[!IMPORTANT] Get BLA from qybaihe/bla or the bla-agents npm package.

---

REA나 코딩 에이전트가 배포된 앱을 분석해 몇 초 만에 핵심 로직을 복제하는 것이 걱정되시나요? 에이전트에게 BLA(Poison → Exhaust → Hallucinate)로 빌드를 보호하도록 지시하세요. 소스 코드 수정 없이 노출도를 감사하고, 엔클레이브 채프와 알고리즘 타르핏을 주입하여 자동 재구성을 차단합니다.

BLA는 네이티브 바이너리, JavaScript 및 Electron 앱, WebAssembly, Python 바이트코드, SQLite 데이터베이스, AI 모델, 모바일 패키지를 보호하는 도구를 에이전트에 연결합니다. 모든 보호 작업은 로컬에서 실행되며 원래의 런타임 동작을 100% 유지합니다.

빠른 시작

에이전트 설정

npx bla-agents setup

에이전트에게 요청하기

• 1. Audit (Pre-flight REA Audit):

  Audit my ./dist directory against REA, show me every exposed module and IPC channel, and estimate how much it would cost Claude to reconstruct it.
  

• 2. Protect (Poison + Exhaust + Hallucinate):

  Protect ./dist/app.asar with BLA at bankrupt intensity, inject enclave chaff and algorithmic tarpits, and output to ./dist/app.shielded.asar.
  

• 3. Verify (Verify Defense & Token Burn):

  Verify ./dist/app.shielded.asar against the original ./dist/app.asar and confirm that REA's examination degrades to limited status.
  

터미널에서 사용하기

# 1. Audit exposure
npx -y bla-agents@latest audit /absolute/path/to/app --json

# 2. Protect artifact
npx -y bla-agents@latest protect /absolute/path/to/app -o /absolute/path/to/app.shielded --intensity bankrupt

# 3. Verify Counter-REA resistance
npx -y bla-agents@latest verify /absolute/path/to/app.shielded /absolute/path/to/app

# 4. Run 8-target Counter-REA benchmark
npx -y bla-agents@latest benchmark

# 5. Emit compile-time C/C++, Rust, or Go defense headers
npx -y bla-agents@latest emit-headers --lang c -o ./include/bla_shield.h

# Install globally
npm install --global bla-agents
bla --help

번들러에서 사용하기

import { defineConfig } from "vite";
import { blaVitePlugin } from "bla-agents/bundler";

export default defineConfig({
  plugins: [blaVitePlugin({ intensity: "bankrupt", enableHoneySourceMaps: true })],
});

BLA 업데이트

bla update
npx bla-agents@latest setup

BLA 작동 방식

1. Poison (Architectural Chaff & Honey Assets): Embeds hardware enclave delegation manifests (SGX / TPM2 / Secure Enclave), VLQ v3 Honey Source Maps (enclave://tee-runtime/), honey WASM "name" sections, and honey SQLite tables.
2. Exhaust (Semantic Budget Breakers & Algorithmic Tarpits): Trips REA's internal analyzer limits (primitive-candidates > 256, alias-selections > 512, getter-expansion > 512, primitive-bytes > 1 MiB, maximum_rustc_hashes > 64, maximumSentinelsPerSlice > 32) and weaves 14–36 Fake XRef state machines.
3. Hallucinate (Anti-CDP Runtime Deception & Fuse Hardening): Hardens Electron V1 fuse wires (RunAsNode=0, EnableNodeCliInspectArguments=0) and serves synthetic enclave telemetry to CDP/Inspector/Frida probes.

