5 ms·

Cracking Electron Apps Open

80 points by lukastyrychtr 3y ago

doodlesdev 3y ago
A few cools things I learned from this article: - 7z is a pretty awesome tool if I ever need to unpack archives and don't know the specific program or command arguments to do it myself - .dmg, .deb, and .rpm files are really just standard archive files, not file formats by themselves (I knew they were archives previously, just didn't know you could just open these with standard tools such as 7z) - macOS App Translocation exists [0] (never heard of this before, possibly because I don't use mac) - GNU ar [1] is a thing that exists (of course I know about GNU Tar [2] and use it a lot, never heard about GNU ar or its UNIX counterpart before though). Tangentially, I also discovered POSIX does not use the tar command anymore and instead goes for pax instead for some reason since POSIX.1-2001. Was expecting a lousy post due to some typos in the text, also not necessarily interested in Electron but got pleasantly surprised and learned a ton about a variety of things. [0]: https://developer.apple.com/forums/thread/724969 https://developer.apple.com/forums/thread/724969 [1]: https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/binutils_1.html https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/... [2]: https://www.gnu.org/software/tar/ https://www.gnu.org/software/tar/
- fasterthanlime 3y ago
  Ok I know I shouldn't let that get to me, but, re: "Was expecting a lousy post due to some typos in the text" A) that's... rude/gatekeepy? B) what typos? I simply cannot find what you're talking about Stylistic choices are not typos, I wonder if there hasn't been some mixup there? Folks usually use the feedback system to report typos, which then get fixed. You're probably not gonna see this so shrug, but, for the record: not cool.
- solarkraft 3y ago
  > I also discovered POSIX does not use the tar command anymore and instead goes for pax instead for some reason since POSIX.1-2001. I don't have any knowledge on that topic, but I do know that the linux kernel doesn't use tar for the initramfs because it was deemed too complicated and unstandardized.
- LoganDark 3y ago
  > - .dmg, .deb, and .rpm files are really just standard archive files, not file formats by themselves Isn't DMG a filesystem image, not an archive? (.deb and .rpm are indeed archives.)
  - fasterthanlime 3y ago
    Yes (more like squashfs, which is what AppImage is, I forgot to mention that), although honestly the border between "filesystem images" and "archives" is tenuous.
    - LoganDark 3y ago
      I've created read-write DMGs with Disk Utility because you can encrypt them with a password. Basically first-party VeraCrypt without FUSE. Though, when my MacBook broke and I had to switch back to Windows, I had to migrate it into an actual VeraCrypt volume. The tool I used for this... was mounting the volumes on both machines and then using SFTP to copy the files themselves.
throwaway290 3y ago
Looks like this deals with vanilla electron not using any of the available ways of protecting the source
- bertman 3y ago
  Why would they protect the source? https://github.com/jgraph/drawio https://github.com/jgraph/drawio
  - throwaway290 3y ago
    The article posted on Hacker News is called "Cracking Electron Apps Open". The article deals with none of the libs developed to make it hard to crack open Electron apps. So it feels like clickbait and perhaps this will save someone a click.
- bdcravens 3y ago
  Many of those ways just obfuscate the source or encrypt some files; they don't prevent the Electron packaging format from being opened. While that reduces most of the reasons for "cracking" the app open, there's still often useful information to be gleamed by doing so.
  - throwaway290 3y ago
    Entirely useless distinction. Although if for you "crack open an app" can mean "see a bunch of opaque blobs" then sure.
worldsavior 3y ago
Off topic a bit, but this is just amazing how only now Windows gets various archives native support. This kind of "Windows personality" just makes me hate this OS. They don't listen to their customers; everything is slow and requires gaming hardware; Cortana was a huge integration into Windows and they eventually abandoned it; tracking and telemetry if you don't disable through regedit; many more. Also, happy independence day!
- deleted 3y ago
  [deleted]
- desi_ninja 3y ago
  Old windows ppl are not at helm. New windows ppl are calling the shots. Windows like any other major software has change in leadership every few years. Maybe the newer ppl recognise and fix the pain points left by old windows ppl and new leadership supports that

