jshook-reverse

JavaScript Reverse Engineering Expert

Senior JavaScript reverse engineering expert, proficient in browser automation, code analysis, and deobfuscation.

Core Capabilities

Reverse Engineering: Obfuscated code analysis, VM cracking, Webpack unpacking, AST transformation
Browser Automation: Puppeteer/CDP, anti-detection, fingerprint spoofing
Encryption Identification: AES/RSA/MD5/SHA identification, parameter extraction, algorithm restoration
Anti-Scraping Bypass: Canvas/WebGL fingerprinting, WebDriver hiding, behavior simulation
Debugging Analysis: CDP debugging, breakpoint analysis, dynamic tracing, Hook injection
Hook Injection: Function interception, network monitoring, property hijacking, event tracing, anti-debugging bypass
Anti-Detection Spoofing: Stealth script injection, fingerprint spoofing, platform presets, WebDriver hiding
DOM Inspection: Element querying, structure analysis, clickable element locating
Page Control: Navigation, clicking, input, screenshots, performance monitoring

How It Works

All commands invoke the tool by executing node dist/skill.js <command> [args] .

Features

Smart Code Collection - Supports summary/priority/incremental modes to prevent Token overflow
AI-Driven Deobfuscation - Supports 20+ obfuscation types, automatically restores code
Code Semantic Understanding - AI-assisted analysis of business logic and encryption algorithms
AI Code Summarization - Single-file/batch/project-level summarization, automatically detects encryption/API/obfuscation features
Encryption Algorithm Detection - Automatically identifies AES/RSA/MD5/SHA and custom algorithms
Browser Automation - Automatically detects and launches Chrome/Edge, supports any drive letter
Anti-Detection Spoofing - 16 anti-detection features, 5 platform presets, Canvas/WebGL/AudioContext fingerprint spoofing
CDP Debugger - Complete breakpoint management, execution control, variable inspection
Script Management - Script listing, source retrieval, pattern finding, content search
Runtime Analysis - Expression evaluation, scope variables, dynamic tracing
Statistics and Caching - Complete caching mechanism and statistics
High Performance - Smart compression, incremental collection, on-demand loading

Tool Details

Code Collection

Tool	Description	Feature
collect_code	Smart Code Collection	Automatically collects inline scripts, external scripts, and dynamically loaded scripts on the page, smart summary mode (to prevent Token overflow), priority mode (keyword priority), incremental mode (on-demand retrieval)
search_in_scripts	Keyword Search	Regular expression search, context line count control, maximum match count limit, highlighted display of match results

Code Analysis

Tool	Description	Feature
deobfuscate	AI-Driven Code Deobfuscation	Supports 20+ obfuscation types, variable name restoration, control flow flattening restoration, string decryption, dead code elimination
understand	AI-Assisted Code Semantic Understanding	Business logic analysis, encryption algorithm identification, API call analysis, data flow tracking
summarize	AI-generated code summary	Single-file AI summary generation, batch file concurrent summarization, project-level summary analysis, encryption/API/obfuscation feature detection, security risk assessment, complexity assessment and recommendations
detect_crypto	Detect and analyze encryption algorithms	Standard algorithm identification (AES/RSA/MD5/SHA), custom algorithm detection, parameter extraction, key location

Browser control

Tools	Description	Features
browser_launch	Launch browser	Automatic detection of Chrome/Edge, support for any drive letter (C-Z), multi-browser selection, CDP remote debugging connection, anti-detection script injection
browser_status	Get browser status	Connection status, current page information, CDP session status
browser_close	Close browser	Graceful disconnection, cleanup of CDP session, process management

Debugging analysis

Tools	Description	Features
debugger_control	Debugger control and status management	Enable/disable debugger, get debugger status, initialize advanced features, Watch expression management, XHR breakpoint management, event breakpoint management
breakpoint_manager	Breakpoint management	Set breakpoints by URL, set breakpoints by script ID, conditional breakpoint support, breakpoint list viewing, breakpoint deletion and clearing
execution_control	Execution control	Pause execution, resume execution, Step Into, Step Over, Step Out
runtime_evaluator	Runtime expression evaluation	Evaluate expressions in the current context, access global variables, access local variables, execute arbitrary JavaScript code
variable_inspector	Variable viewing and scope analysis	View current scope variables, view call frame variables, object property expansion, variable type identification
script_manager	Script management and source code retrieval	List all loaded scripts, get script source code, find scripts by URL pattern, script content search, support inline and external scripts

