new-datadome-deobfuscator

Babel AST-based deobfuscator for DataDome's WAFs (interstitial and captcha). Up to date and maintained for the latest versions. Clean files, extract dynamic challenges, pull out the embedded WASM payload.

Before starting

Please kepe in mind that this Datadome daily update their challenge files (new compilation, new functions/identifiers names + dynamic challenges suffled). This repo has been done thanks to months of studying and analyzing their updates pattern and structures, with the goal of handling them correctly. Please leave a start and read my other works for supporting me,

Live demo

Table of Contents

• What gets deobfuscated
• The logic, condensed
• Installing the module
• Use it as a node module
  • Extracting the dynamic challenge
  • Extracting the WASM payload
• CLI usage
  • Extracting dynamic challenge and WASM via CLI
• Web UI
• Output shape
• Project structure
• What's not supported
• Related work
• Further reading
• Need DataDome Bypass Solutions?
• License & author

What gets deobfuscated

Two scripts, one pipeline:

• captcha.js, the Webpack/Browserify-style bundle DataDome serves on the captcha page
• interstitial.js, the anonymous-IIFE bundle served on the interstitial WAF page

Both come out as clean, per-module files. Plus the post-processing extracts the per-session dynamic challenge expression and the embedded WASM payload + helpers that the bundle uses to compute its detection signature.

Pre vs post here:

The logic, condensed

So, DataDome is still using the same old obfuscation techniques, the only update they push sometime is another layer or operation just on top of the previous ones. Usually updating the deobfuscator means having just to handle a new layer or function concatenation.

The pipeline runs in eight phases:

1. Hex and bracket cleanup

\x48\x65\x6c\x6c\x6f → "Hello" obj[['key']] → obj['key']

2. Module separation

Detects which bundle shape lives at program.body[0] and splits the IIFE / function body into per-module ASTs. Captcha is a browserify-style !function(e,B,s){...}({...}), interstitial is a (function(){ var e={...}; ... })().

! function A(Q, t, C) {
    // Modules handler function
}({
    1: [function(A, Q, t) { /* Module with exports */ }, {}],
    2: [function(A, Q, t) { /* Module with exports */ }, {}],
    ...
}, {}, [6]); // Entry point (Module 6 in this case)

After separation you get something like:

output/captcha/
  captcha.js
  vm-obf.js
  bean.js
  hash.js
  helpers.js
  main.js
  mouseMaths.js
  picasso.js
  slidercaptcha.js

3. T-matrix resolution

DataDome precomputes a 2D array whose cells are references to row-arrays, then uses <matrix>[x][y] everywhere as case values and table keys. The pass extracts the var e = (function(){...})() IIFE that builds it, runs that IIFE in a Node vm context, and rewrites every e[x][y] lookup to the small integer it actually represents. I call this TMatrix. I've already analyzed this logic in a previous article and repo.

4. String cleaning

Variables like let x = window.Number(-92) get executed and replaced inside the correct scope. We then have function calls like fn(numLit, numLit) (the actual string obfuscators) that now have their arguments displayed as literals, so we can fold them into their resulting strings.

5. Executions and replacements

T-matrix replacement, conditional and expression simplification, if-statement folding, opaque-predicate folding. Up to 10 rounds, until nothing changes.

6. Arithmetic expression removal

Removal of "Mixed Boolean-Arithmetic" expressions like -3*(F&-881) + 1*~(F&o) + ... > -388. The pass samples each one across 20+ random integer assignments. If it's invariant, replace with the literal. If it's linear, fit a*x + b*y + c. (Random operations meant to "make the code hard to understand", we just sample our way through them.)

7. Switch-case unflattening, twice

for (r = N; true;) { switch (r) { case X: ...; r = Y; continue; ... } } is flattened back into linear code. The first run handles straightforward cases. Then unused-variable removal strips the decoy for-inits DataDome pads in (for (var eA = 544; true;) where eA is never used and the real state lives in r), and the second run picks up whatever was hiding behind those decoys.

