v0.2.2

Reconstructs ESM module imports on modern Metro bundles and fixes closure and declaration correctness, on top of v0.2.1.

What's new

• ESM import reconstruction: a dependency required from many functions is no longer emitted as the same import X from "M" line dozens of times, and distinct named imports of one module merge into a single import { a, b } from "M". Each import carries the module id as a comment (import { sendRequest, healthcheck } from "HTTPUtils" /* 530 */) so a module can be remapped to a real path by its stable id. Eager inline module loads (importDefault(530).foo(), require(4137).bar()) repeated at every use site are hoisted into one module level binding, while React Native lazy getters (get: () => require(N).default) are left lazy so lazy loading is preserved.
• Closure and declaration correctness: a captured environment slot is now written and read with the same identifier, so a counter increment no longer read closure_1_0 while writing outer1_0. A nested function again declares its own local (let obj) instead of leaving it undeclared or reassigning a parent const when the name happens to match an ancestor local, which restores tens of thousands of declarations on a large bundle.
• Performance: the whole bundle decompile stays around 90 seconds. The ancestor environment slot map is now precomputed once instead of being rebuilt per function, which had made the output phase quadratic on a 130k function bundle.
• Internals: the pipeline context and the closure resolution and hoisting passes are split into focused modules, and object literals filled incrementally (o[0] = x) collapse to a single literal.

Everything from v0.2.1 is included: the bytecode write path, the analyst tooling (dump tables, disasm --info, callgraph, MCP tools), HBC98 async and generator reconstruction, the self update command, and Metro and ESM module reconstruction.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.2.2-linux-x86_64.tar.gz	ffbe444bc6a9dd260f1d96d26ce5ee1c943103dac96aa99b8a053438e3e3fc9e
hermes-decomp-v0.2.2-macos-arm64.tar.gz	abd9ed574b51a319e01c3510b496b759e08c7a7bb358c2f8ac8e38cb8f6aad47
hermes-decomp-v0.2.2-windows-x86_64.zip	b341a0e660a75b19a46b8ee21ff056568b3659d8a3a564186bfc6fe71811ca6b

v0.2.1

Fixes HBC98 (React Native 0.75+) decompilation correctness and makes whole bundle decompilation scale to large modern bundles, on top of v0.2.0.

What's new

• HBC98 correctness: xref now resolves string operands on the modern 12 byte header layout, where it previously returned zero results. The single function decompile no longer duplicates the receiver in calls (x.indexOf(x, y)) and now matches the whole program output. The TypeOfIs check on v97 and newer is decoded from its type bitmask instead of being misread as a string constant. Staged parameter copies that cross basic blocks are resolved, so an argument is no longer left as a dangling temporary (new URL(tmp) becomes new URL(arg0)).
• Async and generator reconstruction (HBC98): v97 removed the generator opcodes, so function* and async bodies compile to desugared state machines. Linear async and generator bodies are now lifted back into yield and await sequences with their resume values, including conditional early exits between suspend points.
• Performance: decompiling a full modern bundle of about 130k functions previously did not finish within minutes. It now completes end to end in about 90 seconds. This removes quadratic passes in object literal folding, global copy propagation, and the whole program inline body rendering, and fans the render out across cores.

Everything from v0.2.0 is included: the bytecode write path (patch, inject, assemble, create), the analyst tooling (dump tables, disasm --info, callgraph, and the MCP tools), the built in self update command, and Metro and ESM module reconstruction.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.2.1-linux-x86_64.tar.gz	f10c879e5b63c5fbff66fb57a3dc4a4a8ca226197fb4aaeec0ac2ce67100acb3
hermes-decomp-v0.2.1-macos-arm64.tar.gz	35bf62c9e712327f26ad17a63596f934d8ab59da1e3041daaad1006572f2f435
hermes-decomp-v0.2.1-windows-x86_64.zip	8c8bee6894d8cd36a841ffabaa49722182d8c0c741353f04ddd0c2f0d7725d53

v0.2.0

Adds a full bytecode write path (patch, inject, assemble, create), analyst tooling, and a wave of decompilation quality and graph accuracy fixes, on top of v0.1.7.

