[GH-ISSUE #3685] [Feature] Chromium Embedded Framework reverse engineering: libcef, helper processes, V8 bindings, custom schemes and IPC reconstruction #1397

New issue

Open

opened 2026-10-16 21:05:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:04 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3685

Problem Statement & Context

Chromium Embedded Framework (CEF)—powered by libcef.dll (Windows), libcef.so (Linux), or Chromium Embedded Framework.framework (macOS)—powers over 100 million client installations worldwide across desktop applications (e.g., Spotify desktop shell, Adobe Creative Cloud desktop, game launchers, trading terminals, and Steam UI).

Unlike Electron, which merges Node.js and Chromium event loops into unified JavaScript runtimes, CEF follows a distinct C++ multi-process embedding architecture:

Helper / Subprocesses: Separate browser, renderer, GPU, and utility executables governed by CefApp and CefExecuteProcess.
C++ V8 JavaScript Bindings: Native C++ classes implementing CefV8Handler and CefV8Accessor registered via CefV8Value::CreateFunction during CefRenderProcessHandler::OnContextCreated.
Cross-Process IPC: Inter-process message passing via CefProcessMessage and CefMessageRouter bridging browser and renderer processes.
Custom Schemes & Resource Handlers: Custom protocols registered via CefSchemeRegistrar, handled through CefResourceHandler or CefSchemeHandlerFactory.
Chromium PAK & Localization Resources: Bundled assets (cef.pak, cef_100_percent.pak, resources.pak, icudtl.dat).

Without dedicated CEF reverse engineering, reverse engineers analyzing libcef-based targets struggle to bridge native C++ entrypoints with rendered web applications.

Proposed Architecture

flowchart TD
    A["CEF Application (Main EXE + libcef + Helper Processes)"] --> B["CEF Semantic Reconstruction Engine"]
    B --> C["CefApp & Process Lifecycle Mapper"]
    B --> D["V8 Extension & Handler Decompiler"]
    B --> E["CEF IPC & Message Router Analyzer"]
    B --> F["Custom Scheme & PAK Resource Extractor"]
    
    C --> C1["CefExecuteProcess & Subprocess Command-lines"]
    C --> C2["Browser / Renderer / Plugin Process Roles"]
    
    D --> D1["CefRenderProcessHandler::OnContextCreated"]
    D --> D2["CefV8Handler::Execute Callbacks"]
    D --> D3["window Binding Injections"]
    
    E --> E1["CefProcessMessage (PID, Message Name, Arguments)"]
    E --> E2["CefMessageRouter Queries & Handlers"]
    
    F --> F1["Custom URL Schemes (CefSchemeRegistrar)"]
    F --> F2["Pak File Asset Decoupling (HTML, CSS, JS)"]
    
    C & D & E & F --> G["Unified CEF Native ↔ V8 ↔ Renderer Interaction Graph"]

Technical Capabilities & Modules

CEF Binary & Subprocess Identification:
- Detect libcef exports, symbols, and version headers (cef_version.h).
- Identify main process vs helper subprocesses (--type=renderer, --type=gpu-process, --type=utility).
- Correlate CefSettings configurations: cache path, remote debugging port, single process mode, and security flags (web_security_disabled).
C++ V8 Native Binding & Handler Discovery:
- Locate implementations of CefRenderProcessHandler::OnContextCreated and OnWebKitInitialized.
- Identify native classes inheriting from CefV8Handler, CefV8Accessor, and CefV8Interceptor.
- Extract JavaScript global object modifications (window.<custom_api>) and map native C++ method callbacks to JavaScript function names.
Inter-Process Communication (IPC) Protocol Recovery:
- Trace CefBrowser::SendProcessMessage and CefFrame::SendProcessMessage.
- Correlate with message reception sinks: OnProcessMessageReceived across browser and renderer process handlers.
- Decode message payloads (CefListValue, CefBinaryValue, JSON parameters).
- Reconstruct asynchronous query routing implemented via CefMessageRouterBrowserSide / CefMessageRouterRendererSide.
Custom Scheme & Resource Interception:
- Locate CefApp::OnRegisterCustomSchemes to extract custom protocol names and security attributes (e.g. is_standard, is_local, is_cors_enabled).
- Map CefSchemeHandlerFactory and CefResourceRequestHandler to discover custom asset virtual servers.
PAK Container Extraction & Asset Reconstruction:
- Parse Chromium .pak format headers, resource ID tables, and compressed data streams (Brotli/Zlib).
- Correlate extracted HTML, CSS, JavaScript, and WebAssembly assets with registered V8 extensions.

Acceptance Criteria

Automated detection of CEF binaries, version identification, and process hierarchy reconstruction.
Recovery of native C++ V8 handlers and their corresponding exposed JavaScript APIs on window.
Bidirectional IPC mapping of CefProcessMessage and CefMessageRouter query flows.
Decompilation of custom scheme handlers and correlation with unpacked .pak web resources.
Export of a comprehensive architecture graph depicting CEF native-web interactions.

