Become King Of Hell
  Guest viewing is limited

Web Development Anti-debug in browsers With Javascript

CyberGod

Administrator
Staff member
Admin
Joined
Dec 23, 2021
Messages
724
Location
Hell
Website
hellofhackers.com
Hellcoins
♆26,040
Profile Music
Quite by accident I came across several ways to find out if the script is running under the browser debugger (firebug, chrome developer tools, etc.) I will share with the public.

Method one
Works everywhere except opera.

Check if console.log() is called Output a function type variable to the console and set the format to %s The debugger tries to turn the value into a string, which triggers the toString method. And we intercept toString (option: the same with the % d format and the toValue method). Tellingly, we need a function, a simple object does not work.

(addition: In chrome, y=/some regular expression/ also rolls)
You must reply before you can see the hidden data contained here.
Nuance. Once IE picks up a debugger, it no longer unhooks it, but simply removes it from sight. Therefore, the code will return true even after the debugger window is closed.

Method two.
Works everywhere :yahoo:

If the toString method is attached to a function, then for some reason it is launched whenever an object is viewed in the debugger window: watch, local variables, etc. <_< Worse, the call comes even if the script is paused :eek: or completed

But why all browsers are buggy?????
You must reply before you can see the hidden data contained here.
Exception: Value output via the console in opera is not intercepted.

Method three.
Works in Chrome/FF

Use css on console output
You must reply before you can see the hidden data contained here.
The request to sniffer.png is sent only if the debugger is open.

Method four.
Works everywhere but not always.

Fall out into the debugger yourself, through the debugger statement or by mistake, then check the timer. In principle, a well-known feature, I quote for the sake of completeness.
You must reply before you can see the hidden data contained here.
debugger is hard to hide. it's easier to hide the error
You must reply before you can see the hidden data contained here.
Alas, the result is not guaranteed. Sometimes browsers refuse to fall into the debugger, especially inside eval()

....... Any
other ideas?
 
Top