js-reverse

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

MCP 前端 JS 逆向作业规范

MCP Front-end JS Reverse Engineering Operation Specification

ACTION REQUIRED（读完后立刻执行）

ACTION REQUIRED (Execute Immediately After Reading)

```
NOW
```
: 读取
```
../field-journal/precedent-reverse.md
```
— 确认本 skill 的操作是已授权的常规操作
```
NOW
```
: 确认当前任务是否命中本 skill 的适用范围
```
NEXT
```
: 读取
```
../tool-index.md
```
，校验工具可用性和实际路径
```
NEXT
```
: 缺工具时调用 bootstrap，不要猜路径
```
ACT
```
: 进入"工作流"第一步并执行，不要停在确认状态

```
NOW
```
: Read
```
../field-journal/precedent-reverse.md
```
— Confirm that the operation of this skill is an authorized routine operation
```
NOW
```
: Confirm whether the current task falls within the scope of application of this skill
```
NEXT
```
: Read
```
../tool-index.md
```
to verify tool availability and actual paths
```
NEXT
```
: Call bootstrap when tools are missing, do not guess paths
```
ACT
```
: Proceed to and execute the first step of the "Workflow", do not stay in the confirmation status

适用范围

Scope of Application

当任务属于以下场景时优先使用本 skill：

定位接口签名、加密参数、风控字段
观察页面请求链路与脚本来源
在运行时抓取函数入参与返回值
追踪某个 XHR/Fetch/WebSocket 的触发点
把页面证据带回 Node 做本地复现与补环境

如果目标是二进制、APK、PE、ELF、DLL、SO，请改用

ida-reverse

、

radare2

或

reverse-engineering

。

Prioritize using this skill when the task belongs to the following scenarios:

Locate interface signatures, encryption parameters, and risk control fields
Observe page request chains and script sources
Capture function inputs and return values at runtime
Track the trigger point of a specific XHR/Fetch/WebSocket
Bring page evidence back to Node for local reproduction and environment patching

If the target is binary, APK, PE, ELF, DLL, or SO, please use

ida-reverse

radare2

, or

reverse-engineering

instead.

当前环境默认工具映射

Default Tool Mapping in Current Environment

本 skill 不假设存在裸工具名，而是默认绑定当前客户端环境里可用的

js-reverse_*

工具。

如果当前任务明确提到

jshookmcp

、

JS hook

、

CDP

、浏览器断点、网络拦截、SourceMap 或 AST 去混淆，也仍然走本 skill；只是把底层 MCP 面切到

jshookmcp

，而不是把它当成一个新的总入口。

前提条件：

jshookmcp

不是本地裸命令工具，而是一个要先下载/注册/启用的 MCP server。只有在 Claude MCP 配置里接入并启用后，相关工具面才真的可调用。

常用映射：

```
list_scripts
```
->
```
js-reverse_list_scripts
```

get_script_source

js-reverse_get_script_source

search_in_sources

js-reverse_search_in_sources

```
break_on_xhr
```
->
```
js-reverse_break_on_xhr
```

evaluate_script

js-reverse_evaluate_script

get_paused_info

js-reverse_get_paused_info

set_breakpoint_on_text

js-reverse_set_breakpoint_on_text

list_network_requests

js-reverse_list_network_requests

get_request_initiator

js-reverse_get_request_initiator

get_websocket_messages

js-reverse_get_websocket_messages

take_screenshot

js-reverse_take_screenshot

```
new_page
```
->
```
js-reverse_new_page
```
```
navigate_page
```
->
```
js-reverse_navigate_page
```
```
select_page
```
->
```
js-reverse_select_page
```
```
select_frame
```
->
```
js-reverse_select_frame
```
```
pause/resume
```
->
```
js-reverse_pause_or_resume
```

如果未来工具名前缀变化，先更新本节，不要在执行时临时猜测。

This skill does not assume the existence of bare tool names, but is bound by default to available

js-reverse_*

tools in the current client environment.

If the current task explicitly mentions

jshookmcp

JS hook

CDP

, browser breakpoints, network interception, SourceMap, or AST deobfuscation, this skill should still be used; only switch the underlying MCP layer to

jshookmcp

instead of treating it as a new main entry.

Prerequisite:

jshookmcp

is not a local bare command tool, but an MCP server that needs to be downloaded/registered/enabled first. Related tool capabilities can only be called after being connected and enabled in the Claude MCP configuration.