8. Code generation + post-processing extractors

One file per separated module. Then extractDynamicChallenge, extractWasm, and extractWasmChallengeFields walk the cleaned ASTs and pull out the per-session signature expression, the embedded WASM bytes, and the ordered list of fields the WASM hashes. Those land on the result object directly (see Use it as a node module).

For the full per-phase walkthrough, the rationale behind each guard, and the historical fixes log, see LEARN.md.

Installing the module

npm install new-datadome-deobfuscator

Node 18 or newer. No native deps.

Use it as a node module

const fs = require('fs');
const { deobfuscate } = require('new-datadome-deobfuscator');

const source = fs.readFileSync('captcha.js', 'utf8');
const result = deobfuscate(source, { logLevel: 'INFO' });

console.log(result.bundleType);             // 'captcha' | 'interstitial' | 'unknown'
console.log(result.moduleOrder);            // ['captcha', 'vm-obf', 'bean', ...]
console.log(result.stats.reductionPercent); // '12.33%'

for (const [name, code] of Object.entries(result.modules)) {
  fs.writeFileSync(`out/${name}.js`, code);
}

The result object:

| field | type | what it is | |---|---|---| | bundleType | string | 'captcha', 'interstitial', or 'unknown' | | modules | object | { moduleName: deobfuscatedSource } | | moduleOrder | string[] | original emission order | | dynamic_challenge | string | null | the bit-twiddle expression DataDome computes per session for its request signature | | wasm | object | null | extracted WASM payload + helper metadata + hashed-fields list | | stats | object | { original, deobfuscated, reduction, reductionPercent } | | warnings | array | non-fatal issues | | errors | array | fatal issues with code and message | | report | object | structured report for downstream tooling |

Options:

| option | default | meaning | |---|---|---| | logLevel | 'INFO' | 'DEBUG' \| 'INFO' \| 'WARN' \| 'ERROR' \| 'NONE' | | logger | (built-in) | bring your own Logger instance, overrides logLevel | | maxPasses | 10 | iterative-pass cap | | generatorOptions | (none) | forwarded to @babel/generator |

Extracting the dynamic challenge from the module

result.dynamic_challenge is a string containing the exact bit-twiddling expression DataDome runs per session over (build-sig, br_ow, br_oh, hardwareConcurrency) to produce its request signature. Decoder calls inside the expression are pre-resolved to literals, and the locally-named source arrays are renamed to consistent identifiers, so what you get is portable: drop it into your own solver and run it.

const { deobfuscate } = require('new-datadome-deobfuscator');
const fs = require('fs');

const source = fs.readFileSync('captcha.js', 'utf8');
const result = deobfuscate(source);

if (result.dynamic_challenge) {
  // The expression as JS source. Plug into your solver / VM.
  console.log(result.dynamic_challenge);

  // Or persist for later replay
  fs.writeFileSync('out/dynamic_challenge.js', result.dynamic_challenge);
} else {
  console.warn('no dynamic challenge found, check warnings:', result.warnings);
}

Returns null when the extractor can't locate the call (rare, and usually means a new variant shape, check result.warnings).

Extracting the WASM payload from the module

result.wasm is the full WASM blob: the raw base64 bytes, the imports-provider source (so you can rebuild the import object), the list of window.* properties the provider touches, every external helper the provider transitively calls, and the ordered list of fields the compiled WASM actually hashes.

const { deobfuscate } = require('new-datadome-deobfuscator');
const fs = require('fs');

const source = fs.readFileSync('captcha.js', 'utf8');
const result = deobfuscate(source);

if (result.wasm) {
  const { wasm, instance, providerName, windowAttributes, helpers, fields } = result.wasm;

  // 1. Save the raw WASM bytes
  fs.writeFileSync('out/datadome.wasm', Buffer.from(wasm, 'base64'));

  // 2. Save the imports-provider so you can rebuild the import object
  fs.writeFileSync('out/imports-provider.js', instance);

  console.log('provider name:', providerName);
  console.log('window attrs touched:', windowAttributes);
  console.log('external helpers:', helpers.map(h => h.name));
  console.log('hashed fields:', fields); // e.g. ['hardwareConcurrency', 'br_oh', 'maxTouchPoints', ...]
}

