Electron App Reverse Engineering

Black-box methodology for reverse engineering Electron applications. Core principle: unpack → map IPC surface → trace auth flow → locate client-side enforcement → verify.

Based on real-world analysis of Wispr Flow, Notion, Slack, VS Code, and other Electron apps.

Quick Start (CTF Mode)

# 1. Extract the package
dpkg -x target_1.0.0_amd64.deb extracted/
# or for .dmg: 7z x target.dmg; cd target/Contents/Resources/

# 2. Unpack ASAR
npx @electron/asar extract resources/app.asar app_unpacked/

# 3. Quick scan for auth/payment endpoints
python3 {baseDir}/scripts/quick_scan.py app_unpacked/