CrackMe v8 — Aegis entitlement challenge
The public target is literally bla harden output (bankrupt + --self-seal): Node license gate + HTML panel + WebAssembly unlock core, absorbing red/blue R1–R12 packaging recipes.
Why v8
v7 Meridian cleartext stayed maintainer-private, so it could not honestly be re-hardened for 2.0. Aegis graduates the standing red/blue entitlement design: unlock-in-WASM, SHA-256(key) mask KDF, commitment outside XOR, seed-derived rounds/pad3, arity-2 / export-order / body-index hygiene — all under real hardenProject() with no --allow-*.
Surface
- Unlock-in-WASM — SHA-256(key) mask KDF + clear commitment segment (not under XOR)
- Host contract — arity-2 +
FLAG{…}+ certificate digest (order/name-independent) - Self-seal — sibling integrity binding; uniform DENIED on wrong key / honeypot canary
Run
npm run crackme:v8 -- '<16-char-key>'Submit a solve
Hash the FLAG with SHA-256 and open a GitHub issue using the CrackMe v8 solve template. The hash must match flagSha256 in challenge/v8/SEAL.json (plaintext key and FLAG are not in git).
Honest scope
BLA raises cost for automated AI reverse-engineering agents and plants decoys. It does not claim immunity to patient interactive human reverse engineering.