What Is the js-reverse Five-Stage Workflow? Observe → Capture → Rebuild → Patch → Deep Dive

The js-reverse five-stage workflow is a systematic, evidence-first methodology for front-end JavaScript reverse engineering that guides analysts from initial request discovery to deep logic analysis through five distinct phases: Observe, Capture, Rebuild, Patch, and Deep Dive.

The js-reverse skill defined in the zhaoxuya520/reverse-skill repository provides a structured approach to analyzing obfuscated front-end JavaScript. This workflow ensures that every step produces verifiable artifacts before proceeding, eliminating guesswork and creating an auditable path from target identification to algorithm extraction.

Stage 1: Observe (Identify the Target)

The Observe stage focuses on discovering the target request, related scripts, and candidate encryption or obfuscation functions without making assumptions about the runtime environment.

According to skills/js-reverse/SKILL.md (lines 75-88), analysts use these specific tool calls to map the attack surface:

• js-reverse_new_page or js-reverse_navigate_page – Opens the target page in a controlled browser context.
• js-reverse_list_network_requests – Enumerates recent network activity to locate API endpoints.
• js-reverse_get_request_initiator – Traces a specific request back to its calling code in the JavaScript heap.
• js-reverse_list_scripts – Lists all loaded scripts to identify code surface area.
• js-reverse_search_in_sources – Searches script sources for patterns like encrypt, sign, or hash to narrow down candidate functions.

This stage produces concrete evidence: request URLs, initiator stack traces, and screenshots of the script list.

Stage 2: Capture (Runtime Sampling)

The Capture stage performs low-impact runtime sampling to record concrete parameters, call order, and execution evidence without triggering anti-debugging mechanisms.

As implemented in skills/js-reverse/SKILL.md (lines 95-105), the recommended tool sequence includes:

1. js-reverse_break_on_xhr – Sets a breakpoint on the exact XHR or FETCH request identified during Observe.
2. js-reverse_evaluate_script – Executes lightweight runtime observation scripts to inspect variable states.
3. js-reverse_get_paused_info – Captures the full call stack, local variables, and parameter values when a breakpoint hits.
4. js-reverse_set_breakpoint_on_text – Optionally sets a text-based breakpoint on specific function signatures (e.g., function encrypt).

The output of this stage includes the exact request headers, payload bodies, and cryptographic inputs observed at runtime.

Stage 3: Rebuild (Create Reproducible Environment)

The Rebuild stage translates the observed evidence into a standalone, reproducible Node.js environment that mimics the browser context using only recorded facts.

Per skills/js-reverse/SKILL.md (lines 106-115), analysts gather the minimal set of environmental data derived from the Observe and Capture phases—such as request headers, cookies, user-agent strings, and crypto primitives—then create a local script file that replicates the network request outside the browser.

This stage does not attempt to fix missing dependencies; it merely isolates the target code and its immediate inputs into a testable format.

Stage 4: Patch (Incremental Environment Completion)

The Patch stage incrementally fills missing environment pieces until the local Node.js script reproduces the target behavior identically.

Following the methodology in skills/js-reverse/SKILL.md (lines 116-126), the process works as follows:

• Detect the first execution divergence (e.g., ReferenceError: crypto is undefined or window is not defined).
• Apply a single, minimal patch—a polyfill, stub, or mock object—to satisfy that specific dependency.
• Re-run the script and record the outcome.
• Repeat until the request parameters, signatures, and responses match the original captured traffic.

This iterative approach prevents over-engineering the environment by only implementing the exact browser APIs the target code requires.

Stage 5: Deep Dive (Post-Reproduction Analysis)

The Deep Dive stage performs advanced analysis once the code executes correctly in the patched environment.

As documented in skills/js-reverse/SKILL.md (lines 127-135), this stage includes:

• AST-based de-obfuscation using js-reverse_* tools or external scripts to flatten control flow and rename variables.
• Algorithm mapping to correlate the recovered logic with the original network request signatures.
• Component documentation to extract reusable decryption or signing modules for future penetration testing.

This stage transforms working but obfuscated code into maintainable, understandable logic.

