refactor: 将文件从子目录提升到仓库根目录

所有文件从 hello_js_reverse_skill/ 子目录移至仓库根目录，
使项目结构更清晰，便于作为 Skill 直接引用。

Made-with: Cursor

templates/browser-auto/main.js

@@ -0,0 +1,170 @@
+/**
+ * 主脚本模板 - 浏览器自动化
+ * 
+ * 适用场景：TLS 指纹检测、复杂环境依赖、window 蜜罐
+ * 使用 Playwright 控制真实 Chrome 浏览器执行请求
+ * 
+ * TODO: 根据逆向分析结果修改配置和逻辑
+ */
+
+const { chromium } = require('playwright-core');
+
+// ============ 配置区域 ============
+
+const CONFIG = {
+    name: '示例项目 - 浏览器自动化',
+    description: '采集全部5页数据',
+    
+    // 目标URL
+    pageURL: 'https://target.com/page',
+    
+    // Chrome 路径（macOS 默认路径）
+    chromePath: '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+    // Linux: '/usr/bin/google-chrome'
+    // Windows: 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe'
+    
+    // 是否显示浏览器
+    headless: false,
+    
+    totalPages: 5,
+    delay: 2000,
+    
+    // 登录 Cookie
+    cookies: [
+        // { name: 'sessionid', value: 'xxx', domain: 'target.com', path: '/' },
+    ],
+    
+    // 注入脚本（可选）
+    injectScript: null,
+};
+
+// ============ 主逻辑 ============
+
+async function main() {
+    console.log(`[*] 项目：${CONFIG.name}`);
+    console.log(`[*] 目标：${CONFIG.description}`);
+    console.log('');
+    
+    // 启动浏览器
+    console.log('[*] 启动浏览器...');
+    const browser = await chromium.launch({
+        executablePath: CONFIG.chromePath,
+        headless: CONFIG.headless,
+        args: [
+            '--disable-blink-features=AutomationControlled',
+            '--no-sandbox',
+        ],
+    });
+    
+    const context = await browser.newContext({
+        userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+        viewport: { width: 1920, height: 1080 },
+        locale: 'zh-CN',
+    });
+    
+    // 设置 Cookie
+    if (CONFIG.cookies.length > 0) {
+        await context.addCookies(CONFIG.cookies);
+    }
+    
+    // 隐藏自动化特征
+    await context.addInitScript(() => {
+        Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
+        window.chrome = { runtime: {} };
+    });
+    
+    // 注入自定义脚本
+    if (CONFIG.injectScript) {
+        await context.addInitScript(CONFIG.injectScript);
+    }
+    
+    const page = await context.newPage();
+    
+    try {
+        // 导航到目标页面
+        console.log('[*] 打开目标页面...');
+        await page.goto(CONFIG.pageURL, { waitUntil: 'networkidle', timeout: 30000 });
+        console.log('[+] 页面加载完成');
+        
+        // 采集数据
+        const allData = [];
+        
+        for (let pageNum = 1; pageNum <= CONFIG.totalPages; pageNum++) {
+            // TODO: 根据实际页面结构修改数据提取逻辑
+            const pageData = await extractPageData(page, pageNum);
+            allData.push(...pageData);
+            console.log(`[+] 正在采集第 ${pageNum}/${CONFIG.totalPages} 页... ✓ 获取 ${pageData.length} 条数据`);
+            
+            if (pageNum < CONFIG.totalPages) {
+                // 翻页
+                await goToNextPage(page, pageNum + 1);
+                await sleep(CONFIG.delay);
+            }
+        }
+        
+        console.log(`\n[+] 采集完成，共 ${allData.length} 条数据`);
+        
+        // 计算结果
+        const result = allData.reduce((sum, val) => sum + val, 0);
+        
+        console.log('\n' + '='.repeat(30) + ' 计算结果 ' + '='.repeat(30));
+        console.log(`答案：${result}`);
+        console.log('='.repeat(70));
+        
+    } catch (error) {
+        console.error('[!] 错误:', error.message);
+        await page.screenshot({ path: 'error_screenshot.png' });
+        console.log('[*] 已保存错误截图: error_screenshot.png');
+    } finally {
+        await browser.close();
+    }
+}
+
+/**
+ * 从页面提取数据
+ * TODO: 根据实际页面结构修改
+ */
+async function extractPageData(page, pageNum) {
+    // 方式1：从页面DOM提取
+    const data = await page.evaluate(() => {
+        const rows = document.querySelectorAll('.data-row');
+        return Array.from(rows).map(row => {
+            const value = row.querySelector('.value')?.textContent?.trim();
+            return parseFloat(value) || 0;
+        });
+    });
+    
+    return data;
+    
+    // 方式2：拦截网络响应
+    // const responsePromise = page.waitForResponse(resp => resp.url().includes('/api/data'));
+    // // 触发数据加载...
+    // const response = await responsePromise;
+    // const json = await response.json();
+    // return json.data;
+}
+
+/**
+ * 翻到下一页
+ * TODO: 根据实际页面结构修改翻页逻辑
+ */
+async function goToNextPage(page, targetPage) {
+    // 方式1：点击翻页按钮
+    await page.click(`.pagination a:has-text("${targetPage}")`);
+    await page.waitForLoadState('networkidle');
+    
+    // 方式2：等待特定元素出现
+    // await page.waitForSelector('.data-loaded');
+    
+    // 方式3：直接导航到带页码的URL
+    // await page.goto(`${CONFIG.pageURL}?page=${targetPage}`, { waitUntil: 'networkidle' });
+}
+
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+main().catch(error => {
+    console.error('\n[!] 运行错误:', error.message);
+    process.exit(1);
+});

