ruishu-reverse

What problem does it solve?

Ruishu (Rivers Security) anti-bot systems block automated access to websites by requiring dynamic JavaScript-generated cookies and URL suffixes. This Skill enables pure algorithmic generation of these tokens without needing a real browser or VM execution, allowing reliable automated access to protected sites for security testing and research.

Core Features & Use Cases

• Pure-Algorithm Cookie T Generation: Reconstructs the multi-layer encryption chain (Huffman, AES-CBC, CRC32, Base64) to generate valid Cookie T values from scratch.
• Data-Driven basearr Adaptation: Uses collected session data to reverse-engineer the TLV structure without reading inner VM bytecode.
• AST-Based Eval Code Analysis: Parses obfuscated JavaScript with acorn to extract opcodes, function mappings, and suffix algorithms from 296KB of eval code.
• URL Suffix Handling: Analyzes and generates URL suffixes for POST requests when required by specific site configurations.

Quick Start

Use the ruishu-reverse skill to generate a valid Cookie T for a Ruishu-protected site by extracting keys from the $_ts.cd parameter, building the basearr TLV structure with collected reference data, and applying the pure-algorithm encryption chain to obtain HTTP 200 access.