I am working on an express application. I obfuscate the source code using javascript-obfuscator. I am using nexe cli for generating a single exe from the obfuscated code. Can anyone tell me if there is any way to reverse engineer the exe genertaed by nexe?

Thanks in advance!!!

  • Yes. If it's runnable, it's possible to reverse engineer it.
    – Ian Cook
    Commented Feb 5, 2020 at 7:57
  • 1
    Are you looking for a "yes", or something more detailed? Please try and be specific as to what you're looking for.
    – tmr232
    Commented Feb 6, 2020 at 15:37
  • @tmr232 I want to know if it is possible to reverse-engineer the exe generated by nexe, then what tool/method should be used to test it?
    – Krish
    Commented Feb 7, 2020 at 4:31
  • 1
    I think yes. But it would require a lot of time.
    – Cync 7X
    Commented Feb 17, 2021 at 13:51

2 Answers 2


Yes. nexe embeds the code in the built binary. Here's a simple example

root@67989c78b131:/tmp# echo "console.log('habibibibi');" | nexe --build
ℹ nexe 4.0.0-beta.17
✔ Already downloaded...
✔ Compiling result
✔ Entry: '[stdin]' written to: tmp
✔ Finished in 0.24s
root@67989c78b131:/tmp# ./tmp
root@67989c78b131:/tmp# strings tmp | grep habibi

So a simple hex editor would be enough to extract js code from it and defeat nexe. javascript-obfuscator on the other hand would be a bit trickier but motivated attackers can do that too.


Of course there is.

I will quote an example of the py2exe or PyInstaller module of Python that “converts” Python code to executable, or also of most Java to exe that convert Java files to executables – what happens in reality is that a compressed executable is created, that is, your environment is copied into an executable to run.

Following my examples, if you take any Java executable converted to executable and extract it, you will get the equivalent of a JVM runtime, similar to the Python example, and if you have dazzled, some types of obfuscation are very simple to remove, so choose well.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.