js-reverse-automation

JS Reverse Engineering Automation

Use JSRPC and a real browser to complete frontend encryption entry point location, runtime forensics, adversarial analysis, verification, and engineering delivery. Browser connection, document identity, and action-level results must form a reviewable chain of evidence.

Applicable Scenarios

• Login/registration page password encryption
• API request signing
• Form field encryption
• Response data decryption

Input Format

Target URL: https://xxx/login
Parameters To Analyze: password
Optional Fetch Example: fetch("https://xxx/api/login", {...})

Core Workflow

1. Pre-analysis Fetch Example(if present) → extract encryption algorithm, parameter format, target URL
2. Open page → inject Hook → trigger target action
3. Capture network requests → locate encryption function
4. Register JSRPC → generate Flask/Burp artifacts
5. Verify output → output complete results in the standard final delivery format

When encountering anti-debugging, anti-Hook, JSVMP, dynamic cookies, environment-based signing, or dynamic loading, first generate and run adversarial_runtime_probe.js; only after observing clear adversarial signals, use --mode intervene or source-level instrumentation.

Detailed Workflow

See workflow/pipeline.md

Adversarial and Verification Capabilities

• Adversarial runtime probes: anti-debugging, integrity checks, environment properties, dynamic code, response chains, Worker/WebSocket/WASM/iframe load events.
• Persistent Hook: automatically detect loss after page reassignment and attempt recovery; all patches can be rolled back via uninstall() .
• Hook composition: adversarial probes and runtime encryption probes share __JSRA_HOOK_REGISTRY__, and the same API uses removable layered wrappers, with external replacement triggering only one rebuild.
• Secure evidence: raw captures use bounded circular-reference-safe snapshots to avoid export failures caused by CryptoJS/JSEncrypt objects.
• Browser session contract: injection, invocation, and navigation are bound to the current tab/document; after disconnection, timeout, pause, or navigation, old references are not reused, avoiding misreporting unknown states as success.
• Control flow observation: optionally observe interference signals such as console clearing, history navigation, storage access, and page closure; only block controlled actions when intervention mode is explicitly enabled, and by default do not change business behavior.
• Conservative source-level instrumentation: generate taps only for explicitly selected simple property reads, and do not rewrite all code by default.
• Adversarial differential: compare events, requests, errors, and newly added evidence between baseline and after intervention; a differential report does not mean the target has been bypassed.
• Complete delivery: standard JSRPC artifacts capture the final fetch/XHR network request during invocation, returning plaintext, final route, ciphertext/signature request body, HTTP status, and business response; the final result also retains analysis results, verification table, copyable commands, shutdown commands, Burp autoDecoder configuration, and generated artifacts; adversarial information is appended as supplementary evidence.
• Capability boundaries: CAPTCHA, WebAuthn, device attestation, cross-origin isolated realms, and unexported WASM internal functions still need to be retained as manual or unsupported paths.

Mandatory pre-delivery checks

After generating the Flask proxy, you must execute:

python3 scripts/check_delivery_contract.py \
  --proxy generated/flask_proxy.py \
  --output artifacts/delivery_contract.json

This check must simultaneously pass JSRPC address normalization, Burp application/octet-stream full message,Content-Length reconstruction, and dataBody wrapper four regressions.jsrpc.base_url You can enter http://127.0.0.1:12080 or http://127.0.0.1:12080/go, and the generator must ensure that only one request is ultimately made to /go。

Port listening does not mean JSRPC is available. Before the final report, you must also use a real browser to perform an action-level smoke test, and confirm the returned plaintext, final route, non-empty requestBody, HTTP status, and business response;/list no action,/go returns 400, or Flask returns 502, you must not write "Flask proxy verification passed".

After saving the action-level results, execute:

python3 scripts/validate_browser_evidence.py \
  --input artifacts/jsrpc_smoke.json \
  --output artifacts/browser_evidence.json

If browser bridge state,tabId and the current documentIdare also saved, then add --require-session. Timeouts, disconnections, pending recovery, or document identity changes can only be marked as unconfirmed, and evidence must not be supplemented by replaying old requests.

Burp full-packet mode must support the outer Content-Type: application/octet-stream, identify the real Content-Type from the inner HTTP message, and return the complete rewritten message; for request/response direction, only one can still be selected at a time, while decryption interfaces and encryption interfaces can be configured simultaneously.

Constraint rules

See constraints/rules.md

Reference materials (load on demand)

• Anti-debugging:references/antidebug-patterns.md
• Complex entry points:references/advanced-entrypoints.md
• Evidence collection:references/evidence-collection.md
• Capability boundaries:references/capability-boundaries.md
• Output contract:references/output-contract.md
• Final report template:references/final-report-template.md
• Adversarial runtime:references/adversarial-runtime.md
• Browser session and evidence:references/browser-session-contract.md

Token budget

• Single call: 50,000 tokens
• Maximum tool calls: 20
• Stop conditions: entry point found and verification passed / all fallback strategies failed / token budget exhausted