Team Tools

I currently lead the Spade sec team. We have three products, which I would like to introduce here in the hope that you find them useful.

First — An Integrated Debugging Toolkit for WeChat Mini Programs

GitHub: https://github.com/Spade-sec/First

This integrated debugging toolkit for WeChat Mini Programs was created by team member ksihr-vs:

Features

• Supports both Windows and macOS.
• Frida injection into WeChat, with a CDP proxy bridge to Chrome DevTools.
• Dynamic cloud function capture (hook wx.cloud.callFunction, modify parameters, and replay calls).
• wx.* API capture (login / request / getUserProfile, and more).
• Route enumeration and navigation, and navigation guard detection.
• wxapkg decryption and unpacking, plus sensitive information scanning.
• MCP Server integration for AI-assisted analysis.
• Online updates for offsets and Skills.

Cloud Function Capture

wx.api Capture

Editing and Searching Decompiled Files

Frist-MCP

Automatic Updates

SpiderDemo — An Anti-Scraping Practice Platform

This anti-scraping practice platform was created by team member Dexter. Website: https://www.spiderdemo.cn/

We offer a wide range of challenges based on common encryption techniques used in anti-scraping systems:

The platform also provides many test CAPTCHAs, including:

• Fixed-length, arithmetic, GIF, and slider CAPTCHAs.
• Click-based, cylinder, scratch-card, jigsaw, and arc CAPTCHAs, among others.

Use them to test recognition methods. The team and community contributors will add more CAPTCHA types over time:

To help users train models, we also provide datasets for most of the CAPTCHAs. These datasets will continue to be improved:

There are also many challenges involving font-based anti-scraping, anti-debugging, jsvmp, WebSocket, and more:

The SpiderDemo public practice lab is open to all security researchers. Its challenge collection combines original team content, selected open-source or publicly available encryption scenarios, and user-submitted demos.

The platform will continue to be updated, so you can return to practice at any time.

Huahuadun (花花盾) — A JavaScript Code Obfuscator

This JavaScript code obfuscator was created by team member Dexter. Website: https://www.spiderdemo.cn/tools/obfuscator/

Example of obfuscated code: