AI Reverse Engineering in Practice: Cracking Modified SHA-1 and 20,000+ Lines of Obfuscated Code in One Shot

AI Reverse Engineering Is Transforming the Efficiency of Web Scraping

Traditional JS reverse engineering requires developers to manually analyze obfuscated code and trace encryption logic, often taking hours or even days. Today, with AI tools (such as OpenAI Codex combined with browser debugging), the same work can be completed in just tens of minutes.

This article uses Aisou Web (ISO official website) as a real-world case study, breaking down in detail how to leverage AI to crack a modified SHA-1 algorithm and 20,000+ lines of obfuscated code in one shot. The gap between traditional and AI-powered reverse engineering isn't about technical ability—it's about methodology choice.

JS Reverse Engineering and Code Obfuscation: Why Is It So Hard?

JS reverse engineering refers to the process of analyzing compiled or obfuscated JavaScript code to reconstruct its original logic. Modern web applications commonly employ multiple obfuscation techniques to protect core business logic: variable name replacement (replacing meaningful variable names with single letters or random strings), control flow flattening (breaking normal if/else and loop structures into state machine patterns), string encryption (encoding plaintext strings as hexadecimal or Base64), and code compression (removing whitespace and comments). Industrial-grade obfuscation tools like obfuscator.io and javascript-obfuscator can transform hundreds of lines of clean code into tens of thousands of lines of nearly unreadable obfuscated code, causing the time cost of manual analysis to grow exponentially. This is the fundamental reason why the 20,000+ line obfuscated file in this case study intimidates traditional reverse engineers.

Target Analysis: Encrypted Parameters of the Login Interface

Opening the login page of Aisou Web and using developer tools to capture network traffic, after entering a phone number and password (e.g., 123456) and clicking login, you can capture a login request. Examining the request parameters reveals several key encrypted fields:

• pwd: The ciphertext after password encryption, e.g., 110adcf883e... — the value obtained after inputting 123456 is clearly standard MD5
• he: A hash value generated by a modified SHA-1 algorithm
• san: Another encrypted parameter based on modified SHA-1
• ts: Timestamp
• seclet: Security verification parameter

Among these, pwd is standard MD5 and relatively straightforward. The real challenge lies in the he, san, and seclet parameters—they originate from a 20,000+ line obfuscated JS file using a modified SHA-1 algorithm.

SHA-1 Algorithm Background: SHA-1 (Secure Hash Algorithm 1) is a cryptographic hash function designed by the U.S. National Security Agency. It takes arbitrary-length input data and outputs a fixed 160-bit (40 hexadecimal character) hash value. Its core characteristic is one-way computation—the original input cannot be derived from the hash value. Website developers often modify standard SHA-1 to increase cracking difficulty. Common techniques include: multiple iterations (performing hash computation on the same data multiple times), partial result extraction (taking only certain digits of the hash value), fixed salt concatenation (adding specific strings to input or output), and modified initialization vectors (changing SHA-1's internal initial constant values). These modifications mean that even if a reverse engineer identifies the basic SHA-1 structure, they cannot directly reproduce results using standard libraries—every modification must be precisely reconstructed.

Traditional Reverse Engineering: The Painful Process of Breakpoint Tracing

Stack Tracing to Locate the Encryption Entry Point

Following traditional JS reverse engineering methods, you need to trace through the call stack layer by layer in developer tools. Starting from L.request, skipping irrelevant code like Promise async callbacks and export statements, you gradually locate where parameters are generated.

Specific steps include:

1. Set a breakpoint at the request interception point to find where parameter R is passed in
2. Trace upward layer by layer to find the MD5 password encryption call point
3. Continue tracing the generation logic of he and san, locating the SH function in the obfuscated file
4. Discover that all these functions point to the same massive obfuscated JS file

During this process, you encounter extensive code obfuscation: variable names replaced with meaningless single letters, control flow disrupted, and strings encoded. Manually analyzing 20,000+ lines of such obfuscated code is extremely inefficient.

The Dilemma of Searching for Parameter Names

Even more troublesome is that directly searching for parameter names (like seclet) in the code fails to locate the correct position. Search results are either strings within links or irrelevant assignment statements (such as assigning an emoji), because the parameter names themselves have also been obfuscated. This is the biggest obstacle that code obfuscation creates for traditional reverse engineering—not only is the logic disrupted, but the "entry point" itself is hidden.

AI Reverse Engineering in Practice: Cracking Three Encrypted Parameters

Technical Foundation of AI Reverse Engineering: Code Comprehension Capabilities of Large Language Models

Before diving into the practical work, it's important to understand why AI is suited for this task. OpenAI Codex and its successors like GPT-4 are pre-trained on tens of billions of lines of open-source code, enabling them to understand code semantics, recognize common algorithm patterns, and translate between different programming languages. In reverse engineering scenarios, the advantage of large language models lies in "pattern matching" rather than "line-by-line execution"—they can identify underlying algorithms from structural features of obfuscated code (such as specific bitwise operation sequences, loop unrolling patterns), similar to the intuitive judgment of human experts, but dozens of times faster. Current mainstream models support context windows exceeding 100,000 tokens, sufficient to accommodate tens of thousands of lines of code for holistic analysis—this is the key technical prerequisite for practical AI reverse engineering.

Step 1: Cracking san and he (Modified SHA-1 Reconstruction)

Download the entire 20,000+ line obfuscated file locally and hand it to AI for analysis. The prompt needs to include key contextual information:

"This is a JS file. The SH function in this file is called with [specific parameters] and produces [specific result value]. Please analyze and reconstruct the algorithm."

The AI's analysis process is highly systematic:

1. Identify obfuscation package scale: Confirm this is a large obfuscated file
2. Locate key functions: Find the definition of the H function
3. Reconstruct algorithm logic: Discover it's SHA-1 run twice, with 8 characters extracted from the middle, then concatenated with a fixed salt value
4. Fill in missing information: The domain name is needed as a computation parameter; after supplementing it, recalculate

The AI ultimately outputs reconstructed Python code that produces the correct san value when executed. The same method handles the he parameter—it uses an embedded method with a fixed parameter dt string passed in, and AI successfully locates and reconstructs the logic involving se, host, key, and other components.

Step 2: Cracking seclet (Fully Automated AI Analysis)

For the seclet parameter, a more aggressive strategy was adopted—giving AI only a page link without any additional hints, letting it autonomously complete the entire reverse analysis.

The prompt was extremely concise:

"Help me analyze the generation logic of the parameters in this login interface."