Attempt to write outside buffer bounds

Expected Behavior I want to extract an asar file using asar extract app.asar command.

Actual Behavior I get the following error: RangeError [ERR_BUFFER_OUT_OF_BOUNDS]: Attempt to write outside buffer bounds

To Reproduce Run asar extract app.asar command on asar file.

Screenshots https://i.imgur.com/zmNOSqq.png

[malept]

Can someone please provide a minimal testcase for this?

[AxDSan]

The error “attempted to write outside buffer bounds” means exactly that, when attempting to write to the buffer it went outside its capacity, meaning it got past the amount of elements of what it’s supposed to have. In this case CocosCreator ASAR has been packed in such a way that it doesn’t even read properly the file because the contents have been encrypted.

The unpacking process of the ASAR files starts from the very beginning, of course… The extractor needs to read the headers first and then verify its contents, like where each file is (you can read more about ASAR file format here: ASAR Format) afterwards, it just proceeds to unpack the file given its header information.

Going back to the discussion, as per example:

Asar’s transform option allows to specify a stream transformer that is applied when the files are packed into the asar container. However at some point you will have to decrypt your files and this is where it gets really tricky. Also, if your static password leaks you’re not winning anything.

const crypto = require('crypto')
var password = new Buffer(‘my secret password’);
function transform(filename) {
 return crypto.createCipher(‘aes-256-cbc’, password);
}
asar.createPackageWithOptions(src, dest, { transform: transform }..)

this means they have packaged their application with a specific transformation option that may have probably encrypted the contents of the headers… since when you open the file only the header is encrypted, and not the actual file contents, or even the names, which if you ask me if quite a smart thing to do!👌