Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

the javascript runtime ( JSRT ) project

  • javascript runtime for windows , based on chakra
  • author: TinySec( @TinySecEx )
  • JSRT is friend for binary hacker , special for windows.
  • this version is a public new version , feel free to open issue.
  • always download the latest version.


host type

filename host arch usage
js.exe console i386 js.exe [options] [--eval script or script.js] [arguments]
js64.exe console amd64 js64.exe [options] [--eval script or script.js] [arguments]
jsw.exe window i386 jsw.exe [options] [--eval script or script.js] [arguments]
jsw64.exe window amd64 jsw64.exe [options] [--eval script or script.js] [arguments]
jsida.plw IDA i386 [options] [--eval script or script.js] [arguments]
jsida.p64 IDA amd64 [options] [--eval script or script.js] [arguments]
jswd.dll windbg i386 !js [options] [--eval script or script.js] [arguments]
jswd64.dll windbg amd64 !js [options] [--eval script or script.js] [arguments]
jsk.sys kernel i386 TODO , support kernel access
jsk64.sys kernel amd64 TODO , support kernel access

notice that , all other dll files under i386/amd64 is just optional

just compatible to my first version.

native support feature

  • real native multi-thread support
  • 64-bit number
  • Buffer
  • host full memory access , and support both GC and manual memory manager.
  • c-like printf and sprintf
  • ffi , support some windows type , full windows api access
  • serialize and unserialize
  • re-entry support for windbg and ida mode
  • portable from windows xp ~ windows 10 rs2
  • small dist.
  • anything you want for binary hack.


  • firefox style ctypes
  • c-style struct and union handle
  • kernel support
  • more documents.


Usage: js [options] [--eval script or script.js] [arguments]

 --version	show version
 --verbose	verbose mode
 --help		show help
 --eval		eval mode

JSRT_SYSTEM_MODULE_PATH		system jsrt module search path
JSRT_MODULE_PATH		common jsrt module search path
JSRT_IDA_MODULE_PATH		jsrt-ida module search path
JSRT_WINDBG_MODULE_PATH		jsrt-windbg module search path

more info is at


xp ~ win10 rs2 support


real multi thread support


visual studio debug support( need windows 10 )



enum windows

const ffi = require("ffi");

const printf = require("cprintf").printf;
const sprintf = require("cprintf").sprintf;
const KdPrint = require("cprintf").KdPrint;

var hUser32 = ffi.loadLibrary( "user32.dll" );
var fnEnumWindows = ffi.bindModule( hUser32 ,  "BOOL WINAPI EnumWindows(_In_ void* lpEnumFunc,_In_ LPARAM      lParam); "  );
var fnGetClassNameA = ffi.bindModule( hUser32 ,  "int WINAPI GetClassNameA(_In_  HWND   hWnd,_Out_ LPTSTR lpClassName,_In_  int    nMaxCount);"  );

// BOOL CALLBACK EnumWindowsProc(_In_ HWND   hwnd,_In_ LPARAM lParam);
function enumRoutine( hWnd , lParam )
	var lpClassNameA = Buffer.alloc( 250 ).fill( 0 );

	var nRet = 0;
	nRet = fnGetClassNameA( hWnd , lpClassNameA , 250 );
	printf("0x%p -> %s|\n" , hWnd  , lpClassNameA.toString() );;

	return true;

function main(  )
	var lpEnumFunc = ffi.thunk( enumRoutine , "BOOL CALLBACK EnumWindowsProc(_In_ HWND   hwnd,_In_ LPARAM lParam);"   );

	fnEnumWindows( lpEnumFunc  , 0 );;
	return 0;

if ( !module.parent )

and you will got

0x0001014A -> ForegroundStaging|
0x00010176 -> ForegroundStaging|
0x000100FC -> tooltips_class32|
0x00010100 -> tooltips_class32|
0x002F0A7E -> Net UI Tool Window|
0x01840922 -> Net UI Tool Window|
0x02A50EF4 -> tooltips_class32|
0x016D0E1A -> UIRibbonStdCompMgr|
0x02A00DCC -> tooltips_class32|
0x010C0DA4 -> tooltips_class32|
0x00890D2E -> tooltips_class32|
0x0001041A -> Chrome_SystemMessageWindow|
0x00010414 -> Base_PowerMessageWindow|
0x00010180 -> IME|
0x00010148 -> IME|
0x0001011C -> IME|
0x02630B5A -> IME|
0x015A074C -> IME|


JSRT project had two version ,

  • the pre-version is self use , not-published , it was written between 2015-07 ~ 2016-09
  • the current version is going to public release , support some compatible to other bindings.

the pre-version is used for kernel fuzz ( self use , not-published)

javascript kernel fuzz


No releases published


No packages published