1.4 KiB
JavaScript and Electron application artifacts
Use analyze_javascript_application for an operator-supplied ASAR or extracted
tree beneath an approved investigation root. Every call requires approved: true; source-map contents require separate approval. Keep the default summary.
Use its counts, roots, node kinds, top findings, coverage, unknowns, and graph
page URIs before requesting more data.
BrowserWindow preferences, preload and contextBridge surfaces, IPC
registrations, utility processes, and native binding requests are static syntax
observations. Only a unique exact literal IPC channel match supports an inferred
pairing. Dynamic or ambiguous channels remain unresolved. A requested .node
member is not a verified native export. Never claim runtime reachability,
registration, defaults, or policy enforcement from static analysis.
Use trace_application_feature on existing application Evidence for one
literal node ID, route, string, API, IPC channel, module, or native export.
Choose a direction and finite bounds. Link Hopper or Ghidra Evidence only when
the exact artifact digest matches.
For version comparison, analyze each version once, then call
compare_application_versions. Accept only its digest, source-map, structural
fingerprint, or non-module semantic matches. Module ordinals and minified names
are not persistent identity. Report added or removed only with complete
opposite-side coverage; otherwise report unknown.