js-reverse

Reverse engineer frontend JavaScript to trace request signatures and reproduce them locally in Node.

7|4|Updated Jun 22, 2026
One-click install
npx skills add https://github.com/dbx0/skills --skill js-reverse-dbx0
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: js-reverse
Source: https://github.com/dbx0/skills/tree/main/skills/binary-re-pwn/reverse-engineering/js-reverse
Command: npx skills add https://github.com/dbx0/skills --skill js-reverse-dbx0

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @jshookmcp/jshook, and includes references (resource) components.

What problem does it solve? Locating how a web page generates API signatures, encryption parameters, and anti-fraud fields is slow and error-prone when done by guessing at minified source. This Skill provides a structured observe-capture-rebuild workflow that grounds every step in runtime evidence collected through js-reverse MCP or jshookmcp browser tooling. ## Core Features & Use Cases - Request and Signature Tracing: Use network request listing, initiator call stacks, and XHR breakpoints to find exactly which script and function generate a target parameter. - Runtime Sampling: Capture function arguments, return values, and WebSocket messages with minimally invasive breakpoints and script evaluation. - Local Node Reproduction: Rebuild the signing logic locally with evidence-driven environment shimming, patching one minimal gap at a time until output is reproducible. - Use Case: Given a target site whose login request carries an encrypted sign parameter, observe the request chain, break on the XHR call, identify the signing function, then reproduce the algorithm in Node with shims for only the browser objects the evidence proves are needed. ## Quick Start Use the js-reverse skill to open the target page, trace the initiator of the login request, and identify the function that generates its signature parameter.

Frequently Asked Questions about js-reverse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find which JavaScript function generates a request signature?

Open the page, list network requests to find the target call, then use get_request_initiator to trace its call stack. Narrow the script scope with search_in_sources and set an XHR breakpoint to capture the signing function's arguments and return value at runtime.

How to reproduce browser signing logic in Node.js?

First collect page evidence: the entry function, call order, parameter sources, and the browser objects it touches. Then import the script in Node, shim only the objects the evidence proves are needed, and patch one minimal gap at a time until output matches.

What is the difference between js-reverse and jshookmcp?

js-reverse_* tools are the default MCP surface for observation and sampling, while jshookmcp is an optional stronger execution surface for CDP debugging, JS hooking, network interception, SourceMap recovery, and AST deobfuscation. jshookmcp must be registered and enabled as an MCP server first.

Can this skill reverse engineer APK, PE, or ELF binaries?

No, this skill targets frontend JavaScript only. For binaries such as APK, PE, ELF, DLL, or SO files, use dedicated binary reverse engineering skills like ida-reverse or radare2 instead.

Why does local environment shimming fail with undefined errors?

Shimming fails when objects are guessed rather than evidence-based, or when too much is patched at once. Shim only what page evidence proves is needed, apply one minimal patch, retest immediately, and check whether the first divergence moved earlier.