diff --git a/doc/api/cli.md b/doc/api/cli.md
index 27a539e6de8819..af1ca0bfe64887 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -100,6 +100,62 @@ If this flag is passed, the behavior can still be set to not abort through
 [`process.setUncaughtExceptionCaptureCallback()`][] (and through usage of the
 `node:domain` module that uses it).
 
+### `--build-snapshot`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Generates a snapshot blob when the process exits and writes it to
+disk, which can be loaded later with `--snapshot-blob`.
+
+When building the snapshot, if `--snapshot-blob` is not specified,
+the generated blob will be written, by default, to `snapshot.blob`
+in the current working directory. Otherwise it will be written to
+the path specified by `--snapshot-blob`.
+
+```console
+$ echo "globalThis.foo = 'I am from the snapshot'" > snapshot.js
+
+# Run snapshot.js to intialize the application and snapshot the
+# state of it into snapshot.blob.
+$ node --snapshot-blob snapshot.blob --build-snapshot snapshot.js
+
+$ echo "console.log(globalThis.foo)" > index.js
+
+# Load the generated snapshot and start the application from index.js.
+$ node --snapshot-blob snapshot.blob index.js
+I am from the snapshot
+```
+
+The [`v8.startupSnapshot` API][] can be used to specify an entry point at
+snapshot building time, thus avoiding the need of an additional entry
+script at deserialization time:
+
+```console
+$ echo "require('v8').startupSnapshot.setDeserializeMainFunction(() => console.log('I am from the snapshot'))" > snapshot.js
+$ node --snapshot-blob snapshot.blob --build-snapshot snapshot.js
+$ node --snapshot-blob snapshot.blob
+I am from the snapshot
+```
+
+For more information, check out the [`v8.startupSnapshot` API][] documentation.
+
+Currently the support for run-time snapshot is experimental in that:
+
+1. User-land modules are not yet supported in the snapshot, so only
+   one single file can be snapshotted. Users can bundle their applications
+   into a single script with their bundler of choice before building
+   a snapshot, however.
+2. Only a subset of the built-in modules work in the snapshot, though the
+   Node.js core test suite checks that a few fairly complex applications
+   can be snapshotted. Support for more modules are being added. If any
+   crashes or buggy behaviors occur when building a snapshot, please file
+   a report in the [Node.js issue tracker][] and link to it in the
+   [tracking issue for user-land snapshots][].
+
 ### `--completion-bash`
 
 <!-- YAML
@@ -1105,6 +1161,22 @@ minimum allocation from the secure heap. The minimum value is `2`.
 The maximum value is the lesser of `--secure-heap` or `2147483647`.
 The value given must be a power of two.
 
+### `--snapshot-blob=path`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+When used with `--build-snapshot`, `--snapshot-blob` specifies the path
+where the generated snapshot blob will be written to. If not specified,
+the generated blob will be written, by default, to `snapshot.blob`
+in the current working directory.
+
+When used without `--build-snapshot`, `--snapshot-blob` specifies the
+path to the blob that will be used to restore the application state.
+
 ### `--test`
 
 <!-- YAML
@@ -1727,6 +1799,7 @@ Node.js options that are allowed are:
 * `--require`, `-r`
 * `--secure-heap-min`
 * `--secure-heap`
+* `--snapshot-blob`
 * `--test-only`
 * `--throw-deprecation`
 * `--title`
@@ -2100,6 +2173,7 @@ done
 [ECMAScript module loader]: esm.md#loaders
 [Fetch API]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
 [Modules loaders]: packages.md#modules-loaders
+[Node.js issue tracker]: https://github.com/nodejs/node/issues
 [OSSL_PROVIDER-legacy]: https://www.openssl.org/docs/man3.0/man7/OSSL_PROVIDER-legacy.html
 [REPL]: repl.md
 [ScriptCoverage]: https://chromedevtools.github.io/devtools-protocol/tot/Profiler#type-ScriptCoverage
@@ -2130,6 +2204,7 @@ done
 [`tls.DEFAULT_MAX_VERSION`]: tls.md#tlsdefault_max_version
 [`tls.DEFAULT_MIN_VERSION`]: tls.md#tlsdefault_min_version
 [`unhandledRejection`]: process.md#event-unhandledrejection
+[`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
 [`worker_threads.threadId`]: worker_threads.md#workerthreadid
 [conditional exports]: packages.md#conditional-exports
 [context-aware]: addons.md#context-aware-addons
@@ -2145,4 +2220,5 @@ done
 [security warning]: #warning-binding-inspector-to-a-public-ipport-combination-is-insecure
 [semi-space]: https://www.memorymanagement.org/glossary/s.html#semi.space
 [timezone IDs]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
+[tracking issue for user-land snapshots]: https://github.com/nodejs/node/issues/44014
 [ways that `TZ` is handled in other environments]: https://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html
diff --git a/src/env.cc b/src/env.cc
index 3366e6b33fc9db..fe5e06f70bd44f 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -248,17 +248,6 @@ std::ostream& operator<<(std::ostream& output,
   return output;
 }
 
-std::ostream& operator<<(std::ostream& output,
-                         const std::vector<PropInfo>& vec) {
-  output << "{\n";
-  for (const auto& info : vec) {
-    output << "  { \"" << info.name << "\", " << std::to_string(info.id) << ", "
-           << std::to_string(info.index) << " },\n";
-  }
-  output << "}";
-  return output;
-}
-
 std::ostream& operator<<(std::ostream& output,
                          const IsolateDataSerializeInfo& i) {
   output << "{\n"
@@ -298,7 +287,7 @@ IsolateDataSerializeInfo IsolateData::Serialize(SnapshotCreator* creator) {
   for (size_t i = 0; i < AsyncWrap::PROVIDERS_LENGTH; i++)
     info.primitive_values.push_back(creator->AddData(async_wrap_provider(i)));
 
-  size_t id = 0;
+  uint32_t id = 0;
 #define V(PropertyName, TypeName)                                              \
   do {                                                                         \
     Local<TypeName> field = PropertyName();                                    \
@@ -352,7 +341,7 @@ void IsolateData::DeserializeProperties(const IsolateDataSerializeInfo* info) {
 
   const std::vector<PropInfo>& values = info->template_values;
   i = 0;  // index to the array
-  size_t id = 0;
+  uint32_t id = 0;
 #define V(PropertyName, TypeName)                                              \
   do {                                                                         \
     if (values.size() > i && id == values[i].id) {                             \
@@ -1482,6 +1471,7 @@ std::ostream& operator<<(std::ostream& output,
 AsyncHooks::SerializeInfo AsyncHooks::Serialize(Local<Context> context,
                                                 SnapshotCreator* creator) {
   SerializeInfo info;
+  // TODO(joyeecheung): some of these probably don't need to be serialized.
   info.async_ids_stack = async_ids_stack_.Serialize(context, creator);
   info.fields = fields_.Serialize(context, creator);
   info.async_id_fields = async_id_fields_.Serialize(context, creator);
@@ -1676,7 +1666,7 @@ EnvSerializeInfo Environment::Serialize(SnapshotCreator* creator) {
   info.should_abort_on_uncaught_toggle =
       should_abort_on_uncaught_toggle_.Serialize(ctx, creator);
 
-  size_t id = 0;
+  uint32_t id = 0;
 #define V(PropertyName, TypeName)                                              \
   do {                                                                         \
     Local<TypeName> field = PropertyName();                                    \
@@ -1693,6 +1683,22 @@ EnvSerializeInfo Environment::Serialize(SnapshotCreator* creator) {
   return info;
 }
 