Common mappings:

```
list_scripts
```
->
```
js-reverse_list_scripts
```

get_script_source

js-reverse_get_script_source

search_in_sources

js-reverse_search_in_sources

```
break_on_xhr
```
->
```
js-reverse_break_on_xhr
```

evaluate_script

js-reverse_evaluate_script

get_paused_info

js-reverse_get_paused_info

set_breakpoint_on_text

js-reverse_set_breakpoint_on_text

list_network_requests

js-reverse_list_network_requests

get_request_initiator

js-reverse_get_request_initiator

get_websocket_messages

js-reverse_get_websocket_messages

take_screenshot

js-reverse_take_screenshot

```
new_page
```
->
```
js-reverse_new_page
```
```
navigate_page
```
->
```
js-reverse_navigate_page
```
```
select_page
```
->
```
js-reverse_select_page
```
```
select_frame
```
->
```
js-reverse_select_frame
```
```
pause/resume
```
->
```
js-reverse_pause_or_resume
```

If the tool name prefix changes in the future, update this section first, do not guess temporarily during execution.

jshookmcp 的定位

Positioning of jshookmcp

角色：
```
js-reverse
```
的增强执行面，不是独立总控
适合：浏览器自动化、CDP 调试、JS Hook、网络拦截、SourceMap 重建、AST 辅助理解
调用前提：先把
```
@jshookmcp/jshook
```
下载并注册到 MCP 客户端配置里，然后确保该 server 已启用
建议入口：仍然按
```
Observe → Capture → Rebuild
```
执行，只是在
```
Observe/Capture
```
阶段优先调用 jshookmcp 的浏览器与 Hook 能力
与 anything-analyzer 关系：两者都能做浏览器/网络侧取证；anything-analyzer 更偏抓包与 HTTP 分析，jshookmcp 更偏 JS 运行时、CDP、Hook 和源码理解

Role: Enhanced execution layer for
```
js-reverse
```
, not an independent master controller
Suitable for: Browser automation, CDP debugging, JS Hook, network interception, SourceMap reconstruction, AST-assisted understanding
Prerequisite for calling: First download and register
```
@jshookmcp/jshook
```
into the MCP client configuration, then ensure the server is enabled
Recommended entry: Still execute according to
```
Observe → Capture → Rebuild
```
, but prioritize calling jshookmcp's browser and Hook capabilities during the
```
Observe/Capture
```
phase
Relationship with anything-analyzer: Both can perform browser/network-side forensics; anything-analyzer focuses more on packet capture and HTTP analysis, while jshookmcp focuses more on JS runtime, CDP, Hook, and source code understanding

核心原则

Core Principles

```
Observe-first
```
```
Hook-preferred
```
```
Breakpoint-last
```
```
Rebuild-oriented
```
```
Evidence-first
```

先页面观察，再最小化采样，再做本地补环境，不要跳过取证直接猜环境。

```
Observe-first
```
```
Hook-preferred
```
```
Breakpoint-last
```
```
Rebuild-oriented
```
```
Evidence-first
```

Start with page observation, then minimize sampling, then perform local environment patching. Do not skip forensics and guess the environment directly.

五阶段工作流

Five-Stage Workflow

1. Observe

目标：先确认目标请求、相关脚本、候选函数，不猜环境。

默认动作：

用

js-reverse_new_page

或

js-reverse_navigate_page

打开目标页面

用
```
js-reverse_list_network_requests
```
找目标请求
用
```
js-reverse_get_request_initiator
```
回溯调用来源

用

js-reverse_list_scripts

、

js-reverse_search_in_sources

缩小脚本范围

必须产出：

目标请求 URL 或特征
initiator 线索
可疑脚本 URL
初始任务记录

Goal: First confirm the target request, related scripts, and candidate functions, do not guess the environment.

Default actions:

Use

js-reverse_new_page

js-reverse_navigate_page

to open the target page

Use
```
js-reverse_list_network_requests
```
to find the target request
Use
```
js-reverse_get_request_initiator
```
to trace back the call source

Use

js-reverse_list_scripts

js-reverse_search_in_sources

to narrow down the script scope

Mandatory outputs:

Target request URL or characteristics
Initiator clues
Suspicious script URL
Initial task record

2. Capture

目标：对目标请求做最小侵入采样，拿到参数样例、调用顺序、运行时证据。

规则：

优先
```
js-reverse_break_on_xhr
```
优先
```
js-reverse_evaluate_script
```
做轻量运行时观察
命中后先看
```
js-reverse_get_paused_info
```
必要时再用
```
js-reverse_set_breakpoint_on_text
```

Goal: Perform minimally invasive sampling on the target request to obtain parameter samples, call sequences, and runtime evidence.

