菜单
Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/oyi77/1ai-skills --skill dsl-vm-reverse命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | dsl-vm-reverse |
| description | Reverse JavaScript-based custom DSL/VM interpreters, non-standard WASM-like runtimes, and risk-control engines. Use when analyzing IIFE or switch-based opcode dispatchers, extracting instruction tables, recovering bytecode semantics, capturing VM state at runtime, or reconstructing execution flow. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | ["javascript","reverse-engineering","dsl","vm","anti-bot","obfuscation","risk-control","web-application-security"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"] |
Many hardened web applications do not run their anti-bot or risk-control logic
as plain JavaScript. Instead they compile it to a custom bytecode interpreted by
a hand-rolled virtual machine — an IIFE wrapping a switch-based opcode
dispatcher over a single-letter variable array (typically d[]), with a
constant table (typically C[9]). The dispatcher is usually named DG(),
W() or similar. Because the interpreter never appears in source maps and the
bytecode is stored as a numeric constant table, the logic is invisible to
standard static review and survives even after the surrounding JS is
beautified.
This skill is a repeatable, six-phase workflow for reversing such engines:
identify the VM, recover variable and opcode semantics, extract the constant
table, locate exported functions, and — when static analysis is not enough —
capture VM state at runtime. It targets the common AWSCInner family of
risk-control engines but generalizes to any IIFE/switch-based dispatcher.
Source: cherry-picked and translated from zhaoxuya520/reverse-skill
(skills/reverse-engineering/dsl-vm-reverse, MIT license).
Trigger phrases:
Use this skill when:
switch dispatch handles
numeric opcodes rather than readable statements.\x00asm magic absent) but a JS bytecode VM.npm i playwright).Input.dispatchMouseEvent.Confirm the target is a custom DSL VM and not plain JS:
\x00asm magic bytes and compute the
zero-byte percentage of the script. A high zero-byte ratio with no \x00asm
header points to a custom bytecode blob, not WASM.var U=void 0; or equivalent single-letter
hoisting that precedes a switch (d[7]&31) style dispatcher.function DG(){...} reading and writing a
shared array d[], with a constant table C[9] referenced as C[9][n].If none of these match, the target is ordinary obfuscated JS — use
js-reverse instead.
Build a variable meaning table before touching opcodes:
var\s+(\w+)\s*=\s*(\d+) over the first 2000
characters of the VM body.d[7] is typically the instruction pointer /
current opcode slot, d[4]/d[5] arithmetic registers, d[6] the operand
stack, d[8] a scratch register, d[9] a return/throw slot. Verify each
role from its usage across the switch body.Extract every case N: label from the dispatcher switch. Each case is one
opcode.
Classify each case by its statement shape (see the reference table below):
| Statement shape | Classification |
|---|---|
d[7]=... (no condition) | BRANCH |
return ... / throw ... | RETURN |
W(C[ ... ,null,function(){...}) | CALL |
new ... | ALLOC |
try{...}catch(...){...} | EXCEPTION |
d[x]=d[y][C[n]] / d[x]=d[y]<d[z] | ARITH / STORE |
P[d[9]]=... | STORE (data handoff) |
Record, for each opcode number, the classification and a one-line comment describing its effect. Keep this table in your notes — it becomes the instruction set reference for Phase 5.
C\[9\]\[(\d+)\].C[9].Find the registration call, e.g. AWSCInner.register(name, moduleName, factory) or an equivalent register() invocation.
Resolve moduleName → the factory function → the object it returns.
If a function name does not exist in the JS source, it is stored as
bytecode in C[9] — note the index range.
Trace the call chain:
AWSCInner._modules['fy'].getToken()
→ W(C[<functionIndex>], null, ...)
→ DG() // interpreter executes the encoded instruction sequence
Convert the traced bytecode range into the reconstructed semantics from Phase 3 so you can read what the exported function actually computes.
If pure static reconstruction stalls (unresolved jumps, dynamic table writes, state-dependent branches), inject a minimal compatible environment and run the VM:
// Minimal AWSC-compatible environment
const fakeEnv = {
AWSCInner: {
_modules: {},
register(name, moduleName, factory) {
this._modules[moduleName] = factory();
}
}
};
// Execute the DSL VM code in this sandbox
dslVmCode.call(fakeEnv);
// Read exports
const token = fakeEnv.AWSCInner._modules['fy'].getToken({});
Drive the real page when the VM needs live browser context (see Runtime
Capture below). In either case, log every d[] write at interesting opcodes to
produce a state trace for verification.