+std::ostream& operator<<(std::ostream& output,
+                         const std::vector<PropInfo>& vec) {
+  output << "{\n";
+  for (const auto& info : vec) {
+    output << "  " << info << ",\n";
+  }
+  output << "}";
+  return output;
+}
+
+std::ostream& operator<<(std::ostream& output, const PropInfo& info) {
+  output << "{ \"" << info.name << "\", " << std::to_string(info.id) << ", "
+         << std::to_string(info.index) << " }";
+  return output;
+}
+
 std::ostream& operator<<(std::ostream& output,
                          const std::vector<std::string>& vec) {
   output << "{\n";
@@ -1774,7 +1780,7 @@ void Environment::DeserializeProperties(const EnvSerializeInfo* info) {
 
   const std::vector<PropInfo>& values = info->persistent_values;
   size_t i = 0;  // index to the array
-  size_t id = 0;
+  uint32_t id = 0;
 #define V(PropertyName, TypeName)                                              \
   do {                                                                         \
     if (values.size() > i && id == values[i].id) {                             \
diff --git a/src/env.h b/src/env.h
index 15e546fab1ed84..de5aad9aa0f14b 100644
--- a/src/env.h
+++ b/src/env.h
@@ -580,7 +580,7 @@ typedef size_t SnapshotIndex;
 
 struct PropInfo {
   std::string name;     // name for debugging
-  size_t id;            // In the list - in case there are any empty entries
+  uint32_t id;          // In the list - in case there are any empty entries
   SnapshotIndex index;  // In the snapshot
 };
 
@@ -987,8 +987,9 @@ struct EnvSerializeInfo {
 struct SnapshotData {
   enum class DataOwnership { kOwned, kNotOwned };
 
-  static const size_t kNodeBaseContextIndex = 0;
-  static const size_t kNodeMainContextIndex = kNodeBaseContextIndex + 1;
+  static const uint32_t kMagic = 0x143da19;
+  static const SnapshotIndex kNodeBaseContextIndex = 0;
+  static const SnapshotIndex kNodeMainContextIndex = kNodeBaseContextIndex + 1;
 
   DataOwnership data_ownership = DataOwnership::kOwned;
 
@@ -1000,12 +1001,16 @@ struct SnapshotData {
   // TODO(joyeecheung): there should be a vector of env_info once we snapshot
   // the worker environments.
   EnvSerializeInfo env_info;
+
   // A vector of built-in ids and v8::ScriptCompiler::CachedData, this can be
   // shared across Node.js instances because they are supposed to share the
   // read only space. We use native_module::CodeCacheInfo because
   // v8::ScriptCompiler::CachedData is not copyable.
   std::vector<native_module::CodeCacheInfo> code_cache;
 
+  void ToBlob(FILE* out) const;
+  static void FromBlob(SnapshotData* out, FILE* in);
+
   ~SnapshotData();
 
   SnapshotData(const SnapshotData&) = delete;
diff --git a/src/node.cc b/src/node.cc
index 9b8b7f9f0bd49e..54da92cc95fbc1 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -1148,38 +1148,127 @@ void TearDownOncePerProcess() {
   per_process::v8_platform.Dispose();
 }
 
+int GenerateAndWriteSnapshotData(const SnapshotData** snapshot_data_ptr,
+                                 InitializationResult* result) {
+  // nullptr indicates there's no snapshot data.
+  DCHECK_NULL(*snapshot_data_ptr);
+
+  // node:embedded_snapshot_main indicates that we are using the
+  // embedded snapshot and we are not supposed to clean it up.
+  if (result->args[1] == "node:embedded_snapshot_main") {
+    *snapshot_data_ptr = SnapshotBuilder::GetEmbeddedSnapshotData();
+    if (*snapshot_data_ptr == nullptr) {
+      // The Node.js binary is built without embedded snapshot
+      fprintf(stderr,
+              "node:embedded_snapshot_main was specified as snapshot "
+              "entry point but Node.js was built without embedded "
+              "snapshot.\n");
+      result->exit_code = 1;
+      return result->exit_code;
+    }
+  } else {
+    // Otherwise, load and run the specified main script.
+    std::unique_ptr<SnapshotData> generated_data =
+        std::make_unique<SnapshotData>();
+    result->exit_code = node::SnapshotBuilder::Generate(
+        generated_data.get(), result->args, result->exec_args);
+    if (result->exit_code == 0) {
+      *snapshot_data_ptr = generated_data.release();
+    } else {
+      return result->exit_code;
+    }
+  }
+
+  // Get the path to write the snapshot blob to.
+  std::string snapshot_blob_path;
+  if (!per_process::cli_options->snapshot_blob.empty()) {
+    snapshot_blob_path = per_process::cli_options->snapshot_blob;
+  } else {
+    // Defaults to snapshot.blob in the current working directory.
+    snapshot_blob_path = std::string("snapshot.blob");
+  }
+
+  FILE* fp = fopen(snapshot_blob_path.c_str(), "wb");
+  if (fp != nullptr) {
+    (*snapshot_data_ptr)->ToBlob(fp);
+    fclose(fp);
+  } else {
+    fprintf(stderr,
+            "Cannot open %s for writing a snapshot.\n",
+            snapshot_blob_path.c_str());
+    result->exit_code = 1;
+  }
+  return result->exit_code;
+}
+
+int LoadSnapshotDataAndRun(const SnapshotData** snapshot_data_ptr,
+                           InitializationResult* result) {
+  // nullptr indicates there's no snapshot data.
+  DCHECK_NULL(*snapshot_data_ptr);
+  // --snapshot-blob indicates that we are reading a customized snapshot.
+  if (!per_process::cli_options->snapshot_blob.empty()) {
+    std::string filename = per_process::cli_options->snapshot_blob;
+    FILE* fp = fopen(filename.c_str(), "rb");
+    if (fp == nullptr) {
+      fprintf(stderr, "Cannot open %s", filename.c_str());
+      result->exit_code = 1;
+      return result->exit_code;
+    }
+    std::unique_ptr<SnapshotData> read_data = std::make_unique<SnapshotData>();
+    SnapshotData::FromBlob(read_data.get(), fp);
+    *snapshot_data_ptr = read_data.release();
+    fclose(fp);
+  } else if (per_process::cli_options->node_snapshot) {
+    // If --snapshot-blob is not specified, we are reading the embedded
+    // snapshot, but we will skip it if --no-node-snapshot is specified.
+    *snapshot_data_ptr = SnapshotBuilder::GetEmbeddedSnapshotData();
+  }
+
+  if ((*snapshot_data_ptr) != nullptr) {
+    NativeModuleLoader::RefreshCodeCache((*snapshot_data_ptr)->code_cache);
+  }
+  NodeMainInstance main_instance(*snapshot_data_ptr,
+                                 uv_default_loop(),
+                                 per_process::v8_platform.Platform(),
+                                 result->args,
+                                 result->exec_args);
+  result->exit_code = main_instance.Run();
+  return result->exit_code;
+}
+
 int Start(int argc, char** argv) {
   InitializationResult result = InitializeOncePerProcess(argc, argv);
   if (result.early_return) {
     return result.exit_code;
   }
 
-  if (per_process::cli_options->build_snapshot) {
-    fprintf(stderr,
-            "--build-snapshot is not yet supported in the node binary\n");
-    return 1;
-  }
+  DCHECK_EQ(result.exit_code, 0);
+  const SnapshotData* snapshot_data = nullptr;
 
