AI-Assisted JS Reverse Engineering: From Manual Code Extraction to Automated Encrypted Parameter Analysis

JS reverse engineering has long been a high-level skill barrier in web security and web scraping. Many beginners struggle with a fundamental question: what exactly should I learn and practice to steadily improve without hitting a ceiling? The industry broadly agrees that reverse engineering e-commerce sites like Pinduoduo is ideal training — the cases are knowledge-rich and the technical logic is broadly applicable, making them a popular choice for advanced practice. This article walks through the traditional "old-school" reverse engineering workflow demonstrated in a Bilibili tutorial, then compares it against the automated analysis enabled by AI (Claude Code + MCP).

Why Pinduoduo Makes an Ideal Advanced Reverse Engineering Case

The core learning focus in web reverse engineering comes down to three major areas: environment reconstruction, obfuscation deobfuscation, and dynamic parameter capture. These three happen to be the foundational pillars for advancing to higher-level techniques — and Pinduoduo's encryption system covers virtually all of them.

Take the target in this analysis: when switching between product listing pages, the server API includes an encrypted parameter called anti_content (referred to verbally in the video as "uncontent"). This value is a garbled string starting with 0aq. Every other request parameter is clearly readable; only this one requires reverse engineering to locate the generation logic. This structure — a single suspicious parameter generated through obfuscation — is exactly the kind of sample that makes for ideal practice in dynamic parameter capture and obfuscation reversal.

The Old-School Workflow: Manual Breakpoints and Stack Tracing

Traditional reverse engineering relies heavily on manual expertise. In the demo, the developer opens the DevTools panel with F12, captures the list API request in the Network tab, inspects the Headers and Payload, and locks onto anti_content as the suspicious encrypted value.

What follows is the most tedious part — globally searching for keywords to locate where the value is generated, setting breakpoints one by one, then refreshing the page or switching tabs to trigger them. The entire process demands that the developer independently identify the encryption point, manually place breakpoints, and trace the call stack without missing a single step.

Once a breakpoint hits, you have to trace upward through the call stack. The video highlights one notable detail: the code makes heavy use of comma expressions, where the rule is that regardless of how many statements precede the final comma, only the last expression's value is returned. Understanding this is essential to correctly identifying which line actually generates the encrypted value — ultimately pinpointing a method called getAntiContent.

Going Deeper: Promise Objects and Control Flow Flattening

Locating the method doesn't end the challenge. The return value is often a Promise object, so you can't directly see the plaintext result — you have to step through it. The demo also encounters Control Flow Flattening, an obfuscation technique that scatters and reassembles code logic to the point where normal reading is nearly impossible.

Continuing to trace the stack reveals internal methods related to serialization such as messagepack and messagepacksending, along with numerous calls tied to system time. The actual encrypted value generation is buried inside a Webpack-bundled chunk file. At this point, the old-school approach requires manually extracting code and reconstructing the environment — an enormous amount of work. The video author candidly admits that even 14 minutes is barely enough time to complete this case by hand, and you still have to repeatedly check for missing environment modules.

Control Flow Flattening is a common code obfuscation technique automatically generated by tools like obfuscator.io or commercial protection solutions. Its core principle is to break up originally sequential code logic and rewrite it as a state machine driven by a while loop: each step corresponds to a state value, and a dispatch array determines what executes next — making it impossible to infer the original logic from code order alone. A simple "A→B→C" flow, after flattening, might become state '3|1|0|2', with the loop dispatching to the corresponding branches in sequence. Static reading becomes almost useless; you must rely on dynamic execution or AST (Abstract Syntax Tree) restoration tools (such as de4js or babel-plugin-based solutions) to recover a readable form. Webpack bundling adds another layer: business logic is split into multiple chunk modules, each indexed by a numeric ID. When extracting code, you must also identify dependency relationships and reconstruct the corresponding modules — otherwise the runtime will fail due to missing dependencies.

AI-Automated Reverse Engineering: Claude Code + MCP in Practice

With AI in the loop, the workflow is dramatically simplified. The author emphasizes that fully automated reverse engineering requires two types of groundwork: first, environment reconstruction standards (including universal structured standards, as well as product-specific templates for platforms like Douyin, Boss, and Pinduoduo); second, MCP (Model Context Protocol) configuration.

MCP plays a role similar to a "USB interface" here — it lets the AI connect to debugging tools, automatically adjust settings, set breakpoints, and inject Hook code, enabling end-to-end analysis.

In the live demo, the author gives Claude a straightforward prompt in VSCode: "Use Claude Code and MCP to reverse-engineer this website." The AI performs impressively — completing the entire workflow in just over ten minutes: analyzing the anti_content value, locating the generation point, finding the key method, invoking the corresponding MCP tool, generating the response, running pre-send validation, retrieving the full-length value, and returning a normal status code.

The resulting PoC file runs directly with Node, outputting system time, the anti_content value starting with 0aq, a passing length check, a 200 status code, and a validation result of true. Target data retrieval works without any issues.

MCP (Model Context Protocol) is an open protocol released by Anthropic in late 2024 to standardize how AI models interact with external tools and data sources. Its design philosophy resembles USB or LSP (Language Server Protocol) — through a unified interface, large models like Claude can invoke external capabilities such as browser debuggers, file systems, and code execution environments without requiring custom integrations for each tool. In a reverse engineering context, once an MCP server is configured, the AI can directly call the Chrome DevTools Protocol (CDP) interface to remotely control the browser: setting breakpoints, reading scope variables, and injecting Hook scripts — all transparently to the user. The key difference from traditional RPA (Robotic Process Automation) is that MCP gives AI the ability to dynamically decide "what to do next" based on contextual understanding, rather than executing a fixed recorded script.

Technical Takeaway: AI Hasn't Replaced Reverse Engineering — It's Eliminated the Grunt Work

It's worth being objective here: AI hasn't eliminated the need for foundational knowledge in reverse engineering. Environment reconstruction standards and MCP toolchain setup still require human preparation, and understanding concepts like Promises, control flow flattening, and Webpack bundling remains essential for verifying whether the AI's output is correct.

What AI genuinely solves is the repetitive, mechanical grunt work — repeatedly placing breakpoints, tracing stacks, extracting code, and patching missing environment modules. It compresses work that would take a senior engineer several hours down to a matter of minutes, freeing learners to focus on understanding the underlying technical logic. For advanced training cases like Pinduoduo, this collaborative model — where humans handle the thinking and AI handles the execution — may well become the new normal in web reverse engineering.

Note: The techniques described in this article are intended solely for security research and educational purposes. Do not use them for any activity that violates platform terms of service or applicable laws.