How to Analyze JavaScript Encryption and Signatures Using reverse-skill

The reverse-skill framework implements a reproducible 5-phase workflow—Observe, Capture, Rebuild, Patch, and DeepDive—to systematically deconstruct JavaScript cryptography using MCP-based browser automation commands.

Analyzing client-side encryption and signature generation requires isolating obfuscated algorithms from complex web applications. The reverse-skill repository provides the js-reverse skill, which maps high-level reverse engineering intents to concrete Model Context Protocol (MCP) commands defined in skills/js-reverse/SKILL.md. This architecture allows security researchers to extract and rebuild encryption routines from any browser-based target without maintaining persistent access to the original site.

The 5-Phase Workflow for JavaScript Reverse Engineering

The js-reverse skill enforces a strict methodological progression defined in skills/js-reverse/SKILL.md. Each phase corresponds to specific MCP commands that abstract low-level Chrome DevTools interactions.

Phase 1: Observe and Map the Attack Surface

The workflow begins by loading the target page and cataloging JavaScript resources. According to the tool mapping in skills/js-reverse/SKILL.md (lines 38-41), you execute:

• js-reverse_new_page or js-reverse_navigate_page to open the target URL
• js-reverse_list_scripts to enumerate all loaded scripts
• js-reverse_search_in_sources to locate suspicious patterns using regex queries like (Crypto|atob|eval|btoa|window\.)

This reconnaissance identifies minified crypto libraries or custom obfuscation routines before any dynamic analysis begins.

Phase 2: Capture Execution Context

Once you identify the script carrying the encrypted payload, you intercept the encryption routine at runtime. The Capture phase uses:

• js-reverse_break_on_xhr to pause execution when the browser sends requests matching your target URL pattern
• js-reverse_get_paused_info to extract the call stack, local variables, and request body from the paused execution context
• js-reverse_get_script_source to pull the function source code from the specific script ID identified in the stack trace

As documented in lines 101-105 of skills/js-reverse/SKILL.md, this captures both the ciphertext and the exact function generating it.

Phase 3: Rebuild the Local Environment

With the captured function extracted, you transition to offline analysis. The Rebuild phase relies on the env-patching workflow documented in skills/js-reverse/references/env-patching.md. You export the captured JavaScript to a local Node.js environment, creating a minimal runtime that contains only the dependencies required for the encryption routine to execute.

This isolation prevents external anti-debugging triggers and removes dependencies on the original site's authentication state or session cookies.

Phase 4: Patch Missing Globals

Most browser crypto code expects globals like window, crypto, or navigator that do not exist in vanilla Node.js. The Patch phase involves iteratively injecting these missing objects until the decryption function runs without reference errors.

The skill's checklist in skills/js-reverse/SKILL.md (lines 138-146) mandates recording each patch in the task artifact, ensuring the final reconstruction is fully documented and reproducible.

Phase 5: DeepDive Algorithm Analysis

Once the function executes locally, you reverse-engineer the cryptographic logic. During DeepDive, you:

• Identify key derivation methods (static constants, server-derived tokens, or session-random values)
• Map encryption modes (AES-GCM, RC4, custom XOR implementations)
• Cross-reference patterns against the crypto sections in reverse-engineering/patterns*.md

The goal is producing a pure Node.js implementation that generates identical ciphertext to the original browser code.

Practical Implementation with MCP Commands

Below is a complete automation script that drives the MCP commands to locate and replay a JavaScript encryption routine. Replace <PAGE_URL> and <TARGET_XHR> with your target values.