-  {
-    bool use_node_snapshot = per_process::cli_options->node_snapshot;
-    const SnapshotData* snapshot_data =
-        use_node_snapshot ? SnapshotBuilder::GetEmbeddedSnapshotData()
-                          : nullptr;
-    uv_loop_configure(uv_default_loop(), UV_METRICS_IDLE_TIME);
-
-    if (snapshot_data != nullptr) {
-      NativeModuleLoader::RefreshCodeCache(snapshot_data->code_cache);
+  auto cleanup_process = OnScopeLeave([&]() {
+    TearDownOncePerProcess();
+
+    if (snapshot_data != nullptr &&
+        snapshot_data->data_ownership == SnapshotData::DataOwnership::kOwned) {
+      delete snapshot_data;
+    }
+  });
+
+  uv_loop_configure(uv_default_loop(), UV_METRICS_IDLE_TIME);
+
+  // --build-snapshot indicates that we are in snapshot building mode.
+  if (per_process::cli_options->build_snapshot) {
+    if (result.args.size() < 2) {
+      fprintf(stderr,
+              "--build-snapshot must be used with an entry point script.\n"
+              "Usage: node --build-snapshot /path/to/entry.js\n");
+      return 9;
     }
-    NodeMainInstance main_instance(snapshot_data,
-                                   uv_default_loop(),
-                                   per_process::v8_platform.Platform(),
-                                   result.args,
-                                   result.exec_args);
-    result.exit_code = main_instance.Run();
+    return GenerateAndWriteSnapshotData(&snapshot_data, &result);
   }
 
-  TearDownOncePerProcess();
-  return result.exit_code;
+  // Without --build-snapshot, we are in snapshot loading mode.
+  return LoadSnapshotDataAndRun(&snapshot_data, &result);
 }
 
 int Stop(Environment* env) {
diff --git a/src/node_internals.h b/src/node_internals.h
index 1401cb33293e61..890d77f79a79ed 100644
--- a/src/node_internals.h
+++ b/src/node_internals.h
@@ -405,6 +405,25 @@ std::string Basename(const std::string& str, const std::string& extension);
 
 node_module napi_module_to_node_module(const napi_module* mod);
 
+std::ostream& operator<<(std::ostream& output,
+                         const std::vector<SnapshotIndex>& v);
+std::ostream& operator<<(std::ostream& output,
+                         const std::vector<std::string>& vec);
+std::ostream& operator<<(std::ostream& output,
+                         const std::vector<PropInfo>& vec);
+std::ostream& operator<<(std::ostream& output, const PropInfo& d);
+std::ostream& operator<<(std::ostream& output, const EnvSerializeInfo& d);
+std::ostream& operator<<(std::ostream& output,
+                         const ImmediateInfo::SerializeInfo& d);
+std::ostream& operator<<(std::ostream& output,
+                         const TickInfo::SerializeInfo& d);
+std::ostream& operator<<(std::ostream& output,
+                         const AsyncHooks::SerializeInfo& d);
+
+namespace performance {
+std::ostream& operator<<(std::ostream& output,
+                         const PerformanceState::SerializeInfo& d);
+}
 }  // namespace node
 
 #endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
diff --git a/src/node_options.cc b/src/node_options.cc
index bcc003afa8d7e6..a37645d1b79b38 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -764,6 +764,13 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             "",  // It's a debug-only option.
             &PerProcessOptions::node_snapshot,
             kAllowedInEnvironment);
+  AddOption("--snapshot-blob",
+            "Path to the snapshot blob that's either the result of snapshot"
+            "building, or the blob that is used to restore the application "
+            "state",
+            &PerProcessOptions::snapshot_blob,
+            kAllowedInEnvironment);
+
   // 12.x renamed this inadvertently, so alias it for consistency within the
   // release line, while using the original name for consistency with older
   // release lines.
diff --git a/src/node_options.h b/src/node_options.h
index 7f209e216c67e1..b20cfae141956a 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -237,6 +237,7 @@ class PerProcessOptions : public Options {
   // snapshot used in different isolates in the same process to be the same.
   // Therefore --node-snapshot is a per-process option.
   bool node_snapshot = true;
+  std::string snapshot_blob;
 
   std::vector<std::string> security_reverts;
   bool print_bash_completion = false;
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index 09b2efbf3b711c..5dad6f3d7a7a0d 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -11,6 +11,7 @@
 #include "node_file.h"
 #include "node_internals.h"
 #include "node_main_instance.h"
+#include "node_metadata.h"
 #include "node_native_module.h"
 #include "node_process.h"
 #include "node_snapshot_builder.h"
@@ -38,6 +39,706 @@ using v8::String;
 using v8::TryCatch;
 using v8::Value;
 
