How Reverse‑Skill Handles JavaScript Frontend Encryption Analysis: A Five‑Stage MCP Workflow

Reverse‑Skill automates JavaScript frontend encryption analysis through a dedicated js‑reverse skill that routes tasks through a five‑stage pipeline—Observe, Capture, Rebuild, Patch, and DeepDive—using MCP‑based tooling to isolate, harvest, and reconstruct obfuscated client‑side cryptography.

The zhaoxuya520/reverse-skill repository treats JavaScript frontend encryption analysis as a specialized discipline governed by strict protocols. When an AI agent encounters encrypted payloads, webpack bundles, or CryptoJS implementations in browser contexts, the system activates a structured workflow designed to turn opaque client‑side protection into reproducible Node.js scripts.

Routing to the js‑reverse Skill

When a task description contains keywords such as frontend encryption, JS signature, encrypted param, webpack, cryptojs, or jshook, the central router located at skills/routing.md matches these patterns and automatically directs the request to the js-reverse/ directory. This routing decision ensures that encryption‑specific tooling and logic are applied rather than generic reverse‑engineering approaches.

The skill selection happens before any code execution, guaranteeing that subsequent tool calls use the js-reverse_* namespace exclusively.

Tool Discovery and Bootstrap

Before executing the five‑stage pipeline, the skill validates the local environment for required MCP tools. The system searches for commands such as js-reverse_new_page, js-reverse_list_network_requests, and js-reverse_break_on_xhr.

If any required tool is missing, the bootstrap scripts skills/scripts/refresh-tool-index.sh (or .ps1 on Windows) execute automatically. These scripts install and register the full suite of js-reverse_* tools, ensuring the agent can proceed without manual intervention.

The Five‑Stage Analysis Pipeline

The core of JavaScript frontend encryption analysis follows a rigid progression through five distinct stages, each responsible for transforming raw browser behavior into analyzable code.

Stage 1: Observe

The Observe stage identifies the target request, script, and candidate encryption functions. The agent opens the target URL using js-reverse_new_page or js-reverse_navigate_page, then monitors network activity.

Key tool calls include:

• js-reverse_list_network_requests to locate suspicious API calls carrying encrypted payloads
• js-reverse_get_request_initiator to trace the call origin back to specific JavaScript functions
• js-reverse_list_scripts combined with js-reverse_search_in_sources to narrow the search space using patterns like "encrypt|sign|hash"

Stage 2: Capture

The Capture stage harvests live runtime data with minimal intrusion. The preferred method uses js-reverse_break_on_xhr to pause requests at the exact moment encrypted parameters are transmitted, allowing inspection of raw values before encoding.

Alternative techniques include:

• js-reverse_evaluate_script for lightweight execution context inspection
• js-reverse_get_paused_info to extract state when breakpoints trigger
• js-reverse_set_breakpoint_on_text for targeting specific code signatures

Stage 3: Rebuild

During Rebuild, the agent transforms observed evidence into a reproducible Node.js environment. The system exports captured payloads, generates a minimal reproduction script, and stores these as task artifacts. This stage bridges the gap between browser‑specific APIs and standalone Node.js execution, creating the foundation for offline analysis.

Stage 4: Patch

The Patch stage iteratively fills missing browser globals required for the encryption routine to function outside the browser. Based on first‑failure feedback during script execution, the agent adds only the necessary polyfills (for example, window, crypto, or crypto.subtle).

Implementation guidance resides in skills/js-reverse/references/env-patching.md, which provides minimal‑impact patching strategies to avoid over‑polyfilling and altering the cryptographic behavior.

Stage 5: DeepDive

The final DeepDive stage performs de‑obfuscation, control‑flow recovery, and business‑logic extraction. The system applies specialized cookbooks depending on the protection scheme detected:

• E‑js‑vmp for JavaScript Virtual Machine Protection (JSVMP)
• E‑js‑deobf for string‑array obfuscation and literal encoding
• E‑js‑anti‑debug for anti‑debugging and anti‑tampering mechanisms

Detailed methodology for these transformations is documented in skills/reverse-engineering/references/nonpe-format-cookbook.md.

