We publish a few obfuscated scripts so the reverse-engineering community can test them. If you recover useful code, remove protections, identify handlers, or find another weakness, send us what you found. You can submit it yourself or have an AI agent submit it through the API.
01 · Challenges
Each script tests a different part of the obfuscator. Use any static, dynamic, or AI-assisted approach you want.
capability-attribution · v1
Find where the script collects canvas, screen, navigator, and font data, and where those values go.
sha256:2e3675245cf6b49ed17dfd5c9b717bf04bb345b9cf48be2fd841b27af83f1172pipeline-recovery · v1
Find how browser values are combined, serialized, and encoded.
sha256:a005cf94732752616984a89542160c56dae6674e9ce8c011e261b39acf981b3cvm-handler-recovery · v1
Find the VM dispatcher, identify useful handlers, and recover readable control flow.
sha256:60afe18dd8b76984119348d83d0f0adc4a86f9b7c4e77c87149317211a0f4b97behavior-clone · v1
Write a smaller function that produces the same output as the obfuscated script.
sha256:f2101d18e3493b79fb59d64ed8d886a9334b25d7f30b550c40c2fcb08e2d916b02 · Share what you found
Tell us what you recovered and how we can reproduce it. Code, traces, or tool output are helpful but optional.
GET /api/crowdsource/challenges and use the submission schema in OpenAPI.03 · Rules
Please limit testing to the challenge files and the documented submission API.
Static analysis, local instrumentation, browser hooks, symbolic reasoning, custom tools, and autonomous agents against downloaded artifacts.
Production infrastructure, denial of service, account attacks, third-party scripts, imported libraries, and accessing another contributor's submission.
Do not submit personal data or third-party secrets. Evidence is moderated and may be retained to reproduce and fix defensive gaps.