Hermes
Hermes - JS Engine. ΠΠ΅ΡΠ΅Π³ΠΎΠ½ΡΠ΅Ρ jS Π² Π±Π°ΠΉΡΠΊΠΎΠ΄ ΠΈ ΠΎΡ ΡΡΠΎΠ³ΠΎ Π²ΡΠ΅ ΡΠ°Π±ΠΎΡΠ°Π΅ Π±ΡΡΡΡΠ΅Π΅
https://facebook.github.io/react-native/docs/hermes release Π±ΠΈΠ½Π°ΡΠΈ: https://github.com/facebook/hermes/releases
Π ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΈ Π² React Native ΠΏΡΠΎΠ΅ΠΊΡ https://facebook.github.io/react-native/docs/hermes
ΠΡΠ»ΠΈΡΠΈΠ΅ ΠΎΡ React Native Π² ΡΠΎΠΌ, ΡΡΠΎ index.android.bundle Π±ΡΠ΄Π΅Ρ ΡΠ΅ΡΠΈΠ°Π»ΠΈΠ·ΠΎΠ²Π°Π½ (Π±ΠΈΠ½Π°ΡΡΠΈΠ½Π°)
$ hermes -b --dump-bytecode index.android.bundle
Error deserializing bytecode: Wrong bytecode version. Expected 74 but got 62%
$ hermes -version
74
ΠΡΡΡ Π½Π΅ΡΠΊΠΎΠ»ΡΠΊΠΎ ΡΠ΅Π»ΠΈΠ·ΠΎΠ² hermes:
v0.8.0 - 83
v0.5.0 - 74
v0.3.* - 72
v0.2.1 - 62
Tools
ΠΎΡ Π±ΠΈΠ½Π°ΡΠΈ ΠΌΠΎΠΆΠ½ΠΎ Π½Π°ΠΉΡΠΈ ΠΏΠΎ ΡΡΡΠ»ΠΊΠ΅: https://github.com/facebook/hermes/releases
Π’ΡΠ΄Π° Π²Ρ ΠΎΠ΄ΡΡ:
hbcdump
hdb
hermes
hermesc
hvm
hermes
ΠΠ°ΠΏΡΡΠΊ JS-ΠΊΠΎΠ΄Π°:
$ hermes test.js
Compiling and Executing JavaScript with Bytecode:
$ hermes -emit-binary -out test.hbc test.js
$ hermes test.hbc
hbcdump
hbcdump β Hermes bytecode disassembler
$ ./hbcdump -objdump-disassemble index.android.bundle
hbcdump> dis 234
d0310a88a868dfb1ee21d12e9011725b1f716875: file format HBC-74
Disassembly of section .text:
000000000002ca48 <_0>:
0002ca48: 30 44 08 00 00 DeclareGlobalVar $0x000844
0002ca4d: 30 48 08 00 00 DeclareGlobalVar $0x000848
[...]
hbcdump> quit
ΠΠ½Π°Ρ ID ΡΡΡΠΎΠΊ, ΠΈΠ½ΡΡΡΡΠΊΡΠΈΠΉ, ΡΡΠ½ΠΊΡΠΈΠΉ (ΡΠ΅ΡΠ΅Π· hbctool, Π½Π°ΠΏΡΠΈΠΌΠ΅Ρ), ΠΌΡ ΠΌΠΎΠΆΠ΅ΠΌ ΠΈΠ·ΡΡΠ°ΡΡ ΡΠ°Π±ΠΎΡΡ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡ
./hbcdump -human -mode=function -pretty-disassemble index.android.bundle
hbcdump> help
These commands are defined internally. Type `help' to see this list.
Type `help name' to find out more about the function `name'.
epilogue
filename
at-virtual
block
summary
function
instruction
io
function-info
help
disassemble
string
hbcdump>
hbcdump> help string
Display string for ID
USAGE: string <STRING_ID>
hbcdump> help filename
Display file name for ID
USAGE: filename <FILENAME_ID>
hbcdump> help at-virtual
Display information about the function at a given virtual offset.
USAGE: at-virtual <OFFSET>
hdb
JavaScript command line debugger
hermesc
Standalone Hermes compiler. This can compile JavaScript to Hermes bytecode, but does not support executing it.
hvm
Standalone Hermes VM. This can execute Hermes bytecode, but does not support compiling it.
hbctool
hbctool ΠΠ½ΡΡΡΡΠΌΠ΅Π½Ρ Π΄Π»Ρ Π±ΠΎΠ»Π΅Π΅ ΡΠ΄ΠΎΠ±Π½ΠΎΠ³ΠΎ Π΄ΠΈΠ·Π°ΡΡΠ΅ΠΌΠ±Π»ΠΈΠ½Π³Π° (Π² ΡΡΠ°Π²Π½Π΅Π½ΠΈΠΈ Ρ hbcdump) ΠΈ Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎΡΡΠΈ ΠΏΠ°ΡΡΠΈΠ½Π³Π°.
