Backend · Java · Programmer

AI Cracks an Obfuscated Wallpaper API in Minutes, No Manual JS Tracing Required

By SimonKing · Aug 25, 2026

Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Obfuscation that once demanded specialized reverse-engineering skill now collapses under commodity AI tooling. Defenders relying on frontend encryption as a data-scraping barrier face a threat model where the attacker's cost has dropped to near zero.

Summary

The Zhefeng Wallpaper site wraps its API requests and responses in Base64-encoded AES-128-CBC ciphertext with PKCS7 padding, making manual reverse engineering a grind through minified, unreadable JavaScript. Traditional breakpoint debugging on the request path yields little usable context. Feeding the site URL directly to an AI agent (opencode) identifies the exact encryption algorithm and key location without step-by-step human analysis. A follow-up prompt then generates multiple breakpoint strategies that pinpoint the decryption routine in the browser debugger, turning a multi-hour task into a few minutes of guided interaction.

Takeaways

— Zhefeng Wallpaper encrypts its API traffic with AES-128-CBC and PKCS7 padding, then Base64-encodes the ciphertext.

— Manual breakpoint debugging on the request path alone was insufficient to locate the decryption logic inside heavily obfuscated JS bundles.

— Pointing an AI coding agent at the live URL automatically identified the encryption scheme and the relevant code locations.

— A second AI prompt produced concrete breakpoint methods that led directly to the decrypted data in the browser debugger.

— The entire reverse-engineering workflow collapsed from hours of manual tracing into a few minutes of AI-guided interaction.

Conclusions

Frontend encryption as a data-protection strategy is effectively dead against AI-assisted adversaries; the key material lives client-side and AI can find it faster than a human.

The bottleneck in reverse engineering has shifted from technical skill to prompt formulation — knowing what to ask the AI determines success.

Slider CAPTCHAs and similar browser-side controls are equally vulnerable to this class of AI-driven analysis, widening the attack surface for scraping.

Concepts & terms

AES-128-CBC

A symmetric block cipher operating on 128-bit blocks in Cipher Block Chaining mode, where each plaintext block is XORed with the previous ciphertext block before encryption.

PKCS7 padding

A padding scheme that adds N bytes of value N to make the plaintext a multiple of the block size, ensuring the decryption routine can determine the original message length.

Source: juejin.cn ↗ Google Translate ↗ Backup ↗