https://github.com/seia-soto/snapit-pkg

A simple tool to extract resources from Pkg executable dynamically.
https://github.com/seia-soto/snapit-pkg

binary executable extract injection node pkg

Last synced: about 11 hours ago
JSON representation

A simple tool to extract resources from Pkg executable dynamically.

• Host: GitHub
• URL: https://github.com/seia-soto/snapit-pkg
• Owner: seia-soto
• License: mit
• Created: 2022-06-06T02:55:45.000Z (over 2 years ago)
• Default Branch: master
• Last Pushed: 2022-09-10T07:35:13.000Z (over 2 years ago)
• Last Synced: 2024-11-05T16:57:48.053Z (about 2 months ago)
• Topics: binary, executable, extract, injection, node, pkg
• Language: JavaScript
• Homepage:
• Size: 822 KB
• Stars: 2
• Watchers: 2
• Forks: 0
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# snapit-pkg

A simple tool to extract resources from Pkg executable dynamically.

## How

By default, nexe, pkg, and all Node.JS based portable executable generators do modify the Node.JS entrypoint.

At this point, they also implement snapshot fs system to embed their own resources.

Depending on the snapshot file system structure, it may be hard to extract.

However, by seeing the design of the executube, we could hook the entrypoint and inject user script into application.

It's true that we can get all data via binary analysis of all Node.JS application, but this is way better to handle.

## Why

- Recover unintentionally deleted files from built executable

- Reverse Engineering

## Usage

To use the tool, clone the repository and run `yarn && yarn start --file ./path-to-exe --type `.

(This will install dependencies and run hooker)

**Available types**

- `pkg`: pkg version 5

- `pkg4`: pkg version 4

After hooking the executable, you can just run it to extract files.

It's dead simple, but dynamic.

## LICENSE

This tool is licensed under MIT.

Everything is free and open-sourced.

I am not associated with pkg or any packages mentioned here.