diff --git a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md index e968d3fad66..0c37fe807ef 100644 --- a/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md +++ b/src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md @@ -113,6 +113,32 @@ Modify the start-main configuration and add the use of a proxy such as: "start-main": "electron ./dist/main/main.js --proxy-server=127.0.0.1:8080 --ignore-certificateerrors", ``` +## Static ASAR-to-native boundary tracing with REA + +**REA** can read an ASAR or extracted application directory without executing its JavaScript bootstrap. Its application graph records package entry points, bundled modules, `BrowserWindow` and preload settings, `contextBridge` members, IPC registrations, native add-on requests and source-map identities. This gives a starting point for tracing a renderer-exposed capability toward a privileged main-process handler.[[35]](#references)[[36]](#references) + +```bash +rea analyze-javascript-application /absolute/path/to/app.asar --json > application-evidence.json +``` + +For a literal feature string, pass the complete Evidence record as `application` and replace the seed with one observed in the target:[[37]](#references) + +```bash +node --input-type=module -e ' +import { readFileSync, writeFileSync } from "node:fs"; +const application = JSON.parse(readFileSync("application-evidence.json", "utf8")); +writeFileSync("trace-input.json", JSON.stringify({ + application, seed: { kind: "string", value: "search-result" }, direction: "both" +}));' +rea trace-application-feature ./trace-input.json --json +``` + +The same `trace_application_feature` workflow also accepts an observed literal API member, IPC channel or module as a seed. Check the resulting handler path, validation candidates and native handoff against the returned source locations. A renderer `invoke` pairs only with one unique `ipcMain.handle`/`handleOnce` candidate on the same exact literal channel; `send` similarly requires one unique `ipcMain.on`/`once`/`addListener` candidate. Dynamic or duplicate handlers stay unresolved. A requested `.node` member is not a verified native export; matching Hopper/Ghidra Evidence must have the same artifact digest before drawing that conclusion. Static reachability also does not prove that the path executed.[[36]](#references)[[37]](#references) + +For the renderer-to-main trust boundary and handler validation, see [Electron contextIsolation RCE via IPC](electron-contextisolation-rce-via-ipc.md). + +For provider-bound native follow-up, see [Reversing Tools & Basic Methods](../../../reversing/reversing-tools-basic-methods/#evidence-backed-native-investigation-with-rea). + ## Electron auto-update attack surface Treat an updater as a remote-code-execution boundary: it retrieves executable content, decides whether that content is newer and trusted, stages it locally, and hands it to an installer. Review the complete trust graph—release index, per-version metadata, artifact, detached signatures, embedded verification key, cache, temporary path, and installer—not only whether the final `.app` is signed.[[33]](#references)[[34]](#references) @@ -771,5 +797,8 @@ Detection and mitigations - [32] [Electron BrowserWindow webPreferences](https://www.electronjs.org/docs/latest/api/browser-window#new-browserwindowoptions) - [33] [Doyensec ElectronSafeUpdater reference implementation](https://github.com/doyensec/ElectronSafeUpdater) - [34] [Electron SafeUpdater: Designing a Secure Electron Auto-Update Mechanism](https://blog.doyensec.com/2026/02/16/electron-safe-updater.html) +- [35] [REA: Reverse Engineer Anything](https://github.com/morluto/rea) +- [36] [REA JavaScript artifact reconstruction](https://github.com/morluto/rea/blob/main/docs/javascript-artifact-reconstruction.md) +- [37] [REA cross-layer JavaScript application workflows](https://github.com/morluto/rea/blob/main/docs/javascript-application-workflows.md) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/reversing/reversing-tools-basic-methods/README.md b/src/reversing/reversing-tools-basic-methods/README.md index 506815d280e..0c67ea70626 100644 --- a/src/reversing/reversing-tools-basic-methods/README.md +++ b/src/reversing/reversing-tools-basic-methods/README.md @@ -63,6 +63,18 @@ With a comprehensive add-in model and an API that extends the tool to suit your [ILSpy plugin for Visual Studio Code](https://github.com/icsharpcode/ilspy-vscode): You can have it in any OS (you can install it directly from VSCode, no need to download the git. Click on **Extensions** and **search ILSpy**).