V8 字节码分析，简单写写在前辈们的基础上，又遇到些什么问题（绝对不是我水不出很长的文章的问题）

（如有错漏，敬请指正，因为是在弄完后过了很久才写的）

我的blog：blog.dorimu.cn

---

0x00 前言

拿到一个需要逆向分析的 JS start.js。

目标环境：

• Node.js：16.14.0

• 对应 V8：9.4.146.24-node.20（flag hash ed0ab240）

核心代码如下：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149

const vm = require('vm');   const v8 = require('v8');   const zlib = require('zlib');   const fs = require('fs');   const path = require('path');   const Module = require('module');   v8.setFlagsFromString('--no-lazy');   v8.setFlagsFromString('--no-flush-bytecode');   global.generateScript=function(cachedData, filename) {      cachedData = zlib.brotliDecompressSync(cachedData);      fixBytecode(cachedData);      const length = readSourceHash(cachedData);      let dummyCode = '';      if (length > 1) {            dummyCode = '"' + '\u200b'.repeat(length - 2) + '"';      }      const script = new vm.Script(dummyCode, {            cachedData,            filename      });      if (script.cachedDataRejected) {            throw new Error('');      }      return script;   }   global.compileCode = function(javascriptCode, compress) {      const script = new vm.Script(javascriptCode, {            produceCachedData: true      });      let bytecodeBuffer = (script.createCachedData && script.createCachedData.call) ?            script.createCachedData() :            script.cachedData;      if (compress) bytecodeBuffer = zlib.brotliCompressSync(bytecodeBuffer);      return bytecodeBuffer;   };   global.fixBytecode = function(bytecodeBuffer) {      const dummyBytecode = compileCode('');      dummyBytecode.subarray(12, 16).copy(bytecodeBuffer, 12);   };   global.readSourceHash = function(bytecodeBuffer) {      return bytecodeBuffer.subarray(8, 12).reduce((sum, number, power) => sum += number * Math.pow(256, power), 0);   };   try {      Module._extensions['.jsc'] = function(fileModule, filename) {            const data = fs.readFileSync(filename, 'utf8')            const bytecodeBuffer = Buffer.from(data, 'base64');            const script = generateScript(bytecodeBuffer, filename);                function require(id) {               return fileModule.require(id);            }            require.resolve = function(request, options) {               return Module._resolveFilename(request, fileModule, false, options);            };            if (process.main) {               require.main = process.main;            }            require.extensions = Module._extensions;            require.cache = Module._cache;            const compiledWrapper = script.runInThisContext({               filename: filename,               lineOffset: 0,               columnOffset: 0,               displayErrors: true            });            const dirname = path.dirname(filename);            const args = [               fileModule.exports, require, fileModule, filename, dirname, process, global            ];            return compiledWrapper.apply(fileModule.exports, args);      };   } catch (ex) {      console.error('xrequire:' + ex.message);   }   require("${codeScript}")

经过搜索资料发现：

这就是V8 cachedData / bytenode 方案。

---

0x01 第一次尝试：View8

定位到 bytecode 后，我先上了 View8：

a5eK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6K6N6h3I4W2M7X3q4E0i4K6u0r3g2X3W2W2N6K6R3`.

然后配套 9.4.146.24.exe 去跑反编译。

发现问题：

• 输出一点代码后自动崩溃退出。

• View8 因 d8 崩溃只导出 23 个外围函数，关键的函数基本丢失。

当时第一反应是项目太久没维护，又去github找别的项目。

---

0x02 第二次尝试：jsc2js

又看了 jsc2js：

90dK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6^5M7i4V1J5x3o6l9$3i4K6u0r3K9Y4y4U0x3X3A6K6

这个仓库新一些，也有 patch + CI 体系。

把 patch 套到 v8 9.4.146.24，结果仍然和第一轮差不多。

这时候基本就炸毛了（先躺一会）：

字节码本来就不太好 hook，现成工具又不稳定。

于是查阅相关资料：

• 2f2K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2S2P5h3&6S2K9$3g2&6j5g2)9J5k6h3y4G2L8g2)9J5c8X3q4J5N6r3W2U0L8r3g2K6i4K6u0r3j5%4c8X3i4K6u0r3j5g2)9J5k6s2q4#2K9h3y4C8i4K6u0V1k6%4g2A6k6r3g2Q4x3X3c8@1L8#2)9J5k6r3c8A6M7$3q4K6M7$3g2E0j5X3I4W2i4K6u0V1N6U0S2Q4x3X3c8T1P5i4c8W2j5$3!0V1k6g2)9J5c8R3`.`.

