find-crypto-entry

find-crypto-entry

Locate the generation entry point of the encryption parameter $ARGUMENTS .

Output target: entry location (script URL + line number/column number + function name)

---

Execution flow

Step 0: Network request location (preferred) ⭐

The most efficient path, directly obtain the call stack of a request that has already occurred:

1. list_network_requests({ resourceTypes: ["xhr", "fetch"] }) - List requests
2. get_network_request(reqid) - Confirm the $ARGUMENTS parameter location (URL/Header/Body)
3. get_request_initiator(requestId) - Directly obtain the JS call stack

Result judgment：

• ✅ Call stack valid → jump to Step 3
• ❌ Call stack empty or meaningless → continue to Step 1

---

Step 1: Static search

When Step 0 cannot locate it, perform static analysis:

1. search_in_sources({ query: "$ARGUMENTS" }) - Search for the encryption parameter name

2. Branching logic：

   • Results ≤ 50: check assignment statements (such as headers.$ARGUMENTS = ...）
   • Results > 50: switch to searching for interceptor features:
     • interceptors.request.use
     • XMLHttpRequest.prototype.send
     • window.fetch =

3. find_in_script(scriptId, query) - Obtain the exact line and column numbers

Result judgment：

• ✅ Clear assignment location found → jump to Step 4
• ❌ Too many results or cannot determine → continue to Step 2

---

Step 2: Dynamic breakpoints

When static search cannot lock it down, set breakpoints:

Option A(recommended):

set_breakpoint_on_text({ text: "$ARGUMENTS", urlFilter: "main" })

Option B：

break_on_xhr({ url: "api关键词" })

⚠️ Prompt the user:Please trigger a request containing the $ARGUMENTS parameter in the browser

Result judgment：

• ✅ Breakpoint hit → continue to Step 3
• ❌ Breakpoint not hit → check whether the breakpoint condition is correct, or try another option

---

Step 3: Stack analysis

After obtaining the call stack, perform graylist filtering:

get_paused_info({ includeScopes: true })

Filtering rules：

Level	Feature	Action
Level 1 Skip	axios, react-dom, vue, jquery, webpack/runtime	Framework noise, skip
Level 2 Check	Contains security, encrypt, auth, fingerprint node_modules of	Suspicious security SDK, check
Level 3 Priority	Non-node_modules (/src/, /app/）	Business code, check first

Result judgment：

• ✅ Suspicious frame found → continue to Step 4
• ❌ All framework code → return to Step 2 and try other breakpoint locations

---

Step 4: Confirm the entry point

Verify on the suspicious frame:

evaluate_on_callframe({
  expression: "arguments",
  frameIndex: 0
})

Look for encryption features:

• Bitwise operations:^, &, |, >>>
• Magic constants:0x67452301(MD5), 0x6a09e667(SHA256)

Result judgment：

• ✅ Confirmed as the encryption entry point → output the result
• ❌ Not encryption logic → check the previous frame in the call stack, or return to Step 3 to check other frames

---

Output format

After finding the entry point, output:

入口位置：
- 参数：$ARGUMENTS
- 脚本：https://example.com/static/js/main.abc123.js
- 位置：第 1 行，第 45678 列
- 函数：anonymous (或具体函数名)
- 调用路径：request → addSign → encrypt

---

Notes

1. Prefer using get_request_initiator - no breakpoints needed, most efficient
2. Prefer using set_breakpoint_on_text - friendly to minified code
3. Only find the entry point, do not perform algorithm recovery - keep the skill single-responsibility
4. Each Step has a clear jump after failure - avoid getting stuck