qybaihe/bla

选用指南

AI 根据 README 整理 · 2026/10/29 23:11:52

使用方式

通过命令行使用，如 `npx bla-agents harden .` 或 `bla harden .`，也可通过 MCP 或编码代理调用。

查看 README 依据

[Quick start](#quick-start) · [Empirical results](#empirical-results-vs-real-rea) · [Format coverage](#format-coverage) · [Benchmark](#benchmark-14-targets-internal-estimates) · [FAQ](#faq) ```bash bla harden . # or tell your agent: "Harden my software against REA" ``` </div> > [!IMPORTANT] > BLA is a **defensive** tool for protecting **your own** software. See [DISCLAIMER.md](DISCLAIMER.md). > Get BLA from [qybaihe/bla](https://github.com/qybaihe/bla) or [npm `bla-agents`](https://www.npmjs.com/package/bla-agents). <div align="center">

| **Hallucinate** | Leave the analyzer with truncated inventories, redaction failures, and ambiguous rabbit holes — while **runtime stays equivalent**. | One sentence covers the common case (auto-discovers `dist/` / `build/` / `.asar` / `.wasm` / `.sqlite` / models / … and runs audit → protect → verify): ```bash npx bla-agents harden . # MCP / agent: bla_harden · "Harden my software against REA" ``` Same pipeline as `bla defend` / `bla_defend` when you already know the path; `harden` is the default one-command UX. ## Quick start ```bash

部署要求

需要 Node.js ^22.23.4 或 24.x，可选安装 Wabt 和 tshark 以进行完整的红队测试。

查看 README 依据

# Node.js ^22.23.4 or 24.x recommended (REA red-team needs zlib.zstd on 22.23+) npx bla-agents setup # register MCP + skill with your coding agent npx bla-agents harden . # one-command Counter-REA pass on the current project npx bla-agents benchmark # 14-target showcase (local estimates + runtime checks) ``` Ask your agent after setup: ```text Harden my software against REA ``` Or run stages explicitly: `audit` · `protect` · `verify` · `defend` — see [CLI and MCP](docs/cli-and-mcp.md). --- ## Empirical results vs real REA

Recorded under **Node v24.22.1** with optional **Wabt 1.0.42** + **tshark 4.4** when noted. Soft-skips keep Node 22 / CI green when tooling is absent. | Format | Before → after | REA outcome after BLA | Budget / error | | --- | ---: | --- | --- | | **Go buildinfo** | 50 KiB → 1.16 MiB | capacity error | `MAX_BUILD_INFO_BYTES` (1 MiB) — *Go build-info string length exceeds the 1 MiB limit* | | **Erlang BEAM** | 84 B → 262 KiB | capacity error | `max_chunks` — *BEAM form exceeds the 64-chunk budget* |

已知限制

作者明确说明：APK 重新签名不受支持；某些原生工具（如 Ghidra、Frida、LLDB）未在此环境中验证；固件、SPIR-V、CUDA fatbinary 和 AMD GPU 对象未进行端到端测试。

查看 README 依据

### Designed-for but **not** empirically verified here These shields exist in-tree and are covered by unit tests / catalog drift checks, but the matching REA path needs **native tooling we did not run** on this box: | Area | Why unverified here | | --- | --- | | Ghidra / native decompilation depth | Requires a Ghidra install + REA bridge | | Frida / LLDB / GDB / Rizin live sessions | Requires those debuggers + device/process attach | | JADX / full Android APK pipeline | APK resigning unsupported; DEX shield is in-tree |

| **Firmware** containers | Skipped — staging/extraction budgets exist; no honest E2E without firmware corpora | | **SPIR-V / CUDA fatbinary / AMD GPU objects** | Skipped — need native GPU object decoders; **PTX text** is shielded in-tree (benchmark only, not a REA GPU-object budget hit) | | EVMole in-process EVM decode | Documented as not pathable in-process; EVM shield still densifies to the 4 MiB input approach | We do **not** claim those paths are empirically bankrupt until `redteam:rea` (or an equivalent harness) records a real before/after against the live analyzer. ---