Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 08-20-2021, 22:15
Artic Artic is offline
Friend
 
Join Date: Jul 2014
Location: target folder
Posts: 86
Rept. Given: 53
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 103
Thanks Rcvd at 25 Times in 19 Posts
Artic Reputation: 15
Material to reverse/patch electron apps on windows?

I know that electron apps are chrome based applications, cross plattform.
What is the best idea/way to attack these apps?
Reply With Quote
  #2  
Old 08-23-2021, 08:52
atom0s's Avatar
atom0s atom0s is offline
Family
 
Join Date: Jan 2015
Location: 127.0.0.1
Posts: 346
Rept. Given: 25
Rept. Rcvd 110 Times in 54 Posts
Thanks Given: 49
Thanks Rcvd at 588 Times in 235 Posts
atom0s Reputation: 100-199 atom0s Reputation: 100-199
In a lot of cases, the developer console/tools are still left in the resulting package and can be turned on/opened with either a command-line option or a shortcut key combo like (Ctrl+Shift+I or similar).

If the package uses a bundler setup NW.js or similar, those usually offer development packages as well as retail packages. For that, you can just download the developer SDK and overwrite the files the program uses as with the dev ones and it'll re-enable the developer console.
__________________
Personal Projects Site: https://atom0s.com
Reply With Quote
The Following User Says Thank You to atom0s For This Useful Post:
Artic (08-24-2021)
  #3  
Old 08-23-2021, 16:47
sendersu sendersu is offline
VIP
 
Join Date: Oct 2010
Posts: 867
Rept. Given: 325
Rept. Rcvd 217 Times in 111 Posts
Thanks Given: 168
Thanks Rcvd at 374 Times in 209 Posts
sendersu Reputation: 200-299 sendersu Reputation: 200-299 sendersu Reputation: 200-299
Sometimes modern web based apps are using wasm modules (WebAssembly)
in this case Chrome has very nice wasm debugger (yes, you coudl step into it!)
but it's on low level wasm opcodes only...
For static analysis I'd recommend Jeb 4.x - it has very nice wasm decompiler into C-like language
Reply With Quote
The Following User Says Thank You to sendersu For This Useful Post:
Artic (08-24-2021)
  #4  
Old 08-23-2021, 19:34
CryptXor CryptXor is offline
Friend
 
Join Date: Oct 2015
Posts: 61
Rept. Given: 0
Rept. Rcvd 24 Times in 12 Posts
Thanks Given: 21
Thanks Rcvd at 116 Times in 36 Posts
CryptXor Reputation: 24
Quote:
Originally Posted by Artic View Post
I know that electron apps are chrome based applications, cross plattform.
What is the best idea/way to attack these apps?
TL;DR Unpack app.asar (contains the logic) in the 'resources' subfolder, deobfuscate a bit if you need too, mod as you please, repack, done.
Reply With Quote
The Following 2 Users Say Thank You to CryptXor For This Useful Post:
Artic (08-24-2021), DominicCummings (09-09-2021)
  #5  
Old 08-24-2021, 02:24
sh3dow sh3dow is offline
Family
 
Join Date: Oct 2014
Posts: 111
Rept. Given: 100
Rept. Rcvd 77 Times in 22 Posts
Thanks Given: 322
Thanks Rcvd at 135 Times in 46 Posts
sh3dow Reputation: 77
Generally, electron app source code will always be exposed to the "know where to look" user.

When the developer build his app which is written in electron, he will notice that when the binaries build is completed, the resource/source code are also exposed in the final built folder. in the resource folder all the app source code revealed to anyone who can access to this folder.

Just unpack the Whatever_name_here.asar file(s) in the resources folder, though sometimes they obfuscate the JavaScript files so you need to deobfuscate them. then read the code, modify it and build again.
Reply With Quote
The Following 2 Users Say Thank You to sh3dow For This Useful Post:
Artic (08-24-2021), Stingered (08-24-2021)
  #6  
Old 08-24-2021, 21:34
Artic Artic is offline
Friend
 
Join Date: Jul 2014
Location: target folder
Posts: 86
Rept. Given: 53
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 103
Thanks Rcvd at 25 Times in 19 Posts
Artic Reputation: 15
Question

Quote:
Originally Posted by CryptXor View Post
TL;DR Unpack app.asar (contains the logic) in the 'resources' subfolder, deobfuscate a bit if you need too, mod as you please, repack, done.
Thanks for all the answers!

i have already unpacked the asar file. It is not obfuscated (lucky me )

i want to remove a limit in the application, bcs thats the only limitation, which bothers me rly, everything just works perfect.