Evidence-First Practice

The js-reverse workflow enforces evidence-first practices: every stage must produce verifiable artifacts—such as request logs, initiator traces, or execution screenshots—before proceeding to the next. This constraint prevents "blind" environment speculation and ensures a repeatable, auditable reverse-engineering path that holds up to scrutiny.

Complete Workflow Implementation

Below is a practical automation script that executes the full five-stage workflow using the built-in js-reverse_* command wrappers around the MCP (Modular Capability Platform) primitives:

// 1️⃣ Observe
await js-reverse_new_page('https://target.app/login');
const netReqs = await js-reverse_list_network_requests();
const targetReq = netReqs.find(r => r.url.includes('/api/auth'));
const initiator = await js-reverse_get_request_initiator(targetReq.id);
const scripts = await js-reverse_list_scripts();
const candidateScripts = await js-reverse_search_in_sources({ pattern: 'encrypt', include: scripts });

// 2️⃣ Capture
await js-reverse_break_on_xhr(targetReq.url);
await js-reverse_evaluate_script(`fetch('${targetReq.url}')`);
const pausedInfo = await js-reverse_get_paused_info();

// 3️⃣ Rebuild (translate evidence to Node.js)
const nodeScript = `
  const fetch = require('node-fetch');
  const crypto = require('crypto'); // polyfilled later
  const headers = ${JSON.stringify(targetReq.headers)};
  fetch('${targetReq.url}', { method: '${targetReq.method}', headers, body: '${pausedInfo.body}' })
    .then(r => r.text())
    .then(console.log);
`;
fs.writeFileSync('repro.js', nodeScript);

// 4️⃣ Patch (iterative fixing)
let reproWorks = false;
while (!reproWorks) {
  try {
    const result = execSync('node repro.js', { encoding: 'utf-8' });
    reproWorks = true; // Exit when successful
  } catch (error) {
    if (error.message.includes('crypto is not defined')) {
      fs.appendFileSync('repro.js', "global.crypto = require('crypto');\n");
    }
    // Additional patches for window, document, etc.
  }
}

// 5️⃣ Deep Dive
await js-reverse_get_script_source(candidateScripts[0].url);
await js-reverse_set_breakpoint_on_text('function encrypt');
await js-reverse_take_screenshot('deepdive.png');

Each await js-reverse_* call routes to the appropriate MCP capability, recording every output to satisfy the evidence-first requirement.

Summary

• Observe uses navigation and network tools to map the attack surface without environment assumptions.
• Capture intercepts runtime execution to record concrete parameters and call stacks.
• Rebuild isolates the target code into a standalone Node.js script using only observed data.
• Patch iteratively adds minimal polyfills until the script reproduces the original behavior.
• Deep Dive applies AST analysis and de-obfuscation to extract business logic from the working reproduction.

Frequently Asked Questions

What tools are used in the Observe stage of js-reverse?

The Observe stage relies on js-reverse_new_page, js-reverse_list_network_requests, js-reverse_get_request_initiator, js-reverse_list_scripts, and js-reverse_search_in_sources to map the target surface without executing potentially detectable code. These tools enumerate network activity and trace requests back to their calling scripts while remaining non-invasive.

How does the Capture stage avoid detection by the target website?

Capture uses low-impact techniques like js-reverse_break_on_xhr to intercept specific requests and js-reverse_evaluate_script for lightweight runtime observation rather than aggressive hooking. By targeting only the specific XHR/FETCH identified during Observe and inspecting paused state with js-reverse_get_paused_info, it minimizes the footprint that anti-debugging scripts might detect.

What is the purpose of the Patch stage in the js-reverse workflow?

The Patch stage resolves environment differences between the browser and Node.js by iteratively applying minimal fixes—such as polyfilling crypto or stubbing window—until the local script executes identically to the browser code. This prevents analysts from over-building a full browser emulator by only implementing the specific APIs the target code actually requires.

When should an analyst move from the Patch stage to Deep Dive?

An analyst proceeds to Deep Dive only after the local script in repro.js successfully executes and produces network requests or cryptographic outputs that match the original captured traffic exactly. This verification ensures that subsequent de-obfuscation and logic extraction in the Deep Dive stage are performed against correctly functioning code, not a broken or incomplete environment.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}