dsl-vm-reverse

🔄 DSL Custom VM Reversing (DSL VM Reverse Engineering)

For reversing custom WASM virtual machines / risk-control engines implemented in JavaScript

---

Table of Contents

• 1. Scope
• 2. DSL VM Identification Traits
• 3. General Reversing Workflow
• 4. Opcode Extraction and Classification
• 5. Runtime Capture Approaches
• 6. Common Status Codes
• 7. Skill Self-Check List

---

1. Scope

Use this skill when the target file matches any of the following traits:

#	Trait	Description
1	IIFE opening + many single-letter variable names	!function(){var U=void 0,y=parseInt,E0=Function,...}
2	Contains DG() or a similar function with a switch-case loop	Interpreter main loop; d[7]&31 decodes the opcode
3	Large file (500KB+) but zero-byte ratio < 1%	Not standard WASM; pure JS
4	Contains C[number] constant-table references	C[9][xxx] function table/string table
5	Single-line minified code	583KB one-liner, obfuscated variable names

Exclusion Rules

Condition	Not this skill	Go to
File starts with \x00asm	Standard WASM binary	reverse-engineering/languages.md
File contains WASM magic as Uint8Array([0,97,115,109])	Embedded WASM	Extract the .wasm, then move to IDA/Ghidra
Standard Webpack bundle (function(e,t,n){...})	Plain JS	js-reverse/
Zero-byte ratio > 20%	WASM binary	reverse-engineering/languages.md

---

2. DSL VM Identification Traits

Code Traits

// Trait 1: IIFE entry; single-letter variables map to numeric constants
!function(){
    var U=void 0, y=parseInt, E0=Function, AN=Uint8Array;
    var E=15, l=10, m=12, x=16, S=13, $=11;
    // Numeric constants are mapped to variable names, replacing raw numbers
    ...
}

// Trait 2: Interpreter main loop DG()
function DG(C, d, ...) {
    var d = [];  // Array simulating the WASM stack/locals
    for (d[7] = x; d[7] !== U;) {
        var aE = d[7] & 31;         // Low 5 bits = opcode
        var O = d[7] >> 5 & 31;      // High 5 bits = sub-operation
        switch (aE) {
            case 0: /* ... */ d[7] = 612; break;
            case 1: /* ... */
            // ... N cases
        }
    }
}

// Trait 3: Constant table C[9] stores function indices and strings
// C[9][0] = ["pc"]      → function parameter descriptors
// C[9][667] = "string"  → string constants
// C[9][x] = number      → function indices

// Trait 4: W(C[index], null, ...) call pattern
// W = Function.prototype.call.bind(call)
// All builtin functions are invoked via C[index] indexing

// Trait 5: Instruction encoding format
// d[7] = opcode(bit 0-4) | subop(bit 5-9) | operand(bit 10+)