+const uint32_t SnapshotData::kMagic;
+
+std::ostream& operator<<(std::ostream& output,
+                         const native_module::CodeCacheInfo& info) {
+  output << "<native_module::CodeCacheInfo id=" << info.id
+         << ", size=" << info.data.size() << ">\n";
+  return output;
+}
+
+std::ostream& operator<<(std::ostream& output,
+                         const std::vector<native_module::CodeCacheInfo>& vec) {
+  output << "{\n";
+  for (const auto& info : vec) {
+    output << info;
+  }
+  output << "}\n";
+  return output;
+}
+
+std::ostream& operator<<(std::ostream& output,
+                         const std::vector<uint8_t>& vec) {
+  output << "{\n";
+  for (const auto& i : vec) {
+    output << i << ",";
+  }
+  output << "}";
+  return output;
+}
+
+class FileIO {
+ public:
+  explicit FileIO(FILE* file)
+      : f(file),
+        is_debug(per_process::enabled_debug_list.enabled(
+            DebugCategory::MKSNAPSHOT)) {}
+
+  template <typename... Args>
+  void Debug(const char* format, Args&&... args) const {
+    per_process::Debug(
+        DebugCategory::MKSNAPSHOT, format, std::forward<Args>(args)...);
+  }
+
+  template <typename T>
+  std::string ToStr(const T& arg) const {
+    std::stringstream ss;
+    ss << arg;
+    return ss.str();
+  }
+
+  template <typename T>
+  std::string GetName() const {
+#define TYPE_LIST(V)                                                           \
+  V(native_module::CodeCacheInfo)                                              \
+  V(PropInfo)                                                                  \
+  V(std::string)
+
+#define V(TypeName)                                                            \
+  if (std::is_same_v<T, TypeName>) {                                           \
+    return #TypeName;                                                          \
+  }
+    TYPE_LIST(V)
+#undef V
+
+    std::string name;
+    if (std::is_arithmetic_v<T>) {
+      if (!std::is_signed_v<T>) {
+        name += "u";
+      }
+      name += std::is_integral_v<T> ? "int" : "float";
+      name += std::to_string(sizeof(T) * 8);
+      name += "_t";
+    }
+    return name;
+  }
+
+  FILE* f = nullptr;
+  bool is_debug = false;
+};
+
+class FileReader : public FileIO {
+ public:
+  explicit FileReader(FILE* file) : FileIO(file) {}
+  ~FileReader() {}
+
+  // Helper for reading numeric types.
+  template <typename T>
+  T Read() {
+    static_assert(std::is_arithmetic_v<T>, "Not an arithmetic type");
+    T result;
+    Read(&result, 1);
+    return result;
+  }
+
+  // Layout of vectors:
+  // [ 4/8 bytes ] count
+  // [   ...     ] contents (count * size of individual elements)
+  template <typename T>
+  std::vector<T> ReadVector() {
+    if (is_debug) {
+      std::string name = GetName<T>();
+      Debug("\nReadVector<%s>()(%d-byte)\n", name.c_str(), sizeof(T));
+    }
+    size_t count = static_cast<size_t>(Read<size_t>());
+    if (count == 0) {
+      return std::vector<T>();
+    }
+    if (is_debug) {
+      Debug("Reading %d vector elements...\n", count);
+    }
+    std::vector<T> result = ReadVector<T>(count, std::is_arithmetic<T>{});
+    if (is_debug) {
+      std::string str = std::is_arithmetic_v<T> ? "" : ToStr(result);
+      std::string name = GetName<T>();
+      Debug("ReadVector<%s>() read %s\n", name.c_str(), str.c_str());
+    }
+    return result;
+  }
+
+  std::string ReadString() {
+    size_t length = Read<size_t>();
+
+    if (is_debug) {
+      Debug("ReadString(), length=%d: ", length);
+    }
+
+    CHECK_GT(length, 0);  // There should be no empty strings.
+    MallocedBuffer<char> buf(length + 1);
+    size_t r = fread(buf.data, 1, length + 1, f);
+    CHECK_EQ(r, length + 1);
+    std::string result(buf.data, length);  // This creates a copy of buf.data.
+
+    if (is_debug) {
+      Debug("\"%s\", read %d bytes\n", result.c_str(), r);
+    }
+
+    read_total += r;
+    return result;
+  }
+
+  size_t read_total = 0;
+
+ private:
+  // Helper for reading an array of numeric types.
+  template <typename T>
+  void Read(T* out, size_t count) {
+    static_assert(std::is_arithmetic_v<T>, "Not an arithmetic type");
+    DCHECK_GT(count, 0);  // Should not read contents for vectors of size 0.
+    if (is_debug) {
+      std::string name = GetName<T>();
+      Debug("Read<%s>()(%d-byte), count=%d: ", name.c_str(), sizeof(T), count);
+    }
+
+    size_t r = fread(out, sizeof(T), count, f);
+    CHECK_EQ(r, count);
+
+    if (is_debug) {
+      std::string str =
+          "{ " + std::to_string(out[0]) + (count > 1 ? ", ... }" : " }");
+      Debug("%s, read %d bytes\n", str.c_str(), r);
+    }
+    read_total += r;
+  }
+
+  // Helper for reading numeric vectors.
+  template <typename Number>
+  std::vector<Number> ReadVector(size_t count, std::true_type) {
+    static_assert(std::is_arithmetic_v<Number>, "Not an arithmetic type");
+    DCHECK_GT(count, 0);  // Should not read contents for vectors of size 0.
+    std::vector<Number> result(count);
+    Read(result.data(), count);
+    return result;
+  }
+
+  // Helper for reading non-numeric vectors.
+  template <typename T>
+  std::vector<T> ReadVector(size_t count, std::false_type) {
+    static_assert(!std::is_arithmetic_v<T>, "Arithmetic type");
+    DCHECK_GT(count, 0);  // Should not read contents for vectors of size 0.
+    std::vector<T> result;
+    result.reserve(count);
+    bool original_is_debug = is_debug;
+    is_debug = original_is_debug && !std::is_same_v<T, std::string>;
+    for (size_t i = 0; i < count; ++i) {
+      if (is_debug) {
+        Debug("\n[%d] ", i);
+      }
+      result.push_back(Read<T>());
+    }
+    is_debug = original_is_debug;
+
+    return result;
+  }
+};
+
+class FileWriter : public FileIO {
+ public:
+  explicit FileWriter(FILE* file) : FileIO(file) {}
+  ~FileWriter() {}
+
+  // Helper for writing numeric types.
+  template <typename T>
+  size_t Write(const T& data) {
+    static_assert(std::is_arithmetic_v<T>, "Not an arithmetic type");
+    return Write(&data, 1);
+  }
+
+  // Layout of vectors:
+  // [ 4/8 bytes ] count
+  // [   ...     ] contents (count * size of individual elements)
+  template <typename T>
+  size_t WriteVector(const std::vector<T>& data) {
+    if (is_debug) {
