Cocos Creator Reverse Engineering — Claude Code skill

English · 简体中文

A Claude Code plugin that reverse-engineers Cocos Creator 2.x and 3.x game builds — detects the engine version, decrypts XXTEA-encrypted .jsc scripts, rebuilds the asset graph (scenes, prefabs, sprite frames, audio, animations, Spine, DragonBones, materials, meshes), and emits an editable Cocos Creator project.

Built on top of cc-reverse, a Node.js CLI for the same job.

What it does

• Detects the engine series (2.3.x / 2.4.x / 3.x) from the build layout.
• Decrypts XXTEA-encrypted .jsc files (auto-extracts the key from main.js/application.js, handles gzipped and raw variants, reconstructs byte-array keys).
• Rebuilds scripts — 2.x's project.js module-pack is split into per-file .ts; 3.x's SystemJS chunks are recovered as .js.
• Rebuilds assets — scenes, prefabs, sprite frames, audio, animations, Spine, DragonBones, with correct .meta files so the project opens in Cocos Creator.
• Supports 3.x bundles — each bundle (main, internal, resources, custom, subpackages) is unpacked into its own subdirectory using the bundle's config.json.
• Handles CCON binary (.cconb / .ccon) asset files.
• Extracts and catalogues — post-pass commands count assets by type, find HTTP endpoints, detect bundled SDKs.

Requirements

Required:

• Node.js 16+
• cc-reverse (installed globally via npm install -g cc-reverse)

Optional (recommended):

• unzip / 7z — for extracting game archives
• jq — for inspecting 3.x settings.json / config.json
• ffmpeg — for converting recovered audio

See setup-guide.md for installation instructions.

Installation

From GitHub (recommended)

In Claude Code:

/plugin marketplace add Crain99/cocos-reverse-engineering-skill
/plugin install cocos-reverse-engineering@cocos-reverse-engineering-skill

From a local clone

git clone https://github.com/Crain99/cocos-reverse-engineering-skill.git

Then:

/plugin marketplace add /path/to/cocos-reverse-engineering-skill
/plugin install cocos-reverse-engineering@cocos-reverse-engineering-skill

Usage

Slash commands

/reverse-cocos path/to/build
/find-jsc-key path/to/build

/reverse-cocos runs the full workflow: dependency check, detection, decryption, unpack, catalogue. /find-jsc-key is a focused lookup when you only want the XXTEA key.

Natural language

The skill activates on phrases like:

• "Reverse engineer this Cocos Creator game"
• "Decompile this Cocos build"
• "Extract assets from this cocos-js project"
• "Find the XXTEA key in this APK"
• "Unpack the scenes from this Cocos 3 build"

Manual scripts

Every step is a standalone bash script:

SKILL=plugins/cocos-reverse-engineering/skills/cocos-reverse-engineering

# Dependencies
bash $SKILL/scripts/check-deps.sh
bash $SKILL/scripts/install-dep.sh cc-reverse

# Detection
bash $SKILL/scripts/detect-project.sh path/to/build

# Key extraction
bash $SKILL/scripts/find-jsc-key.sh path/to/build

# Full unpack
bash $SKILL/scripts/unpack-cocos.sh -o recovered path/to/build

# Post-pass catalogue
bash $SKILL/scripts/find-assets.sh recovered/assets

Repository structure

cocos-reverse-engineering-skill/
├── .claude-plugin/
│   └── marketplace.json
├── plugins/
│   └── cocos-reverse-engineering/
│       ├── .claude-plugin/
│       │   └── plugin.json
│       ├── skills/
│       │   └── cocos-reverse-engineering/
│       │       ├── SKILL.md                   # 5-phase workflow
│       │       ├── references/
│       │       │   ├── setup-guide.md
│       │       │   ├── cc-reverse-usage.md
│       │       │   ├── cocos2x-format.md
│       │       │   ├── cocos3x-format.md
│       │       │   ├── jsc-decryption.md
│       │       │   └── asset-recovery-patterns.md
│       │       └── scripts/
│       │           ├── check-deps.sh
│       │           ├── install-dep.sh
│       │           ├── detect-project.sh
│       │           ├── find-jsc-key.sh
│       │           ├── unpack-cocos.sh
│       │           └── find-assets.sh
│       └── commands/
│           ├── reverse-cocos.md
│           └── find-jsc-key.md
├── LICENSE
└── README.md

References

• cocos-engine on GitHub — the authoritative source for 3.x formats
• cc-reverse — the Node.js engine this skill wraps
• Cocos Creator Docs — official documentation
• cocoscreatorjscdecrypt — XXTEA reference for JSC

Disclaimer

This plugin is for lawful purposes only:

• Recovery of the user's own lost source code
• Security research and authorized penetration testing
• Interoperability analysis permitted under applicable law (e.g., EU Directive 2009/24/EC, US DMCA §1201(f))
• Educational use and CTF competitions

You are solely responsible for ensuring that your use complies with applicable laws, license terms, and platform policies. Unauthorized reverse engineering of software you do not own or do not have permission to analyze may violate copyright or anti-circumvention statutes. When in doubt, ask the copyright holder or stop.

The authors disclaim any liability for misuse.

License

MIT — see LICENSE.