AwesomeREA.org

Tool

hermes-decomp

Rust decompiler and analysis toolkit for Hermes bytecode (.hbc), the compiled form React Native apps ship for the Hermes engine; the README lists HBC versions 40 to 99. Its hermes-decomp CLI shows file information, disassembles, decompiles whole bundles or single functions to JavaScript, with a slower deep mode that recovers more names, and provides a terminal UI, cross-references, call graphs, control-flow graphs, Metro module and closure views and bytecode diffing. A separate hermes-mcp server exposes the read and analysis functions as MCP tools, and the hbc-decomp crate offers them as a Rust library.

Requirements and limitations

  • Release at review: v0.2.4, published 2026-10-01, which is the reviewed main commit. Its archives contain hermes-decomp and hermes-mcp for Linux x86_64 and ARM64, macOS ARM64 and Windows x86_64, with SHA256SUMS; the README also lists a macOS x86_64 build, which this release lacks. Source builds need Rust 1.70+, and an update command checks for or installs newer releases.
  • Input is a Hermes bytecode file from the user's own React Native app, not a plain-JavaScript bundle. Full-bundle decompilation writes an .hdcache file next to the input unless --no-cache is passed. hermes-mcp uses stdio by default; its HTTP transport listens on 127.0.0.1:8744 unless another host is given, and docs/MCP.md lists only read and analysis tools.
  • Separate CLI write commands assemble or patch bytecode and HASM; they never recompile decompiled JavaScript. USAGE.md reports full write support for HBC 96 and below, verified against the Hermes VM, while HBC 97+ files support only same-length string patches and can be checked only with a macOS helper.
  • CI checks formatting and Clippy, builds on each platform and runs the test suite with corpus-dependent tests skipped; the repository keeps small jsx_cycle .hbc test fixtures. Local gates compile sample snippets with hermesc toolchains that the scripts fetch or build, run the original and decompiled code under Node and compare output, with five known failures listed, and cap unparsable modules per bundle, at 211 for the one recorded bundle, so decompiled output is not always valid JavaScript.
  • MIT license. No bytecode was decompiled or patched, and the MCP server was not run.

About this entry

Type
Tool
Category
Android tools
Relationship
Foundation tool
Targets
App

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  2. docs/USAGE.md GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  3. docs/USAGE.md#L99-L152 GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  4. docs/MCP.md GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  5. docs/LIBRARY.md GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  6. Cargo.toml GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  7. .github/workflows/build.yml GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  8. scripts/build/roundtrip.sh GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  9. scripts/build/roundtrip_known_failures.tsv GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  10. scripts/build/gates.sh GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  11. scripts/build/syntax_baseline.tsv GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  12. LICENSE GitHub · SymbioticSec/hermes-decomp · Revision ad4c924
  13. https://github.com/SymbioticSec/hermes-decomp/releases/tag/v0.2.4