templates/browser-auto/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "js-reverse-browser-auto",
+  "version": "1.0.0",
+  "description": "JS逆向 - 浏览器自动化模板",
+  "main": "main.js",
+  "scripts": {
+    "start": "node main.js",
+    "test": "node main.js --test"
+  },
+  "dependencies": {
+    "playwright-core": "^1.45.0"
+  }
+}

templates/node-request/main.js

@@ -0,0 +1,121 @@
+/**
+ * 主脚本模板 - 纯 Node.js 算法还原
+ * 
+ * 适用场景：加密逻辑可完整提取，无浏览器环境依赖
+ * 
+ * TODO: 根据逆向分析结果修改以下配置和逻辑
+ */
+
+const { generateM, generateSign } = require('./utils/encrypt');
+const { RequestClient } = require('./utils/request');
+
+// ============ 配置区域 ============
+
+const CONFIG = {
+    // 目标信息
+    name: '示例项目',
+    description: '采集全部5页数据，计算数值总和',
+    
+    // 接口配置
+    baseURL: 'https://target.com',
+    apiPath: '/api/data',
+    referer: 'https://target.com/page',
+    
+    // 采集配置
+    totalPages: 5,
+    delay: 1500,
+    
+    // 认证信息
+    cookies: {
+        // sessionid: 'your_session_id',
+    },
+    
+    // 自定义请求头
+    headers: {
+        // 'X-Custom-Header': 'value',
+    },
+};
+
+// ============ 主逻辑 ============
+
+async function fetchPage(client, page) {
+    // TODO: 根据实际接口修改参数构造逻辑
+    const m = generateM(page);
+    const timestamp = Math.floor(Date.now() / 1000);
+    
+    const params = {
+        page,
+        m,
+        t: timestamp,
+    };
+    
+    const response = await client.requestWithDelay({
+        method: 'GET',
+        url: CONFIG.apiPath,
+        params,
+    });
+    
+    return response.data;
+}
+
+function extractData(responseData) {
+    // TODO: 根据实际响应格式修改数据提取逻辑
+    if (responseData && responseData.data) {
+        return responseData.data;
+    }
+    return [];
+}
+
+function calculateResult(allData) {
+    // TODO: 根据题目要求修改计算逻辑
+    // 示例：求所有数值的总和
+    const sum = allData.reduce((acc, item) => {
+        const value = typeof item === 'number' ? item : (item.value || 0);
+        return acc + value;
+    }, 0);
+    return sum;
+}
+
+async function main() {
+    console.log(`[*] 项目：${CONFIG.name}`);
+    console.log(`[*] 目标：${CONFIG.description}`);
+    console.log('');
+    
+    const client = new RequestClient({
+        baseURL: CONFIG.baseURL,
+        cookies: CONFIG.cookies,
+        headers: CONFIG.headers,
+        referer: CONFIG.referer,
+        delay: CONFIG.delay,
+    });
+    
+    const allData = [];
+    
+    for (let page = 1; page <= CONFIG.totalPages; page++) {
+        try {
+            const responseData = await fetchPage(client, page);
+            const pageData = extractData(responseData);
+            allData.push(...pageData);
+            console.log(`[+] 正在采集第 ${page}/${CONFIG.totalPages} 页... ✓ 获取 ${pageData.length} 条数据`);
+        } catch (error) {
+            console.error(`[-] 第 ${page} 页采集失败: ${error.message}`);
+            if (error.response) {
+                console.error(`    状态码: ${error.response.status}`);
+                console.error(`    响应: ${JSON.stringify(error.response.data).substring(0, 200)}`);
+            }
+        }
+    }
+    
+    console.log(`\n[+] 采集完成，共 ${allData.length} 条数据`);
+    
+    const result = calculateResult(allData);
+    
+    console.log('\n' + '='.repeat(30) + ' 计算结果 ' + '='.repeat(30));
+    console.log(`答案：${result}`);
+    console.log('='.repeat(70));
+}
+
+main().catch(error => {
+    console.error('\n[!] 运行错误:', error.message);
+    process.exit(1);
+});

templates/node-request/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "js-reverse-project",
+  "version": "1.0.0",
+  "description": "JS逆向 - 纯Node.js算法还原模板",
+  "main": "main.js",
+  "scripts": {
+    "start": "node main.js",
+    "test": "node main.js --test"
+  },
+  "dependencies": {
+    "axios": "^1.7.0",
+    "crypto-js": "^4.2.0"
+  }
+}