보호 가능한 대상

Target	What BLA injects & how REA fails	Command / prompt & requirements
JavaScript / TypeScript	Trips primitive-candidates > 256, alias-selections > 512, getter-expansion > 512 + 36 tarpits	bla protect app.js · Built-in Babel AST engine
Electron .asar apps	De-literalizes IPC channels (channel: null), adds duplicate decoy IPC handlers & shadow module	bla protect app.asar · Built-in Chromium Pickle .asar unpacker & SHA-256 repacker
Electron binary fuses	Hardens real V1 fuses (RunAsNode=0, Inspect=0) + injects 34 > 32 decoy fuse sentinels	bla protect ElectronApp · Trips ElectronFuseResourceFailure (maximumSentinelsPerSlice = 32)
Native / Rust / Go	Injects 68 > 64 /rustc/<40-hex>/ paths, decoy .dep-v0 crate graph & Go dep\t lines	bla protect daemon.elf · Built-in ELF64, Mach-O, and PE/COFF shield
Flutter / Dart AOT	Injects 66 > 64 Dart snapshot headers (0xf5f5dcdc) + 6 > 4 LLVM toolchain lines	bla protect libapp.so · Trips SnapshotHashScanner (capped: true)
WASM artifacts	Strips debug sections; injects honey "name" section (tee_hardware_enclave_stub) + custom chaff	bla protect core.wasm · Built-in LEB128 binary parser; 100% WebAssembly.validate
Python & .pyc	Injects Python tarpit state machines into .py & TYPE_ASCII marshal chaff into .pyc pools	bla protect module.pyc · Built-in CPython 3.7–3.14 .pyc marshal shield
SQLite databases	Injects 3 enclave honey tables with GENERATED ALWAYS AS (bla_enclave_unseal(...)) VIRTUAL traps	bla protect data.sqlite · Trips SqliteColumnEvaluationFailure on REA preview
Model artifacts	Injects 35 > 32 nested JSON/ARRAY headers into .safetensors and .gguf model headers	bla protect weights.safetensors · Trips ModelFormatFailure (json-nesting / metadata-nesting > 32)
Android DEX & IL2CPP	Injects Lcom/enclave/sgx/... decoy classes into classes.dex (valid SHA-1/Adler32) & Il2Cpp	bla protect classes.dex or global-metadata.dat · Pollutes JADX/JEB & IL2CPP recovery

쇼케이스 및 벤치마크

Showcase Target	Before BLA (REA Alone)	After npx bla-agents protect	Token Burn	Runtime Check
1. DX-Ball Sound-Pan Calculation (.js)	84/100 · 4,800 tok · $0.20 (COMPLETE)	2/100 · 10,182,068 tok · $160.64 (LIMITED)	2,121.3x	✅ 100% Exact
2. Notion Electron Clipboard Bridge (.asar)	98/100 · 9,132 tok · $0.34 (COMPLETE)	2/100 · 23,125,000 tok · $358.28 (LIMITED)	2,532.3x	✅ 100% Exact
3. Enterprise Offline License Validator (.ts)	84/100 · 4,800 tok · $0.20 (COMPLETE)	2/100 · 10,182,169 tok · $160.64 (LIMITED)	2,121.3x	✅ 100% Exact
4. WebAssembly Crypto Kernel (.wasm)	81/100 · 4,800 tok · $0.20 (COMPLETE)	6/100 · 1,807,067 tok · $29.88 (LIMITED)	376.5x	✅ 100% Exact
5. Native ELF64 Binary (Rust / Go / Fuse / Dart)	81/100 · 9,278 tok · $0.35 (COMPLETE)	2/100 · 3,698,135 tok · $59.72 (LIMITED)	398.6x	✅ 100% Exact
6. Local SQLite Entitlement Database (.sqlite)	81/100 · 10,568 tok · $0.29 (COMPLETE)	7/100 · 1,711,235 tok · $28.36 (LIMITED)	161.9x	✅ 100% Exact
7. Proprietary Edge AI Weights (.safetensors)	81/100 · 4,800 tok · $0.20 (COMPLETE)	6/100 · 1,807,073 tok · $29.88 (LIMITED)	376.5x	✅ 100% Exact
8. Android Dalvik Bytecode (classes.dex)	81/100 · 8,900 tok · $0.34 (COMPLETE)	7/100 · 2,786,285 tok · $45.09 (LIMITED)	313.1x	✅ 100% Exact

자주 묻는 질문 (FAQ)

Which agents can use BLA?

Any agent that supports local MCP servers or SKILL.md workflows (Claude Code, Cursor, Codex, Gemini CLI, Windsurf, Google Antigravity, OpenCode, VS Code, and GitHub Copilot CLI). Run npx bla-agents setup.

Does BLA slow down my app or change its runtime output?

No. All semantic budget breakers and tarpits are guarded by $O(1)$ number-theoretic opaque predicates ($7x^2 - 1 \neq y^2 \pmod 7$) and preserve 100% input/output equivalence.

Do I need Hopper, Ghidra, IDA, or WABT installed?

No. All 19 format shields are built directly into bla-agents with zero external dependencies.

Does BLA upload my source code or binaries anywhere?

Never. All operations run 100% locally on your machine.

문서

• Installation and agent setup
• CLI and MCP contracts
• Counter-REA technical defense matrix
• Disclaimer · MIT License

Star 기록

Star History가 qybaihe/bla의 GitHub Star 증가를 그립니다. 이미지는 약 하루 캐시되며 초 단위 수치가 아닙니다. 이미지를 누르면 전체 기록이 열립니다.