https://github.com/j4k0xb/asarfix
Fixes/Decrypts asar archives protected by asarmor and asarbreak.
https://github.com/j4k0xb/asarfix
asar asarbreak asarmor electron
Last synced: 8 months ago
JSON representation
Fixes/Decrypts asar archives protected by asarmor and asarbreak.
- Host: GitHub
- URL: https://github.com/j4k0xb/asarfix
- Owner: j4k0xb
- License: gpl-3.0
- Created: 2024-12-22T06:00:46.000Z (over 1 year ago)
- Default Branch: master
- Last Pushed: 2025-02-04T18:33:44.000Z (over 1 year ago)
- Last Synced: 2025-02-04T19:36:38.111Z (over 1 year ago)
- Topics: asar, asarbreak, asarmor, electron
- Language: TypeScript
- Homepage: https://www.npmjs.com/package/asarfix
- Size: 2.49 MB
- Stars: 15
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# asarfix
Fixes/Decrypts asar archives protected by [asarmor](https://github.com/sleeyax/asarmor) and [asarbreak](https://github.com/relative/asarbreak).
```sh
npx asarfix app.asar -o out.asar
npx asar extract out.asar out
```
## Decryption
Asarmor uses AES-128-CBC to encrypt `.js` files in the asar archive.
The encryption key is stored in one of these binaries:
- electron-forge: `resources/app.asar.unpacked/.vite/build/main.node`
- electron-builder: `resources/app.asar.unpacked/dist/main.node`
Asarfix will automatically search for these binaries and try to extract the key.
Specifying a custom binary path with the `-b` flag:
```sh
npx asarfix app.asar -o out.asar -b
```
Specifying a custom key with the `-k` flag:
```sh
npx asarfix app.asar -o out.asar -k
```
The key may also be available in plaintext: `node_modules/asarmor/src/encryption/key.txt`.
## Bypass Debugging Protection
https://github.com/sleeyax/asarmor/blob/2c91d08ba0a00d379d26e7dfb89aa0f1d3b8e05c/src/encryption/main.cpp#L172-L173
It checks process.argv, but this can be bypassed in one of these ways:
- Set the `NODE_OPTIONS=--inspect` environment variable (only works with node, not electron)
- Open `main.node` in a hex editor and replace the `--inspect` string with anything else of the same length
- [Modify Fuses](https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection#modifying-electron-fuses)