js-trace-engine

What problem does it solve?

Heavily obfuscated anti-bot JavaScript often hides its core computation logic (like sign algorithms or cookie generators) behind runtime code generation (eval/Function), anti-debug traps, and JSVMP bytecode interpreters that make static analysis useless. This skill eliminates the guesswork by making the running code fully observable, so you can see exactly how values are computed instead of just seeing the final output.

Core Features & Use Cases

• Recursive dynamic instrumentation: Weaves probes into obfuscated JS that automatically re-instruments runtime-generated code from eval, Function, and setTimeout, so code that only exists after decryption is also traced.
• Anti-debug bypass: Includes an L2 prelude that defeats common anti-debug traps (debugger statements, timing checks, self-defending integrity guards) so tracing doesn't trigger detection.
• Multi-layer auto-routing: Automatically selects the right tracing layer (L1 AST probes, L2 runtime hooks, L3 VM dispatch-loop tracing) based on the target, with optional live source replacement for real Chrome to bypass anti-bot without modifying the page's source integrity.
• Use Case: Reverse engineer a web app's anti-bot sign algorithm by tracing its obfuscated JS, capturing the runtime-decrypted signing code, and generating an execution summary that shows the exact HMAC key derivation and parameter sorting logic.

Quick Start

Use the js-trace-engine skill to trace the obfuscated sign.js file from your target web app and generate an aggregated execution trace that reveals how the hidden sign algorithm computes its output.