How to get JavaScript bytecode from Node.js and V8 in 2019

Drag13
3 min readApr 8, 2019

--

Have you ever thought about how your javascript code looks like in bytecode? If yes, just follow the white rabbit.

Install latest Node.js or check your current version using -v command. If it’s 8.3 or above, everything is OK. If no, check the second part of this article.

Then run your code with a flag “--print-bytecode”. It will instruct the Node to display the bytecode directly to your console.

Try this example:

node --print-bytecode --eval 1+1

After executing you will see a very long list with a code like this:

Parameter count 2
Register count 3
Frame size 24
12 E> 000002252055F082 @ 0 : a5 StackCheck
33 S> 000002252055F083 @ 1 : 0b LdaZero
000002252055F084 @ 2 : 26 fb Star r0
...

If you are curious about what it is and how to read this — here is a good point to start.

But what if you want to see only some part of the code, let’s say some function? Luckily, we have one more flag to filter bytecode by function’s name “--print-bytecode-filter”.

node --print-bytecode --print-bytecode-filter=func_name my_javascript_file

I also pointed Node.Js to read code from my_javascript_file instead of evaluation. Another useful thing is that you can dump the result into another file with pipe operator (for PowerShell), so the final command can look like this:

node --print-bytecode --print-bytecode-filter=func_name my_javascript_file > result.txt

And that’s it — really simple, I would say! But some times, we need to go a bit deeper.

First thing is that when you use Node, you always use production build which is reasonable. But in the release version, some interesting flags are hidden from us. For example, you can’t get AST tree, you get a shorter version of the bytecode (yes, it can be even more detailed). So, if you want to get all the power, you should get a debug version of Node.Js.

Another interesting moment is that guys from Node.js did a really awesome job and split Node.js out from the engine. This means that in real life, your Node can use not V8 from Google team, but Chakra engine from Microsoft or SpiderMonkey or even something else! And you might want to see bytecode from a selected engine.

For quite a long time before, to achieve this you had to download all related source code for the engine you wanted and compile it by yourself. This has been a real pain, especially for Windows users. But, times changed and thanks to the jsvu team, we`ve got a really simple way to get any engine we need, even a debug version for V8. Thanks, guys, you are really awesome!

So, let’s say you want to get V8’s debug version, or maybe, Chakra. All you need is to run this simple command:

npx jsvu

And that’s all! You will be prompted with a few questions (about OS, engines you want to get, etc) and then you will get all already built and ready engines you want! Isn’t that awesome?

More Useful flags

--print-code --print-code-verbose // prints even more information for the code but has no filter for function name--print-opt-code/--print-opt-code-filter // prints optimized code (really hard to read)--trace-turbo/--trace-turbo-filter // prints optimization filter for TurboFan compiler--print-ast // prints Abstract Syntax Tree from your code (v8-debug only)

If you want to see all the flags available for v8 and v8-debug, just check the links above. (Applicable for V8 v7.5.203)

Useful links

That’s it guys, thanks for your time, hope you found this fun enough.

Check my blog for the new updates

--

--

Drag13

Senior Software Developer. Working with .NET and TypeScript. Interested in #websecurity, love #webperformance