+      std::string str = std::is_arithmetic_v<T> ? "" : ToStr(data);
+      std::string name = GetName<T>();
+      Debug("\nWriteVector<%s>() (%d-byte), count=%d: %s\n",
+            name.c_str(),
+            sizeof(T),
+            data.size(),
+            str.c_str());
+    }
+
+    size_t written_total = Write<size_t>(data.size());
+    if (data.size() == 0) {
+      return written_total;
+    }
+    written_total += WriteVector<T>(data, std::is_arithmetic<T>{});
+
+    if (is_debug) {
+      std::string name = GetName<T>();
+      Debug("WriteVector<%s>() wrote %d bytes\n", name.c_str(), written_total);
+    }
+
+    return written_total;
+  }
+
+  // The layout of a written string:
+  // [  4/8 bytes     ] length
+  // [ |length| bytes ] contents
+  size_t WriteString(const std::string& data) {
+    CHECK_GT(data.size(), 0);  // No empty strings should be written.
+    size_t written_total = Write<size_t>(data.size());
+    if (is_debug) {
+      std::string str = ToStr(data);
+      Debug("WriteString(), length=%d: \"%s\"\n", data.size(), data.c_str());
+    }
+
+    size_t r = fwrite(data.c_str(), 1, data.size() + 1, f);
+    CHECK_EQ(r, data.size() + 1);
+    written_total += r;
+
+    if (is_debug) {
+      Debug("WriteString() wrote %d bytes\n", written_total);
+    }
+
+    return written_total;
+  }
+
+ private:
+  // Helper for writing an array of numeric types.
+  template <typename T>
+  size_t Write(const T* data, size_t count) {
+    DCHECK_GT(count, 0);  // Should not write contents for vectors of size 0.
+    if (is_debug) {
+      std::string str =
+          "{ " + std::to_string(data[0]) + (count > 1 ? ", ... }" : " }");
+      std::string name = GetName<T>();
+      Debug("Write<%s>() (%d-byte), count=%d: %s",
+            name.c_str(),
+            sizeof(T),
+            count,
+            str.c_str());
+    }
+
+    size_t r = fwrite(data, sizeof(T), count, f);
+    CHECK_EQ(r, count);
+
+    if (is_debug) {
+      Debug(", wrote %d bytes\n", r);
+    }
+    return r;
+  }
+
+  // Helper for writing numeric vectors.
+  template <typename Number>
+  size_t WriteVector(const std::vector<Number>& data, std::true_type) {
+    return Write(data.data(), data.size());
+  }
+
+  // Helper for writing non-numeric vectors.
+  template <typename T>
+  size_t WriteVector(const std::vector<T>& data, std::false_type) {
+    DCHECK_GT(data.size(),
+              0);  // Should not write contents for vectors of size 0.
+    size_t written_total = 0;
+    bool original_is_debug = is_debug;
+    is_debug = original_is_debug && !std::is_same_v<T, std::string>;
+    for (size_t i = 0; i < data.size(); ++i) {
+      if (is_debug) {
+        Debug("\n[%d] ", i);
+      }
+      written_total += Write<T>(data[i]);
+    }
+    is_debug = original_is_debug;
+
+    return written_total;
+  }
+};
+
+// Layout of serialized std::string:
+// [  4/8 bytes     ] length
+// [ |length| bytes ] contents
+template <>
+std::string FileReader::Read() {
+  return ReadString();
+}
+template <>
+size_t FileWriter::Write(const std::string& data) {
+  return WriteString(data);
+}
+
+// Layout of v8::StartupData
+// [  4/8 bytes       ] raw_size
+// [ |raw_size| bytes ] contents
+template <>
+v8::StartupData FileReader::Read() {
+  Debug("Read<v8::StartupData>()\n");
+
+  int raw_size = Read<int>();
+  Debug("size=%d\n", raw_size);
+
+  CHECK_GT(raw_size, 0);  // There should be no startup data of size 0.
+  // The data pointer of v8::StartupData would be deleted so it must be new'ed.
+  std::unique_ptr<char> buf = std::unique_ptr<char>(new char[raw_size]);
+  Read<char>(buf.get(), raw_size);
+
+  return v8::StartupData{buf.release(), raw_size};
+}
+
+template <>
+size_t FileWriter::Write(const v8::StartupData& data) {
+  Debug("\nWrite<v8::StartupData>() size=%d\n", data.raw_size);
+
+  CHECK_GT(data.raw_size, 0);  // There should be no startup data of size 0.
+  size_t written_total = Write<int>(data.raw_size);
+  written_total += Write<char>(data.data, static_cast<size_t>(data.raw_size));
+
+  Debug("Write<v8::StartupData>() wrote %d bytes\n\n", written_total);
+  return written_total;
+}
+
+// Layout of native_module::CodeCacheInfo
+// [  4/8 bytes ]  length of the module id string
+// [    ...     ]  |length| bytes of module id
+// [  4/8 bytes ]  length of module code cache
+// [    ...     ]  |length| bytes of module code cache
+template <>
+native_module::CodeCacheInfo FileReader::Read() {
+  Debug("Read<native_module::CodeCacheInfo>()\n");
+
+  native_module::CodeCacheInfo result{ReadString(), ReadVector<uint8_t>()};
+
+  if (is_debug) {
+    std::string str = ToStr(result);
+    Debug("Read<native_module::CodeCacheInfo>() %s\n", str.c_str());
+  }
+  return result;
+}
+
+template <>
+size_t FileWriter::Write(const native_module::CodeCacheInfo& data) {
+  Debug("\nWrite<native_module::CodeCacheInfo>() id = %s"
+        ", size=%d\n",
+        data.id.c_str(),
+        data.data.size());
+
+  size_t written_total = WriteString(data.id);
+  written_total += WriteVector<uint8_t>(data.data);
+
+  Debug("Write<native_module::CodeCacheInfo>() wrote %d bytes\n",
+        written_total);
+  return written_total;
+}
+
+// Layout of PropInfo
+// [ 4/8 bytes ]  length of the data name string
+// [    ...    ]  |length| bytes of data name
+// [  4 bytes  ]  index in the PropInfo vector
+// [ 4/8 bytes ]  index in the snapshot blob, can be used with
+//                GetDataFromSnapshotOnce().
+template <>
+PropInfo FileReader::Read() {
+  Debug("Read<PropInfo>()\n");
+
+  PropInfo result;
+  result.name = ReadString();
+  result.id = Read<uint32_t>();
+  result.index = Read<SnapshotIndex>();
+
+  if (is_debug) {
+    std::string str = ToStr(result);
+    Debug("Read<PropInfo>() %s\n", str.c_str());
+  }
+
+  return result;
+}
+
+template <>
+size_t FileWriter::Write(const PropInfo& data) {
+  if (is_debug) {
+    std::string str = ToStr(data);
+    Debug("Write<PropInfo>() %s\n", str.c_str());
+  }
+
+  size_t written_total = WriteString(data.name);
+  written_total += Write<uint32_t>(data.id);
+  written_total += Write<SnapshotIndex>(data.index);
+
+  Debug("Write<PropInfo>() wrote %d bytes\n", written_total);
+  return written_total;
+}
+
+// Layout of AsyncHooks::SerializeInfo
+// [ 4/8 bytes ]  snapshot index of async_ids_stack
