The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode.

I was able to disassemble the binary file using hbctool and came across a function that I would like to learn more about e.g. getSecretData

CreateClosure           Reg8:1, Reg8:1, UInt16:9784
PutById                 Reg8:2, Reg8:1, UInt8:3, UInt16:25656
; Oper[3]: String(25656) 'getSecretData'

This function doesn't appear in any of the *.so files placed in the APK lib folder as I checked with a simple nm command:

for FILE in *.so; do nm -D $FILE | grep secret; done

Using frida to list all the Java classes just lists the ones I already have access to via the classes.dex file:

    onMatch: function(className) {
    onComplete: function() {}

There is talk of a "show source" directive that has been added to Hermes compiler so I am not sure if this is something that can be injected in.

Any help on how I can explore further will be greatly appreciated.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.