New Research: Deterministic Decompilation of Hermes Bytecode Back to Readable JavaScript

By: PRLog

July 20, 2026 at 17:50 PM EDT

ⓘ This article is third-party content and does not represent the views of this site. We make no guarantees regarding its accuracy or completeness.

Research introduces a deterministic, auditable pipeline that reconstructs control flow and Metro modules, validated by round-trip re-execution across 11 compiler versions.

BROOKLYN, N.Y. - July 20, 2026 - PRLog -- Symbiotic Security today announced new research and an open-source tool for deterministic decompilation of Hermes bytecode, the format used by React Native applications in production builds. The decompiler recovers readable JavaScript, including structured control flow, module boundaries, and identifiers, with deterministic output designed for security review.

Find the full research paper here https://hubs.ly/Q04pLtpM0

The research reports coverage across 60 Hermes bytecode versions (HBC 40 to 99) and validation via a public round-trip corpus that recompiles and re-executes decompiled programs across 11 compiler versions, with all 359 programs producing identical output.

"Security reviewers need output they can audit," said a security researcher at Symbiotic Security. "We built a deterministic pipeline so the same bundle yields the same output and every construct can be traced back to the binary."

The tool which can be accessed here https://github.com/SymbioticSec/hermes-decomp has been used in penetration testing and capture-the-flag challenges, helping reviewers reach relevant code paths in large bundles.

About the research
The research addresses a long-standing gap in mobile app security review. Most React Native apps ship their JavaScript compiled into Hermes bytecode, a compact binary format that strips out variable names and file boundaries, leaving security reviewers with raw instructions instead of readable code. Symbiotic Security's decompiler reconstructs that code: it rebuilds loops and conditionals, restores the original module structure, and recovers function names directly from the binary while clearly flagging any names it infers.

Because the approach is rule-based rather than AI-generated, the same app always produces the same output, and every line can be traced back to the binary, a property security audits depend on.

The tool spans 60 bytecode versions (React Native releases from 2019 to 2026) and is validated by a public test suite of 359 programs that all re-execute identically.

Resources

Research paper download: https://hubs.ly/Q04pLtpM0
GitHub repository: https://hubs.ly/Q04q0SwP0

Contact
Symbiotic Security
***@symbioticsec.ai

Photos: (Click photo to enlarge)

Source: Symbiotic Security

Read Full Story - New Research: Deterministic Decompilation of Hermes Bytecode Back to Readable JavaScript | More news from this source

Press release distribution by PRLog

Report this content

If you believe this article contains misleading, harmful, or spam content, please let us know.

Report this article

Symbol	Price	Change (%)
AMZN	271.58	+36.08 (15.32%)
AAPL	308.91	-24.52 (-7.35%)
AMD	476.15	-9.24 (-1.90%)
BAC	61.95	+0.22 (0.36%)
GOOG	356.65	+22.97 (6.88%)
META	556.71	+17.68 (3.28%)
MSFT	464.72	+13.62 (3.02%)
NVDA	200.75	+5.71 (2.93%)
ORCL	129.87	+2.31 (1.81%)
TSLA	311.21	+2.36 (0.76%)

New Research: Deterministic Decompilation of Hermes Bytecode Back to Readable JavaScript

More News

Recent Quotes