+// [ 4/8 bytes ]  snapshot index of fields
+// [ 4/8 bytes ]  snapshot index of async_id_fields
+// [ 4/8 bytes ]  snapshot index of js_execution_async_resources
+// [ 4/8 bytes ]  length of native_execution_async_resources
+// [   ...     ]  snapshot indices of each element in
+//                native_execution_async_resources
+template <>
+AsyncHooks::SerializeInfo FileReader::Read() {
+  Debug("Read<AsyncHooks::SerializeInfo>()\n");
+
+  AsyncHooks::SerializeInfo result;
+  result.async_ids_stack = Read<AliasedBufferIndex>();
+  result.fields = Read<AliasedBufferIndex>();
+  result.async_id_fields = Read<AliasedBufferIndex>();
+  result.js_execution_async_resources = Read<SnapshotIndex>();
+  result.native_execution_async_resources = ReadVector<SnapshotIndex>();
+
+  if (is_debug) {
+    std::string str = ToStr(result);
+    Debug("Read<AsyncHooks::SerializeInfo>() %s\n", str.c_str());
+  }
+
+  return result;
+}
+template <>
+size_t FileWriter::Write(const AsyncHooks::SerializeInfo& data) {
+  if (is_debug) {
+    std::string str = ToStr(data);
+    Debug("Write<AsyncHooks::SerializeInfo>() %s\n", str.c_str());
+  }
+
+  size_t written_total = Write<AliasedBufferIndex>(data.async_ids_stack);
+  written_total += Write<AliasedBufferIndex>(data.fields);
+  written_total += Write<AliasedBufferIndex>(data.async_id_fields);
+  written_total += Write<SnapshotIndex>(data.js_execution_async_resources);
+  written_total +=
+      WriteVector<SnapshotIndex>(data.native_execution_async_resources);
+
+  Debug("Write<AsyncHooks::SerializeInfo>() wrote %d bytes\n", written_total);
+  return written_total;
+}
+
+// Layout of TickInfo::SerializeInfo
+// [ 4/8 bytes ]  snapshot index of fields
+template <>
+TickInfo::SerializeInfo FileReader::Read() {
+  Debug("Read<TickInfo::SerializeInfo>()\n");
+
+  TickInfo::SerializeInfo result;
+  result.fields = Read<AliasedBufferIndex>();
+
+  if (is_debug) {
+    std::string str = ToStr(result);
+    Debug("Read<TickInfo::SerializeInfo>() %s\n", str.c_str());
+  }
+
+  return result;
+}
+
+template <>
+size_t FileWriter::Write(const TickInfo::SerializeInfo& data) {
+  if (is_debug) {
+    std::string str = ToStr(data);
+    Debug("Write<TickInfo::SerializeInfo>() %s\n", str.c_str());
+  }
+
+  size_t written_total = Write<AliasedBufferIndex>(data.fields);
+
+  Debug("Write<TickInfo::SerializeInfo>() wrote %d bytes\n", written_total);
+  return written_total;
+}
+
+// Layout of TickInfo::SerializeInfo
+// [ 4/8 bytes ]  snapshot index of fields
+template <>
+ImmediateInfo::SerializeInfo FileReader::Read() {
+  per_process::Debug(DebugCategory::MKSNAPSHOT,
+                     "Read<ImmediateInfo::SerializeInfo>()\n");
+
+  ImmediateInfo::SerializeInfo result;
+  result.fields = Read<AliasedBufferIndex>();
+  if (is_debug) {
+    std::string str = ToStr(result);
+    Debug("Read<ImmediateInfo::SerializeInfo>() %s\n", str.c_str());
+  }
+  return result;
+}
+
+template <>
+size_t FileWriter::Write(const ImmediateInfo::SerializeInfo& data) {
+  if (is_debug) {
+    std::string str = ToStr(data);
+    Debug("Write<ImmeidateInfo::SerializeInfo>() %s\n", str.c_str());
+  }
+
+  size_t written_total = Write<AliasedBufferIndex>(data.fields);
+
+  Debug("Write<ImmeidateInfo::SerializeInfo>() wrote %d bytes\n",
+        written_total);
+  return written_total;
+}
+
+// Layout of PerformanceState::SerializeInfo
+// [ 4/8 bytes ]  snapshot index of root
+// [ 4/8 bytes ]  snapshot index of milestones
+// [ 4/8 bytes ]  snapshot index of observers
+template <>
+performance::PerformanceState::SerializeInfo FileReader::Read() {
+  per_process::Debug(DebugCategory::MKSNAPSHOT,
+                     "Read<PerformanceState::SerializeInfo>()\n");
+
+  performance::PerformanceState::SerializeInfo result;
+  result.root = Read<AliasedBufferIndex>();
+  result.milestones = Read<AliasedBufferIndex>();
+  result.observers = Read<AliasedBufferIndex>();
+  if (is_debug) {
+    std::string str = ToStr(result);
+    Debug("Read<PerformanceState::SerializeInfo>() %s\n", str.c_str());
+  }
+  return result;
+}
+
+template <>
+size_t FileWriter::Write(
+    const performance::PerformanceState::SerializeInfo& data) {
+  if (is_debug) {
+    std::string str = ToStr(data);
+    Debug("Write<PerformanceState::SerializeInfo>() %s\n", str.c_str());
+  }
+
+  size_t written_total = Write<AliasedBufferIndex>(data.root);
+  written_total += Write<AliasedBufferIndex>(data.milestones);
+  written_total += Write<AliasedBufferIndex>(data.observers);
+
+  Debug("Write<PerformanceState::SerializeInfo>() wrote %d bytes\n",
+        written_total);
+  return written_total;
+}
+
+// Layout of IsolateDataSerializeInfo
+// [ 4/8 bytes ]  length of primitive_values vector
+// [    ...    ]  |length| of primitive_values indices
+// [ 4/8 bytes ]  length of template_values vector
+// [    ...    ]  |length| of PropInfo data
+template <>
+IsolateDataSerializeInfo FileReader::Read() {
+  per_process::Debug(DebugCategory::MKSNAPSHOT,
+                     "Read<IsolateDataSerializeInfo>()\n");
+
+  IsolateDataSerializeInfo result;
+  result.primitive_values = ReadVector<SnapshotIndex>();
+  result.template_values = ReadVector<PropInfo>();
+  if (is_debug) {
+    std::string str = ToStr(result);
+    Debug("Read<IsolateDataSerializeInfo>() %s\n", str.c_str());
+  }
+  return result;
+}
+
+template <>
+size_t FileWriter::Write(const IsolateDataSerializeInfo& data) {
+  if (is_debug) {
+    std::string str = ToStr(data);
+    Debug("Write<IsolateDataSerializeInfo>() %s\n", str.c_str());
+  }
+
+  size_t written_total = WriteVector<SnapshotIndex>(data.primitive_values);
+  written_total += WriteVector<PropInfo>(data.template_values);
+
+  Debug("Write<IsolateDataSerializeInfo>() wrote %d bytes\n", written_total);
+  return written_total;
+}
+
+template <>
+EnvSerializeInfo FileReader::Read() {
+  per_process::Debug(DebugCategory::MKSNAPSHOT, "Read<EnvSerializeInfo>()\n");
+  EnvSerializeInfo result;
+  result.bindings = ReadVector<PropInfo>();
+  result.native_modules = ReadVector<std::string>();
+  result.async_hooks = Read<AsyncHooks::SerializeInfo>();
+  result.tick_info = Read<TickInfo::SerializeInfo>();
+  result.immediate_info = Read<ImmediateInfo::SerializeInfo>();
+  result.performance_state =
+      Read<performance::PerformanceState::SerializeInfo>();