Anti-detection disguise

Tools	Description	Features
stealth_inject	Inject anti-detection script	5 platform presets, Chrome 131+ UA string, hide navigator.webdriver, simulate window.chrome object, Canvas/WebGL/AudioContext fingerprint noise, navigator property consistency, Permissions/Battery/MediaDevices/Notifications/NetworkInformation API simulation, document.hasFocus() override, 16 independently controllable features
stealth_presets	Platform preset management	windows-chrome (Win10+Chrome131)、mac-chrome (macOS+Chrome131)、mac-safari (macOS+Safari18.2)、linux-chrome (Linux+Chrome131)、windows-edge (Win10+Edge131)

Data management

Tools	Description	Features
stats	Get statistics	Cache statistics (file count, size, hit rate), compression statistics (compression rate, space saved), collection statistics (URL count, file count)
clear	Clear all data	Clear file cache, clear compression cache, reset collection status

Command reference

Code collection and search

# 收集代码
collect <url>
collect <url> --smart-mode=summary
collect <url> --smart-mode=priority --priorities=encrypt,sign
collect <url> --compress --max-total-size=5000000

# 搜索脚本
search <keyword>
search "X-Bogus" --context=10
search "function.*encrypt" --regex --max-matches=50

Code analysis

# AI反混淆
deobfuscate <code>

# 代码理解
understand <code>
understand <code> --focus=security

# AI摘要
summarize code <code>
summarize collected
summarize collected --batch

# 加密检测
detect-crypto <code>

Browser control

browser launch          # 自动检测并启动
browser status          # 查看状态
browser close           # 关闭浏览器

Debugger

# 调试器控制
debugger enable
debugger disable
debugger status
debugger init-advanced  # 初始化Watch/XHR/Event/Blackbox

# 断点管理
breakpoint set-url https://example.com/app.js 100
breakpoint set-url https://example.com/app.js 100 0 'x > 10'  # 条件断点
breakpoint set-script <scriptId> <line>
breakpoint list
breakpoint remove <id>
breakpoint clear

# 执行控制
debug-step pause
debug-step resume
debug-step into         # 单步进入
debug-step over         # 单步跳过
debug-step out          # 单步跳出

# 表达式求值
debug-eval window.location.href
debug-eval document.cookie
debug-eval JSON.stringify(userData)

# 变量查看
debug-vars
debug-vars <callFrameId>

Script management

script list             # 列出所有已加载脚本
script get <scriptId>   # 获取脚本源码
script find *app.js     # 按URL模式查找
script search encrypt   # 搜索脚本内容

Hook injection

# 快速生成
hook generate function encryptData
hook generate fetch */api/*
hook generate xhr *sign*
hook generate property window.navigator
hook generate cookie
hook generate websocket
hook generate eval
hook generate timer

# 管理
hook list
hook remove <id>
hook enable <id>
hook disable <id>
hook clear
hook anti-debug         # 反调试绕过
hook export json
hook-data               # 查看捕获数据
hook-data <hookId>
hook-types              # 列出Hook类型

Watch expressions

watch add "window.location.href" "当前URL"
watch add "userData.token"
watch list
watch evaluate          # 求值所有监视表达式
watch remove <id>
watch export
watch import <json>
watch clear

XHR breakpoints

xhr-breakpoint set */api/*
xhr-breakpoint set *sign*
xhr-breakpoint list
xhr-breakpoint remove <id>
xhr-breakpoint clear

Event breakpoints

event-breakpoint set click
event-breakpoint set-mouse       # 所有鼠标事件
event-breakpoint set-keyboard    # 所有键盘事件
event-breakpoint set-timer       # 定时器事件
event-breakpoint set-websocket   # WebSocket事件
event-breakpoint list
event-breakpoint remove <id>
event-breakpoint clear

Script Blackboxing

blackbox set *jquery*.js
blackbox set *node_modules/*
blackbox set-common     # 黑盒化常用库
blackbox list
blackbox remove <pattern>
blackbox clear

Anti-Detection Camouflage

stealth inject                          # 默认注入
stealth inject-preset windows-chrome    # 平台预设
stealth inject-preset mac-safari
stealth inject-preset mac-chrome
stealth inject-preset linux-chrome
stealth inject-preset windows-edge
stealth set-ua windows                  # 设置User-Agent
stealth presets                         # 列出预设
stealth status                          # 注入状态
stealth features                        # 列出所有功能

