2

The Android app I am looking at uses React Native with the Hermes JS Engine. This generates a index.android.bundle binary that contains Hermes JS bytecode.

I was able to disassemble the binary file using hbctool and came across a function that I would like to learn more about e.g. getSecretData

CreateClosure           Reg8:1, Reg8:1, UInt16:9784
PutById                 Reg8:2, Reg8:1, UInt8:3, UInt16:25656
; Oper[3]: String(25656) 'getSecretData'

This function doesn't appear in any of the *.so files placed in the APK lib folder as I checked with a simple nm command:

for FILE in *.so; do nm -D $FILE | grep secret; done

Using frida to list all the Java classes just lists the ones I already have access to via the classes.dex file:

Java.enumerateLoadedClasses({
    onMatch: function(className) {
        console.log(className);
    },
    onComplete: function() {}
});

There is talk of a "show source" directive that has been added to Hermes compiler so I am not sure if this is something that can be injected in.

Any help on how I can explore further will be greatly appreciated.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.