1997-pro-web-reverse-casebook

1997.pro Web Reverse Casebook

Role

This skill compresses the 1997.pro public article corpus into a "case knowledge base + scenario router."

It is responsible for:

• When a task shows vendor names, parameter names, packer forms, or risk-control clues, quickly determine which type of case it most resembles
• Tell you which reference to read first, which type of evidence to check first, and which set of MCP actions to use first
• Bridge the case experience of 1997.pro to existing execution skills, rather than starting a separate parallel master-control process

It does not replace:

• $web-js-reverse-master-flow
• $jsr-reverse
• $mcp-js-reverse-playbook

Complex tasks still need to return to these master-control or execution skills. This skill is only responsible for "what type of problem it resembles and where to start."

Boundaries of responsibility:

• This skill is a site-specific / technical case library, responsible for providing case references, technical anchors, and starting suggestions according to the article system of 1997.pro .
• It does not take over macro phase determination, and does not rewrite the main process of 证据门 -> locate -> recover -> runtime -> env-patch -> replay .
• If the current task has already entered formal phase switching, the authority for phase adjudication must be returned to $web-js-reverse-master-flow。

Default coordination

The default execution stack remains unchanged:

• chrome-devtools-mcp
• js-reverse
• jshook

Experience usage:

• First use chrome-devtools-mcp and js-reverse to obtain real requests, real intermediate states, and real trigger actions.
• When the clues already resemble a certain type of case in 1997.pro , then use this skill to select references and specialized skills.
• When encountering heavy obfuscation, complex Hooks, Stealth, or advanced semantic recovery, then bring jshook to the foreground.
• If the current task has already entered formal phase switching, the final phase judgment is still handed to $web-js-reverse-master-flow。

When to use

Use this skill when any of the following situations occurs:

• The user explicitly mentions 1997.pro, an on-site article name, an author-related article, or wants to "do it according to this blog's method"
• Clues point to a specific vendor / product / parameter:
  • Akamai、Kasada、PX3、reese84、Incapsula、同盾 BlackBox、a_bogus
  • x-s3-s4e、desc、bx-pp、rid、fuid、fs
• Clues point to a specific packer or runtime problem:
  • JSVMP、while + switch、dispatcher、227/226
  • wasm、worker、postMessage、storage.estimate
  • animationend, CSS animation value extraction,run_js detection, browser and Node inconsistency
• What the user wants is "case reference / selection / quick-reference table," not pure process orchestration

Key case anchors

Prioritize identifying problems according to these four groups; do not mix all clues into one "big reverse engineering problem":

1. Risk-control / vendor anchors

• Akamai
• Kasada
• PX / PX3
• reese84 / Incapsula
• 同盾 / BlackBox
• a_bogus

Default reading method:

• First suspect token lane、sign lane、fingerprint lane、challenge lane mixing
• Prioritize reading risk-fingerprint-and-vendors.md
• Generally will reversely drive the $web-js-reverse-master-flow of Phase 1 + Phase 3

2. CAPTCHA / business field anchors

• 腾讯滑块
• 阿里滑块
• _rand
• fuid
• fs
• rid

Default reading method:

• First break down the "position / image / angle chain" and the "trajectory / encryption / signature verification chain"
• Tencent / Alibaba sliders are more likely to simultaneously hit the browser feature channel and the CAPTCHA dual-parameter chain
• Default to reading captcha-protocol-and-mobile.md

3. Packer layer / obfuscation anchors

• JSVMP
• 227
• 226
• 平坦流
• dispatcher
• while + switch
• opcode
• basearr

Default reading method:

• Do not patch the environment first; do packer layer recovery first
• Default to reading jsvmp-wasm-and-deobf.md
• Reversely drive the $web-js-reverse-master-flow of Phase 2

4. Runtime / bridge anchors

• wasm
• protobuf
• bx-pp
• run_js
• storage.estimate
• animationend
• worker
• postMessage

Default reading method:

• First determine whether it is a builder / writer shadowing, or a browser feature channel vs. runtime fork
• wasm/protobuf/bx-pp leans more toward recover
• run_js/storage.estimate/animationend leans more toward runtime

