1997.pro Web Reverse Casebook

Role

This skill compresses the public article corpus of

1997.pro

into a "case knowledge base + scenario router".

It is responsible for:

Quickly determining which type of case the task most resembles when vendor names, parameter names, shell forms or risk control clues appear
Telling you which reference to read first, which type of evidence to check first, and which set of MCP actions to use first
Bridging the case experience from
```
1997.pro
```
to existing execution skills, rather than starting a parallel master control process

It does not replace:

```
$web-js-reverse-master-flow
```
```
$jsr-reverse
```
```
$mcp-js-reverse-playbook
```

Complex tasks still need to return to these master control or execution skills. This skill only focuses on "what type of problem it is and where to start".

Responsibility boundaries:

This skill is a specialized site/technical case library, responsible for providing case references, technical anchors and starting suggestions based on the article system of
```
1997.pro
```
.
It does not take over macro stage judgment, nor rewrite the main flow of
```
evidence gate -> locate -> recover -> runtime -> env-patch -> replay
```
.
If the current task has entered formal stage switching, the stage decision-making power must be returned to
```
$web-js-reverse-master-flow
```
.

Default Collaboration

The default execution stack remains unchanged:

```
chrome-devtools-mcp
```
```
js-reverse
```
```
jshook
```

Experience-based usage:

First use
```
chrome-devtools-mcp
```
and
```
js-reverse
```
to obtain real requests, real intermediate states, and real trigger actions.
When clues resemble a certain type of case on
```
1997.pro
```
, use this skill to select references and specialized skills.
When encountering heavy obfuscation, complex Hook, Stealth or advanced semantic recovery, bring
```
jshook
```
to the foreground.
If the current task has entered formal stage switching, the final stage judgment is still handed over to
```
$web-js-reverse-master-flow
```
.

When to Use

Use this skill when any of the following situations occur:

The user explicitly mentions
```
1997.pro
```
, article names on the site, articles related to the author, or wants to "do it according to this blog's method"

Clues point to specific vendors/products/parameters:

Akamai

Kasada

PX3

reese84

Incapsula

TongDun BlackBox

a_bogus

```
x-s3-s4e
```
,
```
desc
```
,
```
bx-pp
```
,
```
rid
```
,
```
fuid
```
,
```
fs
```

Clues point to specific shell or runtime issues:
- ```
JSVMP
```
  ,
```
while + switch
```
  ,
```
dispatcher
```
  ,
```
227/226
```
- ```
wasm
```
  ,
```
worker
```
  ,
```
postMessage
```
  ,
```
storage.estimate
```
- ```
animationend
```
  , CSS animation value retrieval,
```
run_js
```
  detection, inconsistencies between browser and Node
The user needs "case reference/selection/quick reference table" instead of pure process orchestration

Key Case Anchors

Prioritize identifying problems by these four groups, rather than mixing all clues into a single "big reverse engineering problem":

1. Risk Control / Vendor Anchors

```
Akamai
```
```
Kasada
```
```
PX
```
/
```
PX3
```
```
reese84
```
/
```
Incapsula
```
```
TongDun
```
/
```
BlackBox
```
```
a_bogus
```

Default reading method:

First suspect the mixing of

token lane

sign lane

fingerprint lane

challenge lane

Prioritize reading
```
risk-fingerprint-and-vendors.md
```

Generally drives

Phase 1 + Phase 3

$web-js-reverse-master-flow

in reverse

2. Captcha / Business Field Anchors

```
Tencent slider
```
```
Alibaba slider
```
```
_rand
```
```
fuid
```
```
fs
```
```
rid
```

Default reading method:

First split the "position/image/angle chain" and "trajectory/encryption/signature verification chain"
Tencent/Alibaba sliders are more likely to hit both browser feature channels and captcha dual parameter chains
Default to reading
```
captcha-protocol-and-mobile.md
```

3. Shell / Obfuscation Anchors

```
JSVMP
```
```
227
```
```
226
```
```
flat flow
```
```
dispatcher
```
```
while + switch
```
```
opcode
```
```
basearr
```

Default reading method:

Do not patch the environment first; focus on shell recovery first
Default to reading
```
jsvmp-wasm-and-deobf.md
```
Drives
```
Phase 2
```
of
```
$web-js-reverse-master-flow
```
in reverse

4. Runtime / Bridging Anchors

```
wasm
```
```
protobuf
```
```
bx-pp
```
```
run_js
```
```
storage.estimate
```
```
animationend
```
```
worker
```
```
postMessage
```

Default reading method:

First determine whether it is builder/writer masking, or browser feature channel and runtime branching
```
wasm/protobuf/bx-pp
```
are more inclined to
```
recover
```

run_js/storage.estimate/animationend

are more inclined to

runtime

Usage Sequence

First read routing-matrix.md for scenario classification.
If the user mentions specific articles, specific vendors or wants to confirm coverage, read article-index.md.
Load only one thematic reference based on the current block:
- Risk control, fingerprints, vendor products:
```
risk-fingerprint-and-vendors.md
```
- Browser channels, environment patching, automation countermeasures:
```
browser-runtime-and-env.md
```
- ```
JSVMP
```
  , flat flow,
```
wasm
```
  , deobfuscation:
```
jsvmp-wasm-and-deobf.md
```
- Captchas, protocol parameters, mobile cases:
```
captcha-protocol-and-mobile.md
```
Then hand off the task to the most suitable execution skill.