Complements #3624 (Native C++ semantic reconstruction: RTTI, vtables)
Complements #3608 (React Semantic Reconstruction & Decompiler Engine)
Complements #117 (Full-stack reconstruction)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3685 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context Chromium Embedded Framework (CEF)—powered by `libcef.dll` (Windows), `libcef.so` (Linux), or `Chromium Embedded Framework.framework` (macOS)—powers over 100 million client installations worldwide across desktop applications (e.g., Spotify desktop shell, Adobe Creative Cloud desktop, game launchers, trading terminals, and Steam UI). Unlike Electron, which merges Node.js and Chromium event loops into unified JavaScript runtimes, CEF follows a distinct C++ multi-process embedding architecture: 1. **Helper / Subprocesses**: Separate browser, renderer, GPU, and utility executables governed by `CefApp` and `CefExecuteProcess`. 2. **C++ V8 JavaScript Bindings**: Native C++ classes implementing `CefV8Handler` and `CefV8Accessor` registered via `CefV8Value::CreateFunction` during `CefRenderProcessHandler::OnContextCreated`. 3. **Cross-Process IPC**: Inter-process message passing via `CefProcessMessage` and `CefMessageRouter` bridging browser and renderer processes. 4. **Custom Schemes & Resource Handlers**: Custom protocols registered via `CefSchemeRegistrar`, handled through `CefResourceHandler` or `CefSchemeHandlerFactory`. 5. **Chromium PAK & Localization Resources**: Bundled assets (`cef.pak`, `cef_100_percent.pak`, `resources.pak`, `icudtl.dat`). Without dedicated CEF reverse engineering, reverse engineers analyzing `libcef`-based targets struggle to bridge native C++ entrypoints with rendered web applications. ### Proposed Architecture ```mermaid flowchart TD A["CEF Application (Main EXE + libcef + Helper Processes)"] --> B["CEF Semantic Reconstruction Engine"] B --> C["CefApp & Process Lifecycle Mapper"] B --> D["V8 Extension & Handler Decompiler"] B --> E["CEF IPC & Message Router Analyzer"] B --> F["Custom Scheme & PAK Resource Extractor"] C --> C1["CefExecuteProcess & Subprocess Command-lines"] C --> C2["Browser / Renderer / Plugin Process Roles"] D --> D1["CefRenderProcessHandler::OnContextCreated"] D --> D2["CefV8Handler::Execute Callbacks"] D --> D3["window Binding Injections"] E --> E1["CefProcessMessage (PID, Message Name, Arguments)"] E --> E2["CefMessageRouter Queries & Handlers"] F --> F1["Custom URL Schemes (CefSchemeRegistrar)"] F --> F2["Pak File Asset Decoupling (HTML, CSS, JS)"] C & D & E & F --> G["Unified CEF Native ↔ V8 ↔ Renderer Interaction Graph"] ``` ### Technical Capabilities & Modules 1. **CEF Binary & Subprocess Identification:** - Detect `libcef` exports, symbols, and version headers (`cef_version.h`). - Identify main process vs helper subprocesses (`--type=renderer`, `--type=gpu-process`, `--type=utility`). - Correlate `CefSettings` configurations: cache path, remote debugging port, single process mode, and security flags (`web_security_disabled`). 2. **C++ V8 Native Binding & Handler Discovery:** - Locate implementations of `CefRenderProcessHandler::OnContextCreated` and `OnWebKitInitialized`. - Identify native classes inheriting from `CefV8Handler`, `CefV8Accessor`, and `CefV8Interceptor`. - Extract JavaScript global object modifications (`window.<custom_api>`) and map native C++ method callbacks to JavaScript function names. 3. **Inter-Process Communication (IPC) Protocol Recovery:** - Trace `CefBrowser::SendProcessMessage` and `CefFrame::SendProcessMessage`. - Correlate with message reception sinks: `OnProcessMessageReceived` across browser and renderer process handlers. - Decode message payloads (`CefListValue`, `CefBinaryValue`, JSON parameters). - Reconstruct asynchronous query routing implemented via `CefMessageRouterBrowserSide` / `CefMessageRouterRendererSide`. 4. **Custom Scheme & Resource Interception:** - Locate `CefApp::OnRegisterCustomSchemes` to extract custom protocol names and security attributes (e.g. `is_standard`, `is_local`, `is_cors_enabled`). - Map `CefSchemeHandlerFactory` and `CefResourceRequestHandler` to discover custom asset virtual servers. 5. **PAK Container Extraction & Asset Reconstruction:** - Parse Chromium `.pak` format headers, resource ID tables, and compressed data streams (Brotli/Zlib). - Correlate extracted HTML, CSS, JavaScript, and WebAssembly assets with registered V8 extensions. ### Acceptance Criteria - [ ] Automated detection of CEF binaries, version identification, and process hierarchy reconstruction. - [ ] Recovery of native C++ V8 handlers and their corresponding exposed JavaScript APIs on `window`. - [ ] Bidirectional IPC mapping of `CefProcessMessage` and `CefMessageRouter` query flows. - [ ] Decompilation of custom scheme handlers and correlation with unpacked `.pak` web resources. - [ ] Export of a comprehensive architecture graph depicting CEF native-web interactions. ### Related Issues & Dependencies - Complements #3624 (Native C++ semantic reconstruction: RTTI, vtables) - Complements #3608 (React Semantic Reconstruction & Decompiler Engine) - Complements #117 (Full-stack reconstruction)

bsakaguchi referenced this issue

2026-10-17 21:11:01 +00:00

[PR #1393] [MERGED] fix(javascript): stop reading media preload attributes as Electron preloads #2850

bsakaguchi referenced this issue

2026-10-17 21:11:02 +00:00

[PR #1397] [MERGED] fix(cli): accept JSON files for web capture and screenshot comparisons #2854