# How to Reverse Engineer JavaScript Frontend Encryption with the js-reverse Module

> Learn to reverse engineer JavaScript frontend encryption with the js-reverse module. This guide covers observe, capture, rebuild, patch, and deepdive stages for effective analysis.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: how-to-guide
- Published: 2026-08-07

---

**The js-reverse module automates JavaScript frontend encryption analysis through a five-stage workflow—Observe, Capture, Rebuild, Patch, and DeepDive—that uses MCP-based browser instrumentation to locate signing logic, capture runtime evidence, and reconstruct algorithms in Node.js.**

The `js-reverse` skill in the `zhaoxuya520/reverse-skill` repository provides a systematic approach to reverse engineer JavaScript frontend encryption without guesswork. By leveraging the **js-reverse-mcp** (Modular Certified Processor), security researchers can trace encrypted network requests back to their source functions and rebuild the exact cryptographic implementation locally.

## The Five-Stage Reverse Engineering Workflow

The workflow defined in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) follows the core principle: **Observe-first, Hook-preferred, Breakpoint-last, Rebuild-oriented, Evidence-first**.

### Stage 1: Observe

The goal is to identify the target request, related scripts, and candidate functions without guessing the environment.

- **Commands**: `js-reverse_new_page` or `js-reverse_navigate_page` to load the page, then `js-reverse_list_network_requests` to locate encrypted traffic, `js-reverse_get_request_initiator` to trace the call stack, and `js-reverse_list_scripts` combined with `js-reverse_search_in_sources` to map the code surface.
- **Output**: URLs of encrypted requests, initiator stack traces, script URLs, and initial scope boundaries.

### Stage 2: Capture

Perform minimal-impact runtime sampling to obtain concrete parameter values and call order.

- **Commands**: `js-reverse_break_on_xhr` (or `js-reverse_set_breakpoint_on_text`) to intercept execution, followed by `js-reverse_evaluate_script` and `js-reverse_get_paused_info`.
- **Output**: Real-time argument values, return values, and a snapshot of the call flow at the encryption point.

### Stage 3: Rebuild

Export the observed evidence to a local Node.js project for offline reconstruction.

- **Commands**: `js-reverse_get_script_source` for quick inspection and `js-reverse_save_script_source` for full extraction.
- **Output**: Source snippets, extracted constants, and a skeletal reproduction script.

### Stage 4: Patch

Incrementally add missing browser objects until the Node.js script reproduces the encrypted output.

- **Method**: Follow the **env-patching** rules documented in [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md)—apply single-unit patches, record the "first divergence" after each change, and iterate until ciphertext matches.
- **Output**: A working local module that mirrors the frontend encryption path.

### Stage 5: DeepDive (Optional)

De-obfuscate and reconstruct control-flow for long-term reuse.

- **Methods**: AST de-obfuscation, flow-graph analysis, and static code review.
- **Output**: Clean, documented algorithm ready for integration into security testing or bug-bounty reports.

## Recommended Automation Entry Sequence

The file [`skills/js-reverse/references/automation-entry.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/automation-entry.md) defines the optimal command order for encryption-signature capture:

1. `js-reverse_new_page` or `js-reverse_navigate_page` – Load the target page.
2. `js-reverse_list_network_requests` – Locate the request carrying the encrypted payload.
3. `js-reverse_get_request_initiator` – Trace back to the JavaScript function that initiates the request.
4. `js-reverse_list_scripts` – Enumerate all loaded scripts.
5. `js-reverse_search_in_sources` – Search for the function name, URL patterns, or parameter keys.
6. If needed, set an XHR breakpoint with `js-reverse_break_on_xhr` or a text breakpoint with `js-reverse_set_breakpoint_on_text`.

## Default Tool Parameters

According to [`skills/js-reverse/references/tool-defaults.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/tool-defaults.md), the skill defines sensible defaults to reduce noise:

- `js-reverse_list_network_requests` – Returns only the first page of results.
- `js-reverse_search_in_sources` – Skips minified code (`excludeMinified=true`).
- `js-reverse_get_script_source` – Fetches short snippets; use `js-reverse_save_script_source` for full sources.
- `js-reverse_break_on_xhr` – Requires a stable URL fragment to set the breakpoint.
- `js-reverse_get_paused_info` – Inspects the first frame (`frameIndex=0`).

## Environment Patching Strategy

When captured scripts reference browser-only globals (`window`, `document`, `crypto`, `storage`), apply the **env-patching** methodology from [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md):

- Add only what is proven necessary, one causal unit at a time.
- Log the "first divergence" after each patch to identify exactly what browser API is missing.
- Iterate until the Node.js script reproduces the exact ciphertext observed in the browser.

## Practical Command-Line Workflow

```bash

# 1️⃣ Open the target page

js-reverse_new_page https://example.com/login

# 2️⃣ List network requests and identify the encrypted one (e.g., request #3)

js-reverse_list_network_requests
js-reverse_get_request_initiator 3

# 3️⃣ Locate the responsible script and function

js-reverse_list_scripts
js-reverse_search_in_sources --query "encryptPassword"

# 4️⃣ Set breakpoint on the XHR carrying the encrypted payload

js-reverse_break_on_xhr "/api/auth/login"

# 5️⃣ Trigger the request in the browser (manually or via replay)

# 6️⃣ Dump runtime state when breakpoint hits

js-reverse_get_paused_info

# 7️⃣ Export source for local analysis

js-reverse_get_script_source --url https://example.com/static/app.js > app.js

```

After gathering values (key, IV, algorithm name), create a Node.js script implementing the algorithm, then iteratively apply the **env-patching** rules until the script reproduces the exact ciphertext.

## Summary

- The js-reverse module implements a five-stage workflow defined in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) to systematically reverse engineer JavaScript frontend encryption.
- Key commands include `js-reverse_list_network_requests`, `js-reverse_get_request_initiator`, and `js-reverse_break_on_xhr` for evidence gathering.
- Environment patching follows evidence-driven rules from [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md) to recreate browser globals in Node.js.
- Default parameters minimize noise by excluding minified code and limiting result pages.
- The workflow prioritizes observation and hooking over breakpoints to reduce detection risk during analysis.

## Frequently Asked Questions

### What is the js-reverse module used for?

The js-reverse module is an MCP-based skill designed to automate the reverse engineering of JavaScript frontend encryption and signature generation. It enables security researchers to locate cryptographic logic in browser environments and rebuild exact algorithm implementations in Node.js for auditing and testing.

### How does js-reverse locate encryption functions without manual guessing?

It uses `js-reverse_get_request_initiator` to trace encrypted network requests back to their JavaScript call stacks, combined with `js-reverse_search_in_sources` to locate specific function names or parameter patterns. This eliminates manual script hunting by mapping the request directly to its code origin.

### What is the difference between `js-reverse_get_script_source` and `js-reverse_save_script_source`?

`js-reverse_get_script_source` retrieves short code snippets suitable for quick inspection during active debugging, while `js-reverse_save_script_source` exports complete script sources to disk for comprehensive offline analysis and algorithm reconstruction.

### How do I handle browser-specific objects like window or document when rebuilding locally?

Follow the **env-patching** rules in [`skills/js-reverse/references/env-patching.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/references/env-patching.md) by incrementally adding only the browser objects proven necessary through runtime evidence. After each addition, check for the "first divergence" where output differs from the browser, iterating until the Node.js script produces identical ciphertext.