# How to Analyze JavaScript Encryption and Signatures Using reverse-skill

> Master JavaScript encryption and signatures with reverse-skill's 5-phase workflow. Learn to deconstruct crypto using MCP-based browser automation. Start your analysis today!

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-06

---

**The reverse-skill framework implements a reproducible 5-phase workflow—Observe, Capture, Rebuild, Patch, and DeepDive—to systematically deconstruct JavaScript cryptography using MCP-based browser automation commands.**

Analyzing client-side encryption and signature generation requires isolating obfuscated algorithms from complex web applications. The **reverse-skill** repository provides the `js-reverse` skill, which maps high-level reverse engineering intents to concrete Model Context Protocol (MCP) commands defined in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md). This architecture allows security researchers to extract and rebuild encryption routines from any browser-based target without maintaining persistent access to the original site.

## The 5-Phase Workflow for JavaScript Reverse Engineering

The `js-reverse` skill enforces a strict methodological progression defined in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md). Each phase corresponds to specific MCP commands that abstract low-level Chrome DevTools interactions.

### Phase 1: Observe and Map the Attack Surface

The workflow begins by loading the target page and cataloging JavaScript resources. According to the tool mapping in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 38-41), you execute:

- `js-reverse_new_page` or `js-reverse_navigate_page` to open the target URL
- `js-reverse_list_scripts` to enumerate all loaded scripts
- `js-reverse_search_in_sources` to locate suspicious patterns using regex queries like `(Crypto|atob|eval|btoa|window\.)`

This reconnaissance identifies minified crypto libraries or custom obfuscation routines before any dynamic analysis begins.

### Phase 2: Capture Execution Context

Once you identify the script carrying the encrypted payload, you intercept the encryption routine at runtime. The **Capture** phase uses:

- `js-reverse_break_on_xhr` to pause execution when the browser sends requests matching your target URL pattern
- `js-reverse_get_paused_info` to extract the call stack, local variables, and request body from the paused execution context
- `js-reverse_get_script_source` to pull the function source code from the specific script ID identified in the stack trace

As documented in lines 101-105 of [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md), this captures both the ciphertext and the exact function generating it.

### Phase 3: Rebuild the Local Environment

With the captured function extracted, you transition to offline analysis. The **Rebuild** phase relies on the **env-patching** workflow documented in [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md). You export the captured JavaScript to a local Node.js environment, creating a minimal runtime that contains only the dependencies required for the encryption routine to execute.

This isolation prevents external anti-debugging triggers and removes dependencies on the original site's authentication state or session cookies.

### Phase 4: Patch Missing Globals

Most browser crypto code expects globals like `window`, `crypto`, or `navigator` that do not exist in vanilla Node.js. The **Patch** phase involves iteratively injecting these missing objects until the decryption function runs without reference errors.

The skill's checklist in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 138-146) mandates recording each patch in the task artifact, ensuring the final reconstruction is fully documented and reproducible.

### Phase 5: DeepDive Algorithm Analysis

Once the function executes locally, you reverse-engineer the cryptographic logic. During **DeepDive**, you:

- Identify key derivation methods (static constants, server-derived tokens, or session-random values)
- Map encryption modes (AES-GCM, RC4, custom XOR implementations)
- Cross-reference patterns against the crypto sections in `reverse-engineering/patterns*.md`

The goal is producing a pure Node.js implementation that generates identical ciphertext to the original browser code.

