Electron apps nowadays seem to have a snapshot_blob.bin and a v8_context_snapshot.bin. I am having a hard time trying to find specification of this file type. It doesn't match with .wasm. Files may be platform / CPU architecture specific binaries (and may vary depending on the platform) but I am not sure. They have no typical entry point like a normal PE.

Any advice on reverse engineering these snapshot data blob binary files would be appreciated! I am actually looking for a tool like x64dbg or IDA Pro but also thinking of making a similar debugger by myself if there isn't any available. However, the file specs are needed first. Thanks.

  • a google search says src/snapshot/snapshot.cc in google v8 git code base describes the format a cursory glance on vscode snapshot_blob.bin on hxd shows in my m/c at offset 10 so have you been there ? doesn't it help ?
    – blabb
    Dec 4, 2020 at 19:13
  • Yes I have. It doesn't help at all. I have even tried to decode the opcodes manually by following the opcodes inside V8 repository. However, I believe that they don't match since the snapshot is Electron specific. It even has Electron version number written in it if you look into it with i.e. a hex editor. So V8 source alone does not help. We need more information.
    – Haapavuo
    Dec 6, 2020 at 0:08
  • There has been some develop of Ghidra plugin that can aid in that direction. See: github.com/PositiveTechnologies/ghidra_nodejs Only problem is that solution work for .JSC, and the snapshot is somehow different format...
    – IdanB
    Oct 7, 2021 at 14:52


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.