Extraction stops if a file has a size of < 0

Normally a file shouldn’t have a size less than 0, but when it does the extraction process just exits with:

$ asar extract app.asar extracted

buffer.js:250
    throw new ERR_INVALID_OPT_VALUE.RangeError('size', size);
    ^

RangeError [ERR_INVALID_OPT_VALUE]: The value "-1000" is invalid for option "size"
    at Function.alloc (buffer.js:259:3)
    at new Buffer (buffer.js:177:19)
    at Object.module.exports.readFileSync (C:\Users\Me\AppData\Roaming\npm\node_modules\asar\lib\disk.js:117:16)
    at C:\Users\Me\AppData\Roaming\npm\node_modules\asar\lib\asar.js:214:28
    at Array.map (<anonymous>)
    at Object.module.exports.extractAll (C:\Users\Me\AppData\Roaming\npm\node_modules\asar\lib\asar.js:192:20)
    at Command.<anonymous> (C:\Users\Me\AppData\Roaming\npm\node_modules\asar\bin\asar.js:60:15)
    at Command.listener (C:\Users\Me\AppData\Roaming\npm\node_modules\asar\node_modules\commander\index.js:315:8)
    at Command.emit (events.js:203:13)
    at Command.parseArgs (C:\Users\Me\AppData\Roaming\npm\node_modules\asar\node_modules\commander\index.js:651:12)

I think this is unexpected behaviour and the file should be skipped instead, allowing the extraction of other files in the archive to continue.

Here is a possible fix, but I’m not sure what your thoughts are on this, so ill wait with opening a pull request.

[xssc]

hey, @sleeyax , i think you should reopen this issue, it is very important “while experimenting with an electron-based application you do not own” as you put it

[andrewschreiber]

Hey fellow investigators 😃

If you open up one of these “obfuscated” .asars with a compatible (!) text editor (~maybe vim app.asar) what you find is a header:

".codesign":{"size":-1000,"offset":"0"}

The only match for -1000 in the entire asar file. Compared to a normal asar, this obfuscated asar also has thousands of unicode characters between the header JSON and the first actual file.

I played with stripping out the unicode, changing the codesign size, etc. but kept running into JSON parsing issues when extracting.

Might revisit more later. Looks like there is a new (secret??) codesigning framework for sourcecode protection for electron. I suspect if you could figure out the right value for size, swap the value with the text editor, it might work. If anyone can find the electron codesigning package that does this, that would be very helpful!