asarmor

To protect your Electron application using electron-builder, you must use afterPack and beforePack hooks to encrypt the ASAR and include the required native .node files.

Steps:

1. Update afterPack.js: Use asarmor.encrypt and asarmor.open().patch() to secure the app.asar.
2. Create beforePack.js: Copy main.node and renderer.node from the asarmor build directory to your project's release folder.
3. Update package.json:
   • Set afterPack and beforePack hooks.
   • Change the main entrypoint from .js to the path of main.node.
4. Configure BrowserWindow:
   • nodeIntegration MUST be true.
   • contextIsolation MUST be false.
   • Preload scripts are NOT supported.
5. Bootstrap the Render Process: Use executeJavaScript to require the native .node and the renderer .js files.
6. Main Process Entrypoint: Export a default function that accepts a Uint8Array decryption key to bootstrap the application.

// Example afterPack.js logic
const asarPath = join(packager.getResourcesDir(appOutDir), 'app.asar');
const archive = await asarmor.open(asarPath);
archive.patch();
await archive.write(asarPath);

For electron-forge (specifically Vite + TypeScript setups), use the packageAfterCopy and postPackage hooks.

Steps:

1. Update forge.config.ts hooks:
   • packageAfterCopy: Copy main.node and renderer.node from asarmor's release folder to your build directory.
   • postPackage: Encrypt the app.asar and apply patches.
2. Update package.json: Change main entrypoint to point to the .node file (e.g., .vite/build/main.node).
3. Vite Configuration (Optional): If using Vite, it is recommended to disable chunk splitting for renderer assets to ensure correct bootstrapping.
4. Configure BrowserWindow:
   • nodeIntegration MUST be true.
   • contextIsolation MUST be false.
   • Preload scripts are NOT supported.
5. Bootstrap the Render Process: Use executeJavaScript to require the native renderer.node and your renderer asset (e.g., ./assets/index.js).
6. Main Process Entrypoint: Export a default function accepting a Uint8Array decryption key to initialize the app.

// Example postPackage hook in forge.config.ts
postPackage: async (forgeConfig, buildPath) => {
  const asarPath = `${buildPath.outputPaths[0]}/resources/app.asar`;
  await asarmor.encrypt({ src: asarPath, dst: asarPath });
  const archive = await asarmor.open(asarPath);
  archive.patch();
  await archive.write(asarPath);
}

To use asarmor in an Electron Forge project, you must use the hooks configuration to handle native dependency copying and the encryption/patching process.

1. packageAfterCopy: Use this hook to copy the native asarmor binaries (main.node and renderer.node) from your node_modules into the build directory. This ensures the native modules are available in the packaged application.
2. postPackage: Use this hook to perform the security operations. This involves calling asarmor.encrypt to encrypt JavaScript files within the .asar archive and using asarmor.open followed by .patch() and .write() to apply security patches to the archive.

const config: ForgeConfig = {
  // ... other config
  hooks: {
    packageAfterCopy: async (forgeConfig, buildPath) => {
      const release = join(__dirname, 'node_modules', 'asarmor', 'build', 'Release');
      // Copy main.node
      await copyFile(
        join(release, 'main.node'),
        join(buildPath, '.vite', 'build', 'main.node')
      );
      // Copy renderer.node
      await copyFile(
        join(release, 'renderer.node'),
        join(buildPath, '.vite', 'renderer', 'main_window', 'renderer.node')
      );
    },
    postPackage: async (forgeConfig, buildPath) => {
      const asarPath = `${buildPath.outputPaths[0]}/resources/app.asar`;
      
      // Encrypt JS files in the ASAR
      await asarmor.encrypt({
        src: asarPath,
        dst: asarPath,
      });

      // Apply patches to the ASAR
      const archive = await asarmor.open(asarPath);
      archive.patch();
      await archive.write(asarPath);
    },
  },
};