PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Decompiling Node.js in Ghidra

swarm.ptsecurity.com | research | #reverse-engineering | #ghidra | #research | #nodejs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Behind ghidra_nodejs: decompiling bytenode-protected Node.js applications in Ghidra by parsing the constant pool, function arguments and exception handlers, supporting all JSC opcodes including wide/extra-wide, and resolving cross-references even in obfuscated code.
Published
Collected

Related coverage

research · swarm.ptsecurity.com
How we bypassed bytenode and decompiled Node.js bytecode in Ghidra
Part one of the ghidra_nodejs series: the V8 bytecode format and the bytenode scheme used to ship serialized .jsc binaries, and how the plugin parses, disassembles and decompiles them so otherwise opaque server-side JavaScript can be audited for vulnerabilities.
tool · github.com
SuperGhidra: High-Performance Python Suite for Accelerated Ghidra Reverse Engineering
Drastically accelerates automated binary analysis and provides reliable mathematical verification for neural decompilers, bridging traditional reverse engineering with AI-driven workflows.
research · swarm.ptsecurity.com
Guide to P-code Injection: Changing the intermediate representation of code on the fly in Ghidra
A guide to Ghidra's p-code injection mechanism: for opcodes that are impractical to express in SLEIGH, Java callbacks can generate p-code dynamically at analysis time — illustrated by implementing V8's variable-argument CallRuntime opcode in the ghidra_nodejs plugin.
research · swarm.ptsecurity.com
Creating a Ghidra processor module in SLEIGH using V8 bytecode as an example
How PT SWARM built a Ghidra processor module in SLEIGH for V8 bytecode, gaining readable disassembly and a C-like decompiler for Node.js bytecode — covering the constant pool, p-code injections, analyzers and loaders that make the module work.
research · portswigger.net
Server-side prototype pollution: Black-box detection without the DoS
Safe black-box detection methods for server-side prototype pollution that avoid breaking the server: encoding tricks, JSON spaces, exposed headers and other signals, shipped as a Burp extension.
research · portswigger.net
Exploiting prototype pollution in Node without the filesystem
A new SSPP exploitation technique: Node's --import flag accepts data: URLs, so polluting NODE_OPTIONS runs arbitrary code without touching the filesystem; Node considers this out of scope.
Back