• 501K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6J5j5$3g2Q4x3X3g2E0L8$3g2Q4x3V1j5J5x3o6t1#2i4K6u0r3x3o6q4Q4x3V1j5H3y4#2)9J5c8Y4j5^5i4K6u0V1j5Y4W2@1k6h3y4G2k6r3g2Q4x3X3c8V1k6h3y4G2L8i4m8A6L8r3g2J5i4K6u0r3

V8 bytecode 就是 V8 自己序列化的一段内部数据。

想稳定拿结果，必须回到 V8 源码层改输出逻辑。

不同 V8 版本在字节码层差异很大，尤其是 opcode、参数语义、寄存器布局。

---

0x03 第三次尝试：拉 V8 仓库

@echo off

set PATH=E:\Dev\SDKs\depot_tools;%PATH%

set DEPOT_TOOLS_WIN_TOOLCHAIN=0



mkdir v8_941

cd v8_941



echo solutions = [{ > .gclient

echo   "name": "v8", >> .gclient

echo   "url": "452K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0K9s2u0G2L8h3W2#2L8g2)9J5k6h3N6G2L8$3N6D9k6i4y4G2N6i4u0U0k6g2)9J5k6h3y4G2L8g2)9J5c8Y4j5^5i4K6u0r3N6U0S2Q4x3X3g2Y4K9i4c8Q4y4o6l9&6i4K6u0W2y4q4)9J5k6e0p5@1y4W2)9J5k6e0t1@1", >> .gclient

echo   "deps_file": "DEPS", >> .gclient

echo   "managed": False, >> .gclient

echo   "custom_deps": {}, >> .gclient

echo }] >> .gclient



git clone --depth=1 --branch 9.4.146.24 423K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0K9s2u0G2L8h3W2#2L8g2)9J5k6h3N6G2L8$3N6D9k6i4y4G2N6i4u0U0k6g2)9J5k6h3y4G2L8g2)9J5c8Y4j5^5i4K6u0r3N6U0S2Q4x3X3g2Y4K9i4b7`. v8

gclient sync -D --no-history

---

0x04 patch + 编译参数

先patch，再单独构建 d8：

cd /d <dir>\v8_941\v8

python ..\..\apply_patches_v8_94.py .

gn gen out/release

ninja -C out/release d8

构建参数：

dcheck_always_on = false

is_clang = false

is_component_build = false

is_debug = false

target_cpu = "x64"

use_custom_libcxx = false

v8_monolithic = true

v8_use_external_startup_data = false

v8_static_library = true

v8_enable_disassembler = true

v8_enable_object_print = true

treat_warnings_as_errors = false

v8_enable_pointer_compression = false

v8_enable_31bit_smis_on_64bit_arch = false

v8_enable_lite_mode = false

v8_enable_i18n_support = true

v8_enable_webassembly = true

---

0x05 改动阶段

真男人就要硬刚v8，部分diff我就不贴出来了，把问题和思路贴一下，欸嘿~

---

0x06 问题一：cachedData 反序列化被拒绝

CodeSerializer::Deserialize 默认会严检 magic/version/flags/hash/checksum/source hash。

如果任何一项没通过，它会直接 reject 掉这份缓存，返回空对象。

src/snapshot/code-serializer.cc：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

@@ SerializedCodeData::SanityCheck   -  SanityCheckResult result = SanityCheckWithoutSource();   -  if (result != CHECK_SUCCESS) return result;   -  ...   -  return CHECK_SUCCESS;   +  return SerializedCodeData::SanityCheckResult::CHECK_SUCCESS;       @@ SerializedCodeData::SanityCheckWithoutSource   -  if (this->size_ < kHeaderSize) return INVALID_HEADER;   -  uint32_t magic_number = GetMagicNumber();   -  if (magic_number != kMagicNumber) return MAGIC_NUMBER_MISMATCH;   -  ...   -  if (Checksum(ChecksummedContent()) != c) return CHECKSUM_MISMATCH;   -  return CHECK_SUCCESS;   +  return SerializedCodeData::SanityCheckResult::CHECK_SUCCESS;

src/snapshot/deserializer.cc：

1 2 3 4 5 6 7 8 9 10 11 12 13

@@ Deserializer<IsolateT>::Deserializer   -  CHECK_EQ(magic_number_, SerializedData::kMagicNumber);   +  /*   +  CHECK_EQ(magic_number_, SerializedData::kMagicNumber);   +  */   @@ ReadSingleBytecodeData   +  std::fprintf(stderr, "[FATAL] Unknown serializer bytecode: 0x%02x\n", data);