templates/node-request/utils/encrypt.js

@@ -0,0 +1,71 @@
+/**
+ * 加密参数生成模块
+ * 根据逆向分析还原的加密逻辑，生成请求所需的加密参数
+ */
+
+const crypto = require('crypto');
+
+function md5(str) {
+    return crypto.createHash('md5').update(str).digest('hex');
+}
+
+function sha256(str) {
+    return crypto.createHash('sha256').update(str).digest('hex');
+}
+
+function hmacSha256(message, secret) {
+    return crypto.createHmac('sha256', secret).update(message).digest('hex');
+}
+
+function aesEncrypt(plaintext, key, iv, mode = 'cbc') {
+    const algorithm = `aes-${key.length * 8}-${mode}`;
+    const cipher = crypto.createCipheriv(algorithm, key, mode === 'ecb' ? null : iv);
+    cipher.setAutoPadding(true);
+    let encrypted = cipher.update(plaintext, 'utf8', 'base64');
+    encrypted += cipher.final('base64');
+    return encrypted;
+}
+
+function aesDecrypt(ciphertext, key, iv, mode = 'cbc') {
+    const algorithm = `aes-${key.length * 8}-${mode}`;
+    const decipher = crypto.createDecipheriv(algorithm, key, mode === 'ecb' ? null : iv);
+    decipher.setAutoPadding(true);
+    let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
+    decrypted += decipher.final('utf8');
+    return decrypted;
+}
+
+/**
+ * 生成请求签名
+ * TODO: 根据实际逆向分析修改此函数
+ * @param {Object} params - 请求参数
+ * @returns {string} 签名值
+ */
+function generateSign(params) {
+    const { page, timestamp } = params;
+    // 示例：sign = md5(page + "|" + timestamp + "|" + SECRET)
+    const SECRET = 'your_secret_here';
+    return md5(`${page}|${timestamp}|${SECRET}`);
+}
+
+/**
+ * 生成加密参数 m
+ * TODO: 根据实际逆向分析修改此函数
+ * @param {number} page - 页码
+ * @returns {string} 加密后的参数
+ */
+function generateM(page) {
+    const timestamp = Math.floor(Date.now() / 1000);
+    const sign = generateSign({ page, timestamp });
+    return `${sign}|${timestamp}`;
+}
+
+module.exports = {
+    md5,
+    sha256,
+    hmacSha256,
+    aesEncrypt,
+    aesDecrypt,
+    generateSign,
+    generateM,
+};

templates/node-request/utils/request.js

@@ -0,0 +1,128 @@
+/**
+ * 请求封装模块
+ * 封装 HTTP 请求，处理 Headers、Cookie、重试、频率控制
+ */
+
+const axios = require('axios');
+
+const DEFAULT_HEADERS = {
+    'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+    'Accept': 'application/json, text/javascript, */*; q=0.01',
+    'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8',
+    'Accept-Encoding': 'gzip, deflate, br',
+    'Connection': 'keep-alive',
+    'X-Requested-With': 'XMLHttpRequest',
+};
+
+class RequestClient {
+    constructor(options = {}) {
+        this.baseURL = options.baseURL || '';
+        this.cookies = options.cookies || {};
+        this.headers = { ...DEFAULT_HEADERS, ...options.headers };
+        this.delay = options.delay || 1000;
+        this.maxRetries = options.maxRetries || 3;
+        this.referer = options.referer || '';
+
+        this.client = axios.create({
+            baseURL: this.baseURL,
+            timeout: options.timeout || 30000,
+            headers: this.headers,
+            maxRedirects: 5,
+        });
+    }
+
+    getCookieString() {
+        return Object.entries(this.cookies)
+            .map(([k, v]) => `${k}=${v}`)
+            .join('; ');
+    }
+
+    setCookie(name, value) {
+        this.cookies[name] = value;
+    }
+
+    parseCookies(setCookieHeader) {
+        if (!setCookieHeader) return;
+        const headers = Array.isArray(setCookieHeader) ? setCookieHeader : [setCookieHeader];
+        headers.forEach(h => {
+            const mainPart = h.split(';')[0];
+            const eqIdx = mainPart.indexOf('=');
+            if (eqIdx > 0) {
+                this.cookies[mainPart.substring(0, eqIdx).trim()] = mainPart.substring(eqIdx + 1).trim();
+            }
+        });
+    }
+
+    async request(config) {
+        const finalConfig = {
+            ...config,
+            headers: {
+                ...this.headers,
+                ...config.headers,
+                'Cookie': this.getCookieString(),
+            },
+        };
+
+        if (this.referer) {
+            finalConfig.headers['Referer'] = this.referer;
+        }
+
+        let lastError;
+        for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
+            try {
+                const response = await this.client.request(finalConfig);
+                this.parseCookies(response.headers['set-cookie']);
+                return response;
+            } catch (error) {
+                lastError = error;
+                const status = error.response?.status;
+                console.error(`[Request] 第 ${attempt}/${this.maxRetries} 次请求失败: ${status || error.message}`);
+
+                if (status === 429) {
+                    const waitTime = this.delay * attempt * 2;
+                    console.log(`[Request] 频率限制，等待 ${waitTime}ms...`);
+                    await this.sleep(waitTime);
+                } else if (status >= 500) {
+                    await this.sleep(this.delay * attempt);
+                } else if (status === 403 || status === 412) {
+                    console.error('[Request] 访问被拒绝，可能需要更新 Cookie 或检查加密参数');
+                    throw error;
+                } else {
+                    throw error;
+                }
+            }
+        }
+        throw lastError;
+    }
+
+    async get(url, params = {}, extraHeaders = {}) {
+        return this.request({
+            method: 'GET',
+            url,
+            params,
+            headers: extraHeaders,
+        });
+    }
+
+    async post(url, data = {}, extraHeaders = {}) {
+        return this.request({
+            method: 'POST',
+            url,
+            data,
+            headers: extraHeaders,
+        });
+    }
+
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+
+    async requestWithDelay(config) {
+        const response = await this.request(config);
+        const jitter = Math.random() * this.delay * 0.5;
+        await this.sleep(this.delay + jitter);
+        return response;
+    }
+}
+
+module.exports = { RequestClient, DEFAULT_HEADERS };

