For the ones who wants to take a look, here are some informations about how Passware (2025) works.
Passware is a
Please,
Log in
to view URLs content!
(
Please,
Log in
to view URLs content!
)
This means you'll have to deal with the ASAR file "
resources/app.asar" you can unpack using this command:
npx asar extract "%ProgramFiles%\Passware\Passware Kit Mobile 2025\resources\app.asar" "%ProgramFiles%\Passware\Passware Kit Mobile 2025\resources\app.asar.unpacked.work_in_progress"
repack using:
npx asar pack "%ProgramFiles%\Passware\Passware Kit Mobile 2025\resources\app.asar.unpacked.work_in_progress" "%ProgramFiles%\Passware\Passware Kit Mobile 2025\resources\app.asar"
The main interesting file is "
resources/app.asar.unpacked.work_in_progress/bundle.js"
Logs are located at
%appdata%\Passware\Passware Kit Mobile\pw-logs
You can also take a look at the web
DevTools by running:
PasswareKitMobile.exe --enable-logging --inspect --remote-debugging-port=8315 --remote-allow-origins=*
It will return you a two lines with URLS starting by "ws://", copy the one looking like this:
DevTools listening on ws://127.0.0.1:8315/devtools/browser/8566935b-5a14-4cb9-bb66-81fa10a73a7c
Then open your browser to this URL
Please,
Log in
to view URLs content!
, click on the link named "
Passware" and you'll see a page looking like this:
Here is all I have figured out for now.
At least you all know how to take a look by yourself.
*Notes*:
- There are two ".node" files "mobile.node" and "positron.node", I'm not sure if they are important but there are some cross references between bundle.js and the .node files but I don't know how to read/unpack them.
- To see the web traffic, use Fiddler (Please,
Log in
to view URLs content!
)