Usage order

1. First read routing-matrix.md to classify the scenario.
2. If the user mentions a specific article, a specific vendor, or wants to confirm coverage, then read article-index.md。
3. Load only one topic reference according to the current blocker:
   • Risk control, fingerprinting, vendor products:risk-fingerprint-and-vendors.md
   • Browser channels, environment patching, automation countermeasures:browser-runtime-and-env.md
   • JSVMP, flattening flow,wasm, deobfuscation:jsvmp-wasm-and-deobf.md
   • CAPTCHAs, protocol parameters, mobile cases:captcha-protocol-and-mobile.md
4. Then hand off the task to the most appropriate execution skill.

Reinforcement rules:

• When Akamai/Kasada/PX/reese84/同盾/a_bogus is hit, do not discuss purecalc directly unless the evidence is very sufficient.
• When JSVMP/227/226/平坦流/混淆 is hit, by default only restore the minimal slice, do not do a full beautify.
• When wasm/protobuf/rid/bx-pp is hit, first look for the builder, the bridge layer, and the write-back boundary.
• When run_js/storage.estimate/animationend is hit, first treat it as runtime fork evidence, do not directly classify it as a “missing object”.

Handoff rules

Overall control / forensics

• Complex web tasks default back to $web-js-reverse-master-flow
• When stage determination and tooling are needed, go back to $jsr-reverse
• When minimal request chain / sink localization is needed, go back to $jsr-locate or $js-reverse-trace-hook

Shell restoration

• JSVMP / dispatcher / flattening flow:$jsr-recover
• Control-flow false-branch pruning:$js-controlflow-truth-sampling-prune
• Aliases, string pools, multi-layer assignments:$js-ast-binding-alias-deobf
• Wasm-type VM:$js-wasm-vmp-ir-lifting
• Webpack runtime / bundle bridge:$js-webpack-runtime-node-reuse

Runtime and environment patching

• Browser and Node fork:$jsr-runtime
• Minimal environment migration:$env-patch
• Already runs but the result still drifts:$js-runtime-diff-env-patching
• Anti-debugging / DevTools friction:$js-reverse-env-antidebug

Stable reproduction / protocol

• Parameter chain replay and regression:$js-reverse-sign-replay
• CAPTCHA dual-parameter chain:$captcha-parameter-chain-bisection
• Schema-less protobuf binary:$protobuf-schema-backfill
• Android-side QUIC / So packet capture downgrade:$android-quic-downgrade-hook-capture

What you should output

When using this skill, prioritize outputting the following content, rather than speaking generally about cases:

• Which type of 1997.pro case the current goal most resembles
• The common “hidden state carriers / hidden channels / shell forms” of this type of case
• The first three on-site evidence points to verify
• Which reference to read
• Which execution skill to switch to next, and why
• Assumptions that are still unproven

If the current task hits JSVMP / 平坦流 / wasm / 混淆, you must additionally output:

• Whether it currently looks more like a dispatcher shell, a string-decryption shell, awasm bridge, or a browser feature channel
• What the key state carrier is:ip/g, register arrays, stack objects, constant pools, style final state, storage, message channels
• How deep the minimal restoration needs to go: only the entry / builder, or does it need the key opcode family / imports / exports
• Why it should currently first recover, first runtime, or first go back to locate

If the current task hits Akamai/Kasada/PX/reese84/同盾/a_bogus/腾讯滑块/阿里滑块/rid/fuid/fs/bx-pp/run_js/storage.estimate/animationend, you must additionally output:

• The most common hidden state carrier for this type of problem
• The most likely first fork point
• Misoperation that should not be done first
• Which phase of $web-js-reverse-master-flow should be returned to

Do not use it this way

• Do not treat "similar vendor names" as proof that the algorithms are the same.
• Do not skip real browser evidence and directly apply historical cases to do pure computation.
• Do not load all references by default; read only the one or two most relevant ones.
• Do not let case experience override the real live situation. What this skill provides is a "starting point for the knife", not the evidence itself.
• Do not default to full lifting / full decompilation just because you saw wasm or JSVMP .