菜单
Specialist agent for detecting ALL MAC (Message Authentication Code) functions in downloaded JS files. Part of crypto-recon pipeline.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | crypto-recon-mac |
| description | Specialist agent for detecting ALL MAC (Message Authentication Code) functions in downloaded JS files. Part of crypto-recon pipeline. |
hmac-patterns.md — Complete HMAC catalog: CryptoJS, Web Crypto, Node.js, Android Java, message construction patterns, key sources, Poly1305/GMAC/CMAC, Python templatesFind every Message Authentication Code (MAC) function used in the target's JavaScript. HMAC, CMAC, GMAC, Poly1305, and all variants. Document key, algorithm, input, output.
HmacMD5(, HmacSHA1(, HmacSHA224(, HmacSHA256(, HmacSHA384(, HmacSHA512(
CryptoJS.HmacMD5(
CryptoJS.HmacSHA1(
CryptoJS.HmacSHA256(
CryptoJS.HmacSHA512(
createHmac('md5', key)
createHmac('sha1', key)
createHmac('sha256', key)
createHmac('sha384', key)
createHmac('sha512', key)
subtle.sign({name: 'HMAC', hash: 'SHA-256'
subtle.verify({name: 'HMAC'
forge.hmac.create()
forge.hmac.update(
sjcl.misc.hmac(
hmac(, HMAC(
CMAC, cmac, cbc-mac, CBCMAC
aes-cmac
AES-GCM ← GMAC is implicit when using GCM mode
subtle.encrypt({name:'AES-GCM' ← includes authentication tag
Poly1305, poly1305
ChaCha20-Poly1305 ← Poly1305 as MAC
createCipheriv('chacha20-poly1305'
nacl.secretbox ← uses XSalsa20-Poly1305
SipHash, siphash
UMAC, umac
mac(, MAC(, computeMac(
authTag, auth_tag, authcode
messageAuthCode
Identify HMAC algorithm — which underlying hash?
Extract the MAC key — this is critical
const SECRET = "your_secret_key"
const KEY = "abc123def456"
hmac(data, "hardcoded_key_here")
Determine what is MACed
Output format — hex? base64? uppercase?
Trace usage — where does the MAC tag go?
X-Signature? Body field? URL param?Identify signing pattern — many APIs use:
sort(keys) → filter(nulls) → stringify → HMAC(secret) → append to request
HMAC keys embedded in JS are HIGH VALUE findings. When found:
Common obfuscation patterns for HMAC keys:
// Reversed string
const k = "yek_terces_ruoy".split("").reverse().join("")
// Split across variables
const a = "your_se", b = "cret_key"
const key = a + b
// Base64 encoded
const key = atob("eW91cl9zZWNyZXRfa2V5")
// XOR obfuscated
const key = [0x79,0x6f,0x75,0x72].map(c => String.fromCharCode(c)).join("")
// Unicode escapes
const key = "your_secret"
For each obfuscation found, decode and report the actual key value.
MAC FINDINGS
============
[M1] HMAC-SHA256 — HIGH
File: common.modules-6d4292d1.js
Line: 3201
Function: signRequest(payload, endpoint)
Algorithm: HMAC-SHA256
Key: HARDCODED: "x7k9mNpQ2rSvWyZ3"
Input: JSON.stringify(sorted_payload) + timestamp
Output: hex string, lowercase, full 64 chars → header "X-Auth-Sign"
Callers: apiPost:1100, apiGet:1200
Notes: Same key for all endpoints. Timestamp appended to message.
Key value: "x7k9mNpQ2rSvWyZ3"
[M2] HMAC-MD5 — HIGH
File: page-login-abc123.js
Line: 441
Function: buildLoginSign(params)
Algorithm: HMAC-MD5
Key: Derived from userId + deviceId via SHA1
Input: Alphabetically sorted query string
Output: uppercase hex → URL param "sign"
Callers: [callerFunc]:890
Notes: Weak choice (MD5), but key is dynamic per user
Download all JS/WASM/CSS assets from a target URL using cloudscraper. Saves to output/[domain]/. Called by crypto-recon-orchestrator.
Specialist for EVM blockchain cryptography — EIP-712, personal_sign, ABI encoding, keccak256, ethers.js/wagmi/viem/web3.js. EVM chains only (Ethereum, Polygon, BSC, Arbitrum, etc.). For non-EVM use crypto-recon-web3-solana, crypto-recon-web3-cosmos, or crypto-recon-web3-starknet.
Verifies reconstructed APK signing logic against live app traffic. Uses HAR test vectors or ADB+mitmproxy. Extends crypto-recon-debugging for Android context.
Specialist for finding ALL cryptography in decompiled Android APK — Java source (jadx) and Smali bytecode (apktool). Covers OkHttp interceptors, Retrofit, HMAC, AES, MD5, custom signing, ProGuard-obfuscated code.
Master orchestrator for Android APK reverse engineering. Fully autonomous — decompiles APK, spawns 11 parallel specialists, collects findings, writes report, reconstructs Python code. No intermediate stops. Accepts .apk/.apkm/.xapk + optional HAR.
Builds a complete, clean, standalone Python script for a full API flow (login, register, place bet, etc). Accepts input from reconstruct_*.py files AND from APK flow mappers (Retrofit catalog, auth chain trace, API endpoint list). Called automatically after analysis — no user prompting needed. Uses superpowers executing-plans and verification-before-completion.