Specifications of V8 snapshot binaries / debugging

Question

I stumbled with NW and it's ability to load "compiled javascript binary files". After further reading (first I thought that would be just some minified javascript) I discovered that the docs were talking about actual binary files. It turns out V8 can build a snapshot of a loaded JS source code and dump it to a file, which can then be loaded back into memory.

https://github.com/nwjs/nw.js/wiki/Protect-JavaScript-source-code-with-v8-snapshot

Are there any specifications about the structure of those binary files? Is there a way I can load such a binary file in a disassembler (say IDA Pro)?

Answer 1

(V8 developer here.) No, the format of V8's snapshot files is an internal implementation detail that is neither documented nor assumed to be stable across versions (on the contrary; V8 assumes that any snapshot that wasn't created by the exact same version is incompatible). There is no supported way to load a snapshot file into a disassembler; the way to inspect a snapshot's contents is to debug its creation and/or deserialization.

The background for this situation is that the snapshot files are intended to be a kind of on-disk cache to speed up startup. They are not intended to be distributable binaries.