Electron 应用的反调试、完整性校验与授权链路安全设计

{
  "name": "acme-note",
  "version": "1.0.0",
  "main": "launch.dist.js"
}

npm install -g @electron/asar

asar list app.asar
asar extract app.asar app

const { flipFuses, FuseV1Options, FuseVersion } = require('@electron/fuses');

flipFuses('dist/AcmeNote.exe', {
  version: FuseVersion.V1,

  [FuseV1Options.RunAsNode]: false,
  [FuseV1Options.EnableNodeCliInspectArguments]: false,
  [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,

  [FuseV1Options.OnlyLoadAppFromAsar]: true,
  [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
  [FuseV1Options.EnableCookieEncryption]: true
});

{
  "version": "1.0.0",
  "files": [
    {
      "path": "launch.dist.js",
      "sha256": "..."
    },
    {
      "path": "page-dist/index.html",
      "sha256": "..."
    }
  ],
  "signature": "base64-signature"
}

const fs = require('node:fs/promises');
const path = require('node:path');
const crypto = require('node:crypto');

const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----`;

function stableStringify(value) {
  return JSON.stringify(value, Object.keys(value).sort());
}

function verifyManifestSignature(manifest) {
  const { signature, ...payload } = manifest;

  const verifier = crypto.createVerify('RSA-SHA256');
  verifier.update(stableStringify(payload));
  verifier.end();

  return verifier.verify(
    PUBLIC_KEY,
    Buffer.from(signature, 'base64')
  );
}

async function sha256(filePath) {
  const data = await fs.readFile(filePath);
  return crypto.createHash('sha256').update(data).digest('hex');
}

async function verifyFiles(appDir) {
  const manifestPath = path.join(appDir, 'integrity.manifest.json');
  const manifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));

  if (!verifyManifestSignature(manifest)) {
    throw new Error('Integrity manifest signature is invalid');
  }

  for (const file of manifest.files) {
    const actual = await sha256(path.join(appDir, file.path));

    if (actual !== file.sha256) {
      throw new Error(`File has been modified: ${file.path}`);
    }
  }
}

const { contextBridge, ipcRenderer } = require('electron');

contextBridge.exposeInMainWorld('license', {
  activateOffline(code) {
    return ipcRenderer.invoke('license.activateOffline', code);
  }
});

const { ipcMain } = require('electron');

ipcMain.handle('license.activateOffline', async (_event, code) => {
  if (typeof code !== 'string' || code.length > 4096) {
    return {
      ok: false,
      message: 'Invalid license code format'
    };
  }

  const result = await verifyOfflineLicense(code);

  if (!result.ok) {
    return {
      ok: false,
      message: 'License verification failed'
    };
  }

  return {
    ok: true,
    expiresAt: result.expiresAt
  };
});

const win = new BrowserWindow({
  webPreferences: {
    nodeIntegration: false,
    contextIsolation: true,
    sandbox: true,
    preload: path.join(__dirname, 'preload.js')
  }
});

{
  "product": "acme-note",
  "version": "win|1.0.0",
  "fingerprint": "device-fingerprint",
  "email": "user@example.com",
  "licenseId": "LIC-2026-0001",
  "issuedAt": "2026-06-07",
  "expiresAt": "2027-06-07",
  "type": "pro"
}

base64url(payload).base64url(signature)

const crypto = require('node:crypto');

const PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
...
-----END PUBLIC KEY-----`;

function base64urlDecode(input) {
  input = input.replace(/-/g, '+').replace(/_/g, '/');
  return Buffer.from(input, 'base64');
}

function verifyLicenseToken(token, currentFingerprint) {
  const parts = token.split('.');

  if (parts.length !== 2) {
    return { ok: false, reason: 'Malformed token' };
  }

  const [payloadPart, signaturePart] = parts;

  const payloadBuffer = base64urlDecode(payloadPart);
  const signatureBuffer = base64urlDecode(signaturePart);

  const verifier = crypto.createVerify('RSA-SHA256');
  verifier.update(payloadPart);
  verifier.end();

  const signatureValid = verifier.verify(PUBLIC_KEY, signatureBuffer);

  if (!signatureValid) {
    return { ok: false, reason: 'Invalid signature' };
  }

  const payload = JSON.parse(payloadBuffer.toString('utf8'));

  if (payload.fingerprint !== currentFingerprint) {
    return { ok: false, reason: 'Device mismatch' };
  }

  if (new Date(payload.expiresAt).getTime() < Date.now()) {
    return { ok: false, reason: 'License expired' };
  }

  return {
    ok: true,
    license: payload
  };
}

{
  "success": true
}

{
  "licenseId": "LIC-2026-0001",
  "status": "active",
  "expiresAt": "2027-06-07T00:00:00.000Z",
  "nonce": "random-from-client",
  "issuedAt": "2026-06-07T12:00:00.000Z",
  "signature": "base64-signature"
}

function verifyRenewResponse(response, expectedNonce) {
  const { signature, ...payload } = response;

  if (payload.nonce !== expectedNonce) {
    return { ok: false, reason: 'Nonce mismatch' };
  }

  const verifier = crypto.createVerify('RSA-SHA256');
  verifier.update(JSON.stringify(payload));
  verifier.end();

  const valid = verifier.verify(
    PUBLIC_KEY,
    Buffer.from(signature, 'base64')
  );

  if (!valid) {
    return { ok: false, reason: 'Invalid server signature' };
  }

  return { ok: true, payload };
}