# What Is the js-reverse Five-Stage Workflow? Observe → Capture → Rebuild → Patch → Deep Dive

> Master the js-reverse five-stage workflow for effective JavaScript reverse engineering. Learn to Observe, Capture, Rebuild, Patch, and Deep Dive into front-end code.

- Repository: [ZhaoXu/reverse-skill](https://github.com/zhaoxuya520/reverse-skill)
- Tags: deep-dive
- Published: 2026-08-02

---

**The js-reverse five-stage workflow is a systematic, evidence-first methodology for front-end JavaScript reverse engineering that guides analysts from initial request discovery to deep logic analysis through five distinct phases: Observe, Capture, Rebuild, Patch, and Deep Dive.**

The **js-reverse** skill defined in the `zhaoxuya520/reverse-skill` repository provides a structured approach to analyzing obfuscated front-end JavaScript. This workflow ensures that every step produces verifiable artifacts before proceeding, eliminating guesswork and creating an auditable path from target identification to algorithm extraction.

## Stage 1: Observe (Identify the Target)

The **Observe** stage focuses on discovering the target request, related scripts, and candidate encryption or obfuscation functions without making assumptions about the runtime environment.

According to [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 75-88), analysts use these specific tool calls to map the attack surface:

- `js-reverse_new_page` or `js-reverse_navigate_page` – Opens the target page in a controlled browser context.
- `js-reverse_list_network_requests` – Enumerates recent network activity to locate API endpoints.
- `js-reverse_get_request_initiator` – Traces a specific request back to its calling code in the JavaScript heap.
- `js-reverse_list_scripts` – Lists all loaded scripts to identify code surface area.
- `js-reverse_search_in_sources` – Searches script sources for patterns like `encrypt`, `sign`, or `hash` to narrow down candidate functions.

This stage produces concrete evidence: request URLs, initiator stack traces, and screenshots of the script list.

## Stage 2: Capture (Runtime Sampling)

The **Capture** stage performs low-impact runtime sampling to record concrete parameters, call order, and execution evidence without triggering anti-debugging mechanisms.

As implemented in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 95-105), the recommended tool sequence includes:

1. **`js-reverse_break_on_xhr`** – Sets a breakpoint on the exact XHR or FETCH request identified during Observe.
2. **`js-reverse_evaluate_script`** – Executes lightweight runtime observation scripts to inspect variable states.
3. **`js-reverse_get_paused_info`** – Captures the full call stack, local variables, and parameter values when a breakpoint hits.
4. **`js-reverse_set_breakpoint_on_text`** – Optionally sets a text-based breakpoint on specific function signatures (e.g., `function encrypt`).

The output of this stage includes the exact request headers, payload bodies, and cryptographic inputs observed at runtime.

## Stage 3: Rebuild (Create Reproducible Environment)

The **Rebuild** stage translates the observed evidence into a standalone, reproducible Node.js environment that mimics the browser context using only recorded facts.

Per [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 106-115), analysts gather the minimal set of environmental data derived from the Observe and Capture phases—such as request headers, cookies, user-agent strings, and crypto primitives—then create a local script file that replicates the network request outside the browser.

This stage does not attempt to fix missing dependencies; it merely isolates the target code and its immediate inputs into a testable format.

## Stage 4: Patch (Incremental Environment Completion)

The **Patch** stage incrementally fills missing environment pieces until the local Node.js script reproduces the target behavior identically.

Following the methodology in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 116-126), the process works as follows:

- Detect the first execution divergence (e.g., `ReferenceError: crypto is undefined` or `window is not defined`).
- Apply a single, minimal patch—a polyfill, stub, or mock object—to satisfy that specific dependency.
- Re-run the script and record the outcome.
- Repeat until the request parameters, signatures, and responses match the original captured traffic.

This iterative approach prevents over-engineering the environment by only implementing the exact browser APIs the target code requires.

## Stage 5: Deep Dive (Post-Reproduction Analysis)

The **Deep Dive** stage performs advanced analysis once the code executes correctly in the patched environment.

As documented in [`skills/js-reverse/SKILL.md`](https://github.com/zhaoxuya520/reverse-skill/blob/main/skills/js-reverse/SKILL.md) (lines 127-135), this stage includes:

- **AST-based de-obfuscation** using `js-reverse_*` tools or external scripts to flatten control flow and rename variables.
- **Algorithm mapping** to correlate the recovered logic with the original network request signatures.
- **Component documentation** to extract reusable decryption or signing modules for future penetration testing.

