jshook-skill is a TypeScript-based Claude Code skill that combines LLM-driven deobfuscation, CDP debugging and hook injection for authorized JavaScript analysis in labs and security research.
| Tool | wuji66dde/jshook-skill — AI-powered JavaScript reverse engineering skill for Claude Code |
| Category | Reverse engineering / browser instrumentation (TypeScript) |
| Primary Use | Analyzing obfuscated JavaScript in authorized targets: smart code collection, AI deobfuscation, crypto detection and CDP-based dynamic debugging |
| Safe Use | For authorized penetration tests, internal labs, CTF challenges and defensive research on code you own or have written permission to analyze |
| Telemetry Note | Operates over the Chrome DevTools Protocol on a configurable REMOTE_DEBUGGING_PORT (default 9222); browsers launched with remote debugging expose json/version endpoints and navigator.webdriver artifacts that defenders can monitor, though the tool's stealth module tries to mask some of these |
jshook-skill is a TypeScript project, licensed under GPL-3.0 and sitting at 269 stars, that packages an entire JavaScript reverse engineering toolkit as a skill for Claude Code. The premise is straightforward: instead of juggling a deobfuscator, a crypto detector, a CDP client and a hook framework separately, the tool exposes a unified command vocabulary that an AI agent can dispatch through a central SkillRouter.ts. The README describes it as bilingual (English/Chinese), which tells you the intended audience is the web-reversing community that grew up around signature-parameter analysis — the X-Bogus example in the docs is a direct nod to that niche.
The architecture, as far as the README's project-structure section reveals, is cleanly modularized under src/modules/. A collector/ module handles fetching and caching scripts, with SmartCodeCollector.ts implementing what the README calls Summary, Priority and Incremental modes — a pragmatic answer to the fact that modern bundles routinely blow past LLM context windows, so the tool can compress (CodeCompressor.ts) or fetch only the deltas you care about. The --max-total-size and --compress flags on the collect command confirm this is a first-class design concern rather than an afterthought.
The deobfuscation story is split across Deobfuscator.ts, AdvancedDeobfuscator.ts, ASTOptimizer.ts, a dedicated JSVMPDeobfuscator.ts for JSVMP-style virtual machine obfuscation, and PackerDeobfuscator.ts for classic packers. The README claims support for 20+ obfuscation types, and the AST machinery is Babel-based — pattern recognition and constant detection happen at the syntax-tree level, which is the correct approach versus brittle regex substitution. The deobfuscate and understand commands push the cleaned code through an LLM for semantic analysis, with --focus=security available to bias the explanation toward security-relevant logic.
Crypto detection is handled by CryptoDetector.ts, an CryptoDetectorEnhanced.ts variant that layers AST analysis on top, and a rules file CryptoRules.ts. The claimed coverage includes standard primitives — AES, RSA, MD5, SHA — plus custom or hand-rolled algorithms, which in practice means recognizing telltale constant tables, S-boxes and operation sequences rather than string matching. The README also mentions a security-audit angle: weak-algorithm detection, insecure-configuration warnings and a strength score, which makes the module useful defensively when auditing your own front-end crypto choices.
The dynamic side is where the tool gets genuinely dense. DebuggerManager.ts wraps the Chrome DevTools Protocol to give you breakpoints (including conditional ones via breakpoint set-url <url> <line> <column> '<condition>'), stepping (debug-step into/over/out), variable inspection per call frame, and arbitrary expression evaluation with debug-eval. Supporting managers cover watch expressions, XHR breakpoints (xhr-breakpoint set */api/*), event breakpoints for mouse/keyboard/timer/WebSocket activity, and blackboxing of noise libraries (blackbox set-common) so you step only through first-party code — all things a DevTools user does manually, here exposed as scriptable commands.
Hook injection, managed by HookManager.ts and code-generated through HookCodeBuilder.ts, provides runtime interception of functions, fetch and XHR traffic, properties, document.cookie, WebSocket, eval and timers. The hook generate function encryptData pattern shows the intent: intercept the exact function that produces a signature or ciphertext, then inspect captured arguments and return values with hook-data. There's also a hook anti-debug command described as an anti-debug bypass, which neutralizes the classic infinite-debugger and timing-check tricks sites deploy against analysts — relevant when working on your own hardened applications or CTF targets.
The stealth module deserves scrutiny. Sixteen features across five platform presets (windows-chrome, mac-safari, mac-chrome, linux-chrome, windows-edge) mask automation fingerprints: hiding navigator.webdriver, mocking the window.chrome object, injecting canvas and AudioContext noise, overriding WebGL vendor/renderer strings, and faking Battery, Permissions and NetworkInformation APIs. This is functionally the same surface as anti-detect browsers or puppeteer-extra-stealth. For an authorized analyst it's a convenience — bot detection would otherwise abort the session before you reach the code you're licensed to examine — but it's the feature class that most directly overlaps with scraping and abuse tooling, so scope discipline matters.
Operationally, the tool expects an .env file copied from .env.example, holding either an OPENAI_API_KEY or ANTHROPIC_API_KEY plus a DEFAULT_LLM_PROVIDER selector, and an optional REMOTE_DEBUGGING_PORT defaulting to 9222. Installation is the standard git clone followed by npm install and npm run build, and Claude Code integration is just registering the repository URL in your skill configuration so commands like /jshook-reverse collect https://example.com become available. Browser launch auto-detects Chrome or Edge across drive letters C through Z, a small but thoughtful Windows-centric touch.
The documented workflow — collect, search for encrypt/sign/token keywords, locate the target script, set breakpoints, hook, then deobfuscate and understand — maps exactly onto how a professional approaches authorized signature-algorithm analysis. The final step in the README's workflow, reproducing the encryption/signing logic from the analysis, is standard reverse engineering documentation practice and squarely within scope when the target is your own application or one covered by an engagement agreement. The page command family (navigate, click, type, screenshot, page metrics) rounds this out with enough automation primitive coverage to drive a full analysis session without leaving the tool.
From a defensive telemetry perspective, everything here rides on CDP, which means a browser running with remote debugging enabled is observable: an open 9222 port serving /json endpoints is itself a detection signal on any machine where it shouldn't be. The stealth module explicitly fights fingerprinting checks like navigator.webdriver, so defenders evaluating this class of tool should focus on behavioral indicators — debugging pauses altering timing, hook wrappers visible in toString() inspection — rather than relying on any single fingerprint heuristic. Resource management is called out as a deliberate strength, with proper CDP session cleanup claimed to prevent memory leaks, a detail that suggests the author has actually run long sessions.
Caveats worth noting: the README is feature-dense but offers no test evidence, no benchmark of the claimed 20+ obfuscation families, and no third-party audit of the hook or stealth code injected into the page. Sending collected code fragments to a third-party LLM API is also a data-governance consideration — anything you collect from a client engagement could transit an external provider, so check your engagement's data-handling terms before pointing it at proprietary bundles. Within those limits, jshook-skill is one of the more complete command-driven JavaScript analysis harnesses on GitHub, and its Claude Code packaging makes it an interesting template for how AI agents will increasingly front full reverse engineering pipelines.
wuji66dde/jshook-skill.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.