+  result.exiting = Read<AliasedBufferIndex>();
+  result.stream_base_state = Read<AliasedBufferIndex>();
+  result.should_abort_on_uncaught_toggle = Read<AliasedBufferIndex>();
+  result.persistent_values = ReadVector<PropInfo>();
+  result.context = Read<SnapshotIndex>();
+  return result;
+}
+
+template <>
+size_t FileWriter::Write(const EnvSerializeInfo& data) {
+  if (is_debug) {
+    std::string str = ToStr(data);
+    Debug("\nWrite<EnvSerializeInfo>() %s\n", str.c_str());
+  }
+
+  // Use += here to ensure order of evaluation.
+  size_t written_total = WriteVector<PropInfo>(data.bindings);
+  written_total += WriteVector<std::string>(data.native_modules);
+  written_total += Write<AsyncHooks::SerializeInfo>(data.async_hooks);
+  written_total += Write<TickInfo::SerializeInfo>(data.tick_info);
+  written_total += Write<ImmediateInfo::SerializeInfo>(data.immediate_info);
+  written_total += Write<performance::PerformanceState::SerializeInfo>(
+      data.performance_state);
+  written_total += Write<AliasedBufferIndex>(data.exiting);
+  written_total += Write<AliasedBufferIndex>(data.stream_base_state);
+  written_total +=
+      Write<AliasedBufferIndex>(data.should_abort_on_uncaught_toggle);
+  written_total += WriteVector<PropInfo>(data.persistent_values);
+  written_total += Write<SnapshotIndex>(data.context);
+
+  Debug("Write<EnvSerializeInfo>() wrote %d bytes\n", written_total);
+  return written_total;
+}
+
+// Layout of the snapshot blob
+// [   4 bytes    ]  kMagic
+// [   4/8 bytes  ]  length of Node.js version string
+// [    ...       ]  contents of Node.js version string
+// [   4/8 bytes  ]  length of Node.js arch string
+// [    ...       ]  contents of Node.js arch string
+// [    ...       ]  v8_snapshot_blob_data from SnapshotCreator::CreateBlob()
+// [    ...       ]  isolate_data_info
+// [    ...       ]  env_info
+// [    ...       ]  code_cache
+
+void SnapshotData::ToBlob(FILE* out) const {
+  FileWriter w(out);
+  w.Debug("SnapshotData::ToBlob()\n");
+
+  size_t written_total = 0;
+  // Metadata
+  w.Debug("Write magic %" PRIx32 "\n", kMagic);
+  written_total += w.Write<uint32_t>(kMagic);
+  w.Debug("Write version %s\n", NODE_VERSION);
+  written_total += w.WriteString(NODE_VERSION);
+  w.Debug("Write arch %s\n", NODE_ARCH);
+  written_total += w.WriteString(NODE_ARCH);
+
+  written_total += w.Write<v8::StartupData>(v8_snapshot_blob_data);
+  w.Debug("Write isolate_data_indices\n");
+  written_total += w.Write<IsolateDataSerializeInfo>(isolate_data_info);
+  written_total += w.Write<EnvSerializeInfo>(env_info);
+  w.Debug("Write code_cache\n");
+  written_total += w.WriteVector<native_module::CodeCacheInfo>(code_cache);
+  w.Debug("SnapshotData::ToBlob() Wrote %d bytes\n", written_total);
+}
+
+void SnapshotData::FromBlob(SnapshotData* out, FILE* in) {
+  FileReader r(in);
+  r.Debug("SnapshotData::FromBlob()\n");
+
+  // Metadata
+  uint32_t magic = r.Read<uint32_t>();
+  r.Debug("Read magic %" PRIx64 "\n", magic);
+  CHECK_EQ(magic, kMagic);
+  std::string version = r.ReadString();
+  r.Debug("Read version %s\n", version.c_str());
+  CHECK_EQ(version, NODE_VERSION);
+  std::string arch = r.ReadString();
+  r.Debug("Read arch %s\n", arch.c_str());
+  CHECK_EQ(arch, NODE_ARCH);
+
+  DCHECK_EQ(out->data_ownership, SnapshotData::DataOwnership::kOwned);
+  out->v8_snapshot_blob_data = r.Read<v8::StartupData>();
+  r.Debug("Read isolate_data_info\n");
+  out->isolate_data_info = r.Read<IsolateDataSerializeInfo>();
+  out->env_info = r.Read<EnvSerializeInfo>();
+  r.Debug("Read code_cache\n");
+  out->code_cache = r.ReadVector<native_module::CodeCacheInfo>();
+
+  r.Debug("SnapshotData::FromBlob() read %d bytes\n", r.read_total);
+}
+
 SnapshotData::~SnapshotData() {
   if (data_ownership == DataOwnership::kOwned &&
       v8_snapshot_blob_data.data != nullptr) {
@@ -381,16 +1082,15 @@ void DeserializeNodeInternalFields(Local<Object> holder,
                                    int index,
                                    StartupData payload,
                                    void* env) {
+  if (payload.raw_size == 0) {
+    holder->SetAlignedPointerInInternalField(index, nullptr);
+    return;
+  }
   per_process::Debug(DebugCategory::MKSNAPSHOT,
                      "Deserialize internal field %d of %p, size=%d\n",
                      static_cast<int>(index),
                      (*holder),
                      static_cast<int>(payload.raw_size));
-  if (payload.raw_size == 0) {
-    holder->SetAlignedPointerInInternalField(index, nullptr);
-    return;
-  }
-
   Environment* env_ptr = static_cast<Environment*>(env);
   const InternalFieldInfo* info =
       reinterpret_cast<const InternalFieldInfo*>(payload.data);
@@ -415,15 +1115,14 @@ void DeserializeNodeInternalFields(Local<Object> holder,
 StartupData SerializeNodeContextInternalFields(Local<Object> holder,
                                                int index,
                                                void* env) {
-  per_process::Debug(DebugCategory::MKSNAPSHOT,
-                     "Serialize internal field, index=%d, holder=%p\n",
-                     static_cast<int>(index),
-                     *holder);
   void* ptr = holder->GetAlignedPointerFromInternalField(BaseObject::kSlot);
   if (ptr == nullptr) {
     return StartupData{nullptr, 0};
   }
-
+  per_process::Debug(DebugCategory::MKSNAPSHOT,
+                     "Serialize internal field, index=%d, holder=%p\n",
+                     static_cast<int>(index),
+                     *holder);
   DCHECK(static_cast<BaseObject*>(ptr)->is_snapshotable());
   SnapshotableObject* obj = static_cast<SnapshotableObject*>(ptr);
   per_process::Debug(DebugCategory::MKSNAPSHOT,
@@ -441,7 +1140,7 @@ StartupData SerializeNodeContextInternalFields(Local<Object> holder,
 void SerializeBindingData(Environment* env,
                           SnapshotCreator* creator,
                           EnvSerializeInfo* info) {
-  size_t i = 0;
+  uint32_t i = 0;
   env->ForEachBindingData([&](FastStringKey key,
                               BaseObjectPtr<BaseObject> binding) {
     per_process::Debug(DebugCategory::MKSNAPSHOT,
@@ -451,7 +1150,7 @@ void SerializeBindingData(Environment* env,
                        key.c_str());
 
