js-reverse

MCP Frontend JS Reverse Engineering Work Standard

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW: Read ../field-journal/precedent-reverse.md — confirm that the operation covered by this skill is an authorized routine operation
2. NOW: Confirm whether the current task falls within the scope of this skill
3. NEXT: Read ../tool-index.md to verify tool availability and actual paths
4. NEXT: If tools are missing, call bootstrap; do not guess paths
5. ACT: Enter the first step of the "Workflow" and execute; do not remain in a pending state

Scope

This skill takes priority when the task falls into the following scenarios:

• Locating interface signatures, encryption parameters, or anti-fraud fields
• Observing page request chains and script sources
• Capturing function arguments and return values at runtime
• Tracing the trigger point of a specific XHR/Fetch/WebSocket
• Bringing page evidence back to Node for local reproduction and environment patching

If the target is a binary, APK, PE, ELF, DLL, or SO, use ida-reverse, radare2, or reverse-engineering instead.

Current Environment Default Tool Mapping

This skill does not assume bare tool names; instead, it binds to the js-reverse_* tools available in the current client environment.

If the current task explicitly mentions jshookmcp, JS hook, CDP, browser breakpoints, network interception, SourceMap, or AST deobfuscation, it still falls under this skill; only the underlying MCP surface switches to jshookmcp — it is not treated as a separate entry point.

Prerequisite: jshookmcp is not a local command-line tool; it is an MCP server that must be downloaded, explicitly registered, and enabled. The relevant tool surfaces can only be invoked after it has been connected and enabled in the MCP configuration of the chosen client (Claude, Codex, etc.).

Common mapping:

• list_scripts -> js-reverse_list_scripts
• get_script_source -> js-reverse_get_script_source
• search_in_sources -> js-reverse_search_in_sources
• break_on_xhr -> js-reverse_break_on_xhr
• evaluate_script -> js-reverse_evaluate_script
• get_paused_info -> js-reverse_get_paused_info
• set_breakpoint_on_text -> js-reverse_set_breakpoint_on_text
• list_network_requests -> js-reverse_list_network_requests
• get_request_initiator -> js-reverse_get_request_initiator
• get_websocket_messages -> js-reverse_get_websocket_messages
• take_screenshot -> js-reverse_take_screenshot
• new_page -> js-reverse_new_page
• navigate_page -> js-reverse_navigate_page
• select_page -> js-reverse_select_page
• select_frame -> js-reverse_select_frame
• pause/resume -> js-reverse_pause_or_resume

If the tool name prefix changes in the future, update this section first; do not guess on the fly.

Positioning of jshookmcp

• Role: Enhanced execution surface for js-reverse, not an independent controller
• Suitable for: Browser automation, CDP debugging, JS Hooking, network interception, SourceMap reconstruction, AST-assisted comprehension
• Prerequisite for invocation: First download and register @jshookmcp/jshook in the MCP client configuration, then ensure the server is enabled
• Recommended entry: Still follow Observe → Capture → Rebuild, but during the Observe/Capture phase, prioritize jshookmcp's browser and hooking capabilities
• Relationship with anything-analyzer: Both can perform browser/network forensics; anything-analyzer leans toward packet capture and HTTP analysis, while jshookmcp leans toward JS runtime, CDP, hooks, and source understanding

Core Principles

• Observe-first
• Hook-preferred
• Breakpoint-last
• Rebuild-oriented
• Evidence-first

First observe the page, then minimally sample, then do local environment patching; do not skip forensics and guess the environment.

Five-Phase Workflow

1. Observe

Goal: First confirm the target request, related scripts, and candidate functions; do not guess the environment.

Default actions:

• Use js-reverse_new_page or js-reverse_navigate_page to open the target page
• Use js-reverse_list_network_requests to find the target request
• Use js-reverse_get_request_initiator to trace the call source
• Use js-reverse_list_scripts, js-reverse_search_in_sources to narrow down the script scope

Must produce:

• Target request URL or characteristics
• Initiator clues
• Suspicious script URL
• Initial task record

2. Capture

Goal: Perform minimally invasive sampling of the target request, obtaining parameter samples, call order, and runtime evidence.

Rules:

• Prioritize js-reverse_break_on_xhr
• Prioritize js-reverse_evaluate_script for lightweight runtime observation
• After hitting, first check js-reverse_get_paused_info
• Use js-reverse_set_breakpoint_on_text only when necessary

3. Rebuild

Goal: Organize page evidence into local, iterable Node reproduction materials.

