javascript · 7
JavaScript & Electron
Electron and other packaged JavaScript apps: unpacking app.asar, mapping modules with source maps, and following preload scripts and IPC channels into native add-ons. Other guides unpack an ASAR file in the browser, recover readable modules from a minified bundle, decode a production stack trace with a source map, and audit your own npm package for source map leaks before you publish it.
Audit Your npm Package for Source Map Leaks Before Publishing
Check what your npm package or web build exposes through source maps: npm pack --dry-run, a local map viewer, a REA audit of the live site, and build fixes.
Decode a Minified JavaScript Stack Trace with a Source Map
Turn a production error like app.js:1:68 into the original file, line and name: build hidden source maps, map each frame locally, and automate it with REA.
Deobfuscate javascript-obfuscator (obfuscator.io) Output: Tested
We obfuscated our own script with javascript-obfuscator 5.9.0 at 14 option sets, ran a webcrack-based deobfuscator on each and counted what came back.
Inspect Electron Fuses with REA: Read and Audit the Nine Security Switches
Read the nine Electron fuses from a packaged app with REA without launching it: what RunAsNode, OnlyLoadAppFromAsar and the rest control, how to find the sentinel, and how to use them in a security review.
Reverse Engineer an Electron App with REA: ASAR, Preload, IPC
Analyze an Electron app with REA: read app.asar, map modules and imports, use source maps, follow preload and IPC channels, and hand native add-ons to Ghidra.
Unminify and Recover JavaScript Source from Bundles with REA
Turn a minified webpack bundle back into readable modules with REA: source maps, chunk recovery, Wakaru unpacking, data-flow tracing and source checks.
Unpack an ASAR File: Extract and Inspect an Electron App
Find app.asar on Windows, macOS or Linux, unpack it in your browser or with npx @electron/asar, and read package.json, main, preload and IPC channels first.