templates/vm-sandbox/main.js

@@ -0,0 +1,117 @@
+/**
+ * 主脚本模板 - VM 沙箱执行
+ * 
+ * 适用场景：服务端返回混淆JS用于生成Cookie/Token
+ * 流程：
+ *   1. 请求接口 → 返回混淆 JS
+ *   2. VM 沙箱执行 JS → 提取 Cookie
+ *   3. 携带 Cookie 请求数据接口
+ * 
+ * TODO: 根据逆向分析结果修改配置和逻辑
+ */
+
+const { executeAndExtractCookie } = require('./utils/sandbox');
+const { TwoPhaseClient } = require('./utils/request');
+
+// ============ 配置区域 ============
+
+const CONFIG = {
+    name: '示例项目 - 动态Cookie',
+    description: '采集全部5页数据',
+    
+    baseURL: 'https://target.com',
+    
+    // 第一阶段：获取动态JS的接口
+    jsEndpoint: '/api/init',
+    
+    // 第二阶段：数据接口
+    dataEndpoint: '/api/data',
+    
+    referer: 'https://target.com/page',
+    totalPages: 5,
+    delay: 2000,
+    
+    cookies: {
+        // sessionid: 'your_session_id',
+    },
+};
+
+// ============ 主逻辑 ============
+
+async function getDynamicCookie(client) {
+    console.log('[*] 获取动态Cookie...');
+    
+    // 第一阶段：请求返回JS代码的接口
+    const jsCode = await client.fetchDynamicJS(CONFIG.jsEndpoint);
+    
+    // 在VM沙箱中执行，提取Cookie
+    const result = executeAndExtractCookie(jsCode, {
+        url: CONFIG.baseURL + CONFIG.referer,
+        initialCookie: client.getCookieString(),
+    });
+    
+    if (result.success && Object.keys(result.cookies).length > 0) {
+        console.log(`[+] Cookie 提取成功: ${result.cookieString.substring(0, 100)}...`);
+        client.setCookies(result.cookies);
+        return true;
+    } else {
+        console.error('[-] Cookie 提取失败:', result.error || '未生成Cookie');
+        return false;
+    }
+}
+
+async function fetchPage(client, page) {
+    // TODO: 根据实际接口修改参数
+    const params = { page };
+    return client.fetchWithDelay(CONFIG.dataEndpoint, params);
+}
+
+async function main() {
+    console.log(`[*] 项目：${CONFIG.name}`);
+    console.log(`[*] 目标：${CONFIG.description}`);
+    console.log('');
+    
+    const client = new TwoPhaseClient({
+        baseURL: CONFIG.baseURL,
+        cookies: CONFIG.cookies,
+        delay: CONFIG.delay,
+    });
+    
+    // 获取动态Cookie
+    const cookieOk = await getDynamicCookie(client);
+    if (!cookieOk) {
+        console.error('[!] 无法获取动态Cookie，退出');
+        process.exit(1);
+    }
+    
+    // 采集数据
+    const allData = [];
+    
+    for (let page = 1; page <= CONFIG.totalPages; page++) {
+        try {
+            // 某些网站每次请求都需要刷新Cookie
+            // await getDynamicCookie(client);
+            
+            const responseData = await fetchPage(client, page);
+            const pageData = responseData.data || [];
+            allData.push(...pageData);
+            console.log(`[+] 正在采集第 ${page}/${CONFIG.totalPages} 页... ✓ 获取 ${pageData.length} 条数据`);
+        } catch (error) {
+            console.error(`[-] 第 ${page} 页采集失败: ${error.message}`);
+        }
+    }
+    
+    console.log(`\n[+] 采集完成，共 ${allData.length} 条数据`);
+    
+    // TODO: 根据需求计算结果
+    const result = allData.reduce((sum, item) => sum + (item.value || 0), 0);
+    
+    console.log('\n' + '='.repeat(30) + ' 计算结果 ' + '='.repeat(30));
+    console.log(`答案：${result}`);
+    console.log('='.repeat(70));
+}
+
+main().catch(error => {
+    console.error('\n[!] 运行错误:', error.message);
+    process.exit(1);
+});

templates/vm-sandbox/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "js-reverse-vm-sandbox",
+  "version": "1.0.0",
+  "description": "JS逆向 - VM沙箱执行模板",
+  "main": "main.js",
+  "scripts": {
+    "start": "node main.js",
+    "test": "node main.js --test"
+  },
+  "dependencies": {
+    "axios": "^1.7.0"
+  }
+}

