SuperAPI AI Directory
Partner中文AI newsFavorites
Skillsjs-reverse

js-reverse

Security & auditing

View repository

Updated 10-16 09:45

About this skill

MCP Front-End JS Reverse Engineering Work Specification

ACTION REQUIRED (execute immediately after reading)

  1. NOW: read ../field-journal/precedent-reverse.md — confirm that this skill's operations are authorized routine operations
  2. NOW: confirm whether the current task falls within this skill's scope of application
  3. NEXT: read ../tool-index.md, verify tool availability and the actual path
  4. NEXT: when a tool is missing, call bootstrap; do not guess the path
  5. ACT: enter the first step of the "workflow" and execute it; do not stop in the confirmation state

Scope of Application

Prefer this skill when the task belongs to the following scenarios:

  • Locate interface signatures, encrypted parameters, and risk-control fields
  • Observe page request chains and script origins
  • Capture function inputs and return values at runtime
  • Trace the trigger point of a certain XHR/Fetch/WebSocket
  • Bring page evidence back to Node for local reproduction and environment patching

If the target is a binary, APK, PE, ELF, DLL, or SO, please use ida-reverse、radare2 or reverse-engineering。

Default tool mapping in the current environment

This skill does not assume the existence of bare tool names, but by default binds to the js-reverse_* tools available in the current client environment.

If the current task explicitly mentions jshookmcp、JS hook、CDP, browser breakpoints, network interception, SourceMap, or AST deobfuscation, it still goes through this skill; just switch the underlying MCP surface to jshookmcp, rather than treating it as a new overall entry point.

Prerequisites:jshookmcp is not a local bare command tool, but an MCP server that must first be downloaded, explicitly registered, and enabled. Only after it is connected and enabled in the MCP configuration of the selected client (Claude, Codex, etc.) do the related tool surfaces actually become callable.

Common mappings:

  • list_scripts -> js-reverse_list_scripts
  • get_script_source -> js-reverse_get_script_source
  • search_in_sources -> js-reverse_search_in_sources
  • break_on_xhr -> js-reverse_break_on_xhr
  • evaluate_script -> js-reverse_evaluate_script
  • get_paused_info -> js-reverse_get_paused_info
  • set_breakpoint_on_text -> js-reverse_set_breakpoint_on_text
  • list_network_requests -> js-reverse_list_network_requests
  • get_request_initiator -> js-reverse_get_request_initiator
  • get_websocket_messages -> js-reverse_get_websocket_messages
  • take_screenshot -> js-reverse_take_screenshot
  • new_page -> js-reverse_new_page
  • navigate_page -> js-reverse_navigate_page
  • select_page -> js-reverse_select_page
  • select_frame -> js-reverse_select_frame
  • pause/resume -> js-reverse_pause_or_resume

If the tool name prefixes change in the future, update this section first; do not guess on the fly during execution.

The Role of jshookmcp

  • Role:js-reverse 's enhanced execution surface, not an independent overall controller
  • Suitable for: browser automation, CDP debugging, JS Hook, network interception, SourceMap reconstruction, AST-assisted understanding
  • Prerequisite for invocation: first download @jshookmcp/jshook and register it in the MCP client configuration, then ensure that the server is enabled
  • Recommended entry: still execute according to Observe → Capture → Rebuild , only at the Observe/Capture stage preferentially call jshookmcp's browser and Hook capabilities
  • Relationship with anything-analyzer: both can do browser/network-side evidence collection; anything-analyzer leans more toward packet capture and HTTP analysis, while jshookmcp leans more toward JS runtime, CDP, Hook, and source code understanding

Core Principles

  • Observe-first
  • Hook-preferred
  • Breakpoint-last
  • Rebuild-oriented
  • Evidence-first

Observe the page first, then minimize sampling, then do local environment patching; do not skip evidence collection and directly guess the environment.

Five-Stage Workflow

1. Observe

Goal: first confirm the target request, related scripts, and candidate functions; do not guess the environment.

Default actions:

  • Use js-reverse_new_page or js-reverse_navigate_page to open the target page
  • Use js-reverse_list_network_requests to find the target request
  • Use js-reverse_get_request_initiator to trace back the call origin
  • Use js-reverse_list_scripts、js-reverse_search_in_sources Narrow the script scope

Required output:

  • Target request URL or signature
  • Initiator clue
  • Suspicious script URL
  • Initial task record

2. Capture

Goal: Perform minimally invasive sampling of the target request to obtain parameter samples, call order, and runtime evidence.

