Reverse Engineering Tencent Slider CAPTCHA: Full Walkthrough of the CO Value Encryption Algorithm

Overview

Slider CAPTCHAs are one of the most common human-machine verification mechanisms on the internet. From a technical evolution standpoint, the Slider CAPTCHA is an important variant of CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart). Unlike traditional text-recognition CAPTCHAs, it distinguishes humans from bots by collecting behavioral signals such as mouse trajectories, sliding speed, and acceleration curves — making it significantly more resistant to automated attacks. Tencent's Slider CAPTCHA (TDC, also known as Tencent Waterproof Wall) layers additional countermeasures on top of this: it protects core encryption logic through JS obfuscation and VM sandboxing, while simultaneously using environment fingerprinting to detect automation tools. Thanks to its multi-layer encryption and sophisticated environment detection, it has long been a classic challenge in the JS reverse engineering field. This article provides a complete breakdown of how to use AI assistance to reconstruct Tencent's core CAPTCHA encryption algorithm — covering request parameter analysis, CO value encryption logic tracing, browser environment simulation, and full Python automation.

Request Flow and Key Parameter Analysis

Packet Capture and Endpoint Identification

Open the browser's developer tools (F12), switch to the Network panel, and trigger the slider CAPTCHA. You'll observe the following key requests:

• Image endpoint: Returns URLs for the gap image and background image, along with important parameters like TDCParse (TDC file address) and SESS
• TDC.js file: Contains the EKS value and core encryption logic
• Slide verification endpoint: Submits the sliding result and returns an ERROR CODE (0 = pass, 50 = fail)

Core Payload Parameter Reference

The request payload for the slide verification endpoint contains the following key fields:

Parameter	Description
CO	Core encrypted value, generated locally by JS, approximately 1600–1700 characters long
TLG	Length of the CO value
EKS	Encryption key extracted from the TDC.js file
SESS	Session identifier, sourced from the image endpoint response
NS	Contains sliding distance and related info; the first value is the movement distance
UA	User-Agent; testing shows this is not strictly required

The CO value is the core ciphertext of the entire verification flow and the primary target of the reverse engineering effort.

Tracing the CO Value Encryption Logic and Setting Breakpoints

Fundamentals of JS Reverse Engineering

JS reverse engineering refers to the process of analyzing obfuscated or minified JavaScript code to reconstruct its original logic. Common techniques include: breakpoint debugging (setting breakpoints in Chrome DevTools to step through execution), AST (Abstract Syntax Tree) analysis, and hooking (hijacking native functions to observe their arguments and return values). For CAPTCHA reverse engineering, the core goal is typically to locate the encryption function's entry point, understand the environment variables it depends on, and ultimately reproduce the same encrypted output in a controlled environment.

Locating the CO Value Encryption Entry Point

Searching for a keyword in DevTools (such as the CO assignment statement with a colon) will lead you to the encryption entry point. The core call chain is:

o.getTCDData() → URL decode → obtain CO ciphertext value

Diving into the getTCDData method, you'll find a ternary expression that ultimately redirects to the W method. This method lives inside the tdcgs file — which is where the entire CO value encryption algorithm resides.

Key Details About the iframe Environment

An iframe (inline frame) is an HTML tag used to embed an independent document within a page. Browsers enforce strict Same-Origin Policy isolation for iframes: cross-origin iframes cannot directly access each other's DOM, cookies, or JavaScript variables. Tencent's decision to run the CAPTCHA logic inside an isolated iframe achieves component-level separation while also increasing the complexity of reverse engineering.

One detail that's very easy to overlook: Tencent's Slider CAPTCHA runs inside an iframe tag. When debugging, you must switch to the iframe's execution context — otherwise, the session data and DOM information you retrieve will belong to the parent page, causing inconsistent encryption results. In Chrome DevTools, you can switch to the target iframe using the context selector in the top-left corner of the console. In practice, script breakpoints (global Script breakpoints) are an effective way to accurately capture the execution flow inside the iframe.

AI-Assisted Browser Environment Simulation

Why Environment Simulation Is Necessary

Browsers expose a large number of Web APIs, including DOM interfaces (document, Element), BOM interfaces (window, navigator, location), Canvas 2D/WebGL drawing interfaces, and the Web Crypto API. When browser-side JS code is ported to Node.js, none of these APIs exist, and the code will immediately throw ReferenceError. There are two traditional approaches to environment simulation: one is to use libraries like jsdom to emulate a full DOM environment, but support for Canvas, WebGL, and other graphics APIs is limited; the other is to manually stub out each missing object one by one — precise, but time-consuming.

Once you've fully extracted the tdcgs source file, this becomes the biggest challenge: the code was originally designed to run in a browser, and executing it directly in Node.js will produce a flood of errors due to missing browser APIs. Tencent TDC's environment detection also actively probes for Canvas fingerprints, font lists, WebGL renderer information, and more — so environment simulation isn't just about preventing crashes; the return values also need to look like genuine browser output. Using AI-assisted programming can dramatically reduce the effort required to simulate the browser environment, and this is the core methodology of this article.

Input Materials to Provide to the AI

In practice, you need to supply the AI with the following materials:

1. The tdcgs source file: The complete encryption logic code
2. An environment template: Existing browser environment simulation code from another project as a reference

One-line Summary

A complete reverse engineering walkthrough for reconstructing Tencent Slider CAPTCHA's core encryption algorithm with AI assistance

Paragraph Summary

This article provides a detailed breakdown of the full reverse engineering process for Tencent's Slider CAPTCHA (TDC Waterproof Wall). It covers packet capture to identify key endpoints and the core CO encryption parameter, JS breakpoint debugging to trace the encryption entry point into the tdcgs file, solving the debugging challenges posed by iframe isolation, and using AI assistance to simulate the missing browser runtime environment (DOM, Canvas, WebGL, and other APIs) in Node.js — ultimately enabling Python-based automation.