templates/vm-sandbox/utils/request.js

@@ -0,0 +1,81 @@
+/**
+ * 请求封装模块（VM沙箱版本）
+ * 支持两阶段请求：先获取动态JS生成Cookie，再携带Cookie请求数据
+ */
+
+const axios = require('axios');
+
+const DEFAULT_HEADERS = {
+    'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+    'Accept': 'application/json, text/javascript, */*; q=0.01',
+    'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8',
+    'X-Requested-With': 'XMLHttpRequest',
+};
+
+class TwoPhaseClient {
+    constructor(options = {}) {
+        this.baseURL = options.baseURL || '';
+        this.cookies = options.cookies || {};
+        this.headers = { ...DEFAULT_HEADERS, ...options.headers };
+        this.delay = options.delay || 1500;
+
+        this.client = axios.create({
+            baseURL: this.baseURL,
+            timeout: options.timeout || 30000,
+            headers: this.headers,
+        });
+    }
+
+    getCookieString() {
+        return Object.entries(this.cookies).map(([k, v]) => `${k}=${v}`).join('; ');
+    }
+
+    setCookies(cookieObj) {
+        Object.assign(this.cookies, cookieObj);
+    }
+
+    /**
+     * 第一阶段：获取动态JS代码
+     * @param {string} url - 返回JS代码的接口
+     * @returns {string} JS 代码字符串
+     */
+    async fetchDynamicJS(url, params = {}) {
+        const response = await this.client.get(url, {
+            params,
+            headers: { Cookie: this.getCookieString() },
+            transformResponse: [(data) => data],
+        });
+        return response.data;
+    }
+
+    /**
+     * 第二阶段：携带Cookie请求数据
+     */
+    async fetchData(url, params = {}) {
+        const response = await this.client.get(url, {
+            params,
+            headers: { Cookie: this.getCookieString() },
+        });
+        return response.data;
+    }
+
+    async post(url, data = {}) {
+        const response = await this.client.post(url, data, {
+            headers: { Cookie: this.getCookieString() },
+        });
+        return response.data;
+    }
+
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+
+    async fetchWithDelay(url, params = {}) {
+        const data = await this.fetchData(url, params);
+        const jitter = Math.random() * this.delay * 0.3;
+        await this.sleep(this.delay + jitter);
+        return data;
+    }
+}
+
+module.exports = { TwoPhaseClient, DEFAULT_HEADERS };

templates/vm-sandbox/utils/sandbox.js

@@ -0,0 +1,152 @@
+/**
+ * VM 沙箱模块
+ * 用于执行服务端返回的混淆 JS 代码，提取动态生成的 Cookie/Token
+ */
+
+const vm = require('vm');
+
+function createSandbox(options = {}) {
+    const cookies = {};
+    const logs = [];
+    
+    const sandbox = {
+        window: null,
+        self: null,
+        globalThis: null,
+        top: null,
+        parent: null,
+        
+        document: {
+            cookie: options.initialCookie || '',
+            createElement: (tag) => ({
+                tagName: tag.toUpperCase(), style: {}, src: '',
+                setAttribute: () => {}, getAttribute: () => null,
+                appendChild: () => {}, innerHTML: '',
+            }),
+            getElementById: () => null,
+            getElementsByTagName: (tag) => tag === 'script' ? [1, 2, 3] : [],
+            getElementsByClassName: () => [],
+            querySelector: () => null,
+            querySelectorAll: () => [],
+            head: { appendChild: () => {} },
+            body: { appendChild: () => {} },
+            location: { href: options.url || 'https://example.com' },
+            referrer: '',
+            readyState: 'complete',
+        },
+        
+        navigator: {
+            userAgent: options.userAgent || 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+            appCodeName: 'Mozilla', appName: 'Netscape', appVersion: '5.0',
+            platform: 'MacIntel', language: 'zh-CN', languages: ['zh-CN', 'zh', 'en'],
+            cookieEnabled: true, onLine: true, webdriver: false,
+            plugins: { length: 3 }, mimeTypes: { length: 4 },
+            hardwareConcurrency: 8, maxTouchPoints: 0,
+        },
+        
+        location: {
+            href: options.url || 'https://example.com',
+            protocol: 'https:', host: 'example.com',
+            hostname: 'example.com', pathname: '/', search: '', hash: '',
+            origin: 'https://example.com',
+        },
+        
+        screen: { width: 1920, height: 1080, availWidth: 1920, availHeight: 1055, colorDepth: 24, pixelDepth: 24 },
+        
+        setTimeout: (fn, ms) => setTimeout(fn, Math.min(ms || 0, 3000)),
+        setInterval: (fn, ms) => { /* 不执行定时器避免死循环 */ return -1; },
+        clearTimeout, clearInterval,
+        
+        String, Array, Object, Math, Date, RegExp, JSON, Map, Set,
+        parseInt, parseFloat, isNaN, isFinite, NaN, Infinity, undefined,
+        encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,
+        escape, unescape,
+        Error, TypeError, RangeError, SyntaxError, ReferenceError,
+        ArrayBuffer, Uint8Array, Int32Array, Float64Array, DataView,
+        Promise, Proxy, Reflect, Symbol, Number, Boolean,
+        
+        btoa: (str) => Buffer.from(str, 'binary').toString('base64'),
+        atob: (b64) => Buffer.from(b64, 'base64').toString('binary'),
+        
+        console: {
+            log: (...args) => logs.push(args.join(' ')),
+            warn: () => {}, error: () => {}, info: () => {},
+            debug: () => {}, trace: () => {}, clear: () => {},
+        },
+        
+        XMLHttpRequest: class {
+            open() {} setRequestHeader() {} send() {
+                this.readyState = 4; this.status = 200; this.responseText = '{}';
+                if (this.onreadystatechange) this.onreadystatechange();
+            }
+            addEventListener(e, fn) { this['on' + e] = fn; }
+        },
+    };
+    
+    sandbox.window = sandbox;
+    sandbox.self = sandbox;
+    sandbox.globalThis = sandbox;
+    sandbox.top = sandbox;
+    sandbox.parent = sandbox;
+    sandbox.frames = sandbox;
+    
+    // Cookie 拦截
+    Object.defineProperty(sandbox.document, 'cookie', {
+        get() {
+            return Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join('; ');
+        },
+        set(val) {
+            const mainPart = val.split(';')[0];
+            const eqIdx = mainPart.indexOf('=');
+            if (eqIdx > 0) {
+                const name = mainPart.substring(0, eqIdx).trim();
+                const value = mainPart.substring(eqIdx + 1).trim();
+                cookies[name] = value;
+            }
+        },
+        configurable: true,
+    });
+    
+    if (options.initialCookie) {
+        options.initialCookie.split(';').forEach(pair => {
+            const [k, ...rest] = pair.trim().split('=');
+            if (k) cookies[k.trim()] = rest.join('=');
+        });
+    }
+    
+    return { sandbox, cookies, logs };
+}
+
+/**
+ * 执行混淆 JS 代码并提取 Cookie
+ * @param {string} code - 混淆的 JS 代码
+ * @param {Object} options - 配置选项
+ * @returns {Object} { cookies, logs, success }
+ */
+function executeAndExtractCookie(code, options = {}) {
+    const { sandbox, cookies, logs } = createSandbox(options);
+    vm.createContext(sandbox);
+    
+    try {
+        vm.runInContext(code, sandbox, {
+            timeout: options.timeout || 5000,
+            filename: 'dynamic.js',
+        });
+        
+        return {
+            success: true,
+            cookies: { ...cookies },
+            cookieString: Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join('; '),
+            logs,
+        };
+    } catch (error) {
+        return {
+            success: false,
+            error: error.message,
+            cookies: { ...cookies },
+            logs,
+        };
+    }
+}
+
+module.exports = { createSandbox, executeAndExtractCookie };

