# How Reverse‑Skill Handles JavaScript Frontend Encryption Analysis: A Five‑Stage MCP Workflow

> Reverse-skill streamlines JavaScript frontend encryption analysis with its five-stage MCP workflow. Learn how it isolates, harvests, and reconstructs obfuscated client-side cryptography.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-29

---

**Reverse‑Skill automates JavaScript frontend encryption analysis through a dedicated `js‑reverse` skill that routes tasks through a five‑stage pipeline—Observe, Capture, Rebuild, Patch, and DeepDive—using MCP‑based tooling to isolate, harvest, and reconstruct obfuscated client‑side cryptography.**

The `zhaoxuya520/reverse-skill` repository treats JavaScript frontend encryption analysis as a specialized discipline governed by strict protocols. When an AI agent encounters encrypted payloads, webpack bundles, or CryptoJS implementations in browser contexts, the system activates a structured workflow designed to turn opaque client‑side protection into reproducible Node.js scripts.

## Routing to the js‑reverse Skill

When a task description contains keywords such as *frontend encryption*, *JS signature*, *encrypted param*, *webpack*, *cryptojs*, or *jshook*, the central router located at [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) matches these patterns and automatically directs the request to the `js-reverse/` directory. This routing decision ensures that encryption‑specific tooling and logic are applied rather than generic reverse‑engineering approaches.

The skill selection happens before any code execution, guaranteeing that subsequent tool calls use the `js-reverse_*` namespace exclusively.

## Tool Discovery and Bootstrap

Before executing the five‑stage pipeline, the skill validates the local environment for required MCP tools. The system searches for commands such as `js-reverse_new_page`, `js-reverse_list_network_requests`, and `js-reverse_break_on_xhr`.

If any required tool is missing, the bootstrap scripts [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) (or `.ps1` on Windows) execute automatically. These scripts install and register the full suite of `js-reverse_*` tools, ensuring the agent can proceed without manual intervention.

## The Five‑Stage Analysis Pipeline

The core of JavaScript frontend encryption analysis follows a rigid progression through five distinct stages, each responsible for transforming raw browser behavior into analyzable code.

### Stage 1: Observe

The **Observe** stage identifies the target request, script, and candidate encryption functions. The agent opens the target URL using `js-reverse_new_page` or `js-reverse_navigate_page`, then monitors network activity.

Key tool calls include:
- `js-reverse_list_network_requests` to locate suspicious API calls carrying encrypted payloads
- `js-reverse_get_request_initiator` to trace the call origin back to specific JavaScript functions
- `js-reverse_list_scripts` combined with `js-reverse_search_in_sources` to narrow the search space using patterns like `"encrypt|sign|hash"`

### Stage 2: Capture

The **Capture** stage harvests live runtime data with minimal intrusion. The preferred method uses `js-reverse_break_on_xhr` to pause requests at the exact moment encrypted parameters are transmitted, allowing inspection of raw values before encoding.

Alternative techniques include:
- `js-reverse_evaluate_script` for lightweight execution context inspection
- `js-reverse_get_paused_info` to extract state when breakpoints trigger
- `js-reverse_set_breakpoint_on_text` for targeting specific code signatures

### Stage 3: Rebuild

During **Rebuild**, the agent transforms observed evidence into a reproducible Node.js environment. The system exports captured payloads, generates a minimal reproduction script, and stores these as task artifacts. This stage bridges the gap between browser‑specific APIs and standalone Node.js execution, creating the foundation for offline analysis.

### Stage 4: Patch

The **Patch** stage iteratively fills missing browser globals required for the encryption routine to function outside the browser. Based on first‑failure feedback during script execution, the agent adds only the necessary polyfills (for example, `window`, `crypto`, or `crypto.subtle`).

Implementation guidance resides in [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md), which provides minimal‑impact patching strategies to avoid over‑polyfilling and altering the cryptographic behavior.

### Stage 5: DeepDive

The final **DeepDive** stage performs de‑obfuscation, control‑flow recovery, and business‑logic extraction. The system applies specialized cookbooks depending on the protection scheme detected:
- **`E‑js‑vmp`** for JavaScript Virtual Machine Protection (JSVMP)
- **`E‑js‑deobf`** for string‑array obfuscation and literal encoding
- **`E‑js‑anti‑debug`** for anti‑debugging and anti‑tampering mechanisms

Detailed methodology for these transformations is documented in [`skills/reverse-engineering/references/nonpe-format-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/nonpe-format-cookbook.md).

## Integration with jshookmcp for Advanced Instrumentation

For scenarios requiring deeper Chrome DevTools Protocol (CDP) capabilities—such as inspecting source maps, AST manipulation, or native function hooking—the skill automatically switches to the `jshookmcp` enhanced path. This integration adds browser‑level instrumentation while preserving the identical five‑stage logical flow defined in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md).

The `jshookmcp` hook provides additional granularity for JavaScript frontend encryption analysis when standard MCP tools cannot access the necessary runtime internals.

## Evidence‑First Output and Artifact Generation

Every stage writes structured artifacts that satisfy the [`output-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/output-contract.md) requirements. The final deliverable for a JavaScript frontend encryption analysis task includes:
- The reconstructed Node.js script capable of reproducing the encryption
- The identified encryption key or initialization vector
- A succinct explanation of the cryptographic scheme (RC4, XOR, AES‑ECB, etc.) extracted from the logic
- Command logs, screenshots, and captured payload snapshots

## Practical Command Sequence

Below is a typical invocation sequence an AI agent executes when performing JavaScript frontend encryption analysis:

```bash

# 1. Open the target page

js-reverse_new_page https://example.com/login

# 2. Locate the encrypted API request

js-reverse_list_network_requests | grep "/api/auth"

# 3. Trace the encryption origin

js-reverse_get_request_initiator <request-id>

# 4. Identify candidate scripts

js-reverse_list_scripts | grep "crypto"
js-reverse_search_in_sources "encrypt|sign|hash"

# 5. Pause at the XHR to inspect parameters

js-reverse_break_on_xhr "*/api/auth*"

# 6. Extract runtime secrets

js-reverse_evaluate_script "window.__ENCRYPT_KEY__"

# 7. Export evidence and generate reproducer

js-reverse_get_paused_info > /tmp/payload.json
node generate-reproducer.js /tmp/payload.json > /tmp/reproducer.js

# 8. Debug and patch missing globals

js-reverse_set_breakpoint_on_text "crypto.subtle"

# Apply polyfills per env-patching.md guidelines

```

## Summary

- **Reverse‑Skill** treats JavaScript frontend encryption analysis as a dedicated skill routed through [`skills/routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/routing.md) based on cryptographic keywords.
- The workflow follows five strict stages: **Observe**, **Capture**, **Rebuild**, **Patch**, and **DeepDive**.
- **MCP tools** prefixed with `js-reverse_*` handle browser automation, breakpoint management, and script evaluation.
- **Environment patching** uses minimal polyfills from [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md) to make browser code run in Node.js.
- **De‑obfuscation** relies on specialized cookbooks in [`skills/reverse-engineering/references/nonpe-format-cookbook.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/reverse-engineering/references/nonpe-format-cookbook.md) for VM protection and anti‑debug schemes.
- **Evidence‑first output** delivers reproducible Node scripts, extracted keys, and cryptographic scheme documentation.

## Frequently Asked Questions

### How does Reverse‑Skill choose between standard MCP tools and jshookmcp?

The skill automatically selects `jshookmcp` when the task requires capabilities beyond standard MCP tooling, such as AST‑level inspection, source map analysis, or native function hooking. The decision occurs during the **Observe** stage if initial tool calls fail to expose the necessary encryption entry points, ensuring deeper CDP instrumentation is available while maintaining the five‑stage workflow structure.

### What happens if the required js‑reverse tools are not installed?

If the environment lacks `js-reverse_*` commands, the bootstrap script [`skills/scripts/refresh-tool-index.sh`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/scripts/refresh-tool-index.sh) (or its PowerShell equivalent) executes automatically to install and register the complete tool suite. This guarantees that JavaScript frontend encryption analysis can proceed without manual setup or configuration drift between sessions.

### Which encryption schemes can the DeepDive stage identify?

The **DeepDive** stage extracts and documents standard schemes including RC4, XOR, AES‑ECB, AES‑CBC, and RSA, along with custom rolling or obfuscated algorithms. The identification relies on pattern matching against the de‑obfuscated control flow and constant analysis, with results validated by comparing the reconstructed Node.js output against captured browser payloads.

### How does the Patch stage avoid breaking the encryption logic?

The **Patch** stage follows the **minimal polyfill principle** documented in [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md). It adds only the specific browser globals (such as `window`, `document`, or `crypto.subtle`) that trigger failure during the first execution attempt. This iterative approach ensures the cryptographic environment matches the original browser context without introducing extraneous mocks that could alter entropy sources or timing behaviors.