Integration with jshookmcp for Advanced Instrumentation

For scenarios requiring deeper Chrome DevTools Protocol (CDP) capabilities—such as inspecting source maps, AST manipulation, or native function hooking—the skill automatically switches to the jshookmcp enhanced path. This integration adds browser‑level instrumentation while preserving the identical five‑stage logical flow defined in skills/js-reverse/SKILL.md.

The jshookmcp hook provides additional granularity for JavaScript frontend encryption analysis when standard MCP tools cannot access the necessary runtime internals.

Evidence‑First Output and Artifact Generation

Every stage writes structured artifacts that satisfy the output-contract.md requirements. The final deliverable for a JavaScript frontend encryption analysis task includes:

• The reconstructed Node.js script capable of reproducing the encryption
• The identified encryption key or initialization vector
• A succinct explanation of the cryptographic scheme (RC4, XOR, AES‑ECB, etc.) extracted from the logic
• Command logs, screenshots, and captured payload snapshots

Practical Command Sequence

Below is a typical invocation sequence an AI agent executes when performing JavaScript frontend encryption analysis:

# 1. Open the target page

js-reverse_new_page https://example.com/login

# 2. Locate the encrypted API request

js-reverse_list_network_requests | grep "/api/auth"

# 3. Trace the encryption origin

js-reverse_get_request_initiator <request-id>

# 4. Identify candidate scripts

js-reverse_list_scripts | grep "crypto"
js-reverse_search_in_sources "encrypt|sign|hash"

# 5. Pause at the XHR to inspect parameters

js-reverse_break_on_xhr "*/api/auth*"

# 6. Extract runtime secrets

js-reverse_evaluate_script "window.__ENCRYPT_KEY__"

# 7. Export evidence and generate reproducer

js-reverse_get_paused_info > /tmp/payload.json
node generate-reproducer.js /tmp/payload.json > /tmp/reproducer.js

# 8. Debug and patch missing globals

js-reverse_set_breakpoint_on_text "crypto.subtle"

# Apply polyfills per env-patching.md guidelines

Summary

• Reverse‑Skill treats JavaScript frontend encryption analysis as a dedicated skill routed through skills/routing.md based on cryptographic keywords.
• The workflow follows five strict stages: Observe, Capture, Rebuild, Patch, and DeepDive.
• MCP tools prefixed with js-reverse_* handle browser automation, breakpoint management, and script evaluation.
• Environment patching uses minimal polyfills from skills/js-reverse/references/env-patching.md to make browser code run in Node.js.
• De‑obfuscation relies on specialized cookbooks in skills/reverse-engineering/references/nonpe-format-cookbook.md for VM protection and anti‑debug schemes.
• Evidence‑first output delivers reproducible Node scripts, extracted keys, and cryptographic scheme documentation.

Frequently Asked Questions

How does Reverse‑Skill choose between standard MCP tools and jshookmcp?

The skill automatically selects jshookmcp when the task requires capabilities beyond standard MCP tooling, such as AST‑level inspection, source map analysis, or native function hooking. The decision occurs during the Observe stage if initial tool calls fail to expose the necessary encryption entry points, ensuring deeper CDP instrumentation is available while maintaining the five‑stage workflow structure.

What happens if the required js‑reverse tools are not installed?

If the environment lacks js-reverse_* commands, the bootstrap script skills/scripts/refresh-tool-index.sh (or its PowerShell equivalent) executes automatically to install and register the complete tool suite. This guarantees that JavaScript frontend encryption analysis can proceed without manual setup or configuration drift between sessions.

Which encryption schemes can the DeepDive stage identify?

The DeepDive stage extracts and documents standard schemes including RC4, XOR, AES‑ECB, AES‑CBC, and RSA, along with custom rolling or obfuscated algorithms. The identification relies on pattern matching against the de‑obfuscated control flow and constant analysis, with results validated by comparing the reconstructed Node.js output against captured browser payloads.

How does the Patch stage avoid breaking the encryption logic?

The Patch stage follows the minimal polyfill principle documented in skills/js-reverse/references/env-patching.md. It adds only the specific browser globals (such as window, document, or crypto.subtle) that trigger failure during the first execution attempt. This iterative approach ensures the cryptographic environment matches the original browser context without introducing extraneous mocks that could alter entropy sources or timing behaviors.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}