browser-extension-reverselisted

# Browser Extension Reverse Engineering ## ACTION REQUIRED (execute immediately after reading) 1. `NOW`: Read `../field-journal/precedent-reverse.md` 2. `NOW`: Confirm the target is a **browser extension** (crx/xpi/extracted directory), not ordinary web page JS (for the latter → `js-reverse/`) 3. `NEXT`: Extract the extension; read the manifest 4. `ACT`: Permission surface → background scripts → network/storage hooks ## Applicable Scenarios - Chrome/Edge MV2/MV3 extension analysis - Firefox extensions - Malicious extension IOCs, supply-chain extension poisoning investigations - Recovering signature/encryption/proxy logic implemented by extensions ## Workflow ### 1. Package ```text □ Extract the crx / pull the extension directory from the profile □ manifest.json: permissions, host_permissions, background, content_scripts □ Assess excessive permissions (<all_urls>, webRequest, debugger) ``` ### 2. Logic ```text □ service_worker / background entry points □ content_script injection points and worlds (isolated) □ chrome.storage / IndexedDB keys □ Same as `js-reverse`: observe network traffic and message passing (runtime.sendMessage) ``` ### 3. Dynamic Analysis ```text □ Load the extracted directory in developer mode □ Check for errors at chrome://extensions □ Attach DevTools to the service worker □ If needed, Frida/browser CDP (jshookmcp) ``` ## Toolchain | Tool | Purpose | |------|---------| | unzip/jq | manifest | | Chrome DevTools | Worker debugging | | js-reverse