It goes like this: you do something 40 times and then a limitation dialog comes up (i found the limitation dialog already, also the about dialog)

but so far i have no idea how the limitation dialog is triggered, and how i can for example lift it to N times (even something like 1000 or so would do already.)

I will better leave out, which app im trying to modify here, unless it is allowed here to post.

Any information i could provide that i could understand better how an electron app works?

i mean there is a 110MB exe file, then the asar file (which i unpacked already). The asar files has all the layout in it.

But where could be the limit hidden?
Reply With Quote
  #7  
Old 08-25-2021, 02:29
atom0s's Avatar
atom0s atom0s is offline
Family
 
Join Date: Jan 2015
Location: 127.0.0.1
Posts: 346
Rept. Given: 25
Rept. Rcvd 110 Times in 54 Posts
Thanks Given: 49
Thanks Rcvd at 588 Times in 235 Posts
atom0s Reputation: 100-199 atom0s Reputation: 100-199
It'll most likely be in one of the JS files. They may have minified it so variable names will be nuked and shortened to the smallest amount of characters available.

Quote:
I will better leave out, which app im trying to modify here, unless it is allowed here to post.
You should be fine to post that here, there isn't a rule against naming the software you're targeting for something like this.
__________________
Personal Projects Site: https://atom0s.com
Reply With Quote
  #8  
Old 08-25-2021, 20:03
Artic Artic is offline
Friend
 
Join Date: Jul 2014
Location: target folder
Posts: 86
Rept. Given: 53
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 103
Thanks Rcvd at 25 Times in 19 Posts
Artic Reputation: 15
I was not sure if i can reveal which software i want to target.

Okay i havnt had any time yet to look into it again with the ideas i got here.

I found this app here by Mindomo, which provides offline Concept Maps.
Free version is limited to 40 topics.

you can find it here.
Code:
https://www.mindomo.com/download/10.0/Mindomo_v.10.0.3_x64.exe
Like i wrote it uses a 100+MB exe file, but also has an asar file, which i could unpack.

Last edited by Artic; 08-25-2021 at 20:04. Reason: removed DDL.
Reply With Quote
  #9  
Old 08-25-2021, 23:44
Mendax47 Mendax47 is offline
Family
 
Join Date: Jun 2016
Location: Earth..
Posts: 163
Rept. Given: 9
Rept. Rcvd 5 Times in 5 Posts
Thanks Given: 438
Thanks Rcvd at 209 Times in 81 Posts
Mendax47 Reputation: 5
Quote:
Originally Posted by Artic View Post
I was not sure if i can reveal which software i want to target.

Okay i havnt had any time yet to look into it again with the ideas i got here.

I found this app here by Mindomo, which provides offline Concept Maps.
Free version is limited to 40 topics.

you can find it here.
Code:
https://www.mindomo.com/download/10.0/Mindomo_v.10.0.3_x64.exe
Like i wrote it uses a 100+MB exe file, but also has an asar file, which i could unpack.
I tried to remove all the limitations which are the quickest method to do so... don't worry about dialog showing it free version... everything will work like charm...

copy and replace app.asar or make your original app.asar -> app.asar.bak (a backup) so you can switch between them quickely... but first rename and remove .exetools....

https://drive.google.com/file/d/1Z1O1aoW4Gp2hzPDALPl59YER0ITBNj5g/view?usp=sharing
Reply With Quote
The Following 4 Users Say Thank You to Mendax47 For This Useful Post:
Artic (08-26-2021), besoeso (08-26-2021), DominicCummings (09-09-2021), Zeokat (08-26-2021)
  #10  
Old 08-26-2021, 01:24
Artic Artic is offline
Friend
 
Join Date: Jul 2014
Location: target folder
Posts: 86
Rept. Given: 53
Rept. Rcvd 15 Times in 9 Posts
Thanks Given: 103
Thanks Rcvd at 25 Times in 19 Posts
Artic Reputation: 15
wow this is perfect! thanks alot to everybody.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 19:38.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )