PixelMelt

I'm the guy who wrote/designed the first version of Google's framework for this (a.k.a. BotGuard), way back in 2010. Indeed we were up to "good", like detecting spambots and click fraud. People often think these things are attempts to build supercookies but they aren't, they are only designed to detect the difference between automated and non-automated clients.

There seem to be quite a few VM based JS obfuscation schemes appearing these days, but judging from the blog posts about people attempting to reverse them the designers haven't fully understood how to most fully exploit the technique. Given that the whole point is to make understanding how these programs work hard, that's not a huge surprise.

Building a VM is not an end for obfuscation purposes, it's a means. The actual end goal is to deploy the hash-and-decrypt pattern. I learned this technique from Nate Lawson (via this blog post) and the way his company had used it to great effect in BD+.

A custom VM is powerful not only because it puts the debug

PixelMelt

function golfPack(code){
  function chinaPacker(code) {
    const unicodeChars = [];
    for (let i = 0; i < code.length; i += 2) {
      const char1 = code[i];
      const char2 = code[i + 1] || ' ';
      const codePoint = (char1.charCodeAt(0) << 8) | char2.charCodeAt(0);
      const unicodeChar = String.fromCodePoint(codePoint);
      unicodeChars.push(unicodeChar);
    }

PixelMelt

function loadCssPro() {
    const head = document.getElementsByTagName('head')[0];

    const cssFiles = [
        { href: "https://cdnjs.cloudflare.com/ajax/libs/tippy.js/6.3.7/tippy.min.css", rel: "preload", as: "style" },
        { href: "https://cdn.jsdelivr.net/npm/@simonwep/pickr/dist/themes/nano.min.css", rel: "preload", as: "style" },
        { href: "https://cdnjs.cloudflare.com/ajax/libs/tom-select/2.2.2/css/tom-select.min.css" },
        { href: "https://cdnjs.cloudflare.com/ajax/libs/lity/2.4.1/lity.css", rel: "preload", as: "style" },
        { href: "https://cdn.jsdelivr.net/npm/diff2html/bundles/css/diff2html.min.css", rel: "preload", as: "style" }
    ];

PixelMelt

package main
import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"encoding/base64"
	"errors"
	"fmt"
	"log"
)

PixelMelt

search.brave.com##[data-type="ad"]
search.brave.com##[id="premium-promo-wrapper"]