     if (IsSnapshotableType(key)) {
-      size_t index = creator->AddData(env->context(), binding->object());
+      SnapshotIndex index = creator->AddData(env->context(), binding->object());
       per_process::Debug(DebugCategory::MKSNAPSHOT,
                          "Serialized with index=%d\n",
                          static_cast<int>(index));
diff --git a/test/fixtures/snapshot/check-mutate-fs.js b/test/fixtures/snapshot/check-mutate-fs.js
new file mode 100644
index 00000000000000..2b746957b82b56
--- /dev/null
+++ b/test/fixtures/snapshot/check-mutate-fs.js
@@ -0,0 +1,6 @@
+'use strict';
+
+const fs = require('fs');
+const assert = require('assert');
+
+assert.strictEqual(fs.foo, 'I am from the snapshot');
diff --git a/test/fixtures/snapshot/decompress-gzip-sync.js b/test/fixtures/snapshot/decompress-gzip-sync.js
new file mode 100644
index 00000000000000..a6480a894480ff
--- /dev/null
+++ b/test/fixtures/snapshot/decompress-gzip-sync.js
@@ -0,0 +1,20 @@
+'use strict';
+
+const zlib = require('zlib');
+const fs = require('fs');
+const assert = require('assert');
+
+const fixture = process.env.NODE_TEST_FIXTURE;
+const mode = process.env.NODE_TEST_MODE;
+const file = fs.readFileSync(fixture);
+const result = zlib.gunzipSync(file);
+
+console.log(`Result length = ${result.byteLength}`);
+console.log('NODE_TEST_MODE:', mode);
+if (mode === 'snapshot') {
+  globalThis.NODE_TEST_DATA = result;
+} else if (mode === 'verify') {
+  assert.deepStrictEqual(globalThis.NODE_TEST_DATA, result);
+} else {
+  assert.fail('Unknown mode');
+}
diff --git a/test/fixtures/snapshot/mutate-fs.js b/test/fixtures/snapshot/mutate-fs.js
new file mode 100644
index 00000000000000..f789ab63db54f9
--- /dev/null
+++ b/test/fixtures/snapshot/mutate-fs.js
@@ -0,0 +1,5 @@
+'use strict';
+
+const fs = require('fs');
+
+fs.foo = 'I am from the snapshot';
diff --git a/test/parallel/test-snapshot-api.js b/test/parallel/test-snapshot-api.js
new file mode 100644
index 00000000000000..d6599ceab4199c
--- /dev/null
+++ b/test/parallel/test-snapshot-api.js
@@ -0,0 +1,49 @@
+'use strict';
+
+// This tests snapshot JS API
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const path = require('path');
+const fs = require('fs');
+
+tmpdir.refresh();
+const blobPath = path.join(tmpdir.path, 'snapshot.blob');
+const entry = fixtures.path('snapshot', 'v8-startup-snapshot-api.js');
+{
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '--build-snapshot',
+    entry,
+  ], {
+    cwd: tmpdir.path
+  });
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    assert.strictEqual(child.status, 0);
+  }
+  const stats = fs.statSync(path.join(tmpdir.path, 'snapshot.blob'));
+  assert(stats.isFile());
+}
+
+{
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+  ], {
+    cwd: tmpdir.path,
+    env: {
+      ...process.env,
+    }
+  });
+
+  const stdout = child.stdout.toString().trim();
+  const file = fs.readFileSync(fixtures.path('x1024.txt'), 'utf8');
+  assert.strictEqual(stdout, file);
+  assert.strictEqual(child.status, 0);
+}
diff --git a/test/parallel/test-snapshot-basic.js b/test/parallel/test-snapshot-basic.js
new file mode 100644
index 00000000000000..d0796ee1a4290f
--- /dev/null
+++ b/test/parallel/test-snapshot-basic.js
@@ -0,0 +1,112 @@
+'use strict';
+
+// This tests that user land snapshots works when the instance restored from
+// the snapshot is launched with --help, --check
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const path = require('path');
+const fs = require('fs');
+
+tmpdir.refresh();
+
+let snapshotScript = 'node:embedded_snapshot_main';
+if (!process.config.variables.node_use_node_snapshot) {
+  // Check that Node.js built without an embedded snapshot
+  // exits with 1 when node:embedded_snapshot_main is specified
+  // as snapshot entry point.
+  const child = spawnSync(process.execPath, [
+    '--build-snapshot',
+    snapshotScript,
+  ], {
+    cwd: tmpdir.path
+  });
+
+  assert.match(
+    child.stderr.toString(),
+    /Node\.js was built without embedded snapshot/);
+  assert.strictEqual(child.status, 1);
+
+  snapshotScript = fixtures.path('empty.js');
+}
+
+// By default, the snapshot blob path is cwd/snapshot.blob.
+{
+  // Create the snapshot.
+  const child = spawnSync(process.execPath, [
+    '--build-snapshot',
+    snapshotScript,
+  ], {
+    cwd: tmpdir.path
+  });
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    console.log(child.signal);
+    assert.strictEqual(child.status, 0);
+  }
+  const stats = fs.statSync(path.join(tmpdir.path, 'snapshot.blob'));
+  assert(stats.isFile());
+}
+
+tmpdir.refresh();
+const blobPath = path.join(tmpdir.path, 'my-snapshot.blob');
+{
+  // Create the snapshot.
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '--build-snapshot',
+    snapshotScript,
+  ], {
+    cwd: tmpdir.path
+  });
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    console.log(child.signal);
+    assert.strictEqual(child.status, 0);
+  }
+  const stats = fs.statSync(blobPath);
+  assert(stats.isFile());
+}
+
+{
+  // Check --help.
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '--help',
+  ], {
+    cwd: tmpdir.path
+  });
+
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    console.log(child.signal);
+    assert.strictEqual(child.status, 0);
+  }
+
+  assert(child.stdout.toString().includes('--help'));
+}
+
+{
+  // Check -c.
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '-c',
+    fixtures.path('snapshot', 'marked.js'),
+  ], {
+    cwd: tmpdir.path
+  });
+
+  // Check that it is a noop.
+  assert.strictEqual(child.stdout.toString().trim(), '');
+  assert.strictEqual(child.stderr.toString().trim(), '');
+  assert.strictEqual(child.status, 0);
+}
diff --git a/test/parallel/test-snapshot-cjs-main.js b/test/parallel/test-snapshot-cjs-main.js
new file mode 100644
index 00000000000000..b445a5a2739142
--- /dev/null
+++ b/test/parallel/test-snapshot-cjs-main.js
@@ -0,0 +1,53 @@
+'use strict';
+
+// This tests that user land snapshots works when the instance restored from
+// the snapshot is launched as a CJS module.
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const path = require('path');
+const fs = require('fs');
+
+tmpdir.refresh();
+const blobPath = path.join(tmpdir.path, 'snapshot.blob');
+const file = fixtures.path('snapshot', 'mutate-fs.js');
+const checkFile = fixtures.path('snapshot', 'check-mutate-fs.js');
+
+{
+  // Create the snapshot.
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '--build-snapshot',
+    file,
+  ], {
+    cwd: tmpdir.path
+  });
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    assert.strictEqual(child.status, 0);
+  }
+  const stats = fs.statSync(blobPath);
+  assert(stats.isFile());
+}
+
+{
+  // Run the check file as a CJS module
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    checkFile,
+  ], {
+    cwd: tmpdir.path
+  });
+
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    assert.strictEqual(child.status, 0);
+  }
+}
diff --git a/test/parallel/test-snapshot-error.js b/test/parallel/test-snapshot-error.js
new file mode 100644
index 00000000000000..a68a4e0bd0cd79
--- /dev/null
+++ b/test/parallel/test-snapshot-error.js
@@ -0,0 +1,73 @@
+'use strict';
+
+// This tests that the errors in the snapshot script can be handled
+// properly.
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const path = require('path');
+const fs = require('fs');
+
+tmpdir.refresh();
+const blobPath = path.join(tmpdir.path, 'snapshot.blob');
+const entry = fixtures.path('snapshot', 'error.js');
+
+// --build-snapshot should be run with an entry point.
+{
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '--build-snapshot',
+  ], {
+    cwd: tmpdir.path
+  });
+  const stderr = child.stderr.toString();
+  console.log(child.status);
+  console.log(stderr);
+  console.log(child.stdout.toString());
+  assert.strictEqual(child.status, 9);
+  assert.match(stderr,
+               /--build-snapshot must be used with an entry point script/);
+  assert(!fs.existsSync(path.join(tmpdir.path, 'snapshot.blob')));
+}
+
+// Loading a non-existent snapshot should fail.
+{
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    entry,
+  ], {
+    cwd: tmpdir.path
+  });
+  const stderr = child.stderr.toString();
+  console.log(child.status);
+  console.log(stderr);
+  console.log(child.stdout.toString());
+  assert.strictEqual(child.status, 1);
+  assert.match(stderr, /Cannot open/);
+  assert(!fs.existsSync(path.join(tmpdir.path, 'snapshot.blob')));
+}
+
+
+// Running an script that throws an error should result in an exit code of 1.
+{
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '--build-snapshot',
+    entry,
+  ], {
+    cwd: tmpdir.path
+  });
+  const stderr = child.stderr.toString();
+  console.log(child.status);
+  console.log(stderr);
+  console.log(child.stdout.toString());
+  assert.strictEqual(child.status, 1);
+  assert.match(stderr, /error\.js:1/);
+  assert(!fs.existsSync(path.join(tmpdir.path, 'snapshot.blob')));
+}
diff --git a/test/parallel/test-snapshot-eval.js b/test/parallel/test-snapshot-eval.js
new file mode 100644
index 00000000000000..4cb1309df97d59
--- /dev/null
+++ b/test/parallel/test-snapshot-eval.js
@@ -0,0 +1,73 @@
+'use strict';
+
+// This tests that user land snapshots works when the instance restored from
+// the snapshot is launched with -p and -e
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const path = require('path');
+const fs = require('fs');
+
+tmpdir.refresh();
+const blobPath = path.join(tmpdir.path, 'snapshot.blob');
+const file = fixtures.path('snapshot', 'mutate-fs.js');
+
+{
+  // Create the snapshot.
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '--build-snapshot',
+    file,
+  ], {
+    cwd: tmpdir.path
+  });
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    assert.strictEqual(child.status, 0);
+  }
+  const stats = fs.statSync(blobPath);
+  assert(stats.isFile());
+}
+
+{
+  // Check -p works.
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '-p',
+    'require("fs").foo',
+  ], {
+    cwd: tmpdir.path
+  });
+
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    assert.strictEqual(child.status, 0);
+  }
+  assert(/I am from the snapshot/.test(child.stdout.toString()));
+}
+
+{
+  // Check -e works.
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '-e',
+    'console.log(require("fs").foo)',
+  ], {
+    cwd: tmpdir.path
+  });
+
+  if (child.status !== 0) {
+    console.log(child.stderr.toString());
+    console.log(child.stdout.toString());
+    assert.strictEqual(child.status, 0);
+  }
+  assert(/I am from the snapshot/.test(child.stdout.toString()));
+}
diff --git a/test/parallel/test-snapshot-gzip.js b/test/parallel/test-snapshot-gzip.js
new file mode 100644
index 00000000000000..2ee6cae1979211
--- /dev/null
+++ b/test/parallel/test-snapshot-gzip.js
@@ -0,0 +1,63 @@
+'use strict';
+
+// This tests that a program that decompresses a gzip file and saves the
+// content can be snapshotted and deserialized properly.
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const tmpdir = require('../common/tmpdir');
+const fixtures = require('../common/fixtures');
+const path = require('path');
+const fs = require('fs');
+
+tmpdir.refresh();
+const blobPath = path.join(tmpdir.path, 'snapshot.blob');
+const file = fixtures.path('snapshot', 'decompress-gzip-sync.js');
+
+{
+  // By default, the snapshot blob path is snapshot.blob at cwd
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    '--build-snapshot',
+    file,
+  ], {
+    env: {
+      ...process.env,
+      NODE_TEST_FIXTURE: fixtures.path('person.jpg.gz'),
+      NODE_TEST_MODE: 'snapshot'
+    },
+    cwd: tmpdir.path
+  });
+  const stderr = child.stderr.toString();
+  const stdout = child.stdout.toString();
+  console.log(stderr);
+  console.log(stdout);
+  assert.strictEqual(child.status, 0);
+
+  const stats = fs.statSync(path.join(tmpdir.path, 'snapshot.blob'));
+  assert(stats.isFile());
+  assert(stdout.includes('NODE_TEST_MODE: snapshot'));
+}
+
+{
+  const child = spawnSync(process.execPath, [
+    '--snapshot-blob',
+    blobPath,
+    file,
+  ], {
+    env: {
+      ...process.env,
+      NODE_TEST_FIXTURE: fixtures.path('person.jpg.gz'),
+      NODE_TEST_MODE: 'verify'
+    },
+    cwd: tmpdir.path
+  });
+  const stderr = child.stderr.toString();
+  const stdout = child.stdout.toString();
+  console.log(stderr);
+  console.log(stdout);
+  assert.strictEqual(child.status, 0);
+  assert(stdout.includes('NODE_TEST_MODE: verify'));
+}