Rerius JavaScript API

Node.js native addon and REST API for the Rerius binary analysis engine.

Repository: https://github.com/ECLS-Studio/rerius

---

Installation#

The JS addon must be compiled on the target device - it is a native binary.

# From the Rerius root:
make

# Or use the standalone script:
bash build_js.sh

This produces js/rerius.node. No npm install required.

---

Quick Start#

const rerius = require('rerius');        // after `npm install rerius`
// const rerius = require('./index.js');  // from within a clone of this repo's js/ folder

// Auto-close with withBinary
rerius.withBinary('/path/to/binary', bin => {
    console.log(bin.arch);        // 'AArch64 (ARM64)'
    console.log(bin.sha256);      // 'a3f8...'
    console.log(bin.isPie);       // true / false

    const fns  = bin.functions();
    const syms = bin.symbols();
    console.log(fns.length, 'functions');
});

// Manual lifecycle
const bin = rerius.load('/path/to/binary');
console.log(bin.info);
bin.close();

// Async
await rerius.withBinaryAsync('./binary', async bin => {
    const r = bin.analyze();
    return r.functions.length;
});

---

ReriusBinary Class#

Properties#

Property	Type	Description
info	BinaryInfo	Full binary metadata object
arch	string	Architecture string
format	string	Format string (ELF64, PE32+, …)
os	string	OS/ABI string
entry	bigint	Entry point virtual address
sha256	string	SHA-256 hex digest
buildId	string	GNU Build-ID hex string
isPie	boolean	Position-independent executable
isStripped	boolean	No symbol table
hasDebug	boolean	DWARF debug sections present
file	string	Absolute file path
loadTimeMs	number	Time to load and parse (ms)

---

Analysis Methods#

sections() → Section[]

All sections with name, type, virtual address, file offset, size, flags, instruction count.

symbols() → Symbol[]

All symbols from .symtab, .dynsym, or PE export table.

functions() → Function[]

Detected function boundaries.

xrefs() → Xref[]

All cross-references (call + branch).

xrefsTo(address) → Xref[]

Cross-references targeting a specific address.

xrefsFrom(address) → Xref[]

Cross-references originating from an address.

blocks() → Block[]

CFG basic blocks.

unicodeStrings() → UnicodeString[]

Genuine multi-byte Unicode strings in non-code sections.

strings() → AsciiString[]

ASCII printable strings of length ≥ 4 from non-code sections.

analyze() → AnalysisResult

Full pipeline (symbols → functions → xrefs → CFG → unicode) in one call.

---

Lookup Methods#

symAt(address) → Symbol | null

funcAt(address) → Function | null

sectionByName(name) → Section | null

sectionAt(address) → Section | null

readBytes(address, length) → Uint8Array | null

hottestFunctions(n?) → HottestFunction[]

---

Disassembly Methods#

disasm(section?) → string

Plain-text disassembly.

disasmJson(section?, opts?) → Instruction[]

Structured disassembly with address, mnemonic, operands, bytes, symbol, group.

Options: { limit: 400, offset: 0 }

---

Advanced Analysis (ARM64, RISC-V; symexec also supports x86-64: see docs/API.md for exact per-method coverage)#

symexec(funcIdx?) → string

Symbolic execution trace showing register state as symbolic expressions.

ssa(funcIdx?) → string

SSA-form IR: r0_2 = r0_0 + 0x7.

decompile(funcIdx?) → string

Pseudo-C output from SSA IR.

emulate(funcIdx?, initRegs?) → string

Concrete emulation with step-by-step trace and final register state.

bin.emulate(0, { '0': 42n, '1': 7n })

---

Lifecycle#

close()

Free all native resources.

[Symbol.dispose]()

Supports using declarations in TypeScript 5+.

---

Module Functions#

rerius.load(filePath)                         // → ReriusBinary
rerius.version()                              // → '1.0.0'
rerius.withBinary(filePath, cb)              // → T
rerius.withBinaryAsync(filePath, cb)         // → Promise<T>

---

Detection Methods#

entropy() → string

Shannon entropy sliding window scan. Returns annotated text output identifying HIGH (≥ 6.8 bits/byte) and PACKED/ENCRYPTED (≥ 7.0) regions per section.

rda(section?) → string

Recursive descent disassembly on section (default .text). BFS from entry + all symbols. Dead byte ranges marked [DEAD: 0xstart .. 0xend].

ivf() → string

Instruction validity filter scan of all code sections. Reports: invalid opcodes, privileged instructions in userspace, NOP-runs ≥ 8, INT3-runs ≥ 3, dead bytes after unconditional branches.

---

TypeScript#

import { load, withBinary, ReriusBinary,
         BinaryInfo, Section, Symbol, Function,
         Xref, Block, Instruction, UnicodeString,
         AsciiString, HottestFunction, AnalysisResult } from './js';

---

Examples#

node js/examples/01_binary_info.js /bin/ls
node js/examples/02_symbols_functions.js /bin/ls
node js/examples/03_disasm_json.js /bin/ls
node js/examples/04_unicode_strings.js /bin/ls
node js/examples/05_xrefs_callgraph.js /bin/ls
node js/examples/06_full_analysis.js /bin/ls