None String Constant causing panic

[Static-Flow]

I am trying to use view8 with this binary, https://www.dropbox.com/scl/fi/0ccinw9rpdledkp8up6op/gui-backend.zip?rlkey=0hax59h4k9z7oquoxdoomw4lr&st=gg517hpz&dl=0

An arm64 Little-endian node.js compiled with node 9.4.146.24 (according to VersionDector) and packed using pkg.

I used https://github.com/LockBlock-dev/pkg-unpacker to unpack it and used the resulting gui-backend.js with View8.

After adding some debugging the line right before the error is a string constant like: (newline on purpose)

<
None

Any idea why that might be happening?

[Static-Flow]

output from .\Bin\9.4.146.24.exe .\gui.min.js

Start SharedFunctionInfo
Parameter count 1
Register count 1
Frame size 8
OSR nesting level: 0
Bytecode Age: 0
    0 S> 000001C6C8B9D9AE @    0 : 7f 00 00 00       CreateClosure [0], [0], #0
         000001C6C8B9D9B2 @    4 : c3                Star0
2079594 S> 000001C6C8B9D9B3 @    5 : a8                Return
Constant pool (size = 1)
000001C6C8B9D9B9: [FixedArray] in OldSpace
 - map: 0x00c9cc7c12c1 <Map>
 - length: 1
           0: 0x01c6c8b9d9d1 <SharedFunctionInfo>
Start SharedFunctionInfo
000001C6C8B9D9D1: [SharedFunctionInfo] in OldSpace
 - map: 0x00c9cc7c1971 <Map[56]>
 - name: 0x00c9cc7c17b1 <String[0]: #>
 - inferred name: 0x00c9cc7c17b1 <String[0]: #>
 - kind: NormalFunction
 - syntax kind: AnonymousExpression
 - function_map_index: 183
 - formal_parameter_count: 5
 - expected_nof_properties:
 - language_mode: sloppy
 - data: 0x01c6c8b9da09 <BytecodeArray[85]>
 - code (from data): 0x01b2b1503e81 <Code BUILTIN InterpreterEntryTrampoline>
 - script: 0x01c6c8b9de79 <Script>
 - function token position: 1
 - start position: 10
 - end position: 2079592
 - no debug info
 - scope info: 0x01c6c8b9dae1 <ScopeInfo FUNCTION_SCOPE>
 - length: 5
 - feedback_metadata: 00000208C265DB41: [FeedbackMetadata] in OldSpace
 - map: 0x00c9cc7c1f61 <Map>
 - slot_count: 10
 - create_closure_slot_count: 6
 Slot #0 Call
 Slot #2 Call
 Slot #4 Call
 Slot #6 Call
 Slot #8 Call