ΠΠΎΡΠ»Π΅ ΡΠ°ΡΠΏΠ°ΠΊΠΎΠ²ΠΊΠΈ Π±ΡΠ΄Π΅Ρ ΡΡΠΈ ΡΠ°ΠΉΠ»Π°: instruction.hasm (Π΄ΠΈΠ·Π°ΡΡΠ΅ΠΌΠ±Π»ΠΈΡΠΎΠ²Π°Π½Π½ΡΠΉ ΠΊΠΎΠ΄ Π² Π²ΠΈΠ΄Π΅ ΡΡΠ½ΠΊΡΠΈΠΉ Π»ΠΈΡΡΠΈΠ½Π³ΠΎΠΌ), metadata.json (ΡΠΎΠ΄Π΅ΡΠΆΠΈΡ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΡ, Π³Π΄Π΅ Π½Π°Ρ ΠΎΠ΄ΡΡΡΡ ΠΊΠ°ΠΊΠΈΠ΅ ΡΡΠ½ΠΊΡΠΈΠΈ ΠΈ ΡΠΏ), string.json (ΡΡΡΠΎΠΊΠΈ ΠΈ ΠΈΡ ID).
pip install hbctool
(hack) bongtrop@bongtrop-pc:lab/ $ hbctool disasm HermesReversingLab/assets/index.android.bundle HermesReversingLabHASM
[*] Disassemble 'HermesReversingLab/assets/index.android.bundle' to 'HermesReversingLabHASM' path
[*] Hermes Bytecode [ Source Hash: d0310a88a868dfb1ee21d12e9011725b1f716875, HBC Version: 74 ]
[*] Done
After disassembling HBC (Hermes Bytecode) to HASM (I named it; stands for Hermes Assembly).
In the HermesReversingLabHASM directory, there are 3 files as follows:
metadata.json: stores the important information of Hermes bytecode file
instruction.hasm: stores the application instructions or logics in HASM format (edit application logics in this file)
string.json: store the application strings or texts (edit strings in this file)
Edit the applicationβs instruction in HermesReversingLabHASM/instruction.hasm.
Save the file and assemble HASM to the HBC by using hbctool.
(hack) bongtrop@bongtrop-pc:lab/ $ hbctool asm HermesReversingLabHASM HermesReversingLab/assets/index.android.bundle
[*] Assemble 'HermesReversingLabHASM' to 'HermesReversingLab/assets/index.android.bundle' path
[*] Hermes Bytecode [ Source Hash: d0310a88a868dfb1ee21d12e9011725b1f716875, HBC Version: 74 ]
[*] Done
ΠΈ Π΄Π°Π»Π΅Π΅ ΠΏΠΎΠ΄ΠΏΠΈΡΡΠ²Π°Π΅ΠΌ apk
hermes-dec
ΠΠ½ΡΡΡΡΠΌΠ΅Π½Ρ ΠΎΡ P1sec: https://github.com/P1sec/hermes-dec/
[Frida] Android
ΠΏΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠ΅ ΠΊ ΡΠ΄ΡΡ, ΠΈΡΠΏΠΎΠ»Π½ΠΈΡΡ ΠΊΠΎΠ΄ Π½Π΅ ΡΠΌΠΎΠ³ ΠΏΠΎΠΊΠ°
console.log("[+] Start");
Java.perform(function() {
try {
var ReactInstanceManagerHolder = Java.use('org.jitsi.meet.sdk.ReactInstanceManagerHolder');
console.log("[+] ReactInstanceManagerHolder Found");
var reactInstanceManager = ReactInstanceManagerHolder.getReactInstanceManager(); // com.facebook.react.h
var reactContext = reactInstanceManager.i(); // com.facebook.react.bridge.ReactContext
console.log("[+] Get reactContext");
console.log("[+] test: " + reactContext.hasCurrentActivity());
} catch (err) {
console.log("[-] ReactInstanceManagerHolder Not Found")
}
});
Π‘ΠΎΠΎΡΠ²Π΅ΡΡΡΠ²ΡΡΡΠΈΠΉ ΠΊΠΎΠ΄ Π² ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠΈ
import com.facebook.hermes.reactexecutor.HermesExecutorFactory;
import com.facebook.react.ReactInstanceManager;
// Use the Hermes JavaScript engine.
HermesExecutorFactory jsFactory = new HermesExecutorFactory();
reactInstanceManager
= ReactInstanceManager.builder()
.setApplication(activity.getApplication())
.setCurrentActivity(activity)
.setBundleAssetName("index.android.bundle")
.setJSMainModulePath("index.android")
.setJavaScriptExecutorFactory(jsFactory)
.addPackages(packages)
.setUseDeveloperSupport(BuildConfig.DEBUG)
.setInitialLifecycleState(LifecycleState.RESUMED)
.build();
ΠΡΠΎ Π±ΡΠ»Π° ΠΏΠΎΠΏΡΡΠΊΠ° Π΄ΠΎΠ±ΡΠ°ΡΡΡΡ Π΄ΠΎ jsFactory, ΠΎΠ΄Π½Π°ΠΊΠΎ, Π²ΡΠ΅ ΡΠ°Π²Π½ΠΎ Π½Π΅ ΡΠΌΠΎΠ³ Π½Π°ΠΉΡΠΈ ΠΌΠ΅ΡΠΎΠ΄Ρ, ΡΡΠΎΠ±Ρ ΡΡΠΎ-ΡΠΎ ΠΈΡΠΏΠΎΠ»Π½ΠΈΡΡ Π² ΡΡΠΎΠΌ ΠΊΠΎΠ½ΡΠ΅ΠΊΡΡΠ΅. ΠΠ°ΡΠΈΠ°Π½Ρ Π΄Π°Π»Π΅Π΅ - ΡΠ°Π·ΠΎΠ±ΡΠ°ΡΡΡΡ ΠΊΠ°ΠΊ ΡΠ°Π±ΠΎΡΠ°Π΅Ρ React Debug, ΠΈ ΠΏΠΎΠΏΡΠΎΠ±ΠΎΠ²Π°ΡΡ ΡΡΠΎ-ΡΠΎ ΡΠ°ΠΊΠΎΠ΅ ΡΠ΄Π΅Π»Π°ΡΡ ΠΈΠ· frida.
Last updated
Was this helpful?