---
id: 5122
title: "How we bypassed bytenode and decompiled Node.js bytecode in Ghidra"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/how-we-bypassed-bytenode-and-decompiled-node-js-bytecode-in-ghidra/"
published_at: "2021-05-13T16:03:35Z"
tags: ["reverse-engineering", "ghidra", "v8", "nodejs"]
phying_url: "https://phying.com/item/5122"
lang: en
---

# How we bypassed bytenode and decompiled Node.js bytecode in Ghidra

## Summary

Part one of the ghidra_nodejs series: the V8 bytecode format and the bytenode scheme used to ship serialized .jsc binaries, and how the plugin parses, disassembles and decompiles them so otherwise opaque server-side JavaScript can be audited for vulnerabilities.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2021-05-13T16:03:35Z
- **Original:** https://swarm.ptsecurity.com/how-we-bypassed-bytenode-and-decompiled-node-js-bytecode-in-ghidra/
- **Phying News:** https://phying.com/item/5122