One-click install
npx skills add https://github.com/warterbili/AUTO_REVERSE --skill js-trace-engine
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: js-trace-engine
Source: https://github.com/warterbili/AUTO_REVERSE/tree/main/skills/web/js-trace-engine
Command: npx skills add https://github.com/warterbili/AUTO_REVERSE --skill js-trace-engine

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @babel/core, chrome-remote-interface, webcrack, and includes references (resource) components.

What problem does it solve?

Heavily obfuscated anti-bot JavaScript often hides its core computation logic (like sign algorithms or cookie generators) behind runtime code generation (eval/Function), anti-debug traps, and JSVMP bytecode interpreters that make static analysis useless. This skill eliminates the guesswork by making the running code fully observable, so you can see exactly how values are computed instead of just seeing the final output.

Core Features & Use Cases

  • Recursive dynamic instrumentation: Weaves probes into obfuscated JS that automatically re-instruments runtime-generated code from eval, Function, and setTimeout, so code that only exists after decryption is also traced.
  • Anti-debug bypass: Includes an L2 prelude that defeats common anti-debug traps (debugger statements, timing checks, self-defending integrity guards) so tracing doesn't trigger detection.
  • Multi-layer auto-routing: Automatically selects the right tracing layer (L1 AST probes, L2 runtime hooks, L3 VM dispatch-loop tracing) based on the target, with optional live source replacement for real Chrome to bypass anti-bot without modifying the page's source integrity.
  • Use Case: Reverse engineer a web app's anti-bot sign algorithm by tracing its obfuscated JS, capturing the runtime-decrypted signing code, and generating an execution summary that shows the exact HMAC key derivation and parameter sorting logic.

Quick Start

Use the js-trace-engine skill to trace the obfuscated sign.js file from your target web app and generate an aggregated execution trace that reveals how the hidden sign algorithm computes its output.

Frequently Asked Questions about js-trace-engine

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I trace obfuscated JavaScript that uses runtime eval and anti-debug traps to hide its logic?

Trace obfuscated JavaScript with runtime eval and anti-debug traps by applying dynamic AST instrumentation that recursively hooks eval, Function, and setTimeout calls while bypassing debugger statements and timing checks to expose hidden computation logic.

What is the best way to reverse engineer an anti-bot sign algorithm when static analysis fails?

Reverse engineer an anti-bot sign algorithm when static analysis fails by using multi-layer auto-routing that combines L1 AST probes and L2 runtime hooks to capture runtime-decrypted code and generate an aggregated execution trace of the exact key derivation logic.

Can I trace JSVMP bytecode interpreters without modifying the target's global environment?

Yes, you can trace JSVMP bytecode interpreters without modifying the global environment by applying L3 VM dispatch-loop tracing that instruments the interpreter's internal logic to produce actionable execution evidence while leaving the target's global objects untouched.

Does dynamic instrumentation work with real Chrome to bypass anti-bot detection without altering source integrity?

Yes, dynamic instrumentation works with real Chrome to bypass anti-bot detection by utilizing optional live source replacement via chrome-remote-interface, allowing you to inject probes and observe execution without permanently modifying the page's source integrity.

How do I extract a cookie generation algorithm from heavily obfuscated JavaScript?

Extract a cookie generation algorithm from heavily obfuscated JavaScript by weaving recursive probes into the code that automatically re-instrument runtime-generated code from eval and Function calls, capturing the decrypted execution path to reveal the exact computation logic.

Why does obfuscated JavaScript with self-defending integrity guards prevent static deobfuscation?

Obfuscated JavaScript with self-defending integrity guards prevents static deobfuscation because the core computation logic is hidden behind runtime code generation and anti-debug traps, requiring an L2 prelude to defeat the guards before tracing can expose the actual execution behavior.