This stage transforms working but obfuscated code into maintainable, understandable logic.

## Evidence-First Practice

The **js-reverse** workflow enforces **evidence-first** practices: every stage must produce verifiable artifacts—such as request logs, initiator traces, or execution screenshots—before proceeding to the next. This constraint prevents "blind" environment speculation and ensures a repeatable, auditable reverse-engineering path that holds up to scrutiny.

## Complete Workflow Implementation

Below is a practical automation script that executes the full five-stage workflow using the built-in `js-reverse_*` command wrappers around the MCP (Modular Capability Platform) primitives:

```javascript
// 1️⃣ Observe
await js-reverse_new_page('https://target.app/login');
const netReqs = await js-reverse_list_network_requests();
const targetReq = netReqs.find(r => r.url.includes('/api/auth'));
const initiator = await js-reverse_get_request_initiator(targetReq.id);
const scripts = await js-reverse_list_scripts();
const candidateScripts = await js-reverse_search_in_sources({ pattern: 'encrypt', include: scripts });

// 2️⃣ Capture
await js-reverse_break_on_xhr(targetReq.url);
await js-reverse_evaluate_script(`fetch('${targetReq.url}')`);
const pausedInfo = await js-reverse_get_paused_info();

// 3️⃣ Rebuild (translate evidence to Node.js)
const nodeScript = `
  const fetch = require('node-fetch');
  const crypto = require('crypto'); // polyfilled later
  const headers = ${JSON.stringify(targetReq.headers)};
  fetch('${targetReq.url}', { method: '${targetReq.method}', headers, body: '${pausedInfo.body}' })
    .then(r => r.text())
    .then(console.log);
`;
fs.writeFileSync('repro.js', nodeScript);

// 4️⃣ Patch (iterative fixing)
let reproWorks = false;
while (!reproWorks) {
  try {
    const result = execSync('node repro.js', { encoding: 'utf-8' });
    reproWorks = true; // Exit when successful
  } catch (error) {
    if (error.message.includes('crypto is not defined')) {
      fs.appendFileSync('repro.js', "global.crypto = require('crypto');\n");
    }
    // Additional patches for window, document, etc.
  }
}

// 5️⃣ Deep Dive
await js-reverse_get_script_source(candidateScripts[0].url);
await js-reverse_set_breakpoint_on_text('function encrypt');
await js-reverse_take_screenshot('deepdive.png');

```

Each `await js-reverse_*` call routes to the appropriate MCP capability, recording every output to satisfy the evidence-first requirement.

## Summary

- **Observe** uses navigation and network tools to map the attack surface without environment assumptions.
- **Capture** intercepts runtime execution to record concrete parameters and call stacks.
- **Rebuild** isolates the target code into a standalone Node.js script using only observed data.
- **Patch** iteratively adds minimal polyfills until the script reproduces the original behavior.
- **Deep Dive** applies AST analysis and de-obfuscation to extract business logic from the working reproduction.

## Frequently Asked Questions

### What tools are used in the Observe stage of js-reverse?

The Observe stage relies on `js-reverse_new_page`, `js-reverse_list_network_requests`, `js-reverse_get_request_initiator`, `js-reverse_list_scripts`, and `js-reverse_search_in_sources` to map the target surface without executing potentially detectable code. These tools enumerate network activity and trace requests back to their calling scripts while remaining non-invasive.

### How does the Capture stage avoid detection by the target website?

Capture uses low-impact techniques like `js-reverse_break_on_xhr` to intercept specific requests and `js-reverse_evaluate_script` for lightweight runtime observation rather than aggressive hooking. By targeting only the specific XHR/FETCH identified during Observe and inspecting paused state with `js-reverse_get_paused_info`, it minimizes the footprint that anti-debugging scripts might detect.

### What is the purpose of the Patch stage in the js-reverse workflow?

The Patch stage resolves environment differences between the browser and Node.js by iteratively applying minimal fixes—such as polyfilling `crypto` or stubbing `window`—until the local script executes identically to the browser code. This prevents analysts from over-building a full browser emulator by only implementing the specific APIs the target code actually requires.

### When should an analyst move from the Patch stage to Deep Dive?

An analyst proceeds to Deep Dive only after the local script in [`repro.js`](https://github.com/zhaoxuya520/reverse-skill/blob/main/repro.js) successfully executes and produces network requests or cryptographic outputs that match the original captured traffic exactly. This verification ensures that subsequent de-obfuscation and logic extraction in the Deep Dive stage are performed against correctly functioning code, not a broken or incomplete environment.