@jshookmcp/jshook 0.2.5 → 0.2.6

package/workflows/deobfuscation-pipeline/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "noEmit": false,
+    "outDir": "dist",
+    "rootDir": ".",
+    "strict": true,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["workflow.ts"],
+  "exclude": ["dist", "node_modules"]
+}

package/workflows/deobfuscation-pipeline/workflow.ts

@@ -0,0 +1,119 @@
+import {
+  createWorkflow,
+  type WorkflowExecutionContext,
+  SequenceNodeBuilder,
+} from '@jshookmcp/extension-sdk/workflow';
+
+const workflowId = 'workflow.deobfuscation-pipeline.v1';
+
+export default createWorkflow(workflowId, 'Deobfuscation Pipeline')
+  .description(
+    'End-to-end deobfuscation pipeline: collects scripts, detects obfuscation type (control flow flattening, string encoding, dead code, packer), runs webcrack unpacking, applies AST transforms (constant folding, dead code removal, control flow recovery), and produces cleaned source with diff report.',
+  )
+  .tags(['reverse', 'deobfuscation', 'ast', 'webcrack', 'transform', 'obfuscation', 'mission'])
+  .timeoutMs(15 * 60_000)
+  .defaultMaxConcurrency(3)
+  .buildGraph((ctx: WorkflowExecutionContext) => {
+    const prefix = 'workflows.deobfuscationPipeline';
+    const url = String(ctx.getConfig(`${prefix}.url`, 'https://example.com'));
+    const waitUntil = String(ctx.getConfig(`${prefix}.waitUntil`, 'networkidle0'));
+    const maxScripts = Number(ctx.getConfig(`${prefix}.maxScripts`, 30));
+    const runWebcrack = Boolean(ctx.getConfig(`${prefix}.runWebcrack`, true));
+    const runAstTransforms = Boolean(ctx.getConfig(`${prefix}.runAstTransforms`, true));
+    const maxConcurrency = Number(ctx.getConfig(`${prefix}.parallel.maxConcurrency`, 3));
+
+    const root = new SequenceNodeBuilder('deobfuscation-pipeline-root');
+
+    // Phase 1: Navigate
+    root
+      .tool('enable-network', 'network_enable', { input: { enableExceptions: true } })
+      .tool('navigate', 'page_navigate', { input: { url, waitUntil } })
+
+      // Phase 2: Collect Scripts
+      .tool('collect-scripts', 'collect_code', {
+        input: { includeInline: true, limit: maxScripts },
+      })
+
+      // Phase 3: Parallel Detection
+      .parallel('detect-obfuscation', (p) => {
+        p.maxConcurrency(maxConcurrency)
+          .failFast(false)
+          .tool('detect-obfuscation', 'detect_obfuscation', { input: {} })
+          .tool('detect-crypto', 'detect_crypto', { input: {} })
+          .tool('search-packer-signatures', 'search_in_scripts', {
+            input: { query: 'eval,Function,atob,fromCharCode,charCodeAt,replace,split,reverse,join', matchType: 'any' },
+          });
+      })
+
+      // Phase 4: Source Map Recovery (may reveal original source)
+      .tool('recover-sourcemaps', 'source_map_extract', { input: {} });
+
+    // Phase 5: Webcrack Unpacking
+    if (runWebcrack) {
+      root.tool('webcrack-unpack', 'webcrack_unpack', { input: {} });
+    }
+
+    // Phase 6: AST Transform Pipeline
+    if (runAstTransforms) {
+      root
+        .tool('ast-preview', 'ast_transform_preview', { input: {} })
+        .tool('ast-constant-fold', 'ast_transform_apply', {
+          input: { transform: 'constant_fold' },
+        })
+        .tool('ast-dead-code', 'ast_transform_apply', {
+          input: { transform: 'dead_code_remove' },
+        })
+        .tool('ast-control-flow', 'ast_transform_apply', {
+          input: { transform: 'control_flow_flatten' },
+        });
+    }
+
+    // Phase 7: Basic Deobfuscation
+    root.tool('deobfuscate', 'deobfuscate', { input: {} });
+
+    // Phase 8: Extract Function Tree from cleaned source
+    root.tool('extract-function-tree', 'extract_function_tree', {
+      input: { depth: 3 },
+    });
+
+    // Phase 9: Evidence Recording
+    root
+      .tool('create-evidence-session', 'instrumentation_session_create', {
+        input: {
+          name: `deobfuscation-${new Date().toISOString().slice(0, 10)}`,
+          metadata: { url, workflowId },
+        },
+      })
+      .tool('record-artifact', 'instrumentation_artifact_record', {
+        input: {
+          type: 'deobfuscation_result',
+          label: `Deobfuscation for ${url}`,
+          metadata: { url, runWebcrack, runAstTransforms },
+        },
+      })
+
+      // Phase 10: Session Insight
+      .tool('emit-insight', 'append_session_insight', {
+        input: {
+          insight: JSON.stringify({
+            status: 'deobfuscation_pipeline_complete',
+            workflowId,
+            url,
+            runWebcrack,
+            runAstTransforms,
+          }),
+        },
+      });
+
+    return root;
+  })
+  .onStart((ctx) => {
+    ctx.emitMetric('workflow_runs_total', 1, 'counter', { workflowId, mission: 'deobfuscation_pipeline', stage: 'start' });
+  })
+  .onFinish((ctx) => {
+    ctx.emitMetric('workflow_runs_total', 1, 'counter', { workflowId, mission: 'deobfuscation_pipeline', stage: 'finish' });
+  })
+  .onError((ctx, error) => {
+    ctx.emitMetric('workflow_errors_total', 1, 'counter', { workflowId, mission: 'deobfuscation_pipeline', stage: 'error', error: error.name });
+  })
+  .build();

package/workflows/electron-bridge-mapper/.jshook-install.json

@@ -0,0 +1,14 @@
+{
+  "version": 1,
+  "kind": "workflow",
+  "slug": "electron-bridge-mapper",
+  "id": "workflow.electron-bridge-mapper.v1",
+  "source": {
+    "type": "git",
+    "repo": "https://github.com/vmoranv/jshook_workflow_electron_bridge_mapper",
+    "ref": "main",
+    "commit": "0e2313f0e783f2341ca36dfd164ce7acce17cc32",
+    "subpath": ".",
+    "entry": "workflow.ts"
+  }
+}

package/workflows/electron-bridge-mapper/meta.yaml

@@ -0,0 +1,6 @@
+name: electron-bridge-mapper
+description: JSHook workflow for electron-bridge-mapper
+author: vmoranv
+tags:
+  - workflow
+  - electron-bridge-mapper

package/workflows/electron-bridge-mapper/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "jshook-workflow-electron-bridge-mapper",
+  "private": true,
+  "version": "0.1.0",
+  "description": "jshookmcp workflow: electron-bridge-mapper",
+  "type": "module",
+  "packageManager": "pnpm@10.28.2",
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit"
+  },
+  "dependencies": {
+    "@jshookmcp/extension-sdk": "^0.3.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.3.0",
+    "typescript": "^5.9.3"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}