Start BytecodeArray
Parameter count 6
Register count 5
Frame size 40
OSR nesting level: 0
Bytecode Age: 0
   10 E> 000001C6C8B9DA3E @    0 : 82 00 05          CreateFunctionContext [0], [5]
         000001C6C8B9DA41 @    3 : 1a f9             PushContext r1
         000001C6C8B9DA43 @    5 : 0b 04             Ldar a1
         000001C6C8B9DA45 @    7 : 25 03             StaCurrentContextSlot [3]
         000001C6C8B9DA47 @    9 : 0b 07             Ldar a4
         000001C6C8B9DA49 @   11 : 25 02             StaCurrentContextSlot [2]
         000001C6C8B9DA4B @   13 : 7f 01 00 02       CreateClosure [1], [0], #2
         000001C6C8B9DA4F @   17 : 25 04             StaCurrentContextSlot [4]
         000001C6C8B9DA51 @   19 : 7f 02 01 02       CreateClosure [2], [1], #2
         000001C6C8B9DA55 @   23 : 25 05             StaCurrentContextSlot [5]
         000001C6C8B9DA57 @   25 : 10                LdaTheHole
         000001C6C8B9DA58 @   26 : 25 06             StaCurrentContextSlot [6]
  304 S> 000001C6C8B9DA5A @   28 : 7f 03 02 02       CreateClosure [3], [2], #2
         000001C6C8B9DA5E @   32 : c1                Star2
         000001C6C8B9DA5F @   33 : 16 05             LdaCurrentContextSlot [5]
         000001C6C8B9DA61 @   35 : c0                Star3
         000001C6C8B9DA62 @   36 : 01 0d 05 3f 0b 00 LdaSmi.ExtraWide [737029]
         000001C6C8B9DA68 @   42 : bf                Star4
 1178 E> 000001C6C8B9DA69 @   43 : 62 f8 f7 f6 00    CallUndefinedReceiver2 r2, r3, r4, [0]
538028 S> 000001C6C8B9DA6E @   48 : 7f 04 03 02       CreateClosure [4], [3], #2
         000001C6C8B9DA72 @   52 : c1                Star2
538321 E> 000001C6C8B9DA73 @   53 : 60 f8 02          CallUndefinedReceiver0 r2, [2]
         000001C6C8B9DA76 @   56 : c3                Star0
538337 S> 000001C6C8B9DA77 @   57 : 7f 05 04 02       CreateClosure [5], [4], #2
         000001C6C8B9DA7B @   61 : bf                Star4
538337 E> 000001C6C8B9DA7C @   62 : 62 fa 02 f6 04    CallUndefinedReceiver2 r0, <this>, r4, [4]
538337 E> 000001C6C8B9DA81 @   67 : 25 06             StaCurrentContextSlot [6]
538561 S> 000001C6C8B9DA83 @   69 : 17 06             LdaImmutableCurrentContextSlot [6]
         000001C6C8B9DA85 @   71 : c1                Star2
538561 E> 000001C6C8B9DA86 @   72 : 60 f8 06          CallUndefinedReceiver0 r2, [6]
         000001C6C8B9DA89 @   75 : 7f 06 05 02       CreateClosure [6], [5], #2
         000001C6C8B9DA8D @   79 : c1                Star2
2079586 E> 000001C6C8B9DA8E @   80 : 60 f8 08          CallUndefinedReceiver0 r2, [8]
         000001C6C8B9DA91 @   83 : 0e                LdaUndefined
2079591 S> 000001C6C8B9DA92 @   84 : a8                Return
Constant pool (size = 7)
000001C6C8B9DA99: [FixedArray] in OldSpace
 - map: 0x00c9cc7c12c1 <Map>
 - length: 7
           0: 0x01c6c8b9dae1 <ScopeInfo FUNCTION_SCOPE>
           1: 0x01c6c8b9dc19 <SharedFunctionInfo a0_0xb8de>
Start SharedFunctionInfo
000001C6C8B9DC19: [SharedFunctionInfo] in OldSpace
 - map: 0x00c9cc7c1971 <Map[56]>
 - name: 0x01c6c8b9dbb9 <String[9]: #a0_0xb8de>
 - inferred name: 0x00c9cc7c17b1 <String[0]: #>
 - kind: NormalFunction
 - syntax kind: Declaration
 - function_map_index: 183
 - formal_parameter_count: 2
 - expected_nof_properties:
 - language_mode: sloppy
 - data: 0x01c6c8b9dc51 <BytecodeArray[37]>
 - code (from data): 0x01b2b1503e81 <Code BUILTIN InterpreterEntryTrampoline>
 - script: 0x01c6c8b9de79 <Script>
 - function token position: 62
 - start position: 80
 - end position: 304
 - no debug info
 - scope info: 0x01c6c8b9dcd1 <ScopeInfo FUNCTION_SCOPE>
 - outer scope info: 0x01c6c8b9dae1 <ScopeInfo FUNCTION_SCOPE>
 - length: 2
 - feedback_metadata: 00000208C265DAF1: [FeedbackMetadata] in OldSpace
 - map: 0x00c9cc7c1f61 <Map>
 - slot_count: 4
 - create_closure_slot_count: 1
 Slot #0 Call
 Slot #2 Call