// 1️⃣ Open the page
await mcp.call('js-reverse_new_page', { url: '<PAGE_URL>' });

// 2️⃣ List loaded scripts
const scripts = await mcp.call('js-reverse_list_scripts');
console.log('Loaded scripts:', scripts);

// 3️⃣ Search for cryptic keywords
const candidates = await mcp.call('js-reverse_search_in_sources', {
  query: '(Crypto|atob|eval|btoa|window\\.)',
});
console.log('Potential crypto scripts:', candidates);

// 4️⃣ Break on the XHR that carries the ciphertext
await mcp.call('js-reverse_break_on_xhr', { urlPattern: '<TARGET_XHR>' });

// 5️⃣ When the breakpoint hits, extract the request payload & function source
const paused = await mcp.call('js-reverse_get_paused_info');
const { requestBody, callStack } = paused;
console.log('Captured request body:', requestBody);

// 6️⃣ Grab the decryption function source (assume it’s the top of the stack)
const funcSource = await mcp.call('js-reverse_get_script_source', {
  scriptId: callStack[0].scriptId,
});
console.log('Decryption function:', funcSource);

// 7️⃣ Rebuild a minimal Node env (env-patching) – see the reference for the exact JSON
await mcp.call('js-reverse_evaluate_script', {
  script: `
    const crypto = require('crypto');
    ${funcSource}
    console.log(decrypt(${JSON.stringify(requestBody)}));
  `,
});

This script uses the MCP call helper provided by the reverse-skill client. If the browser MCP lacks sufficient hook depth for source-map reconstruction or AST manipulation, switch to jshookmcp by changing the command prefix to jshook, as registered via the bootstrap process in README_AI.md.

Key Files and Architecture References

Understanding the repository structure ensures you invoke the correct skill and adhere to output contracts.

File	Purpose
routing.md	Contains the routing matrix that dispatches "find frontend signature / encrypted params" intents to the js-reverse skill
skills/js-reverse/SKILL.md	Defines the 5-phase workflow, MCP command mappings, and completion checklists
skills/js-reverse/references/env-patching.md	Specifies how to recreate minimal Node.js environments for isolated crypto analysis
skills/js-reverse/references/output-contract.md	Mandates the structure of final reports fed to docs-generator
reverse-engineering/patterns*.md	Pattern library for common algorithms (AES, RC4, XOR) used during DeepDive
README_AI.md	Documents MCP command discovery and the bootstrap process for jshookmcp

Summary

• reverse-skill routes JavaScript encryption analysis through the js-reverse skill based on user intent matching in routing.md.
• The 5-phase workflow (Observe → Capture → Rebuild → Patch → DeepDive) ensures systematic extraction and offline analysis of crypto routines.
• MCP commands like js-reverse_break_on_xhr and js-reverse_get_paused_info abstract Chrome DevTools operations for reproducible automation.
• Environment patching documented in env-patching.md allows secure offline reconstruction of browser encryption logic without live site dependencies.
• Final artifacts follow the output-contract.md specification for structured reporting.

Frequently Asked Questions

What triggers the js-reverse skill in reverse-skill?

When your query matches the user intent "find frontend signature / encrypted params" in routing.md, the routing matrix dispatches the task to js-reverse. This occurs before any tool execution, ensuring the correct MCP command set (js-reverse_*) is loaded for browser automation.

How does reverse-skill handle environment patching for isolated analysis?

The framework implements the env-patching workflow defined in skills/js-reverse/references/env-patching.md. You iteratively inject missing browser globals (e.g., window, crypto, navigator) into a Node.js runtime until the extracted encryption function executes. Each modification is recorded in the task artifact per the checklist in skills/js-reverse/SKILL.md lines 138-146.

What is the difference between standard MCP commands and jshookmcp?

Standard js-reverse_* commands provide basic browser automation through the anything-analyzer interface. jshookmcp offers deeper CDP (Chrome DevTools Protocol) and AST hook capabilities for complex scenarios like source-map reconstruction. You activate it by using the jshook command prefix instead of js-reverse, as registered during the bootstrap process described in README_AI.md.

Where does reverse-skill store the captured encryption artifacts?

Captured evidence—including script snippets, request dumps, and reconstructed functions—is fed to the docs-generator tool. The output format follows the structured specification in skills/js-reverse/references/output-contract.md, ensuring all analysis steps, patched environments, and final algorithm implementations are documented in a reproducible format.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}