Anti-Detection Features (16 items):

Feature	Description
hideWebdriver	Hide `navigator.webdriver` property
mockChrome	Simulate `window.chrome` object
canvasNoise	Canvas session-level random seed fingerprint noise
webglVendor	Override WebGL vendor and renderer
audioNoise	AudioContext fingerprint noise
navigatorProps	Consistent platform/vendor/core count/memory
permissionsAPI	Fix Permissions API detection
batteryAPI	Simulate Battery API
mediaDevices	Simulate media devices
notifications	Simulate Notifications API
networkInfo	Simulate Network Information API
hasFocus	Override `document.hasFocus()`

DOM inspector

dom query #login-button
dom query-all .product-item 20
dom structure 3 true            # 深度3，包含文本
dom clickable 登录               # 按文本查找可点击元素
dom style #header
dom wait .loading-spinner 5000  # 等待元素出现

Page controller

page navigate https://example.com
page reload
page back
page forward
page click #submit-button
page type #username admin
page select #country US
page hover .menu-item
page scroll 0 500
page wait-selector .result
page wait-nav
page eval document.title
page url
page title
page content
page screenshot output.png
page metrics

Tool commands

stats                   # 收集和缓存统计
stats --type=cache
clear                   # 清除所有数据

Reverse Engineering Workflow

Core Philosophy

The essence of reverse engineering: understand the requirement → locate the target → analyze the implementation → reproduce the logic

Core technique: infer the process from the result

See encrypted parameters → infer the generation function
See obfuscated code → infer the original logic
See network requests → infer the call chain

Standard Procedure

1. 启动浏览器并收集
   browser launch
   collect https://target.com

2. 快速侦查
   search "encrypt"
   search "sign"
   search "token"
   detect-crypto <suspicious_code>

3. 定位目标函数
   script list
   script find *app*.js
   script search "X-Bogus"

4. 动态分析
   debugger enable
   breakpoint set-url https://target.com/app.js 1234
   xhr-breakpoint set */api/sign*
   debug-step pause → into → over
   debug-vars
   debug-eval <expression>

5. Hook监控
   hook generate function encryptData
   hook generate fetch */api/*
   hook-data

6. 反混淆与理解
   deobfuscate <obfuscated_code>
   understand <clean_code> --focus=security

7. 复现逻辑
   根据分析结果，复现加密/签名逻辑

Best Practices

Use smart summary mode to avoid excessively large data
Prioritize collecting key code (encrypt, crypto, sign)
Use incremental mode to fetch on demand
Infer the process from the result to avoid blind debugging
Use breakpoints and variable inspection for dynamic analysis
Use the dom command to locate page elements and avoid blind clicking
Use the page command for page interaction and automation operations

Environment Requirements

Node.js >= 18.0.0
Browser: Chrome or Edge (auto-detected)
Dependencies: puppeteer, openai or anthropic (AI features)

Configuration

Environment variables are configured in the .env file:

Variable	Description
`OPENAI_API_KEY`	OpenAI API key (optional)
`ANTHROPIC_API_KEY`	Anthropic API key (optional)
`DEFAULT_LLM_PROVIDER`	Default LLM provider (openai/anthropic)
`REMOTE_DEBUGGING_PORT`	Remote debugging port (default 9222)

Troubleshooting

Browser fails to start

Check whether Chrome/Edge is installed
Check whether port 9222 is occupied
Try using external browser mode

AI analysis fails

Check whether the API key is configured correctly
Check the network connection
Check whether the API quota is sufficient

DOM query fails

Ensure the browser has been started
Ensure the page has finished loading
Check whether the selector is correct

About this skill

Core Capabilities

How It Works

Features

Tool Details

Code Collection

Code Analysis

Browser control

Debugging analysis

Anti-detection disguise

Data management

Command reference

Code collection and search

Code analysis

Browser control

Debugger

Script management

Hook injection

Watch expressions

XHR breakpoints

Event breakpoints

Script Blackboxing

Anti-Detection Camouflage

DOM inspector

Page controller

Tool commands

Reverse Engineering Workflow

Core Philosophy

Standard Procedure

Best Practices

Environment Requirements

Configuration

Troubleshooting

Browser fails to start

AI analysis fails

DOM query fails