRAY nesting >32 | verified | | | Go buildinfo | ✓ | ✓ >1 MiB | verified | Mapped ELF section | | Flutter / Dart pool | ✓ | ✓ URI/token caps | verified (projected) | | | Erlang BEAM | ✓ | ✓ chunks / atoms | verified | | | EVM + Solidity meta | ✓ | ✓ → 4 MiB input | verified (approach) | | | PCAP | ✓ | ✓ tshark JSON >8 MiB | verified (tshark) | Soft-skip without tshark | | NVIDIA PTX (text) | ✓ | entry flood | benchmark only | Not a REA GPU-object budget | | DEX / IL2CPP / bplist / .NET / JVM / ZIP | ✓ | format-specific | designed-for | APK signing-aware protect unsupported | | Firmware / SPIR-V / CUDA fatbin / AMD GPU | — | — | skipped | See matrix above |

Benchmark (14 targets, internal estimates)

npx bla-agents benchmark runs a local Counter-REA showcase: exposure scores, estimated token/cost multipliers, and measured runtime equivalence. Token/$ columns are internal estimates derived from BLA's catalog of REA limits — they are not the same as the empirical REA process measurements above (those are byte-level analyzer failures with real error strings). npm run verify:rea is a constant-drift harness only and must never be cited as protection evidence; the only authoritative gate is npm run redteam:rea.

Latest local run (bla-agents v1.4.0): aggregate ~612.5× tokens · ~292.2× cost · 14/14 runtime-exact.

| Target | Unprotected (est.) | Protected (est.) | Token mult (est.) | Runtime | | --- | --- | --- | ---: | :---: | | DX-Ball sound-pan (.js) | 84/100 · 4,800 tok · $0.20 | 2/100 · 13.5M tok · $212.82 · LIMITED | 2822.7× | 100% | | Notion Electron clipboard (.asar) | 98/100 · 9,132 tok · $0.34 | 2/100 · 23.1M tok · $358.28 · LIMITED | 2532.3× | 100% | | Enterprise license validator | 84/100 · 4,800 tok · $0.20 | 2/100 · 13.5M tok · $212.82 · LIMITED | 2822.7× | 100% | | WASM crypto kernel | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.83M tok · $30.23 · LIMITED | 381.5× | 100% | | Native ELF64 (Rust/Go/Fuse/Dart) | 81/100 · 35,222 tok · $0.73 | 2/100 · 3.72M tok · $60.03 · LIMITED | 105.6× | 100% | | SQLite entitlement DB | 81/100 · 10,568 tok · $0.29 | 7/100 · 1.71M tok · $28.39 · LIMITED | 162.1× | 100% | | Edge AI Safetensors | 81/100 · 4,800 tok · $0.20 | 6/100 · 1.81M tok · $29.90 · LIMITED | 376.8× | 100% | | Android DEX | 81/100 · 8,900 tok · $0.34 | 7/100 · 2.79M tok · $45.11 · LIMITED | 313.2× | 100% | | Apple bplist | 81/100 · 6,440 tok · $0.26 | 9/100 · 1.36M tok · $22.96 · LIMITED | 211.8× | 100% | | .NET managed DLL | 81/100 · 8,900 tok · $0.34 | 6/100 · 2.45M tok · $39.96 · LIMITED | 274.8× | 100% | | Erlang BEAM | 81/100 · 8,900 tok · $0.34 | 5/100 · 3.86M tok · $62.08 · LIMITED | 433.2× | 100% | | EVM Solidity metadata | 81/100 · 6,440 tok · $0.26 | 6/100 · 1.78M tok · $29.40 · LIMITED | 276.3× | 100% | | libpcap capture | 81/100 · 4,800 tok · $0.20 | 8/100 · 1.60M tok · $26.58 · LIMITED | 333.2× | 100% | | NVIDIA PTX text | 81/100 · 4,800 tok · $0.20 | 6/100 · 2.40M tok · $39.29 · LIMITED | 500.2× | 100% |

How BLA works

1. Exhaustion — trip documented REA caps (primitive-candidates, ASAR header bytes, WASM interface representation, SQLite column evaluation, model JSON/ARRAY nesting, Go buildinfo, BEAM chunks, PCAP tshark JSON, fuse sentinels, …).
2. Deception — canary credentials + system-diagnostic rabbit holes across Python/WASM/SQLite/models/DEX/IL2CPP/bplist/.NET/JVM/ZIP; decoy IPC / enclave manifests / VLQ maps.
3. Runtime guard — Electron V1 fuse hardening; CDP/Frida/inspector detection returns synthetic telemetry during inspection sessions.

Protections are format-native (no commercial packer / external LLVM required). Red line: never break protected program behavior, export surface, binary/section integrity, or format validity.

Project config defaults (P0)

• Per-project seed — BLA mints a random seed into .blarc / bla.config.json on first use. Legacy shared fingerprints (bla-shield-seed-v1, …) are no longer the default.
• --llm-directives — risky LLM-facing bait (fake COPPA/medical notices, dual-use imitation, in-band AI chat markers) is off by default; pass the flag (or llmDirectives: true / MCP llm_directives) to opt in.
• --manifest — .bla-manifest.json is an unsigned attestation (not ed25519-signed) and is opt-in; it is not shipped next to customer artifacts by default. Schema: defense-manifest-v1.json.

FAQ

Any coding agent with local MCP or SKILL.md workflows. npx bla-agents setup configures Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI. After setup, the bundled blind-llm-agents skill is the one-click harden guide (bla_harden / bla harden .); MCP stays the execution layer.

No on the hot path. Budget guards sit behind $O(1)$ opaque predicates. Every benchmark target checks 100% input/output equivalence against the unprotected build.

No. Shields are built into bla-agents. Wabt/tshark/Node 24 are optional — they unlock empirical red-team probes (npm run redteam:rea), not protection itself.

No. See DISCLAIMER.md. Protective payloads activate under reverse-engineering inspection of artifacts you hardened.

Documentation

• DISCLAIMER.md — defensive use, own-software only
• Installation and agent setup
• CLI and MCP contracts
• One-click agent defense (skill-first)
• Weave-decoy MCP
• Empirical REA validation
• blind-llm-agents skill
• Counter-REA matrix
• v1.4.0 release notes (staged)
• CHANGELOG

Report security issues through SECURITY.md.

Contributing

Issues and PRs welcome at qybaihe/bla. Before submitting:

export PATH=$HOME/node22.23.4/bin:$PATH   # or node24
npm run build && npm test && node dist/cli.js benchmark
npm run redteam:rea                        # authoritative (real REA)
# npm run verify:rea                       # drift harness only — NOT protection proof

Community / 友情社区

• 🎯 Public BLA CrackMe v6 (challenge/v6/) — harden-native: a Node vault + HTML panel + WebAssembly core hardened by the real bla harden pipeline (bankrupt, LLM directives OFF, fixed seed). Run npm run crackme:v6 -- '<key>'; SEAL.json publishes digests only (no plaintext key/flag in git).
• LINUX DO (linux.do) — 新的理想型社区

License

MIT