What's new

• Write path: edit and rebuild .hbc files. patch-string replaces any string of any length, including identifiers with recomputed Jenkins hashes and non ASCII values re encoded as UTF 16. patch-function (and asm) assemble a function body from HASM, growing, shrinking or same size, on both legacy and modern (v97+) headers, with out of line large header relocation for overflowed functions. inject-stub adds a runtime no op or a log on entry. create builds a minimal file from scratch, legacy layout for v96 and lower and modern layout for v97 and newer. Every operation is verified on real Hermes VMs across HBC 74, 76, 83, 84, 89, 96 and 98.
• Analyst tooling: dump gains structural tables (cjs-modules, regexp, obj-shapes, function-sources, string-kinds, sections, big-int, array-buffer) with a --json flag, disasm --info prints a per function metadata banner, and a new callgraph command emits caller to callee edges as text or Graphviz DOT. The MCP server exposes the same analyst tools plus the write path.
• Decompilation quality: better JSX resolution, loop reconstruction for while(true) latches and guarded do-while, const and let inference, closure and factory slot naming, and many JS validity fixes (brackets, IIFE parens, export dedupe). Discord HBC96 quality gaps closed.
• Graph accuracy: the call graph now resolves string operands and indirect globalThis.foo callees, raising resolved caller edges on a real Metro bundle from 2361 to 2789, and the control flow graph no longer emits a phantom trailing block.
• Security: the analysis cache fingerprint is computed at build time from the crate version, source files and embedded tables instead of reading the executable, and the secret scanner test assembles its sample key at runtime. This clears the flagged static analysis findings.

Everything from v0.1.7 is included: the built in self update command, TUI xref navigation, loop reconstruction, function name recovery, HBC >=97 support, Metro and ESM module reconstruction, the on disk analysis cache, and the CLI and MCP analyst tooling.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.2.0-linux-x86_64.tar.gz	bb3fde42a004114c5864b895edb0ca3260ae09a6a5040554a2a6ece70210bb5e
hermes-decomp-v0.2.0-macos-arm64.tar.gz	f31c7ff817c46001795e1492d2151881cb17cf69c74c7961d31acd32ee79e83e
hermes-decomp-v0.2.0-windows-x86_64.zip	340067c6aa27c395a9fa19bf9d2434269a93ef40fd44e7ecfba0aa862cbff544

v0.1.7

Adds a built-in self-update command and clears every cargo-audit advisory, on top of v0.1.6.

What's new

• update command: hermes-decomp update --check shows the latest release and its changelog; hermes-decomp update --install downloads the matching archive from GitHub releases, verifies its SHA-256 against the release SHA256SUMS, and replaces the binary in place. A one-line startup notice is available behind HERMES_DECOMP_UPDATE_CHECK=1. Thanks to @aancw (#13). The updater uses a lightweight synchronous stack (ureq), with no tokio/hyper.
• Security: fixed every cargo-audit advisory. Upgraded rmcp to 2.1 (RUSTSEC-2026-0189, DNS rebinding in the MCP HTTP transport), replaced the unmaintained bincode with rmp-serde for the analysis cache, and bumped vulnerable transitive deps (bytes, crossbeam-epoch, anyhow). cargo audit now reports zero vulnerabilities and zero warnings.

Everything from v0.1.6 is included: TUI xref navigation, loop reconstruction, function-name recovery, HBC >=97 support, Metro/ESM module reconstruction, the on-disk analysis cache, and the CLI/MCP analyst tooling.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.1.7-linux-x86_64.tar.gz	7f6ca00d6c7f026e463e5a4863db6a4a513324c75b23e4c8814f532911a28e10
hermes-decomp-v0.1.7-macos-arm64.tar.gz	a8604130ff578c876d0116a6b1602dbe9faf48ff34406c4d3554cd30d9c87966
hermes-decomp-v0.1.7-windows-x86_64.zip	68e5a34ab0a478fa0b0cd841768e9e2622b530a3ab5391c4b27125c11dac9949

v0.1.6

Adds TUI cross-reference navigation and a round of decompiler output-quality fixes on top of v0.01.5. First release using standard SemVer tags.

What's new

• TUI xref navigation: press g on any function to open a picker of its callees and callers, then Enter to jump to the target (Go to Definition / Find All References for the TUI). Thanks to @aancw (#10).
• Loop reconstruction: array for loops (such as Babel's _defineProperties) that previously decompiled to invalid JavaScript (an orphan break, an undefined counter, a misplaced merge block) are now recovered as valid for (let i = 0; i < n; i++) loops. Bottom-tested while (true) loops are recovered as do/while.
• Function-name recovery: variables assigned a named function value now keep that name (for example _typeof, _getPrototypeOf, _interopRequireDefault) instead of the generic fn. Names come from the bytecode function headers, so they are exact.

Everything from v0.01.5 is included: HBC >=97 support, Metro/ESM module reconstruction, the on-disk analysis cache, the CLI/MCP analyst tooling, TUI content search, and text selection/copy.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.1.6-linux-x86_64.tar.gz	4bf05af194bc067890ce718663b67c5d59fa1e61183142c4686edfb8b3bc03de
hermes-decomp-v0.1.6-macos-arm64.tar.gz	6c3f9c3b33ab180926681393a581a102680704961d385bb05f74d5620b0fe4a0
hermes-decomp-v0.1.6-windows-x86_64.zip	559252a7821cc50e536b152a8923bdbdbf2867c93b051ca12f9c6f045caa086f

v0.01.5

Adds TUI text selection and clipboard copy on top of v0.01.4.

