JS逆向常用HOOK代码

JS逆向常用HOOK代码

JSON HOOK

(function(){
    var my_stringify = JSON.stringify;
    JSON.stringify=function(params){
        console.log("HOOK stringify",params);
        debugger
        return my_stringify(params)
    };

    var my_parse = JSON.parse;
    JSON.parse = function(params){
        console.log("HOOK parse",params);
        debugger
        return my_parse(params);
    }
})();

COOKIE HOOK

(function(){
    var cookie_cache = document.cookie;
    Object.defineProperty(document,'cookie',{
        get:function(){
            console.log('Get cookie');
            debugger
            return cookie_cache;
        },
        set:function(val){
            console.log('Set cookie',val);
            debugger
            var cookie=val.split(";")[0];
            var ncookie=cookie.split("=");
            var flag = false;
            var cache=cookie_cache.split("; ");
            cache = cache.map(function(a){
                if (a.split("=")[0]===ncookie[0]){
                    flag=true;
                    return cookie;
                }
                return a;
            })
            cookie_cache=cache.join("; ");
            if (!flag){
                cookie_cache+=cookie+"; ";
            }
            this._value=val;
            return cookie_cache;
        },
    });
})();

(function(){
    'use strict'
    Object.defineProperty(document, 'cookie', {
        get: function() {
            //debugger;
            return "";
        },
        set: function(value) {
            debugger;
            return value;
        },
});
})()

(function() {
    // 严谨模式 检查所有错误
    'use strict';
    // document 为要hook的对象 这里是hook的cookie
 var cookieTemp = "";
    Object.defineProperty(document, 'cookie', {
  // hook set方法也就是赋值的方法 
  set: function(val) {
    // 这样就可以快速给下面这个代码行下断点
    // 从而快速定位设置cookie的代码
    console.log('Hook捕获到cookie设置->', val);
                debugger;
    cookieTemp = val;
    return val;
  },
  // hook get 方法也就是取值的方法 
  get: function()
  {
   return cookieTemp;
  }
    });
})();

Search Decode Hook

(function(){
    for (var p in window){
        var s = p.toLowerCase();
        if (s.indexOf('encode') != -1 || s.indexOf('encry') != -1){
            console.log("encode function.\n",window[p]);
            debugger
        }
        if (s.indexOf('decode') != -1 || s.indexOf('decry') !=-1){
            console.log("decode function.\n",window[p]);
            debugger
        }
    }
})();

Headers Hook

(function () {
    var _setRequestHeader = window.XMLHttpRequest.prototype.setRequestHeader;
    window.XMLHttpRequest.prototype.setRequestHeader = function (key, value) {
        if (key == 'Authorization') {
            debugger;
        }
        return _setRequestHeader.apply(this, arguments);
    };
})();

Debugger Hook

(()=>{
    Function.prototype.__constructor = Function.prototype.constructor;
    Function.prototype.constructor = function(){
        if(arguments && typeof arguments[0]==='string'){
            if("debugger"===arguments[0]){
                return
            }
            return Function.prototype.__constructor.apply(this,arguments);
        }
    }
})()

Function.prototype.constructor_ = Function.prototype.constructor;
Function.prototype.constructor = function (a) {
    if(a == "debugger") {
        return function (){};
    }
    return Function.prototype.constructor_(a);
};

setInterval_new=setInterval
setInterval=function(a,b){
if(a.indexOf("debugger")==-1){
    return setInterval_new(a,b)
    }
}

Function.prototype.constructor = function(){}

eval_bc = eval  
eval =function(a){
    if (a===='debugger;a=asdasdasdas')
    return eval_bc(a)
}

// Hook setTimeout

var setTimeout_ = setTimeout
var setTimeout = function (func, time){
    if (func == txsdefwsw){
        return function () {};
    }
    return setTimeout_(func, time)
}

eval Hook

(function() {
    if (window.__cr_eval) return
    window.__cr_eval = window.eval
    var myeval = function (src) {
        console.log("==== eval begin: length=" + src.length + ",caller=" + (myeval.caller && myeval.caller.name) + " ====")
        console.log(src);
        console.log("==== eval end ====")
        return window.__cr_eval(src)
    }
    var _myeval = myeval.bind(null) 
    _myeval.toString = window.__cr_eval.toString
    Object.defineProperty(window, 'eval', { value: _myeval })
    console.log(">>>> eval injected: " + document.location + " <<<<")
})();

(function(){
	'use strict';
	var _eval = window.eval;
	window.eval = function(x){_eval(x.replace("debugger",';'));};
	window.eval.toString = _eval.toString;
})();