\ If you need to **decompile**, **modify** and **recompile** again you can use [**dnSpy**](https://github.com/dnSpy/dnSpy/releases) or an actively maintained fork of it, [**dnSpyEx**](https://github.com/dnSpyEx/dnSpy/releases). (**Right Click -> Modify Method** to change something inside a function). +### Execution-free managed inspection with REA + +**REA** can inspect PE/CLI metadata and CIL without loading the assembly. Start with the artifact identity, then inspect members and declared native boundaries; this is useful when reviewing suspicious calls before using a decompiler or running the program.[[16]](#references)[[17]](#references) + +```bash +rea inspect-managed-artifact /absolute/path/Assembly.dll --json +rea inspect-managed-members /absolute/path/Assembly.dll --json +rea inspect-managed-native-boundaries /absolute/path/Assembly.dll --json +``` + +For version diffing, `compare_managed_members` uses raw CIL/signature identity and decoded-instruction fingerprints rather than treating metadata tokens as stable across builds. A P/Invoke declaration is not proof that native code ran; `verify_managed_native_boundaries` needs matching native export or function Evidence to check that boundary. Keep the artifact digest, MVID and unresolved mappings with the result.[[17]](#references) + ### DNSpy Logging In order to make **DNSpy log some information in a file**, you could use this snippet: @@ -183,6 +195,24 @@ cheat-engine.md [**Decompiler Explorer**](https://dogbolt.org/) is a web front-end to a number of decompilers. This web service lets you compare the output of different decompilers on small executables. +## Evidence-backed native investigation with REA + +**REA** exposes Hopper, Ghidra and IDA analysis through CLI and MCP. It requires Node.js 22.x (at least 22.19), 24.x (at least 24.11), or 26+, plus npm. Configure an existing native provider first; check `rea providers --json` and select a provider explicitly when more than one supports the target. Use an observed function name or address from the inventory in place of `0x1000` below.[[16]](#references)[[18]](#references) + +```bash +npm install --global rea-agents +rea providers --json +rea inspect /absolute/path/to/program --provider ghidra --json +rea search /absolute/path/to/program "search" --provider ghidra --json +rea trace /absolute/path/to/program "search" --provider ghidra --json +rea xrefs /absolute/path/to/program 0x1000 --provider ghidra --json +rea function /absolute/path/to/program 0x1000 --provider ghidra --json +``` + +Start from a feature string or symbol, follow references and callers, then inspect the selected function dossier and pseudocode with `rea decompile`. REA binds a session to the selected provider rather than silently replacing it after a failure. For repeatable queries, `--snapshot PATH` reuses only matching artifact bytes, provider, settings, operation and parameters; a snapshot is a local cache, not a saved provider database. Preserve the returned Evidence and explicit unknowns instead of treating inferred paths or decompiler text as original source.[[16]](#references)[[18]](#references) + +For JavaScript/Electron entry points leading into native add-ons, see [Electron Desktop Apps](../../network-services-pentesting/pentesting-web/electron-desktop-apps/#static-asar-to-native-boundary-tracing-with-rea). + ## ARM & MIPS @@ -667,5 +697,8 @@ https://www.youtube.com/watch?v=VVbRe7wr3G4 - [13] [GoResolver: Using Control-Flow Graph Similarity to Automatically Deobfuscate Golang Binaries](https://volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically) - [14] [Volexity GoStringExtractor repository](https://github.com/volexity/GoStringExtractor) - [15] [Go Get 'Em: Updates to Volexity Golang Tooling](https://www.volexity.com/blog/2025/08/11/go-get-em-updates-to-volexity-golang-tooling/) +- [16] [REA: Reverse Engineer Anything](https://github.com/morluto/rea) +- [17] [REA managed-code analysis](https://github.com/morluto/rea/blob/main/docs/managed-code-analysis.md) +- [18] [REA CLI and Evidence guide](https://github.com/morluto/rea/blob/main/docs/cli.md) {{#include ../../banners/hacktricks-training.md}}