| Opcode | Type | Characteristic statement |
|---|---|---|
| 0 | BRANCH | d[7]=xxx unconditional jump |
| 1 | CALL | W(C[Y],null,function(){...}) embedded call |
| 2 | ARITH | d[4]=0, d[7]=72 register assignment |
| 3 | ARITH | d[0]=d[1][C[x]], d[5]=d[0]<d[3] compare |
| 4 | STORE | d[8]=d[5]in d[4] property/in check |
| 5 | ARITH | d[8]=d[4]-d[8] arithmetic |
| 6 | RETURN | return gV / throw |
| 7 | ALLOC | d[6]=[], d[6][C[8]](...) push |
| 8 | BRANCH | d[7]=d[k]?512:425 conditional jump |
| 9 | STRING | d[6][C[t]]=d[m], new fh(...) regex |
| 10 | ALLOC | argument prep, call-frame creation |
| 11 | STRING | new fh("\\s",d[5]) regex match |
| 12 | STORE | P[d[9]]=d[4][C[H]](d[3]) data handoff |
| 13 | CALL | C[9][113]=d[9] module init |
| 14 | STRING | d[8]=d[9]+d[m] string concat |
| 15 | RETURN | return EL; |
| 16 | ALLOC | var r,P,Z,B... local declarations |
| 17 | ALLOC | (Z=[])[C[8]](69,T,445) static array init |
| 18 | TABLE | function/type table init |
| 19 | EXCEPTION | try{for(var RK=x;... try-catch loop |
| 20 | DOM | Is[d[o]] DOM operation |
| 21 | STORE | safe global/object property fetch |
| 22 | STRING | new fh(r,v) string/regex handling |
| 23 | BRANCH | try-catch safe fetch + conditional jump |
| 24 | CALL | W(C[2],null,8,z,FL) multi-arg call |
| 25 | EXCEPTION | try{...}catch(C){...} catch + jump |
Opcode bit layout (observed): 5-bit opcode | 5-bit sub-opcode | operand.
Decoded in JS as d[7]&31 (opcode), d[7]>>5&31 (sub-opcode). Verify the
layout per sample before relying on it.
from selenium import webdriver
driver = webdriver.Chrome()
# Inject anti-detection before any script runs
driver.execute_cdp_cmd("Page.addScriptToEvaluateOnNewDocument", {
"source": r"""
Object.defineProperty(navigator, 'webdriver', {get: () => false});
Object.defineProperty(navigator, 'plugins', {get: () => [1,2,3,4,5]});
Object.defineProperty(navigator, 'languages', {get: () => ['zh-CN','zh','en']});
"""
})
# Send trusted CDP mouse events
driver.execute_cdp_cmd("Input.dispatchMouseEvent", {
"type": "mousePressed",
"x": 549.5, "y": 441.2,
"button": "left", "buttons": 1,
"clickCount": 1, "pointerType": "mouse"
})
const { chromium } = require('playwright');
(async () => {
const browser = await chromium.launch();
const page = await browser.newPage();
// Observe API traffic while the VM runs
await page.route('**/api/**', async route => { await route.continue_(); });
await page.goto('https://target-page.com');
// Wait until the DSL VM finished initializing
await page.waitForFunction(() => {
return window.AWSCInner &&
window.AWSCInner._modules &&
window.AWSCInner._modules['fy'];
});
// Trigger the flow that runs the bytecode
await page.mouse.move(500, 400);
await page.mouse.down();
// ... interaction sequence ...
await page.mouse.up();
await browser.close();
})();
DSL VM tokens are usually bound to the browser context (TLS JA3 fingerprint, IP, cookies, request headers). Replaying the captured token outside the browser lets the server detect the context mismatch. Do not default to a pure protocol approach.
| Code | Meaning | Handling |
|---|---|---|
| 0 | Verification passed | Extract sessionId + sig |
| 300 | Risk-control blocked | Blocked; cannot pass |
| 8778 | Verification failed, retry | Retry the operation |
| 8776 | Action too fast, retry | Add delay, then retry |
| 69634 | Generic failure | Check request parameters |
Run this self-check before claiming the reversal is complete:
DG()-style
dispatcher, no \x00asm magic).var X=<number> literals decoded).case N: labels.C[9] constant table reference range.js-reverse instead.\x00asm magic) — WASM tooling applies.| Rationalization | Reality |
|---|---|
| "The switch is too long; I'll only read the opcodes I hit first." | An incomplete opcode table misreads later bytecode. Classify all case N: labels before concluding semantics. |
| "I beautified the JS, so the logic is now readable." | Beautifying does not decode bytecode. The logic lives in the C[9] table + dispatcher, not the source formatting. |
| "I'll just replay the captured token with curl." | Tokens are context-bound (JA3, IP, cookies). Server-side context mismatch detection defeats pure protocol replay. |
| "The variable names are meaningless, so I can skip mapping them." | The numeric literals bound to those variables are the indices and constants the VM needs — skipping the map guarantees misreads. |
| "One captured output is enough evidence." | A single match can be luck. Verify against at least two independent captures before claiming correctness. |