1

Electron apps nowadays seem to have a snapshot_blob.bin and a v8_context_snapshot.bin. I am having a hard time trying to find specification of this file type. It doesn't match with .wasm. Files may be platform / CPU architecture specific binaries (and may vary depending on the platform) but I am not sure. They have no typical entry point like a normal PE.

Any advice on reverse engineering these snapshot data blob binary files would be appreciated! I am actually looking for a tool like x64dbg or IDA Pro but also thinking of making a similar debugger by myself if there isn't any available. However, the file specs are needed first. Thanks.

Improve this question
3
  • a google search says src/snapshot/snapshot.cc in google v8 git code base describes the format a cursory glance on vscode snapshot_blob.bin on hxd shows 7.8.279.23-electron.0 in my m/c at offset 10 so have you been there ? doesn't it help ?
    – blabb
    Dec 4 '20 at 19:13
  • Yes I have. It doesn't help at all. I have even tried to decode the opcodes manually by following the opcodes inside V8 repository. However, I believe that they don't match since the snapshot is Electron specific. It even has Electron version number written in it if you look into it with i.e. a hex editor. So V8 source alone does not help. We need more information.
    – Haapavuo
    Dec 6 '20 at 0:08
  • There has been some develop of Ghidra plugin that can aid in that direction. See: github.com/PositiveTechnologies/ghidra_nodejs Only problem is that solution work for .JSC, and the snapshot is somehow different format...
    – IdanB
    Oct 7 '21 at 14:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.