Rules:

Prioritize
```
js-reverse_break_on_xhr
```
Prioritize
```
js-reverse_evaluate_script
```
for lightweight runtime observation
Check
```
js-reverse_get_paused_info
```
first after hitting the breakpoint
Use
```
js-reverse_set_breakpoint_on_text
```
only when necessary

3. Rebuild

目标：把页面证据整理成本地可迭代的 Node 复现材料。

规则：

本地补环境必须以页面观测证据为依据

不允许空想式补

window/document/navigator/crypto/storage

每次只记录一个最小因果补丁决策

Goal: Organize page evidence into locally iterable Node reproduction materials.

Rules:

Local environment patching must be based on page observation evidence

Do not patch

window/document/navigator/crypto/storage

based on assumptions

Record only one minimal causal patch decision at a time

4. Patch

目标：按报错和 first divergence 驱动补环境，直到本地脚本稳定跑出目标参数。

规则：

先看缺什么，再补什么
一次只做一个最小补丁决策
每次补丁后立即复测
每次补丁都写入任务记录

Goal: Drive environment patching based on errors and first divergence until the local script stably outputs the target parameters.

Rules:

Check what is missing first, then patch accordingly
Make only one minimal patch decision at a time
Retest immediately after each patch
Record each patch in the task record

5. DeepDive

目标：本地跑通后，再做去混淆、控制流还原、业务逻辑提纯。

规则：

如果当前任务只是出签名，这一阶段可以降级
如果要长期复用算法链路，这一阶段必须做
Issue #65 混淆旁路（U–AV §4）：JSVMP（AD）→
```
E-js-vmp
```
；CFF+字符串数组（AE）→
```
E-js-deobf
```
；DevTools/debugger 反调试（AF）→
```
E-js-anti-debug
```
。完整触发表见
```
../reverse-engineering/references/nonpe-format-cookbook.md
```
；AST 细节仍用
```
references/ast-deobfuscation.md
```

Goal: After running successfully locally, perform deobfuscation, control flow restoration, and business logic purification.

Rules:

This phase can be downgraded if the current task only requires generating signatures
This phase must be completed if the algorithm chain needs long-term reuse
Issue #65 Obfuscation Bypass (U–AV §4): JSVMP (AD) →
```
E-js-vmp
```
; CFF+string array (AE) →
```
E-js-deobf
```
; DevTools/debugger anti-debugging (AF) →
```
E-js-anti-debug
```
. Complete trigger table see
```
../reverse-engineering/references/nonpe-format-cookbook.md
```
; AST details still use
```
references/ast-deobfuscation.md
```

执行要求

Execution Requirements

所有重要步骤都要写入本地 task artifact
如果无法解释为什么调用某个工具，就不要调用
优先使用
```
js-reverse_*
```
或 jshookmcp 的现成 MCP 能力直接取证，不要先写脚本重造能力
失败时按
```
references/fallbacks.md
```
回退
输出遵循
```
references/output-contract.md
```

All important steps must be written into the local task artifact
Do not call a tool if you cannot explain why it is being called
Prioritize using the ready-made MCP capabilities of
```
js-reverse_*
```
or jshookmcp for direct forensics, do not reinvent capabilities by writing scripts first
Fall back according to
```
references/fallbacks.md
```
when failing
Output follows
```
references/output-contract.md
```

必读引用

Required References

自动化入口：
```
references/automation-entry.md
```
参数默认值：
```
references/tool-defaults.md
```
任务输入模板：
```
references/task-input-template.md
```
MCP 专用任务编排：
```
references/mcp-task-template.md
```
任务产物：
```
references/task-artifacts.md
```
本地复现：
```
references/local-rebuild.md
```
补环境：
```
references/env-patching.md
```
Node 复现：
```
references/node-env-rebuild.md
```
插桩：
```
references/instrumentation.md
```
AST 去混淆：
```
references/ast-deobfuscation.md
```

非 PE/JS 混淆菜谱 U–AV：

../reverse-engineering/references/nonpe-format-cookbook.md

（AD/AE/AF）

回退：
```
references/fallbacks.md
```
输出契约：
```
references/output-contract.md
```

Automation entry:
```
references/automation-entry.md
```
Parameter defaults:
```
references/tool-defaults.md
```
Task input template:
```
references/task-input-template.md
```
MCP-specific task orchestration:
```
references/mcp-task-template.md
```
Task artifacts:
```
references/task-artifacts.md
```
Local reproduction:
```
references/local-rebuild.md
```
Environment patching:
```
references/env-patching.md
```
Node reproduction:
```
references/node-env-rebuild.md
```
Instrumentation:
```
references/instrumentation.md
```
AST deobfuscation:
```
references/ast-deobfuscation.md
```

