常⽤js逆向hook⽅法
1.hook eval
(function() {
'use strict';
//过debuger
var eval_ = window.eval;
window.eval = function(x){
eval_(x.replace("debugger;","  ; "));
};
//防debuger检测
String = eval_.toString;
})();
2.hook debugger
//⽅式1
structor=function(){};
structor_bc=structor;
structor=function(){
if (arguments==="debugger"){return}
else{return structor_bc.apply(this,arguments)}
};
//⽅式2
n_eval = eval
eval = function () {
if (argument.indexOf("debugger") === 0) {
return
}
return n_eval.apply(argument)
}
//⽅式3
n_eval = eval
eval = function () {
reg = RegExp(/debugger/)
if ((argument)) {
return
}
return n_eval.apply(argument)
}
//⽅式4
n_Function = Function
Function = function () {
if (argument.indexOf("debugger") === 0) {
return
}
return n_Function.apply(argument)
}
//⽅式5
n_Function = Function
Function = function () {
reg = RegExp(/debugger/)
if ((argument)) {
return
}
return n_Function.apply(argument)
}
3.hook cookie
/
/当前版本hook⼯具只⽀持Content-Type为html的⾃动hook
(function () {
'use strict';
var cookie_cache = kie;
Object.defineProperty(document, 'cookie', {
get: function () {
console.log(cookie_cache);
return cookie_cache;
},
set: function (val) {
debugger;
var cookie = val.split(";")[0];
var ncookie = cookie.split("=");
var flag = false;
var cache = cookie_cache.split(";");
if (a.split("=")[0] === ncookie[0]) {
flag = true;
return cookie;
}
return a;
});
cookie_cache = cache.join(";");
if (!flag) {
cookie_cache += cookie + ";";
}
},
});
})();
4.hook ajax !function (t) {
function n(e) {
if (r[e]) return r[e].exports;
var i = r[e] = {
exports: {},
id: e,
loaded: !1
};
return t[e].ports, i, i.exports, n),
i.loaded = !0,
}
var r = {};
return n.m = t,
n.c = r,
n.p = "",
n(0)
}([function (t, n, r) {
r(1)(window)
},
function (t, n) {
var n = "RealXMLHttpRequest";
t.hookAjax = function (t) {
function r(n) {
return function () {
var r = this.hasOwnProperty(n + "_") ? this[n + "_"] : this.xhr[n],
e = (t[n] || {}).getter;
return e && e(r, this) || r
}
}
function e(n) {
return function (r) {
var e = this.xhr,
i = this,
o = t[n];
if ("function" == typeof o) e[n] = function () {
t[n](i) || r.apply(e, arguments)
};
else {
var u = (o || {}).setter;
r = u && u(r, i) || r;
try {
e[n] = r
} catch (t) {
this[n + "_"] = r
}
}
}
}
function i(n) {
return function () {
var r = [].slice.call(arguments);
if (!t[n] || !t[n].call(this, r, this.xhr)) return this.xhr[n].apply(this.xhr, r)
}
}
return window[n] = window[n] || XMLHttpRequest,
var t = new window[n];
for (var o in t) {
var u = "";
try {
u = typeof t[o]
} catch (t) {
}
"function" === u ? this[o] = i(o) : Object.defineProperty(this, o, {
get: r(o),
set: e(o),
enumerable: !0
})
}
this.xhr = t
},
window[n]
},
t.unHookAjax = function () {
window[n] && (XMLHttpRequest = window[n]),
window[n] = void 0
},
t.default = t
}
}]);
hookAjax(
/
/ hook functions and callbacks of XMLHttpRequest object
{
onreadystatechange: function (xhr) {
//console.log("onreadystatechange called: %O", xhr)
},
onload: function (xhr) {
//console.log("onload called: %O", xhr)
},
open: function (arg, xhr) {
console.log("open called: method:%s,url:%s,async:%s", arg[0], arg[1], arg[2], xhr);            // arg[1] += "?hook_tag=1";
//统⼀添加请求头
js arguments},
send: function (arg, xhr) {
console.log("send called: %O", arg[0]);
xhr.setRequestHeader("_custom_header_", "ajaxhook")
},
setRequestHeader: function (arg, xhr) {
console.log("setRequestHeader called!", arg)
},
// hook attributes of XMLHttpRequest object
timeout: {
setter: function (v, xhr) {
//timeout shouldn't exceed 10s
return Math.max(v, 1000);
}
}
}
);
5.防⽌hook检测// 这段代码防⽌反hook的检测
orig = window.eval;
window.eval=function(str){debugger;orig(str);}
String = function (){String();}
6.防原型链检测//如hook了split⽅法
String.prototype.split_bk=String.prototype.split;
String.prototype.split = function(val){
str = String()
debugger;
return str.spilt_bk(val)
}
//伪装原型链
String.String=function(){
return 'function split() { [native code] }'
}

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。