AN INDEPENDENT FIELD GUIDE TO REVERSE ENGINEER ANYTHING Meet the open-source project ↗
Tested lab / Intermediate

The interesting part of an Electron button is often the bridge.

Read renderer, preload and main-process relationships without assuming that matching names prove runtime behavior.

Your reading list

The interface says “Export.” The file writer lives somewhere else. In an Electron app, the distance between those two places is often an IPC bridge, and that bridge gives you a useful route through a large package.

The three places to keep straight

The renderer handles the page. A preload script can expose a limited API to it. The main process handles application-level operations. Our Pocket Notes fixture makes that separation visible with one file for each role.

REA’s static analysis found the preload entrypoint and a matched IPC relationship in this fixture. It did not execute those files. That is the evidence boundary for the walkthrough below.

Screenshots below capture actual REA 6.8.0 CLI output, rendered from recorded command stdout in xterm.js on 27 October 2026. Orange arrows sit in a separate margin. Where a source excerpt follows REA output, the caption identifies it. Expand any image to read the details. Download the commands, view requests and evidence, or read the command transcripts.

1. Find the page-facing call

In renderer.js, the button’s event listener calls window.notesAPI.exportNotes(notes) and then updates a status message. This tells you the API the page expects, but it does not yet tell you how a file is written.

REA identifies the HTML renderer entrypoint; its source calls window.notesAPI.exportNotes.

Actual REA renderer facts followed by nl output of renderer.js from our fixture. The repeated HTML entrypoint comes from two static observations.

Look for the bridge definition next. In a real bundle, aliases and wrappers may make this less direct. Preserve the source location you started from so you can revisit the chain.

2. Match the channel, not just the method name

The preload defines exportNotes in an exposed API and invokes notes:export. The main process registers a handler using the same literal string.

Real REA facts show notes:export invoked on the renderer side and handled on the main side.

Actual REA channel observations. Both operations share the literal channel, while runtime reachability remains unproven.

A matching string makes a useful static link. A dynamically assembled channel may remain unresolved. Avoid “fixing” an unresolved relationship by inventing the string that would make the diagram look complete.

3. Read the handler’s conditions

The receiver contains a cancellation branch before CSV construction and the file write. That branch is part of the behavior, not incidental code to skip over.

Real REA handler facts and fixture source show cancellation before the UTF-8 file write.

Actual REA facts followed by a source excerpt. The arrows label the early return and writeFile without covering either statement.

The fixture quotes CSV values and doubles embedded quotes. It also lacks production concerns such as sender validation, a strict input schema and complete error handling. A tutorial fixture is useful precisely because we can state what it leaves out.

What changes in a real app

A bridge may use helper factories, assembled APIs or message ports. One visible call can delegate through several wrappers before it reaches Electron’s underlying APIs. A static analyzer can locate candidates, while reading the wrapper body establishes how values flow through them.

The Notion clipboard case is a good example of why those extra hops matter. It is an attributed case study of a specific package version, not a guarantee about today’s installed Notion app.

A useful stopping point

Stop when you can name the page API, transport operation, receiver, relevant branch and final effect, with a source location for each. Keep any unproven runtime condition in the report.

Then make an explicit decision about runtime validation. Static reachability and a successful export are different claims. For the first claim, the inspected source may be enough. For the second, you need a controlled run with a known input and a checked output file.

Sources & further reading

Local fixture inspected with REA. Static findings and runtime unknowns are stated in the guide. Our method

KEEP THE QUESTION GOING

Do you actually need Ghidra, Hopper, or IDA?

Intermediate · 3 MIN READ
ONE MORE GOOD QUESTION

Keep investigating.

All guides

Open full-resolution image ↗