[!IMPORTANT] Get BLA from qybaihe/bla or the bla-agents npm package.

---

Vous craignez qu'un attaquant utilise REA pour cloner votre application en quelques secondes ? Demandez à votre agent de la protéger avec BLA (Poison → Exhaust → Hallucinate).

BLA connecte votre agent à des outils de protection pour binaires natifs, applications JavaScript et Electron, WebAssembly, bytecode Python, bases SQLite et modèles d'IA, 100 % en local et sans impact sur l'exécution.

Démarrage rapide

Configurer votre agent

npx bla-agents setup

Demander à votre agent

• 1. Audit (Pre-flight REA Audit):

  Audit my ./dist directory against REA, show me every exposed module and IPC channel, and estimate how much it would cost Claude to reconstruct it.
  

• 2. Protect (Poison + Exhaust + Hallucinate):

  Protect ./dist/app.asar with BLA at bankrupt intensity, inject enclave chaff and algorithmic tarpits, and output to ./dist/app.shielded.asar.
  

• 3. Verify (Verify Defense & Token Burn):

  Verify ./dist/app.shielded.asar against the original ./dist/app.asar and confirm that REA's examination degrades to limited status.
  

Utiliser le terminal

# 1. Audit exposure
npx -y bla-agents@latest audit /absolute/path/to/app --json

# 2. Protect artifact
npx -y bla-agents@latest protect /absolute/path/to/app -o /absolute/path/to/app.shielded --intensity bankrupt

# 3. Verify Counter-REA resistance
npx -y bla-agents@latest verify /absolute/path/to/app.shielded /absolute/path/to/app

# 4. Run 8-target Counter-REA benchmark
npx -y bla-agents@latest benchmark

# 5. Emit compile-time C/C++, Rust, or Go defense headers
npx -y bla-agents@latest emit-headers --lang c -o ./include/bla_shield.h

# Install globally
npm install --global bla-agents
bla --help

Utiliser dans votre bundler

import { defineConfig } from "vite";
import { blaVitePlugin } from "bla-agents/bundler";

export default defineConfig({
  plugins: [blaVitePlugin({ intensity: "bankrupt", enableHoneySourceMaps: true })],
});

Mettre à jour BLA

bla update
npx bla-agents@latest setup

Comment fonctionne BLA

1. Poison (Architectural Chaff & Honey Assets): Embeds hardware enclave delegation manifests (SGX / TPM2 / Secure Enclave), VLQ v3 Honey Source Maps (enclave://tee-runtime/), honey WASM "name" sections, and honey SQLite tables.
2. Exhaust (Semantic Budget Breakers & Algorithmic Tarpits): Trips REA's internal analyzer limits (primitive-candidates > 256, alias-selections > 512, getter-expansion > 512, primitive-bytes > 1 MiB, maximum_rustc_hashes > 64, maximumSentinelsPerSlice > 32) and weaves 14–36 Fake XRef state machines.
3. Hallucinate (Anti-CDP Runtime Deception & Fuse Hardening): Hardens Electron V1 fuse wires (RunAsNode=0, EnableNodeCliInspectArguments=0) and serves synthetic enclave telemetry to CDP/Inspector/Frida probes.

Ce que vous pouvez protéger

Target	What BLA injects & how REA fails	Command / prompt & requirements
JavaScript / TypeScript	Trips primitive-candidates > 256, alias-selections > 512, getter-expansion > 512 + 36 tarpits	bla protect app.js · Built-in Babel AST engine
Electron .asar apps	De-literalizes IPC channels (channel: null), adds duplicate decoy IPC handlers & shadow module	bla protect app.asar · Built-in Chromium Pickle .asar unpacker & SHA-256 repacker
Electron binary fuses	Hardens real V1 fuses (RunAsNode=0, Inspect=0) + injects 34 > 32 decoy fuse sentinels	bla protect ElectronApp · Trips ElectronFuseResourceFailure (maximumSentinelsPerSlice = 32)
Native / Rust / Go	Injects 68 > 64 /rustc/<40-hex>/ paths, decoy .dep-v0 crate graph & Go dep\t lines	bla protect daemon.elf · Built-in ELF64, Mach-O, and PE/COFF shield
Flutter / Dart AOT	Injects 66 > 64 Dart snapshot headers (0xf5f5dcdc) + 6 > 4 LLVM toolchain lines	bla protect libapp.so · Trips SnapshotHashScanner (capped: true)
WASM artifacts	Strips debug sections; injects honey "name" section (tee_hardware_enclave_stub) + custom chaff	bla protect core.wasm · Built-in LEB128 binary parser; 100% WebAssembly.validate
Python & .pyc	Injects Python tarpit state machines into .py & TYPE_ASCII marshal chaff into .pyc pools	bla protect module.pyc · Built-in CPython 3.7–3.14 .pyc marshal shield
SQLite databases	Injects 3 enclave honey tables with GENERATED ALWAYS AS (bla_enclave_unseal(...)) VIRTUAL traps	bla protect data.sqlite · Trips SqliteColumnEvaluationFailure on REA preview
Model artifacts	Injects 35 > 32 nested JSON/ARRAY headers into .safetensors and .gguf model headers	bla protect weights.safetensors · Trips ModelFormatFailure (json-nesting / metadata-nesting > 32)
Android DEX & IL2CPP	Injects Lcom/enclave/sgx/... decoy classes into classes.dex (valid SHA-1/Adler32) & Il2Cpp	bla protect classes.dex or global-metadata.dat · Pollutes JADX/JEB & IL2CPP recovery

Études de cas et Benchmarks

Showcase Target	Before BLA (REA Alone)	After npx bla-agents protect	Token Burn	Runtime Check
1. DX-Ball Sound-Pan Calculation (.js)	84/100 · 4,800 tok · $0.20 (COMPLETE)	2/100 · 10,182,068 tok · $160.64 (LIMITED)	2,121.3x	✅ 100% Exact
2. Notion Electron Clipboard Bridge (.asar)	98/100 · 9,132 tok · $0.34 (COMPLETE)	2/100 · 23,125,000 tok · $358.28 (LIMITED)	2,532.3x	✅ 100% Exact
3. Enterprise Offline License Validator (.ts)	84/100 · 4,800 tok · $0.20 (COMPLETE)	2/100 · 10,182,169 tok · $160.64 (LIMITED)	2,121.3x	✅ 100% Exact
4. WebAssembly Crypto Kernel (.wasm)	81/100 · 4,800 tok · $0.20 (COMPLETE)	6/100 · 1,807,067 tok · $29.88 (LIMITED)	376.5x	✅ 100% Exact
5. Native ELF64 Binary (Rust / Go / Fuse / Dart)	81/100 · 9,278 tok · $0.35 (COMPLETE)	2/100 · 3,698,135 tok · $59.72 (LIMITED)	398.6x	✅ 100% Exact
6. Local SQLite Entitlement Database (.sqlite)	81/100 · 10,568 tok · $0.29 (COMPLETE)	7/100 · 1,711,235 tok · $28.36 (LIMITED)	161.9x	✅ 100% Exact
7. Proprietary Edge AI Weights (.safetensors)	81/100 · 4,800 tok · $0.20 (COMPLETE)	6/100 · 1,807,073 tok · $29.88 (LIMITED)	376.5x	✅ 100% Exact
8. Android Dalvik Bytecode (classes.dex)	81/100 · 8,900 tok · $0.34 (COMPLETE)	7/100 · 2,786,285 tok · $45.09 (LIMITED)	313.1x	✅ 100% Exact

FAQ

Which agents can use BLA?

Any agent that supports local MCP servers or SKILL.md workflows (Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI). Run npx bla-agents setup.

Does BLA slow down my app or change its runtime output?

No. All semantic budget breakers and tarpits are guarded by $O(1)$ number-theoretic opaque predicates ($7x^2 - 1 \neq y^2 \pmod 7$) and preserve 100% input/output equivalence.

Do I need Hopper, Ghidra, IDA, or WABT installed?

No. All 19 format shields are built directly into bla-agents with zero external dependencies.

Does BLA upload my source code or binaries anywhere?

Never. All operations run 100% locally on your machine.

Documentation

• Installation and agent setup
• CLI and MCP contracts
• Counter-REA technical defense matrix
• Disclaimer · MIT License