recaptcha

Description

This repository contains a technical analysis of Google's antibot (reCAPTCHA) focusing on:

• Payload Structure and Values
• Fingerprinting Techniques
• Obfuscation Techniques
• Anti-debugging/Tampering Techniques
• Virtual Machines

Contact

• Discord: @g_recaptcha
• Telegram: @lyxlobyx

Obfuscation Techniques

reCAPTCHA is one of the anti-bot systems with the most sophisticated obfuscation techniques, employing a series of transformations that make the code less readable and more difficult to reverse engineer. Most obfuscations can be easily manipulated using the Abstract Syntax Tree (AST), but some are processed at runtime, rendering the AST useless in this case. Polymorphism is also applied to the code to change its structure in each version of the script. For example, the code doesn't perform the action directly. Instead, it uses objects or functions that change shape

• Sequence Expressions The code is flattened by converting each block statement into a continuous comma-separated expression, it can appear in if statements, function arguments, and even within objects

• Mixed Boolean Arithmetic Intertwines arithmetic operations (addition, subtraction, multiplication) with bitwise operations (AND, OR, XOR, NOT) to hide the original logic, for example -2 * ~(h & H) + -2 + (h ^ H)

• Indirect Function Table Each function is built within a table, and is called using its index, like functions[index](https://github.com/elyelysiox/recaptcha/blob/main/args)

• Inline Constant Array A local array literal is assigned inline, mid-expression, the array groups constants (numbers, strings) that are reused throughout the function body via index access

  // b = [14, 1, "call"] assigned inline inside a sequence expression
  function(Y, Q, c, l, G, X, W, J, b, P) {
      (Y & 94) == Y && (b = [14, 1, "call"], ...)
      W[b[2]](J, G)   // W.call(J, G)
      Y >> b[1] & b[0]  // Y >> 1 & 14
  }
  

• Function Multiplexing Multiple logically distinct functions are merged into one, using a numeric parameter as a block selector. The active block is determined by evaluating the parameter against bitwise conditions. Callers pass a numeric literal as the selector

  function(N, y, U, Y, h, H, m, C, u) {
      C = [26, 47, 6];
  
      // block 1
      if ((N - 2 ^ 14) < N && (N - C[2] | 28) >= N) {
          // convert value to string logic
      }
  
      // block 2
      if ((N + 4 & 40) >= N && (N + 5 & C[0]) < N) {
          Y = bB();
          throw Error(Y === void 0 ? "unexpected value " + U + y : Y);
      }
  
      return u;
  }
  

• Logical Operator Branching Replaces if statements and if/else blocks with logical operator short-circuit evaluation, converting control flow into expressions. combined with sequence expressions, multiple branches appear as a single continuous comma-separated expression

  // if (a) { block }
  a && (block)
  
  // if (!a) { block }
  a || (block)
  
  // if (a) { x } else { y }
  a ? x : y
  
  // combined with CFF and sequence expressions:
  (Y | 1) & 14 || (c = Q.O, J = c.O.length + c.g.length),
  (Y ^ 59) >> 3 == 3 && (Q.classList
      ? Q.classList.add(c)
      : Z[31](31, Q, c) || (l = f[0](84, "string", "", Q), ...)),
  

• Bind Native Methods Constants Binds native browser methods to their original receivers, storing them as constants to prevent tampering

  LO = (Tw = self) == null ? void 0 :
   (K9 = Tw.Math) == null ? void 0 :
   (v4 = K9.floor) == null ? void 0 :
   (mF = v4.bind) == null ? void 0 :
   mF.call(v4, Math)  // Math.floor.bind(Math)
  
  LO(x)           // Math.floor(x)
  U4()            // Math.random()
  Ge(obj, prop)   // Object.defineProperty(obj, prop)
  

• Dead Code Inaccessible or unused blocks of code are injected throughout the file, increasing its size to over 60,000 lines, this makes static analysis and LLM-based reverse engineering difficult

• Control Flow Flattening Transforms each part of the code (declarations and loops) into a flat state machine. It hides the original execution logic by routing all code blocks through a central "dispatcher" block

  Dispatchers can change shape; some have 2-3 state variables, and the loop/condition type changes. They look like this

  

  This is a CFF with 2 state variables, one handles the catch block and the other the try block.

• Encrypted String Pool All string literals (DOM APIs, browser properties, CSS values, error messages, etc) are encrypted into a single massive string pool. A decryption function uses a seed and an LCG-based XOR cipher to extract each string at runtime

  There are 1990+ call sites spread across the code, the decryption function uses a running key that accumulates decoded codepoints, making each character dependent on all previous ones

  X = function(J, b, P, F, U) {
      U = ["codePointAt", 127, "char encrypted pool"];
      for (F = (P = 0, b = "", l); P < Q; P++)
          J = (U[2][U[0]](c + P) ^ F) & U[1],  // XOR with running key
          b += String.fromCodePoint(J),
          F += J; // accumulate key
      return G = b;
  }
  
  // call sites pass a seed to locate and decrypt each string
  Z[23](64, 4, 54961, 103)()  // → "lang"
  Z[23](66, 4, 54961, 103)()  // → "addEventListener"
  Z[23](32, 12, 20287, 852)() // → "inline-block"
  

  

• Stateful Value Iterator reCAPTCHA uses stateful function that returns a sequence of runtime objects and values (like window, document.body, numeric constants) in a fixed order, each call advances an internal cursor, calling it out of sequence or too many times corrupts all subsequent reads. A timeout mechanism invalidates the state after a fixed interval, returning null for any late reads

  // sequential calls return different values:
  c()  // → window
  c()  // → document.body
  c()  // → 123
  c()  // → null (timeout expired)
  
  l(c(), G[2], G[W[1]], G[1]) + l(c(), G[2], G[W[1]], 12)
  // ↑ window                     ↑ window
  
  10 * l(c(), G[2], G[W[1]], G[1]) + l(c(), G[2], G[W[1]], 12))
  
  c().querySelectorAll(a[X[2]](98, X[1], X[1]))
  // ↑ document.body  
  
  

• Computed Function Table This is similar to Indirect Function Table, but here the index of the function to be obtained is calculated at runtime with a seed, using XOR and Modulus

  c = ((Q ^ no | U[1]) >> 5) + no
  A = mN[(c % U[2] + U[2]) % U[2]]  // mN is the function table (50+ functions)
  

  q[29](5, 6977)   // seed=6977  → index resolves to function at mN[X]
  q[29](53, 6187)  // seed=6187  → different index, different function
  

  

• Runtime Value Encryption Some values ​​(captcha configuration parameters, anchor parameters, etc) are never stored in plain text; they are encrypted immediately after collection and decrypted only at the time of use, have a prefix B at the beginning