How to Reverse Engineer JavaScript Frontend Encryption with the js-reverse Module

The js-reverse module automates JavaScript frontend encryption analysis through a five-stage workflow—Observe, Capture, Rebuild, Patch, and DeepDive—that uses MCP-based browser instrumentation to locate signing logic, capture runtime evidence, and reconstruct algorithms in Node.js.

The js-reverse skill in the zhaoxuya520/reverse-skill repository provides a systematic approach to reverse engineer JavaScript frontend encryption without guesswork. By leveraging the js-reverse-mcp (Modular Certified Processor), security researchers can trace encrypted network requests back to their source functions and rebuild the exact cryptographic implementation locally.

The Five-Stage Reverse Engineering Workflow

The workflow defined in skills/js-reverse/SKILL.md follows the core principle: Observe-first, Hook-preferred, Breakpoint-last, Rebuild-oriented, Evidence-first.

Stage 1: Observe

The goal is to identify the target request, related scripts, and candidate functions without guessing the environment.

• Commands: js-reverse_new_page or js-reverse_navigate_page to load the page, then js-reverse_list_network_requests to locate encrypted traffic, js-reverse_get_request_initiator to trace the call stack, and js-reverse_list_scripts combined with js-reverse_search_in_sources to map the code surface.
• Output: URLs of encrypted requests, initiator stack traces, script URLs, and initial scope boundaries.

Stage 2: Capture

Perform minimal-impact runtime sampling to obtain concrete parameter values and call order.

• Commands: js-reverse_break_on_xhr (or js-reverse_set_breakpoint_on_text) to intercept execution, followed by js-reverse_evaluate_script and js-reverse_get_paused_info.
• Output: Real-time argument values, return values, and a snapshot of the call flow at the encryption point.

Stage 3: Rebuild

Export the observed evidence to a local Node.js project for offline reconstruction.

• Commands: js-reverse_get_script_source for quick inspection and js-reverse_save_script_source for full extraction.
• Output: Source snippets, extracted constants, and a skeletal reproduction script.

Stage 4: Patch

Incrementally add missing browser objects until the Node.js script reproduces the encrypted output.

• Method: Follow the env-patching rules documented in skills/js-reverse/references/env-patching.md—apply single-unit patches, record the "first divergence" after each change, and iterate until ciphertext matches.
• Output: A working local module that mirrors the frontend encryption path.

Stage 5: DeepDive (Optional)

De-obfuscate and reconstruct control-flow for long-term reuse.

• Methods: AST de-obfuscation, flow-graph analysis, and static code review.
• Output: Clean, documented algorithm ready for integration into security testing or bug-bounty reports.

Recommended Automation Entry Sequence

The file skills/js-reverse/references/automation-entry.md defines the optimal command order for encryption-signature capture:

1. js-reverse_new_page or js-reverse_navigate_page – Load the target page.
2. js-reverse_list_network_requests – Locate the request carrying the encrypted payload.
3. js-reverse_get_request_initiator – Trace back to the JavaScript function that initiates the request.
4. js-reverse_list_scripts – Enumerate all loaded scripts.
5. js-reverse_search_in_sources – Search for the function name, URL patterns, or parameter keys.
6. If needed, set an XHR breakpoint with js-reverse_break_on_xhr or a text breakpoint with js-reverse_set_breakpoint_on_text.

Default Tool Parameters

According to skills/js-reverse/references/tool-defaults.md, the skill defines sensible defaults to reduce noise:

• js-reverse_list_network_requests – Returns only the first page of results.
• js-reverse_search_in_sources – Skips minified code (excludeMinified=true).
• js-reverse_get_script_source – Fetches short snippets; use js-reverse_save_script_source for full sources.
• js-reverse_break_on_xhr – Requires a stable URL fragment to set the breakpoint.
• js-reverse_get_paused_info – Inspects the first frame (frameIndex=0).

Environment Patching Strategy

When captured scripts reference browser-only globals (window, document, crypto, storage), apply the env-patching methodology from skills/js-reverse/references/env-patching.md:

• Add only what is proven necessary, one causal unit at a time.
• Log the "first divergence" after each patch to identify exactly what browser API is missing.
• Iterate until the Node.js script reproduces the exact ciphertext observed in the browser.

Practical Command-Line Workflow

# 1️⃣ Open the target page

js-reverse_new_page https://example.com/login

# 2️⃣ List network requests and identify the encrypted one (e.g., request #3)

js-reverse_list_network_requests
js-reverse_get_request_initiator 3

# 3️⃣ Locate the responsible script and function

js-reverse_list_scripts
js-reverse_search_in_sources --query "encryptPassword"

# 4️⃣ Set breakpoint on the XHR carrying the encrypted payload

js-reverse_break_on_xhr "/api/auth/login"

# 5️⃣ Trigger the request in the browser (manually or via replay)

# 6️⃣ Dump runtime state when breakpoint hits

js-reverse_get_paused_info

# 7️⃣ Export source for local analysis

js-reverse_get_script_source --url https://example.com/static/app.js > app.js

After gathering values (key, IV, algorithm name), create a Node.js script implementing the algorithm, then iteratively apply the env-patching rules until the script reproduces the exact ciphertext.

Summary

• The js-reverse module implements a five-stage workflow defined in skills/js-reverse/SKILL.md to systematically reverse engineer JavaScript frontend encryption.
• Key commands include js-reverse_list_network_requests, js-reverse_get_request_initiator, and js-reverse_break_on_xhr for evidence gathering.
• Environment patching follows evidence-driven rules from skills/js-reverse/references/env-patching.md to recreate browser globals in Node.js.
• Default parameters minimize noise by excluding minified code and limiting result pages.
• The workflow prioritizes observation and hooking over breakpoints to reduce detection risk during analysis.

Frequently Asked Questions

What is the js-reverse module used for?

The js-reverse module is an MCP-based skill designed to automate the reverse engineering of JavaScript frontend encryption and signature generation. It enables security researchers to locate cryptographic logic in browser environments and rebuild exact algorithm implementations in Node.js for auditing and testing.

How does js-reverse locate encryption functions without manual guessing?

It uses js-reverse_get_request_initiator to trace encrypted network requests back to their JavaScript call stacks, combined with js-reverse_search_in_sources to locate specific function names or parameter patterns. This eliminates manual script hunting by mapping the request directly to its code origin.

What is the difference between js-reverse_get_script_source and js-reverse_save_script_source?

js-reverse_get_script_source retrieves short code snippets suitable for quick inspection during active debugging, while js-reverse_save_script_source exports complete script sources to disk for comprehensive offline analysis and algorithm reconstruction.

How do I handle browser-specific objects like window or document when rebuilding locally?

Follow the env-patching rules in skills/js-reverse/references/env-patching.md by incrementally adding only the browser objects proven necessary through runtime evidence. After each addition, check for the "first divergence" where output differs from the browser, iterating until the Node.js script produces identical ciphertext.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}