templates/wasm-loader/main.js

@@ -0,0 +1,160 @@
+/**
+ * 主脚本模板 - WASM 加载还原
+ * 
+ * 适用场景：加密函数通过 WebAssembly 实现
+ * 流程：
+ *   1. 下载/加载 .wasm 文件
+ *   2. 补全运行环境
+ *   3. 调用 WASM 导出的加密函数
+ *   4. 使用加密结果构造请求
+ * 
+ * TODO: 根据逆向分析结果修改配置和逻辑
+ */
+
+const { loadWasmFromFile, loadWasmFromURL, analyzeWasm } = require('./utils/wasm-loader');
+const { patchWasmBindgen } = require('./utils/env-patch');
+const axios = require('axios');
+const path = require('path');
+
+// ============ 配置区域 ============
+
+const CONFIG = {
+    name: '示例项目 - WASM加密',
+    description: '采集全部5页数据',
+    
+    baseURL: 'https://target.com',
+    dataEndpoint: '/api/data',
+    
+    // WASM 文件路径或 URL
+    wasmSource: './main.wasm',    // 本地文件
+    // wasmSource: 'https://target.com/main.wasm',  // 远程 URL
+    
+    // WASM 导出函数名
+    encryptFunction: 'encode',
+    
+    // WASM 类型: 'plain' | 'emscripten' | 'wasm-bindgen' | 'go'
+    wasmType: 'plain',
+    
+    totalPages: 5,
+    delay: 1500,
+    
+    cookies: {},
+    headers: {
+        'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36',
+    },
+};
+
+// ============ 主逻辑 ============
+
+let wasmExports = null;
+
+async function initWasm() {
+    console.log('[*] 加载 WASM 模块...');
+    
+    // 根据 WASM 类型补全环境
+    if (CONFIG.wasmType === 'wasm-bindgen') {
+        patchWasmBindgen();
+    }
+    
+    // 分析 WASM 结构
+    if (CONFIG.wasmSource.startsWith('http')) {
+        console.log('[*] 从远程下载 WASM...');
+        const result = await loadWasmFromURL(CONFIG.wasmSource);
+        wasmExports = result.exports;
+        console.log('[+] WASM 导出函数:', Object.keys(result.exports).filter(k => typeof result.exports[k] === 'function'));
+    } else {
+        const wasmPath = path.resolve(CONFIG.wasmSource);
+        
+        // 先分析 WASM 结构
+        const analysis = await analyzeWasm(wasmPath);
+        console.log('[*] WASM 导出:', analysis.exports.map(e => `${e.name}(${e.kind})`).join(', '));
+        console.log('[*] WASM 导入:', analysis.imports.map(i => `${i.module}.${i.name}`).join(', '));
+        
+        const result = await loadWasmFromFile(wasmPath);
+        wasmExports = result.exports;
+    }
+    
+    // 验证加密函数存在
+    if (typeof wasmExports[CONFIG.encryptFunction] !== 'function') {
+        throw new Error(`WASM 导出函数 "${CONFIG.encryptFunction}" 不存在。可用函数: ${Object.keys(wasmExports).filter(k => typeof wasmExports[k] === 'function').join(', ')}`);
+    }
+    
+    console.log(`[+] WASM 加载成功，加密函数: ${CONFIG.encryptFunction}`);
+}
+
+function generateEncryptedParam(page) {
+    // TODO: 根据逆向分析修改参数生成逻辑
+    const timestamp = Math.floor(Date.now() / 1000);
+    
+    // 调用 WASM 导出的加密函数
+    const encrypted = wasmExports[CONFIG.encryptFunction](timestamp, page);
+    
+    // TODO: 根据实际格式组装参数
+    return `${encrypted}|${timestamp}|${page}`;
+}
+
+async function fetchPage(page) {
+    const m = generateEncryptedParam(page);
+    
+    const response = await axios.get(`${CONFIG.baseURL}${CONFIG.dataEndpoint}`, {
+        params: { page, m },
+        headers: {
+            ...CONFIG.headers,
+            Cookie: Object.entries(CONFIG.cookies).map(([k, v]) => `${k}=${v}`).join('; '),
+            Referer: CONFIG.baseURL,
+        },
+    });
+    
+    return response.data;
+}
+
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+async function main() {
+    console.log(`[*] 项目：${CONFIG.name}`);
+    console.log(`[*] 目标：${CONFIG.description}`);
+    console.log('');
+    
+    // 初始化 WASM
+    await initWasm();
+    console.log('');
+    
+    // 验证：测试加密函数
+    const testResult = generateEncryptedParam(1);
+    console.log(`[*] 加密测试: page=1 → m=${testResult}`);
+    console.log('');
+    
+    // 采集数据
+    const allData = [];
+    
+    for (let page = 1; page <= CONFIG.totalPages; page++) {
