PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How we bypassed bytenode and decompiled Node.js bytecode in Ghidra

swarm.ptsecurity.com | research | #reverse-engineering | #ghidra | #v8 | #nodejs
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part one of the ghidra_nodejs series: the V8 bytecode format and the bytenode scheme used to ship serialized .jsc binaries, and how the plugin parses, disassembles and decompiles them so otherwise opaque server-side JavaScript can be audited for vulnerabilities.
Published
Collected

Related coverage

research · swarm.ptsecurity.com
Creating a Ghidra processor module in SLEIGH using V8 bytecode as an example
How PT SWARM built a Ghidra processor module in SLEIGH for V8 bytecode, gaining readable disassembly and a C-like decompiler for Node.js bytecode — covering the constant pool, p-code injections, analyzers and loaders that make the module work.
research · swarm.ptsecurity.com
Decompiling Node.js in Ghidra
Behind ghidra_nodejs: decompiling bytenode-protected Node.js applications in Ghidra by parsing the constant pool, function arguments and exception handlers, supporting all JSC opcodes including wide/extra-wide, and resolving cross-references even in obfuscated code.
tool · github.com
SuperGhidra: High-Performance Python Suite for Accelerated Ghidra Reverse Engineering
Drastically accelerates automated binary analysis and provides reliable mathematical verification for neural decompilers, bridging traditional reverse engineering with AI-driven workflows.
research · swarm.ptsecurity.com
Guide to P-code Injection: Changing the intermediate representation of code on the fly in Ghidra
A guide to Ghidra's p-code injection mechanism: for opcodes that are impractical to express in SLEIGH, Java callbacks can generate p-code dynamically at analysis time — illustrated by implementing V8's variable-argument CallRuntime opcode in the ghidra_nodejs plugin.
research · theori.io
A Deep Dive into V8 Sandbox Escape Technique Used in In-The-Wild Exploit
How Theori escaped the V8 sandbox by abusing a raw pointer in the WasmIndirectFunctionTable object to gain arbitrary write and code execution, plus patch analysis of related sandboxification commits.
research · portswigger.net
Server-side prototype pollution: Black-box detection without the DoS
Safe black-box detection methods for server-side prototype pollution that avoid breaking the server: encoding tricks, JSON spaces, exposed headers and other signals, shipped as a Burp extension.
Back