manjustice/datadome-vm-internals
DataDome embeds a custom VM in their bundle to hide what they're actually doing. I got curious and pulled it apart. Sharing it here for anyone who's interested in the same kind of reverse engineering puzzle.
DataDome ships a heavily obfuscated JavaScript bundle to your browser. Inside it, there's a custom virtual machine — they compile their actual fingerprinting logic into a private bytecode format, then run it inside that VM at runtime. This analysis of the latest version at the time of writing.
No DataDome code is included in this repo — only my own analysis and tooling.
Please read the note at the bottom before using this.
Once you can read the bytecode, a few things stand out.
String encryption. All strings are stored in a single encrypted blob at the top of the bytecode. Each string is decoded at runtime using a per-entry XOR key combined with a seed baked into the table header. So even reading raw bytes tells you nothing without knowing the seed.
S-box tables everywhere. The first ~20KB of bytecode is almost entirely PUSH_N_IMM + ARRAY_FROM_STACK sequences building 256-byte lookup tables. These are S-boxes, likely for a custom cipher or AES rounds used to hash the collected signals before sending them.
Fingerprinting signals you can actually see after decoding the strings:
This project exists purely to satisfy curiosity about how custom VM obfuscation works in practice. It's a learning exercise in reverse engineering, not a tool for bypassing bot detection.
What you do with this knowledge is on you.
