What is recaptcha-vm?

This is a Rust-based research project that reverse-engineers the virtual machine Google embeds inside reCAPTCHA. reCAPTCHA runs a custom bytecode interpreter inside your browser to collect fingerprinting signals (mouse movement, timing, browser properties, and so on) before deciding whether to show a challenge. This project documents and implements the tools to read and analyze that bytecode. The repository contains four components. The bytecode module handles decoding and decrypting the two forms of bytecode the VM uses. The configuration bytecode is loaded first, carrying encrypted strings and encryption keys, it is decrypted by XOR-folding two separate keys to produce a seed, then running a linear congruential generator over the encrypted bytes. The main bytecode is dynamically constructed inside reCAPTCHA's JavaScript and contains the fingerprint collection logic, it is encrypted separately during execution and decrypted at VM boot. The disassembler module reads the decrypted bytecode and translates it into a human-readable list of instructions. The project documents all 42 opcodes in the VM's instruction set, covering arithmetic, string operations, property access on JavaScript objects and the window, conditional jumps, function calls, event handling, and several specialized operations like obtaining the current performance timestamp or decrypting an encrypted string from the character set. The VM runs with 2048 registers. The instruction pointer and register indices are encoded as variable-length 7-bit continuation integers. The decompiler module is partially complete. The control flow graph analyzer (which maps the branching structure of the bytecode) and the instruction lifter (which converts raw instructions into a higher-level representation) are done, but the full decompiler output is still a work in progress. The encryption module handles the payload encryption functions the VM uses when sending signals back out of the browser context. This project is aimed at security researchers, bot-detection analysts, and developers who need to understand what reCAPTCHA is measuring inside their users' browsers. Reading the code requires comfort with Rust and with concepts like bytecode interpreters and XOR-based obfuscation.