Non-PE/JS obfuscation cookbook U–AV:

../reverse-engineering/references/nonpe-format-cookbook.md

(AD/AE/AF)

Fallback:
```
references/fallbacks.md
```
Output contract:
```
references/output-contract.md
```

路由上下文

Routing Context

上游入口:

skills/SKILL.md

（总控）、

routing.md

上游备选:

anything-analyzer MCP（端口 23816）的浏览器工具可作为替代或补充
jshookmcp 可作为更强的浏览器/CDP/Hook/Network/SourceMap/AST 执行面
```
reverse-engineering/SKILL.md
```
（如果目标不是前端 JS）

下游出口:

需补环境 →
```
references/env-patching.md
```

需本地复现 →

references/local-rebuild.md

references/node-env-rebuild.md

需去混淆 →
```
references/ast-deobfuscation.md
```
走不通时回退 →
```
references/fallbacks.md
```

同级关联模块: anything-analyzer MCP（浏览器自动化和 HTTP 捕获能力可以互补）

Upstream Entries:

skills/SKILL.md

(Master Control),

routing.md

Upstream Alternatives:

Browser tools of anything-analyzer MCP (port 23816) can be used as substitutes or supplements
jshookmcp can be used as a stronger execution layer for browser/CDP/Hook/Network/SourceMap/AST
```
reverse-engineering/SKILL.md
```
(if the target is not front-end JS)

Downstream Exits:

Environment patching required →
```
references/env-patching.md
```

Local reproduction required →

references/local-rebuild.md

references/node-env-rebuild.md

Deobfuscation required →
```
references/ast-deobfuscation.md
```
Fallback when stuck →
```
references/fallbacks.md
```

Peer Associated Modules: anything-analyzer MCP (browser automation and HTTP capture capabilities can complement each other)

按需自举（On-Demand Bootstrap）

On-Demand Bootstrap

本 skill 依赖的 MCP 能力可通过统一自举系统自动注册。

The MCP capabilities relied on by this skill can be automatically registered through the unified bootstrap system.

自动化能力边界

Automation Capability Boundaries

能力	可自动注册	方式	说明
jshookmcp	✓	npm-mcp（npx 启动）	自动写入 Claude MCP 配置
anything-analyzer	✓	local-http-mcp	自动注册 + 可自动启动服务
Node.js	✓	winget 安装	运行时依赖

Capability	Auto-registerable	Method	Description
jshookmcp	✓	npm-mcp (started via npx)	Automatically written to Claude MCP configuration
anything-analyzer	✓	local-http-mcp	Auto-registration + service can be started automatically
Node.js	✓	Install via winget	Runtime dependency

自举方式

Bootstrap Methods

powershell

undefined

powershell

undefined

注册 jshookmcp 到 MCP 配置

Register jshookmcp to MCP configuration

powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('jshookmcp')

注册并启动 anything-analyzer

Register and start anything-analyzer

powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('anything-analyzer') -StartServices

undefined

powershell -File "<skill-root>\scripts\bootstrap-reverse.ps1" -Capability @('anything-analyzer') -StartServices

undefined

注意事项

Notes

```
jshookmcp
```
注册后仍需在 AI 客户端中启用该 MCP server 才能调用
```
anything-analyzer
```
需要 pnpm 和项目源码，bootstrap 会自动 clone 并安装依赖
如果 Node.js 未安装，bootstrap 会先通过 winget 安装 Node.js 22

<br><br>## 任务完成自检（声称完成前 MUST 通过）

我是否执行了工作流中的每一步（而不是只阅读）？
我是否基于
```
tool-index
```
使用了真实工具路径？
我是否产出了可复现证据（命令/脚本/截图/报告）？
我是否完成并回写了 RULES 要求的 Checklist 项？

After registering
```
jshookmcp
```
, you still need to enable the MCP server in the AI client to call it
```
anything-analyzer
```
requires pnpm and project source code; bootstrap will automatically clone and install dependencies
If Node.js is not installed, bootstrap will first install Node.js 22 via winget

<br><br>## Task Completion Self-Check (MUST Pass Before Claiming Completion)

Did I execute every step in the workflow (instead of just reading)?
Did I use real tool paths based on
```
tool-index
```
?
Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
Did I complete and write back the Checklist items required by RULES?