Rules:

  • Prefer js-reverse_break_on_xhr
  • Prefer js-reverse_evaluate_script for lightweight runtime observation
  • After a hit, first check js-reverse_get_paused_info
  • If necessary, then use js-reverse_set_breakpoint_on_text

3. Rebuild

Goal: Organize page evidence into locally iterable Node reproduction material.

Rules:

  • Local environment shimming must be based on page observation evidence
  • Speculative shimming of window/document/navigator/crypto/storage
  • Record only one minimal causal shim decision each time

4. Patch

Goal: Drive environment shimming by errors and first divergence until the local script stably produces the target parameters.

Rules:

  • First see what is missing, then shim what is missing
  • Make only one minimal patch decision at a time
  • Retest immediately after each patch
  • Write every patch into the task record

5. DeepDive

Goal: After it runs locally, then perform deobfuscation, control flow recovery, and business logic refinement.

Rules:

  • If the current task is only to produce a signature, this stage can be downgraded
  • If the algorithm chain is to be reused long term, this stage must be done
  • Issue #65 obfuscation bypass (U–AV §4): JSVMP (AD) → E-js-vmp; CFF + string array (AE) → E-js-deobf; DevTools/debugger anti-debugging (AF) → E-js-anti-debug. See the full trigger table in ../reverse-engineering/references/nonpe-format-cookbook.md; for AST details still use references/ast-deobfuscation.md

Execution requirements

  • All important steps must be written into the local task artifact
  • If you cannot explain why a tool is called, do not call it
  • Prefer using js-reverse_* or jshookmcp's ready-made MCP capabilities to collect evidence directly; do not first write scripts to recreate capabilities
  • On failure, fall back according to references/fallbacks.md Fallback
  • Output follows references/output-contract.md

Required references

  • Automation entry:references/automation-entry.md
  • Default parameter values:references/tool-defaults.md
  • Task input template:references/task-input-template.md
  • MCP-specific task orchestration:references/mcp-task-template.md
  • Task artifacts:references/task-artifacts.md
  • Local reproduction:references/local-rebuild.md
  • Environment shimming:references/env-patching.md
  • Node reproduction:references/node-env-rebuild.md
  • Instrumentation:references/instrumentation.md
  • AST deobfuscation:references/ast-deobfuscation.md
  • Non-PE/JS obfuscation recipes U–AV:../reverse-engineering/references/nonpe-format-cookbook.md（AD/AE/AF）
  • Fallback:references/fallbacks.md
  • Output contract:references/output-contract.md

Routing context

Upstream entry: skills/SKILL.md(master control),routing.md Upstream alternative:

  • The browser tools of anything-analyzer MCP (port 23816) can be used as a substitute or supplement
  • jshookmcp can serve as a stronger browser/CDP/Hook/Network/SourceMap/AST execution surface
  • reverse-engineering/SKILL.md(if the target is not front-end JS)

Downstream exit:

  • Needs environment shimming → references/env-patching.md
  • Needs local reproduction → references/local-rebuild.md / references/node-env-rebuild.md
  • Needs deobfuscation → references/ast-deobfuscation.md
  • When stuck, fall back → references/fallbacks.md

Sibling related module: anything-analyzer MCP (browser automation and HTTP capture capabilities can complement each other)

On-Demand Bootstrap

The MCP capabilities this skill depends on can be installed through the unified bootstrap system; MCP client registration must explicitly select the target, and by default no client global configuration will be written.

Automation capability boundaries

Capability Can be auto-registered Method Description
jshookmcp ✓ npm-mcp (started via npx) Register after explicitly selecting Claude / Codex / Both
anything-analyzer ✓ local-http-mcp The service can be started automatically; client registration must be explicitly selected
Node.js ✓ winget install Runtime dependency

Bootstrap method

# 安装并注册 jshookmcp；Codex 可替换为 Claude 或 Both
powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('jshookmcp') -McpHostTarget Codex

# 注册并启动 anything-analyzer
powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('anything-analyzer') -StartServices -McpHostTarget Codex

Notes

  • jshookmcp After registration, you still need toenablethe MCP server in the AI client before it can be called
  • If -McpHostTarget is not passed, it only installs/prepares the capability and returns registration-required, without modifying the Claude or Codex configuration
  • anything-analyzer requires pnpm and the project source code; bootstrap will automatically clone and install dependencies
  • If Node.js is not installed, bootstrap will first install Node.js 22 via winget

## Task completion self-check (MUST pass before claiming completion)

  • Did I execute every step in the workflow (rather than only reading it)?
  • Did I use the real tool path based on tool-index ?
  • Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
  • Did I complete and write back the Checklist items required by RULES?