index.js

/**
 * ⚠️ PRIVACY RESEARCH USE ONLY
 * For authorized testing environments that comply with all applicable laws.
 * See: https://github.com/botswin/FunCaptcha-Privacy-Research/blob/main/DISCLAIMER.md
 */

// @ts-check

import { generate } from '@babel/generator';
import parser from '@babel/parser';
import axios from 'axios';
import fs from 'fs/promises';
import puppeteer from 'puppeteer';
import {
    bindSingleArgCalls,
    convertComputedToProperty,
    evaluateAndInlineCalls,
    inlineImmutableBindings,
    mergeStringConcat,
    removeArrayFunctions,
    removeShuffleIIFE,
} from './utils.js';

const LANDING_URL = 'https://blizzard-api.arkoselabs.com/v2/2.16.0/enforcement.f845a08949c076f42e09da2c4b7496a6.html';

(async () => {
    // Launch headless browser
    const browser = await puppeteer.launch({ headless: true });
    const page = await browser.newPage();

    // Enable request interception
    await page.setRequestInterception(true);

    /** @type {string} */
    let originalScript;

    page.on('request', async (request) => {
        const url = request.url();

        if (url === LANDING_URL) {
            const { data: html } = await axios.get(url);
            // remove Content-Security-Policy meta
            let modifiedHtml = html.replace(/<meta http-equiv="Content-Security-Policy"[^>]*>/, '');

            // remove attribute "integrity" from script tags
            modifiedHtml = modifiedHtml.replace(/<script[^>]*integrity="[^"]*"[^>]*>/g, (match) => {
                return match.replace(/ integrity="[^"]*"/, '');
            });

            // Respond with modified HTML
            await request.respond({
                status: 200,
                contentType: 'text/html; charset=utf-8',
                body: modifiedHtml,
            });

            return;
        }

        // Intercept any request matching "/enforcement.*.js"
        if (/\/enforcement\..*\.js$/.test(url)) {
            // Fetch the script via Axios
            ({ data: originalScript } = await axios.get(url));

            // Perform AST transformation
            let ast = parser.parse(originalScript);
            inlineImmutableBindings(ast);
            ast = bindSingleArgCalls(ast);

            const modifiedScript = generate(ast, { retainLines: true }).code;

            // Respond with modified script
            await request.respond({
                status: 200,
                contentType: 'application/javascript; charset=utf-8',
                body: modifiedScript,
            });

            return;
        }

        await request.continue();
    });

    await page.goto(LANDING_URL, { waitUntil: 'networkidle0' });

    // Perform additional transformations
    const ast = parser.parse(originalScript);
    inlineImmutableBindings(ast);
    bindSingleArgCalls(ast);

    // Evaluate and inline function calls
    await evaluateAndInlineCalls(page, ast);

    mergeStringConcat(ast);
    convertComputedToProperty(ast);
    removeArrayFunctions(ast);
    removeShuffleIIFE(ast);
    const modifiedScript = generate(ast, { retainLines: false }).code;

    // Save the modified script to a file
    const outputPath = './funcaptcha.transformed.js';
    const prettier = await import('prettier');
    const prettierConfig = await prettier.resolveConfig(outputPath);
    const formatted = await prettier.format(modifiedScript, {
        ...prettierConfig,
        filepath: outputPath,
    });
    await fs.writeFile(outputPath, formatted, 'utf-8');

    // Close the browser
    await browser.close();
    console.log(`Transformed script saved to ${outputPath}`);
})();