crypto-recon-encoding

name	crypto-recon-encoding
description	Specialist agent for detecting ALL encoding, obfuscation, and data transformation schemes in downloaded JS files. Part of crypto-recon pipeline.

Crypto Recon — Encoding & Obfuscation Specialist

Companion Files

• encoding-catalog.md — Full catalog: Base64 variants (standard/URL-safe/no-padding), Base58, Base32, hex (upper/lower), custom alphabets, percent encoding, ROT, multi-layer encoding, detection matrix

Purpose

Find every encoding, obfuscation, and data transformation used in the target's JavaScript — including Base64, Base58, hex encoding, ROT variants, percent-encoding, and custom alphabets. These are often used around or instead of proper crypto.

Complete Pattern Checklist

Base64 (Standard & Variants)

btoa(, atob(
Buffer.from(x).toString('base64')
Buffer.from(x, 'base64').toString()
.toString('base64')
.toString('base64url')
Base64.encode(, Base64.decode(
base64.encode(, base64.decode(
base64js.fromByteArray(
base64js.toByteArray(
CryptoJS.enc.Base64.stringify(
CryptoJS.enc.Base64.parse(
forge.util.encode64(
forge.util.decode64(

Custom Base64 alphabet detection:
'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
→ if followed by +/ or -_ it's standard/URL-safe Base64
→ if followed by other chars → CUSTOM ALPHABET (high value finding)

Base58 (Common in crypto wallets / some payment apps)

base58.encode(, base58.decode(
bs58.encode(, bs58.decode(
Base58.encode(
'123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
← The Base58 alphabet without 0, O, I, l

Base32

base32.encode(, base32.decode(
'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567'  ← standard Base32 alphabet
← common in TOTP/Google Authenticator implementations

Hexadecimal Encoding

.toString(16)           ← number to hex
parseInt(x, 16)         ← hex to number
.toString('hex')        ← Buffer/Node.js
Buffer.from(x, 'hex')
CryptoJS.enc.Hex.stringify(
CryptoJS.enc.Hex.parse(
forge.util.bytesToHex(
forge.util.hexToBytes(
hex.encode(, hex.decode(

URL / Percent Encoding

encodeURIComponent(
decodeURIComponent(
encodeURI(
decodeURI(

ROT / Caesar Cipher

ROT13, rot13, rot_13
ROT47, rot47
charCodeAt.*\+.*13
charCodeAt.*\-.*13

Custom Alphabet Substitution

// Any string of 62-64 unique characters (likely a custom encoding alphabet)
// Search for variable assignments where value is 60+ char string of mixed case letters+digits
const CHARS = "[A-Za-z0-9+/=]{62,}"

Unicode / Escape Obfuscation

\u00          ← unicode escapes in strings
\x            ← hex escapes
String.fromCharCode(
charCodeAt(
unescape(     ← old obfuscation technique
escape(
decodeURIComponent(encodeURIComponent(

BigInt Encoding Patterns

BigInt(, bigint(
.toString(16)  ← bigint to hex
new BigInteger(   ← jsbn library
BigInteger.fromHex(
BigInteger.toString(16)

Padding and Normalization

padStart(, padEnd(    ← zero-padding hex/base64
.replace(/=+$/, '')   ← removing Base64 padding

Analysis Steps Per Finding

1. Identify exact encoding scheme and variant

   • Standard Base64 (+/) vs URL-safe (-_) vs custom alphabet

2. Determine purpose

   • Is encoding used standalone OR wrapping a hash/cipher?
   • Example: btoa(md5(data)) → Base64 wrapping MD5

3. Find custom alphabets — extract and document verbatim:

   CUSTOM ALPHABET: "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_"
   → This is URL-safe Base64 with digits first
   

4. Trace the full chain:

   raw_data
     → JSON.stringify
     → encodeURIComponent
     → btoa           ← encode step
     → sent in POST body
   

5. Check for double-encoding (common mistake/obfuscation):

   btoa(btoa(data))           // double base64
   encodeURIComponent(btoa(x))  // base64 then URL-encode
   

Special: Obfuscation Detection

If JS is obfuscated (eval, packed, jsfuck, etc.):

Patterns indicating obfuscation:

eval(function(p,a,c,k,e,d)   ← Dean Edwards packer
[][(![]+[])[...]]             ← JSFuck
wind      ← Unicode obfuscation
_0x1a2b, _0xabc               ← Hex variable names (common obfuscator output)

Action when found:

1. Flag file as obfuscated
2. Note obfuscation type
3. Attempt basic deobfuscation:
   • For Dean Edwards: evaluate the packer expression in a safe sandbox
   • For hex variables: note the mapping
4. Pass to crypto-recon-custom for deeper analysis

Output Format

ENCODING FINDINGS
=================

[E1] Base64 (URL-safe) — HIGH
  File:      common.modules-6d4292d1.js
  Line:      3801
  Function:  encodePayload(data)
  Scheme:    Base64 URL-safe (-_ variant)
  Wraps:     AES-256-GCM ciphertext + IV (IV prepended)
  Direction: Encode before sending, decode on response
  Callers:   sendSecureRequest:4101
  Notes:     IV (16 bytes) prepended to ciphertext before Base64

[E2] Custom Alphabet Base64 — HIGH
  File:      index-5ef15b56.js
  Line:      8801
  Function:  customEncode(str)
  Scheme:    Custom Base64
  Alphabet:  "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ.~"
  Usage:     Token encoding for X-Token header
  Callers:   buildHeader:2201
  Notes:     Non-standard alphabet. Differs from standard only in last 2 chars.

[E3] Hex Encoding — MEDIUM
  File:      common.modules-6d4292d1.js
  Line:      2847
  Function:  (inline in generateSignParams)
  Scheme:    Hex, uppercase
  Wraps:     MD5 digest
  Usage:     Appended to request as "signature" param
  Notes:     .hexdigest().toUpperCase().slice(0, 32)