What changed in this Electron update? Diffing two app.asar builds without running either

说明与用途

hexvero 能够在不运行 Electron 应用的情况下，静态比较两个 app.asar 包，报告文件/行更改、IPC 通道增删以及窗口设置差异。

问题

Determine what changed between two Electron app builds without executing them.

结果

hexvero identified that 1.5.0 removed the openInShell IPC channel, added checkUpdate, changed window nodeIntegration from true to false and sandbox from false to true, and flagged unresolved IPC channels from environment-variable-based names.

工作流

• Install Node 22+
• Run npx hexvero demo to copy example builds
• Run npx hexvero compare notesdesk-1.4.0.asar notesdesk-1.5.0.asar --report report.md to generate a Markdown report
• Optionally launch the UI with npx hexvero ui --demo --open to view source lines

证据

hexvero joins the three: interfaces (2) + preload.js::notesdesk::checkUpdate @ b: preload.js:9, handler main.js:30 · link direct - preload.js::notesdesk::openInShell @ a: preload.js:9, handler main.js:30 · link direct

来源

1.5.0 registers plugin:${name} channels with names from an environment variable. No static reading can list them.

来源

It reads files; it never runs the app. A finding is what the code contains, not what it does, and not proof that anything is exploitable.

来源