---

0x07 问题二：反汇编/打印阶段栈溢出

这里就是之前view8打印不出来的主要问题：

1. BytecodeArray::Disassemble

2. 打常量池

3. 命中 SharedFunctionInfo

4. SharedFunctionInfoPrint

5. 再次 Disassemble

6. 深度叠加，最终栈爆

• 改动：TLS guard + SEH

src/diagnostics/objects-printer.cc：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19

+thread_local int g_in_bytecode_disasm = 0;   ...   +  ++g_in_bytecode_disasm;   +  hbc->Disassemble(*(c->os));   +  --g_in_bytecode_disasm;   @@ SharedFunctionInfoPrint   -  PrintSourceCode(os);   +  // PrintSourceCode(os);   +  int exc = SehWrapCall(DoBcDisasm, &ctx);   +  if (exc != 0) { os << "<BytecodeArray Disassemble CRASHED ...>"; }

src/objects/objects.cc：

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

+extern thread_local int g_in_bytecode_disasm;   +void SafePrintSharedFunctionInfo(...);   +void SafePrintFixedArray(...);   ...    case SHARED_FUNCTION_INFO_TYPE:   +  if (g_in_bytecode_disasm > 0) { break; }   +  SafePrintSharedFunctionInfo(shared, os);    case FIXED_ARRAY_TYPE:   +  SafePrintFixedArray(FixedArray::cast(*this), os);

• 对应：d8 入口改成 BFS 平铺

src/d8/d8.cc：

1 2 3 4 5 6 7 8 9 10 11

+void Shell::LoadBytecode(...)   +std::deque<i::Handle<i::SharedFunctionInfo>> queue;   +std::unordered_set<i::Address> seen;   +while (!queue.empty()) { ... }   +global_template->Set(isolate, "loadBytecode",   +                     FunctionTemplate::New(isolate, LoadBytecode));

---

0x08 稳定性

修 Handle 生命周期和字节码迭代稳定性

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

-        i::HandleScope inner_scope(isolateInternal);   +        // No inner HandleScope here — child handles stored in queue/all_sfis   +        // must survive across iterations. outer_scope keeps them all alive.   ...   -            i::BytecodeArray handle_storage = *hbca;   -            i::Handle<i::BytecodeArray> handle(   -                reinterpret_cast<i::Address*>(&handle_storage));   -            i::interpreter::BytecodeArrayIterator iterator(handle);   +            // Use hbca directly — it's a proper Handle rooted in print_scope.   +            i::interpreter::BytecodeArrayIterator iterator(hbca);   ...   +                // Re-derive base_address each iteration (GC-safe)   +                i::Address base_address = hbca->GetFirstBytecodeAddress();

调试可见性 + SFI 入队条件

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

+    printf("[DBG] root SFI ptr = 0x%p\n", reinterpret_cast<void*>(root->ptr()));   +    printf("[DBG] root HasBytecodeArray = %d\n", root_has_bc);   ...   +            printf("[DBG]   cp[%d] raw=0x%p smi=%d\n", cp_index,   +                   reinterpret_cast<void*>(obj.ptr()), obj.IsSmi());   ...   -            if (obj.IsSharedFunctionInfo()) {   +            if (!obj.IsSmi() && obj.IsSharedFunctionInfo()) {

---

常量池可读性增强

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

+const int kMaxLiteralElementsToPrint = 1024;   +std::function<void(i::Object, int)> print_compact_obj;   ...   +if (value.IsArrayBoilerplateDescription()) { ... }   +if (value.IsFixedArray()) { ... }   +if (value.IsFixedDoubleArray()) { ... }   ...   +print_compact_obj(obj, 0);

---

其它

src/objects/string.cc：

1 2 3 4 5 6 7 8 9

-if (len > kMaxShortPrintLength) {   +// if (len > kMaxShortPrintLength) {   ...   -accumulator->Add("%c", c);   +accumulator->Add("\\u%04x", c);

---

0x09 将反编译结果初步还原成可读js

• 喂给 jsc2js/View8（这里你可能要手动改一下，懒得贴了），我记得好像还要处理一下常量池？

---

来来回回折腾了三天 hhhhhhh

写完跑路