Cocos Creator Reverse Engineering — Claude Code skill
English · 简体中文
A Claude Code plugin that reverse-engineers Cocos Creator 2.x and 3.x game builds — detects the engine version, decrypts XXTEA-encrypted .jsc scripts, rebuilds the asset graph (scenes, prefabs, sprite frames, audio, animations, Spine, DragonBones, materials, meshes), and emits an editable Cocos Creator project.
Built on top of cc-reverse, a Node.js CLI for the same job.
What it does
- Detects the engine series (2.3.x / 2.4.x / 3.x) from the build layout.
- Decrypts XXTEA-encrypted
.jsc files (auto-extracts the key from main.js/application.js, handles gzipped and raw variants, reconstructs byte-array keys).
- Rebuilds scripts — 2.x's
project.js module-pack is split into per-file .ts; 3.x's SystemJS chunks are recovered as .js.
- Rebuilds assets — scenes, prefabs, sprite frames, audio, animations, Spine, DragonBones, with correct
.meta files so the project opens in Cocos Creator.
- Supports 3.x bundles — each bundle (
main, internal, resources, custom, subpackages) is unpacked into its own subdirectory using the bundle's config.json.
- Handles CCON binary (
.cconb / .ccon) asset files.
- Extracts and catalogues — post-pass commands count assets by type, find HTTP endpoints, detect bundled SDKs.
Requirements
Required:
- Node.js 16+
cc-reverse (installed globally via npm install -g cc-reverse)
Optional (recommended):
unzip / 7z — for extracting game archivesjq — for inspecting 3.x settings.json / config.jsonffmpeg — for converting recovered audio
See setup-guide.md for installation instructions.
Installation
From GitHub (recommended)
In Claude Code:
/plugin marketplace add Crain99/cocos-reverse-engineering-skill
/plugin install cocos-reverse-engineering@cocos-reverse-engineering-skill
From a local clone
git clone https://github.com/Crain99/cocos-reverse-engineering-skill.git
Then:
/plugin marketplace add /path/to/cocos-reverse-engineering-skill
/plugin install cocos-reverse-engineering@cocos-reverse-engineering-skill
Usage
Slash commands
/reverse-cocos path/to/build
/find-jsc-key path/to/build
/reverse-cocos runs the full workflow: dependency check, detection, decryption, unpack, catalogue. /find-jsc-key is a focused lookup when you only want the XXTEA key.
Natural language
The skill activates on phrases like:
- "Reverse engineer this Cocos Creator game"
- "Decompile this Cocos build"
- "Extract assets from this cocos-js project"
- "Find the XXTEA key in this APK"
- "Unpack the scenes from this Cocos 3 build"
Manual scripts
Every step is a standalone bash script:
SKILL=plugins/cocos-reverse-engineering/skills/cocos-reverse-engineering
# Dependencies
bash $SKILL/scripts/check-deps.sh
bash $SKILL/scripts/install-dep.sh cc-reverse
# Detection
bash $SKILL/scripts/detect-project.sh path/to/build
# Key extraction
bash $SKILL/scripts/find-jsc-key.sh path/to/build
# Full unpack
bash $SKILL/scripts/unpack-cocos.sh -o recovered path/to/build
# Post-pass catalogue
bash $SKILL/scripts/find-assets.sh recovered/assets
Repository structure
cocos-reverse-engineering-skill/
├── .claude-plugin/
│ └── marketplace.json
├── plugins/
│ └── cocos-reverse-engineering/
│ ├── .claude-plugin/
│ │ └── plugin.json
│ ├── skills/
│ │ └── cocos-reverse-engineering/
│ │ ├── SKILL.md # 5-phase workflow
│ │ ├── references/
│ │ │ ├── setup-guide.md
│ │ │ ├── cc-reverse-usage.md
│ │ │ ├── cocos2x-format.md
│ │ │ ├── cocos3x-format.md
│ │ │ ├── jsc-decryption.md
│ │ │ └── asset-recovery-patterns.md
│ │ └── scripts/
│ │ ├── check-deps.sh
│ │ ├── install-dep.sh
│ │ ├── detect-project.sh
│ │ ├── find-jsc-key.sh
│ │ ├── unpack-cocos.sh
│ │ └── find-assets.sh
│ └── commands/
│ ├── reverse-cocos.md
│ └── find-jsc-key.md
├── LICENSE
└── README.md
References
Disclaimer
This plugin is for lawful purposes only:
