electron

Electron apps

disrobe electron <executable> reads what an Electron build allows at run time and whether its application archive is the one the build was signed with. JavaScript inside the archive is recovered by the JavaScript passes (disrobe js, disrobe auto); this command covers the shell around it.

disrobe electron "C:\Program Files\App\App.exe"           # fuses, declared hashes, resources\app.asar
disrobe electron App.app/Contents/Frameworks/Electron\ Framework.framework/Electron\ Framework \
    --info-plist App.app/Contents/Info.plist --asar App.app/Contents/Resources/app.asar
disrobe electron App.exe --json

What it reports

• Every fuse wire in the file (Electron 12 and later), with its offset and, in a universal macOS binary, the slice it sits in: the wire version, the declared fuse count and each fuse's state (enabled, disabled, removed, or a raw byte disrobe does not know). Version 1 fuses are named in order: RunAsNode, EnableCookieEncryption, EnableNodeOptionsEnvironmentVariable, EnableNodeCliInspectArguments, EnableEmbeddedAsarIntegrityValidation, OnlyLoadAppFromAsar, LoadBrowserProcessSpecificV8Snapshot, GrantFileProtocolExtraPrivileges, WasmTrapHandlers. The text output says what a risky state allows: ELECTRON_RUN_AS_NODE turning the app into a Node.js interpreter, NODE_OPTIONS code injection, --inspect debugger ports, an archive that is not checked against its embedded hash, loading from an unpacked app folder, unencrypted cookies, privileged file:// pages.
• The ASAR integrity hashes the build declares: the INTEGRITY/ELECTRONASAR resource of a Windows executable and ElectronAsarIntegrity in a macOS bundle's Info.plist.
• For each archive (given with --asar, or found as resources/app.asar beside the executable or Contents/Resources/app.asar in a bundle): the SHA-256 of its header JSON and the header pickle size (as @electron/asar reports them), whether it equals the declared hash, and for every packed file the result of its own integrity record (whole-file hash and every block hash), so a file edited after packaging is named with the blocks that changed. Unpacked files are listed.

Evidence

crates/disrobe-binfmt/tests/electron_reference.rs grades against Electron's own tools on the fixtures in corpus/electron-app/ (regenerated byte for byte by make_fixtures.mjs). @electron/asar packs an authored app with an unpacked native module and records the header hash and every file's integrity record; the header hash goes into an INTEGRITY resource of a small authored PE built with clang and llvm-rc, which holds a fuse wire with Electron's default states. @electron/fuses then flips that wire into a hardened and a mixed configuration and flips both slices of an authored universal binary, and its getCurrentFuseWire records the result. Every fuse byte, the slice names, the declared hash, the header hash and size, the file list and every per-file integrity result must equal what those tools report. A flipped fuse byte, an edited file (named with block 0) and an edited header must each be detected, and 600 corrupted copies must produce a report or a typed error. crates/disrobe-cli/tests/electron_cli.rs runs the command on an executable with resources/app.asar beside it, before and after the archive header is changed.

Limits

• Wire versions other than 1 are listed with raw bytes and no names.
• Only SHA-256 integrity records are checked; others are reported as unsupported.
• Fuse wires are found by their sentinel; a binary with more than 32 sentinels is read for the first 32.
• No real Electron release is in the grader (the build would be a third-party binary); the fixtures carry the real structures written by Electron's tools.