Loading...
Loading...
Run browser encrypted JS in Node.js (environment patching). env_core.js provides function disguise/prototype chain/Proxy engine, Claude writes stubs on demand in run.js according to the diagnosis report. TRIGGER when: user says "environment patching", "module extraction", "run in Node", "webpack module extraction", "environment simulation", "run JS in Node", or needs to run independently without browser after finding the encryption entry. DO NOT TRIGGER when: only debugging in browser, doing AST deobfuscation, or writing ordinary Node.js code.
npx skill4agent add zhizhuodemao/ai-reverse-toolkit env-patch/find-crypto-entryenv_core.jssetFuncNativesetObjNativegetNativeProtowrapFuncmonitorcreateProxyrun.jsbrowser-stubs.mdsource/env/const env = require('./env_core')env.setFuncNative()env.createProxy()typeof chrome !== "undefined" ? chrome : undefinedglobalThiswindowObject.defineProperty(global, name, ...)require()const env = require('./env_core')env.init({ window, document, navigator, location })require('./main.js')| File | Purpose |
|---|---|
| Utility set + Proxy engine + Diagnostic report |
| Minimal webpack runtime |
env/<project>/
├── source/ # Original JS (downloaded, not modified)
├── env/ # Runtime environment
│ ├── env_core.js # Copied from template, do not modify
│ ├── main.js # Target JS copy (or sdk.js + bytecode.js)
│ ├── run.js # Loader + environment stubs + test
│ └── sign.js # Signature interface (encapsulated at last)
├── python/ # Verification scripts
└── docs/progress.md| Scenario | JS File | Reference Document |
|---|---|---|
| Single file SDK | Copy to | — |
| SDK + bytecode separated | | |
| webpack bundle | Extract modules to | |
| Runtime dynamic loading | Download via curl to | |
const env = require('./env_core');
const _process = process; // init() will hide process, reserve reference in advance
// ① Build minimal stubs (get document/navigator/location from browser-stubs.md)
const fakeDocument = { /* ... */ };
const fakeNavigator = { /* ... */ };
const fakeLocation = { /* ... */ };
// ② Assemble window
const fakeWindow = {
document: fakeDocument,
navigator: fakeNavigator,
location: fakeLocation,
// ... supplement on demand
};
fakeWindow.window = fakeWindow;
fakeWindow.self = fakeWindow;
fakeWindow.top = fakeWindow;
fakeWindow.parent = fakeWindow;
fakeWindow.globalThis = fakeWindow;
// ③ Initialize (Node leak blocking + global mounting)
env.init({
window: env.createProxy(fakeWindow, 'window', 0),
document: env.createProxy(fakeDocument, 'document', 0),
navigator: env.createProxy(fakeNavigator, 'navigator', 0),
location: env.createProxy(fakeLocation, 'location', 0),
});
// ④ Additional global synchronization
// global.chrome = window.chrome; // If needed
// ⑤ Load target JS
require('./main.js');
// ⑥ Test
console.log('Signature function:', typeof window.签名函数名);node env/run.jsDiagnostic report
├── [HANG] Process stuck/no output → Refer to references/anti-debug.md
│ ├── setInterval debugger infinite loop → hook setInterval to filter
│ ├── eval/Function dynamically generated debugger → hook eval + Function to strip
│ └── Synchronous while(true) → Locate source code, patch global in run.js
│
├── [ERRORS] → Must be fixed immediately
│ ├── TypeError: xxx is not a function → Supplement corresponding method
│ ├── xxx is not defined → Supplement global variable/constructor
│ └── Cannot read property of undefined → Supplement intermediate object
│
├── [UNDEFINED] → Process item by item
│ ├── First use evaluate_script to get real value from browser
│ ├── Also undefined in browser → Skip (marked as confirmed)
│ └── Has value in browser → Supplement to run.js (get standard writing from browser-stubs.md)
│
└── ERRORS = 0 && All UNDEFINED confirmed → Enter signature format verification
├── Signature length/prefix consistent with browser → Step 4
└── Inconsistent signature → In-depth investigation
├── monitor() wraps key objects to track property access
├── Global error interception: process.on('uncaughtException')
├── Check item by item against references/node-detection.md
└── No abnormalities in all external hooks → references/limitations.mdbrowser-stubs.mdenv_core.jsconst env = require('./env_core');
// ... Environment construction (same as run.js) ...
require('./main.js');
module.exports = function sign(url, data) {
// Call signature function, return result
return window.签名函数名(url, data);
};| File | When to read |
|---|---|
| Process is stuck/extremely slow, or target is known to have debugger anti-debugging |
| Need to supplement stubs, look up standard writing |
| Signature downgrade (length/prefix inconsistent with browser) |
| SDK + bytecode separation, multi-interpreter scenarios |
| Encryption code is dynamically loaded from API |
| webpack bundle module extraction |
| Suspect localStorage has control flow switch |
| When all external hooks are invalid, understand the ceiling of the solution |