What's new

• TUI text selection and copy: left-click and drag in the content pane (disassembly, decompiled or info) to select text, with a highlight scoped to the pane; on release the selection is copied to the terminal clipboard via OSC 52, so you can paste it elsewhere (works in iTerm2, Kitty, Alacritty, WezTerm, Ghostty). Thanks to @aancw (#9).

Everything from v0.01.4 is included: HBC >=97 support, Metro/ESM module reconstruction, the on-disk analysis cache, the expanded CLI/MCP analyst tooling, and TUI content search.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.01.5-linux-x86_64.tar.gz	f3dff744dc849ea6a6178fcc22e801df2aba10eaa0918df6ccea3f9a6224c02b
hermes-decomp-v0.01.5-macos-arm64.tar.gz	9cc1d3e47104d837c28c667b8a24dd90a835fefc37aab9b4003c246f4e475149
hermes-decomp-v0.01.5-windows-x86_64.zip	c3b08e9fda275a126474986f99f07e1e38a82b7e812b3fb90b7365cf70ba296a

v0.01.4

Adds TUI content search on top of v0.01.3.

What's new

• TUI content search: press s to search within the selected function's rendered view (disassembly, decompiled or info). Matches are highlighted while preserving syntax colors, with Enter/Down/Up to navigate, Esc to exit, and a [1/N] match counter. Thanks to @aancw (#6, #8).

Everything from v0.01.3 is included: HBC >=97 support, Metro/ESM module reconstruction, the on-disk analysis cache, and the expanded CLI/MCP analyst tooling.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.01.4-linux-x86_64.tar.gz	bd0679441679deeb27226f200f6d975afc697920272cfe79c5e56f2bdc633891
hermes-decomp-v0.01.4-macos-arm64.tar.gz	3f28405dad9058fb6d5fc1fe5cc07687b44c85c3ce2c35b9796b73930a27751f
hermes-decomp-v0.01.4-windows-x86_64.zip	16e1ce4b86ab294d7221a0b92a358c124966c9d380638822fb482c5928ca359c

v0.01.3

Feature release: full HBC >=97 (React Native 0.75+) support, Metro/ESM module reconstruction, an on-disk analysis cache, and expanded CLI/MCP analyst tooling (PR #7).

What's new

• HBC >=97 (v97-v99): modern function headers + exception tables (try/catch), function* generators, ES6 classes with super, array destructuring, SSA live-range splitting, and corrected v98/v99 opcode/builtin tables.
• Metro reconstruction & naming: per-module ESM output (import/export), factory-role detection (classic 4-param and modern 7-param), JSX reconstruction, and inter-procedural parameter naming.
• On-disk analysis cache: the whole-program analysis is cached to <input>.hdcache (keyed by a SHA-256 of the bytecode), so repeated runs -- including the TUI and MCP server -- load in ~0.2s instead of re-analyzing.
• CLI/MCP tooling: dump --kind structural tables, callgraph, disasm --info; modules/deps/extract on the full pipeline; MCP server with 21 tools and an optional Streamable HTTP transport.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.01.3-linux-x86_64.tar.gz	60bf2df70992c51cfdfa4b481a7bfe661f702ef4a3fa87ea535d5b0abc403a08
hermes-decomp-v0.01.3-macos-arm64.tar.gz	7c8698d02d41d252ed4efd1f4d02aed8df5fe091cb2bcc29bcf0d8c4616c38e1
hermes-decomp-v0.01.3-windows-x86_64.zip	fd9b19ab55516a5e91e688dc8d37f4b1cf308adaa1b790520dc39b8d12971d9b

v0.01.2

Maintenance release focused on Hermes v96 support and stability (PR #5, fixes #4).

What's fixed

The capacity overflow crash on Hermes v96 bundles is fixed: info, bin-diff and disasm now run cleanly on v96 inputs, and real v96 variable names are recovered. The debug-info header is read correctly (seven u32 fields instead of three), and the bytecode parser is hardened more broadly so malformed or oversized counts fail with a clear error instead of aborting the process.

The TUI also gains a full-program side-by-side diff view (base vs modified, decompiled by default, streamed per function), and the decompile view no longer freezes for several seconds on large bundles. This release upgrades ratatui to 0.30 and removes the unsafe libc SIGPIPE handling flagged by the security scan.

Downloads

Each archive contains the hermes-decomp and hermes-mcp binaries. Verify with shasum -a 256 -c SHA256SUMS.

File	SHA256
hermes-decomp-v0.01.2-linux-x86_64.tar.gz	749d013071d065c001bdb7d0c355c8a585ee6d19993281167d7a4002af5b0c45
hermes-decomp-v0.01.2-macos-arm64.tar.gz	33ae196a405e919383c397f3c071fae7606347cecffbdc0e51036ae1803c2afc
hermes-decomp-v0.01.2-windows-x86_64.zip	5ed4d709205757670f632b18c71b603fde2ef12f7397e34dba69247d6707192b

v0.01.1

Merge pull request #3 from SymbioticSec/fix-windows-build

Fix Windows release build and add cross-platform CI