The wasm object shape:

| field | type | what it is | |---|---|---| | wasm | string | raw WASM module, base64-encoded (starts with AGFzbQ) | | instance | string | source code of the imports-provider function | | providerName | string | name of the imports-provider in the original bundle | | windowAttributes | string[] | window.* properties the provider touches (DataView, Uint32Array, Error, …) | | helpers | array | { name, source } for every external helper the provider calls | | fields | string[] | ordered list of field names hashed by wasm_b (e.g. hardwareConcurrency, br_oh, maxTouchPoints) |

Returns null when the bundle has no embedded WASM or the extractor hits an unfamiliar shape.

NOTE The fields of the wasm_boring challenge changes daily, that's why we extract them alongisde the dynamic helpers, instance and windows attrs

CLI usage

# direct
npx datadome-deobfuscate input.js out/

# with a structured report on the side
npx datadome-deobfuscate input.js out/ --report out/report.json

Flags:

| flag | meaning | |---|---| | --input <path> | alternative to the positional input argument | | --output <path> | alternative to the positional outputPrefix argument | | --report <path> | writes the full structured report (timestamp, per-module status, stats, errors, warnings, dynamic_challenge, wasm) | | --log-level <LEVEL> | DEBUG \| INFO \| WARN \| ERROR \| NONE, default INFO | | --no-delimiter | suppresses the ===DEOBFUSCATOR_RESULT=== line on stdout | | -h, --help | usage |

Exit codes:

| code | meaning | |---|---| | 0 | clean run, no errors (warnings tolerated) | | 1 | fatal error: bad input, parse failure, or unexpected crash | | 2 | finished, but at least one module recorded errors |

The line right after ===DEOBFUSCATOR_RESULT=== on stdout contains the same JSON the --report flag writes to disk. That's the contract for downstream tooling that wants to scrape the output without writing files:

report = json.loads(
    out.split('===DEOBFUSCATOR_RESULT===', 1)[1].strip().splitlines()[0]
)
if report['status'] != 'success':
    for e in report['errors']:
        print(e['message'])

Suppress the delimiter with --no-delimiter if you don't want it in the stdout stream.

Extracting dynamic challenge and WASM via CLI

The post-processing extractors run automatically on every CLI invocation. The dynamic challenge expression and the full WASM blob land in the structured report on disk (and on the stdout delimiter line). No extra flags needed.

npx datadome-deobfuscate input/captcha.js out/captcha/ --report out/captcha/report.json

Then read the bits you care about:

# just the dynamic challenge expression
jq -r '.dynamic_challenge' out/captcha/report.json > out/dynamic_challenge.js

# the raw WASM bytes (base64-decoded)
jq -r '.wasm.wasm' out/captcha/report.json | base64 --decode > out/datadome.wasm

# the imports-provider source code
jq -r '.wasm.instance' out/captcha/report.json > out/imports-provider.js

# the ordered list of fields the WASM hashes
jq -r '.wasm.fields[]' out/captcha/report.json

Or if you're piping without writing to disk, scrape the stdout delimiter:

npx datadome-deobfuscate input/captcha.js out/captcha/ \
  | sed -n '/===DEOBFUSCATOR_RESULT===/{n;p;}' \
  | jq '{ dc: .dynamic_challenge, wasm_fields: .wasm.fields }'

Both dynamic_challenge and wasm always appear at the top level of the report payload, regardless of which module they were extracted from.

Web UI

The repo doubles as a Vercel-deployable dashboard. Drop a captcha or interstitial file in the browser, watch the pipeline run, get the modules back as a zip.

Locally:

git clone https://github.com/glizzykingdreko/new-datadome-deobfuscator
cd new-datadome-deobfuscator
npm install
npm run dev
# → http://localhost:3000

Production:

npm i -g vercel
vercel deploy

Output shape

| bundle | modules emitted | |---|---| | captcha | captcha, vm-obf, bean, hash, helpers, main, mouseMaths, picasso, slidercaptcha | | interstitial | reloader, interstitial, obfuscate, helpers, vm-obf, localstorage, main |

Plus, when present:

• dynamic_challenge: the bit-twiddle expression DataDome computes per session for its request signature.
• wasm: the embedded WASM module's bytes plus extracted helper metadata (provider name, window attributes touched, external helpers, hashed-fields list).