+        try {
+            const responseData = await fetchPage(page);
+            const pageData = responseData.data || [];
+            allData.push(...pageData);
+            console.log(`[+] 正在采集第 ${page}/${CONFIG.totalPages} 页... ✓ 获取 ${pageData.length} 条数据`);
+            
+            if (page < CONFIG.totalPages) {
+                await sleep(CONFIG.delay + Math.random() * 500);
+            }
+        } catch (error) {
+            console.error(`[-] 第 ${page} 页采集失败: ${error.message}`);
+        }
+    }
+    
+    console.log(`\n[+] 采集完成，共 ${allData.length} 条数据`);
+    
+    // TODO: 计算结果
+    const result = allData.reduce((sum, item) => sum + (item.value || 0), 0);
+    
+    console.log('\n' + '='.repeat(30) + ' 计算结果 ' + '='.repeat(30));
+    console.log(`答案：${result}`);
+    console.log('='.repeat(70));
+}
+
+main().catch(error => {
+    console.error('\n[!] 运行错误:', error.message);
+    process.exit(1);
+});

templates/wasm-loader/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "js-reverse-wasm",
+  "version": "1.0.0",
+  "description": "JS逆向 - WASM加载还原模板",
+  "main": "main.js",
+  "scripts": {
+    "start": "node main.js",
+    "test": "node main.js --test"
+  },
+  "dependencies": {
+    "axios": "^1.7.0"
+  }
+}

templates/wasm-loader/utils/env-patch.js

@@ -0,0 +1,97 @@
+/**
+ * WASM 环境补全模块
+ * 为不同类型的 WASM（Emscripten、wasm-bindgen 等）提供最小运行环境
+ */
+
+/**
+ * 补全 wasm-bindgen (Rust) 生成的 WASM 所需的环境
+ * 常见于 Rust 编写的加密模块
+ */
+function patchWasmBindgen() {
+    class Window {
+        constructor() {
+            this.document = {
+                body: {},
+                head: {},
+                createElement: () => ({}),
+                getElementById: () => null,
+                querySelector: () => null,
+            };
+        }
+    }
+    
+    const win = new Window();
+    win.window = win;
+    win.self = win;
+    win.globalThis = win;
+    
+    globalThis.Window = Window;
+    globalThis.window = win;
+    globalThis.self = win;
+    globalThis.document = win.document;
+    
+    // wasm-bindgen 可能使用 TextEncoder/TextDecoder
+    if (typeof TextEncoder === 'undefined') {
+        const { TextEncoder, TextDecoder } = require('util');
+        globalThis.TextEncoder = TextEncoder;
+        globalThis.TextDecoder = TextDecoder;
+    }
+    
+    return win;
+}
+
+/**
+ * 补全 Emscripten 生成的 WASM 所需的环境
+ */
+function patchEmscripten() {
+    return {
+        print: console.log,
+        printErr: console.error,
+        TOTAL_MEMORY: 16777216,
+        TOTAL_STACK: 5242880,
+        noInitialRun: true,
+        noExitRuntime: true,
+        onRuntimeInitialized: null,
+        preRun: [],
+        postRun: [],
+    };
+}
+
+/**
+ * 补全 Go WASM 所需的环境
+ */
+function patchGoWasm() {
+    globalThis.process = globalThis.process || { argv: ['node'], env: {} };
+    globalThis.fs = globalThis.fs || require('fs');
+    
+    // Go WASM 需要 performance.now
+    if (typeof performance === 'undefined') {
+        globalThis.performance = {
+            now: () => Date.now(),
+        };
+    }
+    
+    // Go WASM 需要 crypto.getRandomValues
+    if (typeof globalThis.crypto === 'undefined') {
+        const nodeCrypto = require('crypto');
+        globalThis.crypto = {
+            getRandomValues: (arr) => {
+                const bytes = nodeCrypto.randomBytes(arr.length);
+                arr.set(bytes);
+                return arr;
+            },
+        };
+    }
+}
+
+/**
+ * 清理环境补丁（测试完成后调用）
+ */
+function cleanupPatches() {
+    delete globalThis.Window;
+    delete globalThis.window;
+    delete globalThis.self;
+    delete globalThis.document;
+}
+
+module.exports = { patchWasmBindgen, patchEmscripten, patchGoWasm, cleanupPatches };