Reinforcement rules:

When hitting
```
Akamai/Kasada/PX/reese84/TongDun/a_bogus
```
, do not directly discuss purecalc unless evidence is very sufficient.
When hitting
```
JSVMP/227/226/flat flow/obfuscation
```
, only restore the minimum slice by default, do not perform full beautification.
When hitting
```
wasm/protobuf/rid/bx-pp
```
, first find the builder, bridging layer and write-back boundary.
When hitting
```
run_js/storage.estimate/animationend
```
, first treat it as runtime branching evidence, do not directly classify it as "missing object".

Handoff Rules

Master Control / Forensics

Complex Web tasks default back to
```
$web-js-reverse-master-flow
```
Return to
```
$jsr-reverse
```
when stage judgment and tooling are needed
Return to
```
$jsr-locate
```
or
```
$js-reverse-trace-hook
```
when minimum request chain/sink positioning is needed

Shell Recovery

```
JSVMP
```
/ dispatcher / flat flow:
```
$jsr-recover
```
Control flow false branch pruning:
```
$js-controlflow-truth-sampling-prune
```
Aliases, string pools, multi-layer assignments:
```
$js-ast-binding-alias-deobf
```
Wasm-type VM:
```
$js-wasm-vmp-ir-lifting
```
Webpack runtime / packaging bridge:
```
$js-webpack-runtime-node-reuse
```

Runtime and Environment Patching

Browser and Node branching:
```
$jsr-runtime
```
Minimum environment migration:
```
$env-patch
```
Runs but results still drift:
```
$js-runtime-diff-env-patching
```
Anti-debugging / DevTools friction:
```
$js-reverse-env-antidebug
```

Stable Reproduction / Protocol

Parameter chain replay and regression:
```
$js-reverse-sign-replay
```
Captcha dual parameter chain:
```
$captcha-parameter-chain-bisection
```
Schema-less protobuf binary:
```
$protobuf-schema-backfill
```
Android-side QUIC / So packet capture downgrade:
```
$android-quic-downgrade-hook-capture
```

What You Should Output

When using this skill, prioritize outputting the following content instead of talking about cases generally:

Which type of
```
1997.pro
```
case the current target most resembles
Common "hidden state carriers / hidden channels / shell forms" of this type of case
Three on-site evidence points to verify first
Which reference to read
Which execution skill to switch to next and why
Unproven assumptions at present

If the current task hits

JSVMP / flat flow / wasm / obfuscation

, you must additionally output:

Whether it is more like a
```
dispatcher
```
shell, string decryption shell,
```
wasm
```
bridge, or browser feature channel
What the key state carrier is:
```
ip/g
```
, register array, stack object, constant pool, style final state, storage, message channel
How deep to recover at minimum: only the entry/builder, or key
```
opcode
```
families/imports/exports are needed
Why you should prioritize
```
recover
```
,
```
runtime
```
, or return to
```
locate
```
at present

If the current task hits

Akamai/Kasada/PX/reese84/TongDun/a_bogus/Tencent slider/Alibaba slider/rid/fuid/fs/bx-pp/run_js/storage.estimate/animationend

, you must additionally output:

The most common hidden state carrier for this type of problem
The most likely first branching point
Misoperations that should not be done first
Which phase of
```
$web-js-reverse-master-flow
```
to return to

Do Not Use It This Way

Do not treat "similar vendor names" as proof of identical algorithms.
Do not skip real browser evidence and directly apply historical cases for pure calculation.
Do not load all references by default; only read one or two most relevant ones at present.
Do not let case experience override real on-site situations. This skill provides "starting positions", not evidence itself.
Do not default to full lifting / full decompilation just because
```
wasm
```
or
```
JSVMP
```
is encountered.

1997-pro-web-reverse-casebook

NPX Install

Tags

SKILL.md Content (Chinese)

1997.pro Web Reverse Casebook

Role

Default Collaboration

When to Use

Key Case Anchors

1. Risk Control / Vendor Anchors

2. Captcha / Business Field Anchors

3. Shell / Obfuscation Anchors

4. Runtime / Bridging Anchors

Usage Sequence

Handoff Rules

Master Control / Forensics

Shell Recovery

Runtime and Environment Patching

Stable Reproduction / Protocol

What You Should Output

Do Not Use It This Way