Research Release: Deterministic Decompilation of Hermes Bytecode

TL;DR

We built a deterministic decompiler that turns Hermes bytecode (HBC) back into readable JavaScript. It recovers control flow, reconstructs Metro modules, and assigns identifiers, marking which names it read from the binary and which it inferred from usage.

The problem

Most React Native apps don’t ship readable JavaScript. During the build, Hermes precompiles your JS into a versioned binary format called Hermes bytecode (HBC), and that binary ships inside the app. The app starts faster, but open a production bundle for review and you’ll see raw opcodes. Existing tools stop at disassembly: they show you each instruction and leave you to piece the logic together by hand. Most audits stall there.

What’s new

1. Deterministic output security reviewers can audit
2. Coverage across 60 Hermes bytecode versions (HBC 40 to 99)
3. Control-flow structuring that handles Hermes loop inversion
4. Metro module reconstruction into ECMAScript modules with imports and exports
5. Validation via a public round-trip corpus (359 programs, all passing)

How it works

The decompiler runs a five-stage pipeline:

1. Parsing: the decompiler reads the binary HBC file and extracts headers, string tables, and raw bytecode instructions.
2. Disassembly: it turns the raw bytes into readable opcodes (Mov, Call, Add, and so on).
3. IR generation: it lifts the bytecode into a high-level intermediate representation, mapping registers to variables and analyzing jumps to build a control-flow graph.
4. Analysis and transformation: constant and copy propagation clean up the code, structure recovery rebuilds if, while, and for from the graph, and pattern matching detects classes, async functions, and generators.
5. Code generation: it emits the optimized representation as valid JavaScript.

It ships as both a command-line tool and an MCP server, so you can run it by hand or wire it into an AI-assisted analysis workflow.

Read the full paper

• Download the paper: https://hubs.ly/Q04pLtpM0

Get the code

• GitHub repository: https://github.com/SymbioticSec/hermes-decomp

What this changes for security review

Hermes bytecode is how most React Native apps ship, and reviewers have had to stop at disassembly. Readable, deterministic output lets you audit the recovered code and trace each construct back to the binary.

CTA

If you want help analyzing React Native apps or integrating decompilation into your workflow, talk to Symbiotic Security: https://symbioticsec.ai/contact