## Practical Implementation with MCP Commands

Below is a complete automation script that drives the MCP commands to locate and replay a JavaScript encryption routine. Replace `<PAGE_URL>` and `<TARGET_XHR>` with your target values.

```javascript
// 1️⃣ Open the page
await mcp.call('js-reverse_new_page', { url: '<PAGE_URL>' });

// 2️⃣ List loaded scripts
const scripts = await mcp.call('js-reverse_list_scripts');
console.log('Loaded scripts:', scripts);

// 3️⃣ Search for cryptic keywords
const candidates = await mcp.call('js-reverse_search_in_sources', {
  query: '(Crypto|atob|eval|btoa|window\\.)',
});
console.log('Potential crypto scripts:', candidates);

// 4️⃣ Break on the XHR that carries the ciphertext
await mcp.call('js-reverse_break_on_xhr', { urlPattern: '<TARGET_XHR>' });

// 5️⃣ When the breakpoint hits, extract the request payload & function source
const paused = await mcp.call('js-reverse_get_paused_info');
const { requestBody, callStack } = paused;
console.log('Captured request body:', requestBody);

// 6️⃣ Grab the decryption function source (assume it’s the top of the stack)
const funcSource = await mcp.call('js-reverse_get_script_source', {
  scriptId: callStack[0].scriptId,
});
console.log('Decryption function:', funcSource);

// 7️⃣ Rebuild a minimal Node env (env-patching) – see the reference for the exact JSON
await mcp.call('js-reverse_evaluate_script', {
  script: `
    const crypto = require('crypto');
    ${funcSource}
    console.log(decrypt(${JSON.stringify(requestBody)}));
  `,
});

```

This script uses the MCP `call` helper provided by the reverse-skill client. If the browser MCP lacks sufficient hook depth for source-map reconstruction or AST manipulation, switch to **jshookmcp** by changing the command prefix to `jshook`, as registered via the bootstrap process in [`README_AI.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md).

## Key Files and Architecture References

Understanding the repository structure ensures you invoke the correct skill and adhere to output contracts.

| File | Purpose |
|------|---------|
| [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md) | Contains the routing matrix that dispatches "find frontend signature / encrypted params" intents to the `js-reverse` skill |
| [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) | Defines the 5-phase workflow, MCP command mappings, and completion checklists |
| [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md) | Specifies how to recreate minimal Node.js environments for isolated crypto analysis |
| [`skills/js-reverse/references/output-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/output-contract.md) | Mandates the structure of final reports fed to `docs-generator` |
| `reverse-engineering/patterns*.md` | Pattern library for common algorithms (AES, RC4, XOR) used during DeepDive |
| [`README_AI.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md) | Documents MCP command discovery and the bootstrap process for `jshookmcp` |

## Summary

- **reverse-skill** routes JavaScript encryption analysis through the `js-reverse` skill based on user intent matching in [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md).
- The **5-phase workflow** (Observe → Capture → Rebuild → Patch → DeepDive) ensures systematic extraction and offline analysis of crypto routines.
- **MCP commands** like `js-reverse_break_on_xhr` and `js-reverse_get_paused_info` abstract Chrome DevTools operations for reproducible automation.
- **Environment patching** documented in [`env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/env-patching.md) allows secure offline reconstruction of browser encryption logic without live site dependencies.
- Final artifacts follow the [`output-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/output-contract.md) specification for structured reporting.

## Frequently Asked Questions

### What triggers the js-reverse skill in reverse-skill?

When your query matches the user intent "find frontend signature / encrypted params" in [`routing.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/routing.md), the routing matrix dispatches the task to `js-reverse`. This occurs before any tool execution, ensuring the correct MCP command set (`js-reverse_*`) is loaded for browser automation.

### How does reverse-skill handle environment patching for isolated analysis?

The framework implements the **env-patching** workflow defined in [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md). You iteratively inject missing browser globals (e.g., `window`, `crypto`, `navigator`) into a Node.js runtime until the extracted encryption function executes. Each modification is recorded in the task artifact per the checklist in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) lines 138-146.

### What is the difference between standard MCP commands and jshookmcp?

Standard `js-reverse_*` commands provide basic browser automation through the anything-analyzer interface. **jshookmcp** offers deeper CDP (Chrome DevTools Protocol) and AST hook capabilities for complex scenarios like source-map reconstruction. You activate it by using the `jshook` command prefix instead of `js-reverse`, as registered during the bootstrap process described in [`README_AI.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/README_AI.md).

### Where does reverse-skill store the captured encryption artifacts?

Captured evidence—including script snippets, request dumps, and reconstructed functions—is fed to the `docs-generator` tool. The output format follows the structured specification in [`skills/js-reverse/references/output-contract.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/output-contract.md), ensuring all analysis steps, patched environments, and final algorithm implementations are documented in a reproducible format.