如何调试pkg打包的运行中NodeJS程序？能否恢复源码并修复？

Absolutely, both IDA Pro and OllyDbg are solid choices to resolve this issue—let’s break down how to approach it, especially since that c:\snapshot\xxx.js error path is a dead giveaway: this is almost certainly a Node.js app bundled with pkg. That context simplifies our debugging work a lot.

First, Understand the Bundle Context #

pkg wraps Node.js apps into standalone executables, and the snapshot path refers to the bundled JS code that gets unpacked and executed at runtime. Your year-related bug is almost definitely hardcoded logic in that unpacked JS, or a date check that wasn’t handled for new years.

Tool-by-Tool Approach #

OllyDbg: Quick Runtime Patching for Year Checks #

OllyDbg is perfect for real-time debugging to spot and fix the hardcoded year fast:

• Fire up OllyDbg and load your problematic executable.
• Use Search > For All Text Strings to hunt for year values (like "2023", "2024") or the exact error message you’re seeing. Set breakpoints on these strings—this will stop the program right when it’s accessing that year logic.
• When the breakpoint hits, inspect the surrounding assembly code. You’ll likely see a comparison between the current system year and a hardcoded value (e.g., checking if currentYear == 2023).
• Patch the executable directly: modify the comparison instruction (e.g., change JE to JMP to skip the check) or overwrite the hardcoded year with the current one. Save the patched executable via File > Save File—just make sure to back up the original first!

IDA Pro: Deep Reverse Engineering & Pseudocode Recovery #

If you want to reconstruct more of the underlying JS logic (not just patch the bug), IDA is the way to go:

• Load the executable into IDA and let it finish auto-analysis.
• Search for references to c:\snapshot\xxx.js—this will lead you to the section containing the bundled V8 bytecode.
• Use IDA’s built-in V8 bytecode decompiler (or community plugins if needed) to convert the bytecode into readable pseudocode. This won’t give you the exact original source, but it will let you trace the logic flow, find the unhandled year variable, and understand how the bug is triggered.
• Once you’ve identified the problematic code, use IDA’s patching tools to modify the bytecode or assembly instructions to fix the year issue, then export the patched executable.

Bonus: Try Unpacking the pkg Bundle First #

Before diving into heavy reverse engineering, you might be able to unpack the bundle directly with tools like pkg-unpack. Run it against your executable, and it will extract the original bundled JS files (including that xxx.js). If this works, you can edit the year logic directly in the JS file, then re-bundle it with pkg—this is way faster than patching the binary!

Pro tip: Always make a full backup of the original executable before modifying it. You don’t want to accidentally break the entire program while debugging.

内容的提问来源于stack exchange，提问作者NSK