web-reverse-algorithm

Web Reverse Engineering Pure Algorithm

This skill is not "giving a fixed formula," but rather compressing the method layer, problem-type layer, training layer, and engineering layer in the knowledge base into a single overall entry point.

First compress the task into this closed loop, then decide which references to read, which path to take, and what kind of implementation code to write:

最终请求 / 最终 cookie / 最终 verify / 最终 WS 帧
-> writer
-> builder
-> entry
-> source

Core Principles

1. Find the final write-out point first, do not start by reading large obfuscated files.
2. Store intermediate values first, do not guess algorithm names first.
3. Narrow the execution scope first, then fill in the environment.
4. Prove the input-output boundary first, then decide whether to migrate the whole thing.
5. Organize the results into a reusable structure first, then continue with version adaptation.

Order of Use

1. First determine the problem type

First classify the target into one of the following:

• Standard signature / standard digest problem
• Hybrid encryption / key wrapping problem
• Cookie / Header / multi-parameter linkage problem
• JSVMP / VMP / heavily obfuscated pure algorithm problem
• Wasm / Protobuf / WebSocket / binary protocol problem
• CAPTCHA / risk control / challenge problem

If you still cannot distinguish it, first read references/01-decision-tree.md。

2. Then determine the current blocking point

First determine which of the following categories you are stuck on:

• The entry point was not found correctly
• The original string or original payload is not aligned
• The intermediate array / intermediate object was not captured
• Runtime dependencies are not fully supplied
• The image line and the parameter line were not separated
• The protocol boundary was not proven

When you are unsure at this step, first read references/04-debug-env-playbook.md。

3. Choose a route by problem type

Standard signature / hybrid encryption / Cookie / Header / Chinese cryptographic algorithms

Applicable signals:

• Regular output length
• md5/sha1/hmac/aes/rsa/sm3/sm4
• token&t&appKey&data
• params + encSecKey
• document.cookie or the header is clearly traceable

Prioritize reading references/02-algorithm-families.md。

JSVMP / VMP / Xiaohongshu / a_bogus / complex multi-parameter pure algorithm

Applicable signals:

• Large arrays, interpreters,for(;;)+switch
• dense bitwise operations, state arrays, register-style writing
• window._webmsxyw、__TENCENT_CHAOS_VM、byted_acrawler a type of entry point

Prioritize reading references/02-algorithm-families.md and references/04-debug-env-playbook.md。

Wasm / Protobuf / WebSocket / challenge protocol

Applicable signals:

• WebAssembly.instantiate
• application/x-protobuf
• Binary responses, exported functions, first packet/verification packet segmentation

Prioritize reading references/02-algorithm-families.md and references/03-captcha-families.md。

CAPTCHA / risk control / challenge / verify

Always first separate the 5 lines:

1. Initialization / challenge line
2. Image or problem statement recognition line
3. Parameter builder line
4. Environment / fingerprint / collect line
5. Final verify line

Prioritize reading references/03-captcha-families.md。

Unified Workflow

1. Lock onto the final write-out point

Prioritize cutting in from these locations:

• fetch
• XMLHttpRequest.send
• setRequestHeader
• document.cookie
• JSON.stringify
• verify submission point
• WebSocket first packet or verification packet sending point

2. Record 5 layers of checkpoints

At minimum retain:

1. writer checkpoint: final URL / header / body / cookie / WS frame
2. builder input: query, payload, token, challenge, distance, track, browser info
3. raw string or raw payload
4. intermediate array / intermediate object / pre-encoding byte stream
5. final output

3. First restore the intermediate state, then restore the final encoding

This rule is especially important in the following types of problems:

• Xiaohongshu x-s / x-s-common
• Douyin a_bogus / X-Bogus
• Tencent collect
• NetEase Shield w
• various payload -> encode header families

4. Only patch the environment when necessary

Prioritize patching down to the minimum runnable boundary:

1. window/self/globalThis/document/navigator/location
2. cookie/storage/performance/Date/crypto
3. canvas/webgl/audio/plugins/mimeTypes/RTCPeerConnection

If the target has been reduced to a pure function, do not escalate the task into a "big environment-patching problem".

5. Converge the result into an engineering interface

Ultimately prioritize producing the following artifacts:

• minimum input set
• intermediate checkpoint set
• build_context() / build_payload() / sign() / solve() this kind of layered interface
• comparison between local samples and browser samples
• failure diagnosis points

Results you should produce

When using this skill, prioritize outputting:

1. problem type determination
2. writer / builder / entry / source layering
3. determination of the current blocking point
4. list of necessary checkpoints
5. whether AST, instrumentation, environment patching, image recognition, or protocol unpacking is needed
6. recommended implementation structure: function, solver, SDK, service
7. error-prone points and version risks

Resource navigation

• references/01-decision-tree.md Purpose: first determine the problem type, blocking point, and request chain location.
• references/02-algorithm-families.md Purpose: standard signatures, hybrid encryption, Cookie/Header, JSVMP, Wasm, Chinese cryptography, site family patterns.
• references/03-captcha-families.md Purpose: captcha/risk control routes such as Tencent, Geetest, NetEase Shield, Baidu rotate, Alibaba v2, V5, Pinduoduo, hCaptcha, etc.
• references/04-debug-env-playbook.md Purpose: hook, logpoint, minimal environment patching, browser/local alignment, anti-debugging and evidence management.
• references/05-training-routes.md Purpose: learning order, training stages, how cases onboard newcomers, how to absorb video materials.
• references/06-engineering-maintenance.md Purpose: how to absorb GitHub projects, how to design interfaces, how to record primary landing points/secondary landing points/tags when expanding the library.
• scripts/new_case_scaffold.py Purpose: create a standardized case directory for a new site or new challenge.

Case scaffold

To quickly set up a "reviewable, extensible" case skeleton in the workspace, run:

python "<skill-dir>\\scripts\\new_case_scaffold.py" `
  "case-name" `
  --type captcha `
  --family tencent `
  --tags captcha,collect,pow `
  --sources "https://example-a,https://example-b" `
  --language py `
  --output ".\\research"

The scaffold will generate:

• case-overview.md
• request-chain.md
• evidence-log.md
• checkpoints.json
• metadata.json
• solver_stub.js or solver_stub.py
• todo.md

Final constraints

Always lean toward the following practices:

1. Enter from a real request or real sink.
2. Establish isomorphic checkpoints for browser values and local values.
3. First separate the algorithm layer, environment layer, and protocol layer, then decide how to migrate.
4. When there are multiple articles for the same site, record the "differences in approach"; do not keep only one final answer.
5. For each case, preserve the input boundary, checkpoints, code skeleton, and error-prone points, rather than only keeping the final finished product.