reversing-react-native-apps

Reversing React Native Apps

React Native apps are JavaScript wearing a native shell. That is good news — the application logic ships as a bundle you can read — unless the bundle was compiled to Hermes bytecode, in which case you need a decompiler and the version compatibility problem becomes the whole task.

When to Use

• jadx shows ReactActivity, ReactNativeHost, and little application logic
• The APK contains assets/index.android.bundle or lib/*/libhermes.so
• The IPA contains main.jsbundle
• You need to find API endpoints, secrets, or business logic in an RN app
• You need to patch or hook JavaScript-level behaviour

When NOT to Use

• Flutter (libapp.so, libflutter.so) — use reversing-flutter-apps
• Unity (global-metadata.dat) — use reversing-unity-il2cpp
• Native Java/Kotlin apps — use testing-mobile-applications
• Native modules written in C/C++ — use analyzing-binaries

Identify the Bundle Format

This one check decides whether the job takes ten minutes or a day.

unzip -j target.apk 'assets/index.android.bundle' -d ./out
file ./out/index.android.bundle
xxd ./out/index.android.bundle | head -2

First bytes	Format	Path
Readable JS (var __BUNDLE_START, __d(function)	Plain JavaScript	Beautify and read directly
Binary, Hermes magic (c6 1f bc 03 little-endian)	Hermes bytecode	Decompile — see below

# Plain bundle: beautify, then it reads like any minified web app
npx js-beautify index.android.bundle -o bundle.js
rg -n 'https?://|api[_-]?key|Bearer |secret|token' bundle.js | head -50

A plain bundle is a gift. Module boundaries survive as __d(function(...) registrations, source maps are occasionally shipped by mistake (index.android.bundle.map — always check), and the whole application logic is in front of you.

Hermes Bytecode

Hermes compiles JS to its own bytecode (HBC). The bytecode version is embedded in the header and changes with React Native releases, which is the single biggest practical obstacle: a tool that supports HBC 74 will refuse or misparse HBC 96.