0

Electron apps nowadays seem to have a snapshot_blob.bin and a v8_context_snapshot.bin. I am having a hard time trying to find specification of this file type. It doesn't match with .wasm. Files may be platform / CPU architecture specific binaries (and may vary depending on the platform) but I am not sure. They have no typical entry point like a normal PE.

Any advice on reverse engineering these snapshot data blob binary files would be appreciated! I am actually looking for a tool like x64dbg or IDA Pro but also thinking of making a similar debugger by myself if there isn't any available. However, the file specs are needed first. Thanks.

Improve this question
2
  • a google search says src/snapshot/snapshot.cc in google v8 git code base describes the format a cursory glance on vscode snapshot_blob.bin on hxd shows 7.8.279.23-electron.0 in my m/c at offset 10 so have you been there ? doesn't it help ? – blabb Dec 4 '20 at 19:13
  • Yes I have. It doesn't help at all. I have even tried to decode the opcodes manually by following the opcodes inside V8 repository. However, I believe that they don't match since the snapshot is Electron specific. It even has Electron version number written in it if you look into it with i.e. a hex editor. So V8 source alone does not help. We need more information. – Haapavuo Dec 6 '20 at 0:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.