Start BytecodeArray
Parameter count 3
Register count 2
Frame size 16
OSR nesting level: 0
Bytecode Age: 0
   80 E> 000001C6C8B9DC86 @    0 : 82 00 01          CreateFunctionContext [0], [1]
         000001C6C8B9DC89 @    3 : 1a fa             PushContext r0
         000001C6C8B9DC8B @    5 : 10                LdaTheHole
         000001C6C8B9DC8C @    6 : 25 02             StaCurrentContextSlot [2]
  118 S> 000001C6C8B9DC8E @    8 : 14 fa 05 00       LdaContextSlot r0, [5], [0]
         000001C6C8B9DC92 @   12 : c2                Star1
  118 E> 000001C6C8B9DC93 @   13 : 60 f9 00          CallUndefinedReceiver0 r1, [0]
  118 E> 000001C6C8B9DC96 @   16 : 25 02             StaCurrentContextSlot [2]
  130 S> 000001C6C8B9DC98 @   18 : 7f 01 00 02       CreateClosure [1], [0], #2
  146 E> 000001C6C8B9DC9C @   22 : 24 fa 04 00       StaContextSlot r0, [4], [0]
         000001C6C8B9DCA0 @   26 : 14 fa 04 00       LdaContextSlot r0, [4], [0]
         000001C6C8B9DCA4 @   30 : c2                Star1
  272 E> 000001C6C8B9DCA5 @   31 : 62 f9 03 04 02    CallUndefinedReceiver2 r1, a0, a1, [2]
  303 S> 000001C6C8B9DCAA @   36 : a8                Return
Constant pool (size = 2)
000001C6C8B9DCB1: [FixedArray] in OldSpace
 - map: 0x00c9cc7c12c1 <Map>
 - length: 2
           0: 0x01c6c8b9dcd1 <ScopeInfo FUNCTION_SCOPE>
           1: 0x01c6c8b9dd51 <SharedFunctionInfo a0_0xb8de>
Start SharedFunctionInfo
000001C6C8B9DD51: [SharedFunctionInfo] in OldSpace
 - map: 0x00c9cc7c1971 <Map[56]>
 - name: 0x01c6c8b9dbb9 <String[9]: #a0_0xb8de>
 - inferred name: 0x00c9cc7c17b1 <String[0]: #>
 - kind: NormalFunction
 - syntax kind: AnonymousExpression
 - function_map_index: 183
 - formal_parameter_count: 2
 - expected_nof_properties:
 - language_mode: sloppy
 - data: 0x01c6c8b9dd89 <BytecodeArray[22]>
 - code (from data): 0x01b2b1503e81 <Code BUILTIN InterpreterEntryTrampoline>
 - script: 0x01c6c8b9de79 <Script>
 - function token position: 147
 - start position: 155
 - end position: 271
 - no debug info
 - scope info: 0x01c6c8b9de11 <ScopeInfo FUNCTION_SCOPE>
 - outer scope info: 0x01c6c8b9dcd1 <ScopeInfo FUNCTION_SCOPE>
 - length: 2
 - feedback_metadata: 000001C6C8B9DE61: [FeedbackMetadata] in OldSpace
 - map: 0x00c9cc7c1f61 <Map>
 - slot_count: 3
 - create_closure_slot_count: 0
 Slot #0 BinaryOp
 Slot #1 LoadKeyed


Start BytecodeArray
Parameter count 3
Register count 2
Frame size 16
OSR nesting level: 0
Bytecode Age: 0
  177 S> 000001C6C8B9DDBE @    0 : 0b 03             Ldar a0
  196 E> 000001C6C8B9DDC0 @    2 : 00 45 9e 01 00 00 SubSmi.Wide [414], [0]
         000001C6C8B9DDC6 @    8 : 18 03             Star a0
  232 S> 000001C6C8B9DDC8 @   10 : 17 02             LdaImmutableCurrentContextSlot [2]
         000001C6C8B9DDCA @   12 : a9 00             ThrowReferenceErrorIfHole [0]
         000001C6C8B9DDCC @   14 : c2                Star1
         000001C6C8B9DDCD @   15 : 0b 03             Ldar a0
  241 E> 000001C6C8B9DDCF @   17 : 2f f9 01          LdaKeyedProperty r1, [1]
         000001C6C8B9DDD2 @   20 : c3                Star0
  270 S> 000001C6C8B9DDD3 @   21 : a8                Return
Constant pool (size = 1)
000001C6C8B9DDD9: [FixedArray] in OldSpace
 - map: 0x00c9cc7c12c1 <Map>
 - length: 1
           0: 0x01c6c8b9dd31 <String[9]: #_0x250867>
Handler Table (size = 0)
Source Position Table (size = 14)
0x01c6c8b9ddf1 <ByteArray[14]>

