Borrow, do not reimplement
The vendor’s script already computes the payload correctly. Mount it and call it, so your decoder cannot drift from the build.
web-re-toolkit
Record a browser run, open the shipped script, borrow its own primitives, lift its virtual machine, and attribute wire fields to the environment facts that move them.
What it does
Section titled “What it does”wre drives Chrome, records the run into a capture bundle, and gives you the script the page loaded. From there you deobfuscate it, mount it in a V8 realm and call its functions as handles, probe its virtual machine handler by handler, and diff its payloads by address.
Everything target-specific lives in one TOML manifest. Everything else is shared library code across 24 crates.
Identity survives a rebuild
Roles are located by structural shape, magic constants and behaviour, then locked. The next build produces a diff, not a silent miss.
Native shapes, real values
The sandbox installs its browser surface as V8 bindings, so accessors are genuinely native. Values come from profiles captured off real devices.
Attribute many facts in few runs
A pooled design tests 64 automation markers in 7 page loads, then confirms each verdict by planting that marker alone.
The clients
Section titled “The clients”AkamaiRun a live Bot Manager sensor headlessly and carry the session it produces.
KasadaAnswer a live Bot Defence interrogation headlessly and carry the token it issues.
Start here
Section titled “Start here”InstallBuild the binary and point it at Chrome.
A worked passCapture, deobfuscate, mount, lift, diff, verify.
Headless clientsWrite a client in Rust, ship it to four languages.
Packagesnpm, PyPI, Go modules and crates for every shipped client.
Ask a question
Section titled “Ask a question”Questions about a target, a capture that will not reproduce, or a client that stopped matching after a rebuild go in the Discord.