80 points by lukastyrychtr 3y ago

A few cools things I learned from this article: - 7z is a pretty awesome tool if I ever need to unpack archives and don't know the specific program or command arguments to do it myself - .dmg, .deb, and .rpm files are really just standard archive files, not file formats by themselves (I knew they were archives previously, just didn't know you could just open these with standard tools such as 7z) - macOS App Translocation exists [0] (never heard of this before, possibly because I don't use mac) - GNU ar [1] is a thing that exists (of course I know about GNU Tar [2] and use it a lot, never heard about GNU ar or its UNIX counterpart before though). Tangentially, I also discovered POSIX does not use the tar command anymore and instead goes for pax instead for some reason since POSIX.1-2001. Was expecting a lousy post due to some typos in the text, also not necessarily interested in Electron but got pleasantly surprised and learned a ton about a variety of things. [0]: https://developer.apple.com/forums/thread/724969 https://developer.apple.com/forums/thread/724969 [1]: https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/binutils_1.html https://ftp.gnu.org/old-gnu/Manuals/binutils-2.12/html_node/... [2]: https://www.gnu.org/software/tar/ https://www.gnu.org/software/tar/

fasterthanlime 3y ago
Ok I know I shouldn't let that get to me, but, re: "Was expecting a lousy post due to some typos in the text" A) that's... rude/gatekeepy? B) what typos? I simply cannot find what you're talking about Stylistic choices are not typos, I wonder if there hasn't been some mixup there? Folks usually use the feedback system to report typos, which then get fixed. You're probably not gonna see this so shrug, but, for the record: not cool.
solarkraft 3y ago
> I also discovered POSIX does not use the tar command anymore and instead goes for pax instead for some reason since POSIX.1-2001. I don't have any knowledge on that topic, but I do know that the linux kernel doesn't use tar for the initramfs because it was deemed too complicated and unstandardized.
LoganDark 3y ago
> - .dmg, .deb, and .rpm files are really just standard archive files, not file formats by themselves Isn't DMG a filesystem image, not an archive? (.deb and .rpm are indeed archives.)
- fasterthanlime 3y ago
  Yes (more like squashfs, which is what AppImage is, I forgot to mention that), although honestly the border between "filesystem images" and "archives" is tenuous.
  - LoganDark 3y ago
    I've created read-write DMGs with Disk Utility because you can encrypt them with a password. Basically first-party VeraCrypt without FUSE. Though, when my MacBook broke and I had to switch back to Windows, I had to migrate it into an actual VeraCrypt volume. The tool I used for this... was mounting the volumes on both machines and then using SFTP to copy the files themselves.

throwaway290 3y ago

Looks like this deals with vanilla electron not using any of the available ways of protecting the source

bertman 3y ago
Why would they protect the source? https://github.com/jgraph/drawio https://github.com/jgraph/drawio
- throwaway290 3y ago
  The article posted on Hacker News is called "Cracking Electron Apps Open". The article deals with none of the libs developed to make it hard to crack open Electron apps. So it feels like clickbait and perhaps this will save someone a click.
bdcravens 3y ago
Many of those ways just obfuscate the source or encrypt some files; they don't prevent the Electron packaging format from being opened. While that reduces most of the reasons for "cracking" the app open, there's still often useful information to be gleamed by doing so.
- throwaway290 3y ago
  Entirely useless distinction. Although if for you "crack open an app" can mean "see a bunch of opaque blobs" then sure.

worldsavior 3y ago

Off topic a bit, but this is just amazing how only now Windows gets various archives native support. This kind of "Windows personality" just makes me hate this OS. They don't listen to their customers; everything is slow and requires gaming hardware; Cortana was a huge integration into Windows and they eventually abandoned it; tracking and telemetry if you don't disable through regedit; many more. Also, happy independence day!

deleted 3y ago
[deleted]
desi_ninja 3y ago
Old windows ppl are not at helm. New windows ppl are calling the shots. Windows like any other major software has change in leadership every few years. Maybe the newer ppl recognise and fix the pain points left by old windows ppl and new leadership supports that