End BytecodeArray

End SharedFunctionInfo

Handler Table (size = 0)
Source Position Table (size = 21)
0x0208c265dac9 <ByteArray[21]>

End BytecodeArray

End SharedFunctionInfo

           2: 0x01c6c8ba19c1 <SharedFunctionInfo a0_0x5968>
Start SharedFunctionInfo
000001C6C8BA19C1: [SharedFunctionInfo] in OldSpace
 - map: 0x00c9cc7c1971 <Map[56]>
 - name: 0x01c6c8b9dbd9 <String[9]: #a0_0x5968>
 - inferred name: 0x00c9cc7c17b1 <String[0]: #>
 - kind: NormalFunction
 - syntax kind: Declaration
 - function_map_index: 183
 - formal_parameter_count: 0
 - expected_nof_properties:
 - language_mode: sloppy
 - data: 0x01c6c8ba19f9 <BytecodeArray[31]>
 - code (from data): 0x01b2b1503e81 <Code BUILTIN InterpreterEntryTrampoline>
 - script: 0x01c6c8b9de79 <Script>
 - function token position: 1227
 - start position: 1245
 - end position: 538010
 - no debug info
 - scope info: 0x01c6c8ba1a79 <ScopeInfo FUNCTION_SCOPE>
 - outer scope info: 0x01c6c8b9dae1 <ScopeInfo FUNCTION_SCOPE>
 - length: 0
 - feedback_metadata: 000000E3B9063409: [FeedbackMetadata] in OldSpace
 - map: 0x00c9cc7c1f61 <Map>
 - slot_count: 3
 - create_closure_slot_count: 1
 Slot #0 Literal
 Slot #1 Call


Start BytecodeArray
Parameter count 1
Register count 2
Frame size 16
OSR nesting level: 0
Bytecode Age: 0
 1245 E> 000001C6C8BA1A2E @    0 : 82 00 01          CreateFunctionContext [0], [1]
         000001C6C8BA1A31 @    3 : 1a fa             PushContext r0
         000001C6C8BA1A33 @    5 : 10                LdaTheHole
         000001C6C8BA1A34 @    6 : 25 02             StaCurrentContextSlot [2]
 1264 S> 000001C6C8BA1A36 @    8 : 78 01 00 05       CreateArrayLiteral [1], [0], #5
 1264 E> 000001C6C8BA1A3A @   12 : 25 02             StaCurrentContextSlot [2]
537950 S> 000001C6C8BA1A3C @   14 : 7f 02 00 02       CreateClosure [2], [0], #2
537959 E> 000001C6C8BA1A40 @   18 : 24 fa 05 00       StaContextSlot r0, [5], [0]
537990 S> 000001C6C8BA1A44 @   22 : 14 fa 05 00       LdaContextSlot r0, [5], [0]
         000001C6C8BA1A48 @   26 : c2                Star1
537997 E> 000001C6C8BA1A49 @   27 : 60 f9 01          CallUndefinedReceiver0 r1, [1]
538009 S> 000001C6C8BA1A4C @   30 : a8                Return
Constant pool (size = 3)
000001C6C8BA1A51: [FixedArray] in OldSpace
 - map: 0x00c9cc7c12c1 <Map>
 - length: 3
           0: 0x01c6c8ba1a79 <ScopeInfo FUNCTION_SCOPE>
           1: 0x01c6c8ba1af9 <ArrayBoilerplateDescription PACKED_ELEMENTS, 0x0297e3cc1119 <FixedArray[40884]>
Start FixedArray
00000297E3CC1119: [FixedArray]
 - map: 0x00c9cc7c1809 <Map>
 - length: 40884
           0: 0x01c6c8ba1b11 <String[10]: #IiASgCCCEC>
           1: 0x01c6c8ba1b31 <String[10]: #YoApgBQQJG>
           2: 0x01c6c8ba1b51 <String[10]: #AgB0UEQCAI>
           3: 0x01c6c8ba1b71 <String[10]: #MgAUHIAWor>
[..snip..]
        3621: 0x01c6c8bbdb21 <String[10]: #IAAoAgQhAA>
        3622: 0x01c6c8bbdb41 <String[10]: #uNEABqAAAA>
        3623: 0x01c6c8bbdb61 <String[10]: #DzYCBCALIA>
        3624: 0x01c6c8bbdb81 <String[10]: #ADYCMCADIA>
        3625: 0x00c9cc7c7c89

[Static-Flow]

The string issue seemed to be a problem with the constant:

$> hexdump.exe -C -s $((102129)) -n 32 .\gui.min.jsc
00018ef1  44 7a 59 43 42 43 41 4c  49 41 00 00 00 00 00 00  |DzYCBCALIA......|
00018f01  01 10 51 62 f6 a3 44 61  0a 00 00 00 41 44 59 43  |..Qb..Da....ADYC|
00018f11
$> hexdump.exe -C -s $((102101)) -n 32 .\gui.min.jsc
00018ed5  75 4e 45 41 42 71 41 41  41 41 00 00 00 00 00 00  |uNEABqAAAA......|
00018ee5  01 10 51 62 ee e9 de 47  0a 00 00 00 44 7a 59 43  |..Qb...G....DzYC|
00018ef5
$> hexdump.exe -C -s $((102073)) -n 32 .\gui.min.jsc
00018eb9  49 41 41 6f 41 67 51 68  41 41 00 00 00 00 00 00  |IAAoAgQhAA......|
00018ec9  01 10 51 62 32 e3 da 5e  0a 00 00 00 75 4e 45 41  |..Qb2..^....uNEA|
00018ed9
$> hexdump.exe -C -s $((102157)) -n 32 .\gui.min.jsc (bad one)
00018f0d  41 44 59 43 4d 43 41 44  49 41 00 00 00 00 00 00  |ADYCMCADIA......|
00018f1d  05 00 22 f2 01 01 10 51  62 3e 9b 24 31 0a 00 00  |.."....Qb>.$1...|
00018f2d

when I remove the bytes which are different from the rest 05 00 22 f2 01 I don't get the None string error but now the V8 binary fails with:

#
# Fatal error in , line 0
# Check failed: current == end_slot_index.
#
#
#
#FailureMessage Object: 000000C1B60FDA10
==== C stack trace ===============================

        (No symbol) [0x00007FF61EEE2B5B]
        (No symbol) [0x00007FF61EECB421]
        (No symbol) [0x00007FF61EEE6F32]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21BA1E+1718926]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2169A3+1698323]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21B9EC+1718876]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C079+1720553]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F2157E9+1693785]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F21C0FC+1720684]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F3A4CFF+3329391]
        (No symbol) [0x00007FF61EFE3089]
        (No symbol) [0x00007FF61EFEEA3F]
        (No symbol) [0x00007FF61EED567E]
        (No symbol) [0x00007FF61EED5185]
        (No symbol) [0x00007FF61EEC2F6C]
        (No symbol) [0x00007FF61EEC3901]
        (No symbol) [0x00007FF61EEC3B41]
        CrashForExceptionInNonABICompliantCodeRange [0x00007FF61F98A600+9512560]
        BaseThreadInitThunk [0x00007FFB9787E8D7+23]
        RtlUserThreadStart [0x00007FFB97FA8D9C+44]

[girish0x0]

Can you share your jsc file?