Rules:

• Local environment patching must be based on page observation evidence
• Do not blindly patch window/document/navigator/crypto/storage without evidence
• Each patch decision should record only one minimal causal patch

4. Patch

Goal: Drive environment patching based on errors and first divergence, until the local script stably produces the target parameters.

Rules:

• First see what is missing, then patch it
• Make only one minimal patch decision at a time
• Re-test immediately after each patch
• Record each patch in the task record

5. DeepDive

Goal: After local verification, proceed with deobfuscation, control flow restoration, and business logic extraction.

Rules:

• If the current task only needs to generate a signature, this phase can be downgraded
• If the algorithm chain needs to be reused long-term, this phase is mandatory
• Issue #65 obfuscation bypass (U–AV §4): JSVMP (AD) → E-js-vmp; CFF+string array (AE) → E-js-deobf; DevTools/debugger anti-debugging (AF) → E-js-anti-debug. Full trigger table in ../reverse-engineering/references/nonpe-format-cookbook.md; AST details still in references/ast-deobfuscation.md

Execution Requirements

• All important steps must be written into the local task artifact
• If you cannot explain why a tool is called, do not call it
• Give priority to existing MCP capabilities (js-reverse_* or jshookmcp) for direct forensics; do not write scripts to reinvent the wheel
• On failure, fall back according to references/fallbacks.md
• Output follows references/output-contract.md

Required References

• Automation entry: references/automation-entry.md
• Tool defaults: references/tool-defaults.md
• Task input template: references/task-input-template.md
• MCP-specific task orchestration: references/mcp-task-template.md
• Task artifacts: references/task-artifacts.md
• Local rebuild: references/local-rebuild.md
• Environment patching: references/env-patching.md
• Node reproduction: references/node-env-rebuild.md
• Instrumentation: references/instrumentation.md
• AST deobfuscation: references/ast-deobfuscation.md
• Non-PE/JS obfuscation cookbook U–AV: ../reverse-engineering/references/nonpe-format-cookbook.md (AD/AE/AF)
• Fallbacks: references/fallbacks.md
• Output contract: references/output-contract.md

---

Routing Context

Upstream entry: skills/SKILL.md (master controller), routing.md Upstream alternatives:

• anything-analyzer MCP (port 23816) browser tools can serve as alternatives or complements
• jshookmcp can serve as a more powerful browser/CDP/Hook/Network/SourceMap/AST execution surface
• reverse-engineering/SKILL.md (if the target is not frontend JS)

Downstream exits:

• Need environment patching → references/env-patching.md
• Need local reproduction → references/local-rebuild.md / references/node-env-rebuild.md
• Need deobfuscation → references/ast-deobfuscation.md
• Fallback on failure → references/fallbacks.md

Peer-related modules: anything-analyzer MCP (browser automation and HTTP capture capabilities complement this skill)

---

On-Demand Bootstrap

The MCP capabilities this skill depends on can be installed through a unified bootstrap system; MCP client registration must explicitly choose a target, and by default no client configuration is modified.

Automation Capability Boundary

Capability	Auto-registerable	Method	Description
jshookmcp	✓	npm-mcp (npx start)	Register after explicitly selecting Claude / Codex / Both
anything-analyzer	✓	local-http-mcp	Can auto-start the service; client registration must be explicit
Node.js	✓	winget install	Runtime dependency

Bootstrap Method

# Install and register jshookmcp; replace Codex with Claude or Both as needed
powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('jshookmcp') -McpHostTarget Codex

# Register and start anything-analyzer
powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('anything-analyzer') -StartServices -McpHostTarget Codex

Notes

• After registering jshookmcp, you still need to enable the MCP server in the AI client to call its tools
• If -McpHostTarget is not passed, the script only installs/prepares the capability and returns registration-required, without modifying Claude or Codex configuration
• anything-analyzer requires pnpm and the project source code; bootstrap will automatically clone and install dependencies
• If Node.js is not installed, bootstrap will first install Node.js 22 via winget

## Task Completion Self-Check (MUST pass before claiming completion)

• Have I executed every step of the workflow (rather than just reading it)?
• Have I used real tool paths based on tool-index?
• Have I produced reproducible evidence (commands/scripts/screenshots/reports)?
• Have I completed and written back the checklist items required by RULES?