How We Built a 3-Layer JS + WebAssembly Crackme to Stress-Test Code Defense Against AI Decompilers

Soltrix Studios — Sat, 14 Nov 2026 14:35:21 +0000

Traditional JavaScript and WebAssembly obfuscators rely on lexical cosmetic tricks: renaming variables to _0x4a2b, base64-encoding string arrays, and wrapping functions in simple switch statements.

While those techniques slow down casual inspection in browser DevTools, modern static semantic graph extractors (morluto/rea), native decompilers (NSA Ghidra, WABT wasm-decompile), and LLM-driven reverse-engineering agents slice through them in seconds. An LLM does not care what a variable is named; it reads the data-flow graph and reconstructs clean source code.

To solve this at the compiler level, we built Syferit (github.com/soltrix-studios/syferit), an open-core (v1.0.2) multi-target code defense engine for JavaScript/TypeScript, WebAssembly, Python, and C/C++ (LLVM).

Instead of asking developers to take our word for it, we shipped a live 60 FPS browser game and 3-layer reverse-engineering crackme: SYFER-DEFENDER: The Three-Layer Override.

Play the Live 60 FPS Browser Challenge: https://syferit.soltrixstudios.com/challenge
Download the Offline Crackme Bundle (.wasm + .js + CLI): https://syferit.soltrixstudios.com/challenge/syferit-defender-crackme.zip
Inspect the Decompiler & Agent Receipts: https://syferit.soltrixstudios.com/#benchmarks
GitHub Repository (v1.0.2): https://github.com/soltrix-studios/syferit

Why Cosmetic Obfuscation Fails Against Static Semantic Graphs

When an automated reverse-engineering pipeline like morluto/rea (rea-agents) or wasm-decompile analyzes a binary, it follows three steps:

Constant & Literal Extraction: Recovering string tables, API routes, and magic numbers from AST literals or Python co_consts.
Call-Graph & Object-Flow Resolution: Mapping which functions call which targets and tracking property reads across objects.
Symbolic Simplification: Using algebraic rules or SMT solvers to fold dead branches and recover the underlying if (input === secret) comparison.

If a transformation is algebraically invertible, an automated pass or an LLM agent will invert it.

How Syferit Hardens Code Across 3 Layers

In SYFER-DEFENDER, the game's weapon tiers and final flag decryption are locked behind three independent 128-bit credentials (OVERRIDE ALPHA, OVERRIDE BETA, and OVERRIDE OMEGA).

Layer 1: Non-Invertible Algebraic Invariants (`@syferit/core`)

Instead of storing target values or reversible XOR masks in JavaScript, @syferit/core lowers equality checks into 32-bit FNV-1a modular multiplication chains (Math.imul) entangled with cyclic state-machine dispatchers.

Rather than checking x === C, the engine verifies that x satisfies a modular residue invariant while simultaneously using the intermediate 32-bit state to compute the next basic-block jump target.

Layer 2: WebAssembly MBA & Frame Expansion (`@syferit/wasm`)

The second credential (OVERRIDE BETA) is verified inside a compiled WebAssembly binary (enclave.wasm -> verify_beta(b0, b1, b2, b3)).

@syferit/wasm parses the raw .wasm binary (99 B -> 832 B), expands local register frames (local i32 x 6), rewrites scalar checks into multi-instruction Mixed Boolean-Arithmetic (MBA) expressions, and splits execution across coupled state-machine functions in the WASM function table.

Layer 3: Cross-Boundary Cryptographic Coupling

Unlocking all three credentials combines the live execution states from both vault-engine.js and enclave.wasm into a 384-bit stream cipher key that decrypts the final flag in memory. Patching a boolean return value (return true) in DevTools will not work because the wrong mathematical residue produces garbage bytes during stream decryption.

Verifiable Telemetry Receipts

You can reproduce these exact results locally on the challenge bundle (syferit-defender-crackme.zip):

1. `morluto/rea` (`rea-agents`) Static Semantic Graph Analysis

npx rea-agents analyze-javascript-application ./dist --format json

Evidence ID: ev_e944fd12a1d8fd7b45afb4ff7ef2be85eea9262dcf32b8d000ccfee8a06cca29
Coverage Status: "unknown"
Graph Telemetry: 2,722 nodes | 2,387 relations | 788 unresolved unknowns (324 object-flow, 263 call-flow, 198 data-flow)
Top Unknown Reasons:
- 213x call-flow :: dynamic-call ("Unsupported MemberExpression call target.")
- 171x object-flow :: ambiguous-target ("Static read property /imul has unknown-coverage presence")
- 36x object-flow :: ambiguous-target ("Static read property /seats has unknown-coverage presence" [Architectural Gaslighting decoy])
AST & CFG Fingerprint Collision: Distinct state-machine functions compile to the exact same normalized_ast_sha256 (e80a4d87...) and control_flow_sha256 (79ad94b5...) hashes.
Literals Recovered: 6 total across all 2,722 nodes, and 6/6 are injected EULA_TITLE_17_PROPRIETARY / DMCA_TITLE_17_SEC_1201_NOTICE strings (0 secret constants recovered).

2. `WABT 1.0.42` (`wasm-objdump -x -d` / `wasm-decompile`)

wasm-objdump -x -d enclave.wasm

Binary Transition: 99 B -> 832 B
Static Constant Scan: 0 plaintext key constants or target residues present in the binary or decompiled pseudocode.

Try the Crackme or Integrate Syferit in 60 Seconds

If you enjoy reverse engineering, grab the offline bundle or open the live browser challenge and see if you can deterministically invert the 32-bit modular arithmetic to recover ALPHA, BETA, and OMEGA:

Live Challenge: https://syferit.soltrixstudios.com/challenge
GitHub & Documentation: https://github.com/soltrix-studios/syferit

Or try the CLI directly on your own JS, WASM, Python, or C/C++ project:

npx @syferit/cli harden ./src/vault.js -o ./dist/vault.protected.js

Feedback, questions, and crackme write-ups are very welcome in the comments!

DEV Community: Soltrix Studios