templates/wasm-loader/utils/wasm-loader.js

@@ -0,0 +1,115 @@
+/**
+ * WASM 加载与执行模块
+ * 在 Node.js 中加载 WebAssembly 模块并调用导出函数
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * 加载本地 WASM 文件
+ * @param {string} wasmPath - WASM 文件路径
+ * @param {Object} importObject - 导入对象（环境依赖）
+ * @returns {Object} WASM 实例的 exports
+ */
+async function loadWasmFromFile(wasmPath, importObject = {}) {
+    const wasmBuffer = fs.readFileSync(wasmPath);
+    return loadWasm(wasmBuffer, importObject);
+}
+
+/**
+ * 从 URL 下载并加载 WASM
+ * @param {string} url - WASM 文件 URL
+ * @param {Object} importObject - 导入对象
+ * @returns {Object} WASM 实例的 exports
+ */
+async function loadWasmFromURL(url, importObject = {}) {
+    const axios = require('axios');
+    const response = await axios.get(url, { responseType: 'arraybuffer' });
+    return loadWasm(response.data, importObject);
+}
+
+/**
+ * 从二进制数据加载 WASM
+ */
+async function loadWasm(wasmBuffer, importObject = {}) {
+    const defaultImports = {
+        env: {
+            memory: new WebAssembly.Memory({ initial: 256, maximum: 512 }),
+            table: new WebAssembly.Table({ initial: 0, element: 'anyfunc' }),
+            abort: (msg, file, line, col) => {
+                console.error(`WASM abort at ${file}:${line}:${col}: ${msg}`);
+            },
+            __memory_base: 0,
+            __table_base: 0,
+            ...importObject.env,
+        },
+        wasi_snapshot_preview1: {
+            fd_write: () => 0,
+            fd_read: () => 0,
+            fd_close: () => 0,
+            fd_seek: () => 0,
+            fd_fdstat_get: () => 0,
+            environ_sizes_get: () => 0,
+            environ_get: () => 0,
+            proc_exit: (code) => { throw new Error(`WASM proc_exit(${code})`); },
+            clock_time_get: () => BigInt(Date.now()) * 1000000n,
+            ...importObject.wasi_snapshot_preview1,
+        },
+        ...importObject,
+    };
+    
+    // 检查 WASM 需要哪些导入
+    const module = await WebAssembly.compile(wasmBuffer);
+    const requiredImports = WebAssembly.Module.imports(module);
+    
+    // 确保所有需要的导入都存在
+    for (const imp of requiredImports) {
+        if (!defaultImports[imp.module]) {
+            defaultImports[imp.module] = {};
+        }
+        if (!defaultImports[imp.module][imp.name]) {
+            switch (imp.kind) {
+                case 'function':
+                    defaultImports[imp.module][imp.name] = () => {};
+                    break;
+                case 'global':
+                    defaultImports[imp.module][imp.name] = new WebAssembly.Global({ value: 'i32', mutable: true }, 0);
+                    break;
+                case 'memory':
+                    defaultImports[imp.module][imp.name] = new WebAssembly.Memory({ initial: 256 });
+                    break;
+                case 'table':
+                    defaultImports[imp.module][imp.name] = new WebAssembly.Table({ initial: 0, element: 'anyfunc' });
+                    break;
+            }
+        }
+    }
+    
+    const instance = await WebAssembly.instantiate(module, defaultImports);
+    
+    return {
+        exports: instance.exports,
+        module,
+        instance,
+        imports: requiredImports,
+    };
+}
+
+/**
+ * 分析 WASM 模块的导出和导入
+ */
+async function analyzeWasm(wasmPath) {
+    const wasmBuffer = fs.readFileSync(wasmPath);
+    const module = await WebAssembly.compile(wasmBuffer);
+    
+    const exports = WebAssembly.Module.exports(module);
+    const imports = WebAssembly.Module.imports(module);
+    
+    return {
+        exports: exports.map(e => ({ name: e.name, kind: e.kind })),
+        imports: imports.map(i => ({ module: i.module, name: i.name, kind: i.kind })),
+    };
+}
+
+module.exports = { loadWasmFromFile, loadWasmFromURL, loadWasm, analyzeWasm };