jshook

name

jshook

description

JavaScript security analysis and reverse engineering with the jshook-cli CLI — deobfuscation, structure/behavior/crypto analysis, browser/network/debugger instrumentation, traffic capture, proxy interception, hook generation, WASM/native inspection, and Android RE. Use when analyzing, deobfuscating, hooking, or reverse-engineering JavaScript, web pages, or native/Android targets, not for ordinary JS development.

jshook skill

jshook-cli is a CLI for JavaScript security analysis and reverse engineering. It exposes a large tool surface (browser, network, debugger, proxy, transform, WASM, native, Android, and more) behind a small set of commands.

Always pass --json so output is a single compact JSON envelope you can parse. For complex arguments, write a temp JSON file and use --args-file <path> instead of inline --args to avoid shell escaping.

When to use

• JavaScript security analysis, reverse engineering, or behavior understanding
• Code deobfuscation / protection analysis
• Browser instrumentation, page/script inspection, network capture, debugger snapshots
• Intercepting proxy capture (HTTP/HTTPS)
• Android APK / native binary RE, WASM inspection, hook/patch generation

When NOT to use

• General JS development: linting, formatting, bundling, running tests
• Plain HTTP requests — use curl/fetch
• Static file serving

Two ways in

Prefer a high-level command when one matches the task; fall back to the tools protocol for everything else.

High-level commands

Stateless — run directly, no daemon needed:

jshook-cli analyze <file-or-url> --json              # --focus structure|business|security|all (default all)
jshook-cli deobfuscate <file-or-url> --out clean.js --json   # --engine auto|webcrack, --detect-only

Stateful — require a daemon session (see below):

jshook-cli browser inspect <url>    --session work --json   # page status + scripts
jshook-cli network capture <url>    --session work --json   # requests + stats (--limit, --tail, --fields, --deduplicate-urls)
jshook-cli debugger snapshot <url>  --session work --json   # scripts, paused state, breakpoints, blackbox
jshook-cli proxy capture [url-filter] --session work --json # start/reuse intercept proxy (--port, --restart, --stop-after)
jshook-cli reverse session --session work --action create --platform android --package-name <pkg> --json

Discover all workflows and their input schemas:

jshook-cli workflows list --json
jshook-cli run <workflow> --args-file args.json --json   # e.g. js.analyze, browser.inspect

Stateful workflows need a daemon + --session

Stateful commands (browser, network, debugger, proxy, reverse) and any multi-step tools call sequence that launches a browser, proxy, or debugger must run through a daemon session. Without --session, each command spins up a fresh runtime and tears it down on exit, so a browser launched in one call is gone by the next — and stateful workflows fail with VALIDATION: Workflow requires daemon/session mode.

Start the daemon once, then reuse the same --session <name> across related commands so state (launched browser, selected page, enabled domains) persists:

jshook-cli daemon start --json
jshook-cli browser inspect https://example.com --session work --json
jshook-cli network capture https://example.com --session work --json   # reuses the same browser
jshook-cli tools call page_navigate --session work --args '{"url":"https://example.com/login"}' --json
jshook-cli daemon status --json
jshook-cli daemon session close work --json   # release one session
jshook-cli daemon stop --json                 # stop the daemon

State lives under ~/.jshook-cli/daemon; override with --state-dir or JSHOOK_DAEMON_STATE_DIR.

Discovery-first tool protocol

For anything not covered by a high-level command, discover before you invoke. Do not guess tool names or arguments.

1. Route a task — returns ranked tools plus ready-to-run describeCommand / callCommand and a nextActions plan:

   jshook-cli tools route "collect all scripts from a page and detect obfuscation" --json
   

2. Search for a specific tool by keywords:

   jshook-cli tools search "wasm disassemble" --top 10 --json
   

3. List / browse, optionally by domain (e.g. browser, network, debugger, transform, wasm, process, trace):

   jshook-cli tools list --json
   jshook-cli tools list --domain browser --json
   

4. Describe a tool's schema, then call it:

   jshook-cli tools describe detect_obfuscation --json
   jshook-cli tools call detect_obfuscation --args-file args.json --json
   

describe and call work for any tool — out-of-profile and heavy "full-tier" tools (ADB, native, syscall, etc.) are loaded on demand, and tools call auto-activates a tool's domain when needed.

list / search / route are scoped to the current profile (--profile, default workflow). To surface heavy full-tier tools during discovery, add --profile full:

jshook-cli tools list --domain adb-bridge --profile full --json
jshook-cli tools search "android frida hook" --profile full --json

route for multi-step planning · search to find an exact tool · list to browse · describe before every call · call as the universal execution escape hatch. (tools list|search|route|describe|call are also available as top-level aliases, e.g. jshook-cli route "…".)

Output contract

Every command prints one JSON envelope on stdout; diagnostic logs go to stderr, so parse stdout directly and don't merge 2>&1.

• Success: { "success": true, "command": "...", "data": <result>, "meta": { "elapsedMs": N, "profile": "workflow" } } — read data.
• Failure: { "success": false, "error": { "code": "...", "message": "...", "details": ... }, "hint": "..." } — read hint; it usually tells you the exact next command. Process exit code is non-zero on failure.

Other common flags: --format json|pretty|ndjson (presentation) and --profile search|workflow|full (discovery scope).

Examples

Detect obfuscation without transforming, then deobfuscate to a file:

jshook-cli deobfuscate obfuscated.js --detect-only --json
jshook-cli deobfuscate obfuscated.js --out clean.js --engine webcrack --json

Inspect a page and capture its network traffic in one session:

jshook-cli daemon start --json
jshook-cli browser inspect https://example.com --session work --include-source --json
jshook-cli network capture https://example.com --session work --limit 200 --deduplicate-urls --json

Route → describe → call for an unfamiliar task:

jshook-cli tools route "decode a base64 + xor obfuscated string blob" --json
jshook-cli tools describe <tool-from-route> --json
cat > args.json <<'JSON'
{"code":"var _0x1=[\"log\"];console[_0x1[0]](1);"}
JSON
jshook-cli tools call detect_obfuscation --args-file args.json --json