Fausto-404/js-reverse-automation--skill

What it solves

This project automates the complex process of JavaScript reverse engineering, specifically targeting the decryption and analysis of encrypted login parameters, request signatures (tokens/signs), and encrypted response content. It eliminates the tedious manual work of environment emulation ("补环境"), locating encryption functions, and writing boilerplate code for remote calls.

How it works

The system leverages the Model Context Protocol (MCP) to connect an AI agent to a real browser via chrome-devtools-mcp. Instead of trying to recreate the browser environment in Node.js, it uses a JSRPC (JavaScript Remote Procedure Call) approach to call functions directly within the live browser.

The workflow follows a structured pipeline (Phase 0-9) that includes:

1. Discovery: Using runtime Hook probes and Webpack module analysis to find encryption functions.
2. Verification: A scoring system and differential verification to ensure the correct function is identified.
3. Delivery: Automatically generating a Python Flask proxy server and the necessary configuration for Burp Suite's autoDecoder to integrate the reverse-engineered logic into a penetration testing workflow.
4. Evolution: Maintaining an evolution_matrix.json to store experience and patterns from previous tasks to handle new obfuscation techniques.

Who it’s for

Security researchers, penetration testers, and data scrapers who need to bypass complex JavaScript encryption and signatures without spending hours manually analyzing obfuscated code.

Highlights

• Live Browser Execution: Uses JSRPC to bypass obfuscation by treating the real browser as the algorithm parser.
• Full-Chain Automation: Automates everything from function discovery and browser injection to the deployment of a Flask proxy.
• Evidence-Driven Analysis: Employs SHA-256 fingerprinting and evidence graphs to track data flow from producer to consumer.
• Integrated Tooling: Seamlessly connects with Burp Suite for real-time request/response modification.
• Self-Evolving Knowledge: Uses a memory library to retain adversarial experience across different tasks.