Project structure

new-datadome-deobfuscator/
  lib/index.js                Public Node.js API. deobfuscate(source, options).
  bin/cli.js                  CLI entry point.
  api/deobfuscate.js          Vercel serverless function. Streaming + non-streaming.
  api/deobfuscate-worker.js   Worker thread that runs the pipeline and streams logs.
  server.js                   Local dev server. Serves public/, routes /api/deobfuscate.
  public/                     Web UI. index.html, styles.css, app.js.
  transformers/
    index.js                          Pipeline runner.
    captcha.js                        Bundle-shape detection + module separation.
    preprocessing/index.js            Phases 1 through 7 + recursive harvest.
    transformations/                  One file per pass: t-matrix, switch-case, opaque-predicates, ...
    extractDynamicChallenge.js        Pulls out the per-session bit-twiddle expression.
    extractWasm.js                    Extracts WASM bytes + imports provider + helpers.
    extractWasmChallengeFields.js     Reads the ordered field list fed into wasm_b().
  input/                      Reference obfuscated bundles.
  output/                     Reference deobfuscated output.
  LEARN.md                    Per-phase walkthrough + historical fixes log.
  CLAUDE.md                   Agent instructions for this codebase.

What's not supported

• DataDome tags.js, the third client-side script DataDome ships. Different bundle shape, different decoder location. Not in scope here.
• Decoder calls with non-numeric args, C(someVar) where someVar isn't a literal stays as-is.
• For-loop state machines with dynamic initial state, if the initial state expression contains a decoder call that can't resolve, the unflattener skips that loop. Currently 0 such skips on the reference inputs.

Related work

Other DataDome work I've published, all open-source:

• datadome-wasm: the embedded WASM module reverse-engineered standalone.
• datadome-encryption: DataDome's request-payload encryption logic, Node.
• datadome-encryption-python: same encryption logic ported to Python.
• Datadome-GeeTest-Captcha-Solver: solver for the GeeTest variant of DataDome's captcha.
• Datadome-Movements-Display: visualizer for the mouse-movement signals DataDome collects.

Older repos, kept for reference but superseded by this one:

• Datadome-Deobfuscator (Oct 2023, outdated)
• Datadome-Interstitial-Deobfuscator (Jan 2024, outdated)
• Datadome-Captcha-Deobfuscator (Jan 2024, outdated)
• Datadome-Interstital-Encryptor (outdated)

Other antibot vendors, same pattern:

• akamai-script-patcher: Akamai bot-management script deobfuscator + integrity-check patcher.
• akamai-v3-deobfuscator: Akamai v3 sensor data trace and reconstruction.
• akamai-v3-tools: Akamai v3 sensor data encrypt / decrypt web UI.

Further reading

• LEARN.md: the deep dive. Per-phase rationale, the obfuscation patterns DataDome stacks, the corruption guards in Phase 4, the recursive harvest, the switch-case red-herring for-init handling, the post-processing extractors, and the fixes log.
• Analyzing DataDome's latest changes: Medium write-up on the most recent obfuscator updates.
• Breaking down DataDome's captcha WAF: Medium walkthrough of the captcha bundle's structure.

Need DataDome Bypass Solutions?

Get in touch with some experts who truly understand the technology, don't think you want to have your project down each time Datadome pushes a change.

At TakionAPI we provide it. Be sure to check it out, start a free trial and then proceed checking out our documentation, one api call and Datadome is not a problem you need to worry about anymore.

Check our datadome-bypass-examples and be sure to start a free trial for testing them.

License & author

MIT. Author: glizzykingdreko.

• GitHub
• Twitter
• Medium
• Email
• Buy me a coffee ❤️
• TakionAPI

This repo is the open-source companion to TakionAPI's DataDome solving API. If you don't want to wire up the full bypass yourself, TakionAPI ships a ready-to-plug solver.