Skip to content

Finding new methods to detect tampering of native functions in JS (chrome V8)

Notifications You must be signed in to change notification settings

hrt/TamperDetectJS

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

70 Commits
 
 
 
 
 
 
 
 

Repository files navigation

https://hrt.github.io/TamperDetectJS/

https://hrt.github.io/TamperDetectJS/

Detecting alterered native functions / prototypes in Javascript

"It is impossible to determine whether an object is a proxy or not (transparent virtualization)." - https://exploringjs.com/es6/ch_proxies.html

Detecting altered prototypes is useful for when you don't want 3rd party scripts from messing with your page - including anti cheats for certain games. This repo explores methods of detecting if a method has been tampered with as well as methods to get around such detections.

In conclusion, it's possible to determine if a proxy of a native function is a proxy. There are many tells.


index.html is a standalone page with embeded javascript that will check if Array.prototype.join has been tampered with.

You can view index.html on your browser here https://hrt.github.io/TamperDetectJS/

I've included two tampermonkey content script that tampers with Array.prototype.join.

One is a simple proxy that gets detected. The other attempts to conceal the proxy but still fails...


Big thonks to Lemons1337 for chipping in.

Note: This is meant only for chromium based browsers. You will get false detections on others.