datadome / deob · v2.0 idle

// drop a .js file // or click to browse — no file

— / — modules / — reduced orig — deob — warn —

▸ console 0 entries

▸ dynamic_challenge —

—

▸ wasm payload —

—

~/api/deobfuscate

http api

// drop a captcha or interstitial bundle, get a json response. node 18+ only.

[01] POST /api/deobfuscate

default. accepts application/json, multipart/form-data, or raw js. returns one json object with the modules, stats, dynamic_challenge, and wasm summary.

curl -X POST https://new-datadome-deobfuscator.glizzykingdreko.com/api/deobfuscate \
  -H 'content-type: application/json' \
  -d '{"source": ""}'

[02] POST /api/deobfuscate?stream=1

streaming variant. returns application/x-ndjson with one json event per line as the worker progresses. ideal for long bundles or live log dashboards.

curl -N -X POST 'https://new-datadome-deobfuscator.glizzykingdreko.com/api/deobfuscate?stream=1&level=INFO' \
  -H 'accept: application/x-ndjson' \
  -H 'content-type: application/json' \
  -d '{"source": ""}'

[03] response shape

{
  "bundleType": "captcha",
  "modules": {
    "captcha":      "",
    "vm-obf":       "",
    "bean":         "",
    "hash":         "",
    "helpers":      "",
    "main":         "",
    "mouseMaths":   "",
    "picasso":      "",
    "slidercaptcha":""
  },
  "moduleOrder": ["captcha", "vm-obf", "bean", "hash", ...],
  "dynamic_challenge": "(((... ^ ...) >>> 0) ...)",
  "wasm": {
    "wasmBytes": 27124,
    "helperCount": 4,
    "windowAttributes": ["..."],
    "providerName": "...",
    "fields": ["..."]
  },
  "stats": {
    "original":         480340,
    "deobfuscated":     421087,
    "reduction":        59253,
    "reductionPercent": "12.33%"
  },
  "warnings": 1,
  "errors":   []
}

[04] ndjson event types (stream mode)

{"type":"open",   "t":1714325000000}
{"type":"meta",   "t":1714325000050, "bytes":480340}
{"type":"log",    "t":1714325000158, "level":"INFO",  "message":"[Deobfuscator] Replacing t-matrix..."}
{"type":"log",    "t":1714325000233, "level":"INFO",  "message":"[Deobfuscator] Phase 3.5: harvested 25 helpers..."}
{"type":"result", "t":1714325004866, "elapsedMs":4773, "data": { /* same shape as above */ }}
{"type":"done",   "t":1714325004870, "exitCode":0}

[05] errors

400 bad input · 405 method not allowed · 500 worker crashed (returned in {type:"error"} on stream).

~/npm/datadome-deobfuscator

node module

// the same pipeline as the dashboard, available as a node library and a cli.

[01] install

npm i datadome-deobfuscator
# or: pnpm add datadome-deobfuscator
# or: yarn add datadome-deobfuscator

[02] library

const fs = require('fs');
const { deobfuscate } = require('datadome-deobfuscator');

const source = fs.readFileSync('captcha.js', 'utf8');
const result = deobfuscate(source, { logLevel: 'INFO' });

console.log(result.bundleType);             // 'captcha' | 'interstitial' | 'unknown'
console.log(result.moduleOrder);            // ['captcha', 'vm-obf', 'bean', ...]
console.log(result.stats.reductionPercent); // '12.33%'

for (const [name, code] of Object.entries(result.modules)) {
  fs.writeFileSync(`out/${name}.js`, code);
}

[03] options

deobfuscate(source, {
  logLevel:         'INFO',  // 'DEBUG' | 'INFO' | 'WARN' | 'ERROR' | 'NONE'
  logger:           myLogger, // optional, overrides logLevel
  maxPasses:        10,       // iterative-pass cap
  generatorOptions: { /* @babel/generator opts */ },
});

[04] cli

# direct
npx datadome-deobfuscate input.js out/

# with a structured report on the side
npx datadome-deobfuscate input.js out/ --report out/report.json

# silence the stdout delimiter
npx datadome-deobfuscate input.js out/ --no-delimiter

[05] exit codes

0   clean run, no errors (warnings tolerated)
1   fatal error: bad input, parse failure, or unexpected crash
2   finished, but at least one module recorded errors

[06] stdout contract for downstream tooling

the line right after ===DEOBFUSCATOR_RESULT=== contains the same json the --report flag writes to disk:

report = json.loads(
    out.split('===DEOBFUSCATOR_RESULT===', 1)[1].strip().splitlines()[0]
)
if report['status'] != 'success':
    for e in report['errors']:
        print(e['message'])