Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: I'm building a browser for reverse engineers

nullpt.rs

Post reply on HN
Print view View original

11–20 of 58 posts

Re: Show HN: I'm building a browser for reverse engineers

#12

Post by nullpt_rs »

Matheus28 wrote: post #10

You can just use Proxy to get around toString shenanigans and prevent any detection whatsoever.

Someone mentioned this as well in another comment. Turns out most of this could’ve been done as an extension after all :-)

edit: actually, wouldn’t you still need to override the global you’d like to instrument? At that point, the toString of the modified function would leak your hook.

see: https://gist.github.com/voidstar0/179990efe918d1028b72f292cf...

Regardless, I do have some interesting ideas that should hopefully make my pain of compiling Chromium for 3 hours worth it though :p

Cheat Engine for site scripts? Who knows. Mostly just using this as an opportunity to learn some browser internals so id say it still paid off :)

Re: Show HN: I'm building a browser for reverse engineers

#15

Post by coolelectronics »

nullpt_rs wrote: post #12
Matheus28 wrote: post #10

You can just use Proxy to get around toString shenanigans and prevent any detection whatsoever.

Someone mentioned this as well in another comment. Turns out most of this could’ve been done as an extension after all :-) edit: actually, wouldn’t you still need to override the global you’d like to instrument? At that point, the toString of the modified function would leak your hook. see: https://gist.github.com/voidstar0/179990efe918d1028b72f292cf... Regardless, I do have some interesting ideas that should hopeful…

Your example proxies the console object, the intended way in this case is to make a proxy from the log function itself and use the apply hook

toString will be called on the Proxy and not your hook so it won't reveal anything

Re: Show HN: I'm building a browser for reverse engineers

#16

Post by 2bird3 »

tbrockman wrote: post #8
nullpt_rs wrote: post #6

Earlier quoted context omitted.

Thanks for sharing some examples! Someone shared a similar project in the other thread. I didn’t realize this at the time of writing haha. FWIW I still think modifying the browser has some positives wrt stealth and hooking out of process frames (could be wrong on the second part, haven’t actually tested!) Still good to know though will leave a note in the article :-)

Yeah, there's a pretty overwhelming amount of browser APIs and functionality which isn't always (well-)documented to learn about. If I recall correctly Proxies wouldn't be detectable (seems to be supported by https://exploringjs.com/es6/ch_proxies.html#sec_detect-proxi... ) so long as your injected content script runs first (otherwise other code could presumably override the Proxy constructor). You should also be abl…

To note, there are undocumented detections to even Proxys, for example using `in` operator in v8 (such as `proxiedFunc in 1` for some proxied function). Really cool to see a project like this.

Re: Show HN: I'm building a browser for reverse engineers

#19

Post by nullpt_rs »

coolelectronics wrote: post #15
nullpt_rs wrote: post #12

Earlier quoted context omitted.

Someone mentioned this as well in another comment. Turns out most of this could’ve been done as an extension after all :-) edit: actually, wouldn’t you still need to override the global you’d like to instrument? At that point, the toString of the modified function would leak your hook. see: https://gist.github.com/voidstar0/179990efe918d1028b72f292cf... Regardless, I do have some interesting ideas that should hopeful…

Your example proxies the console object, the intended way in this case is to make a proxy from the log function itself and use the apply hook toString will be called on the Proxy and not your hook so it won't reveal anything

D'oh! You are correct :-) Good catch and thanks for teaching me something!
Post reply on HN