Detecting tamper via strict comparison to native function pulled from iframe

[asger-finding]

It's possible to create a new iframe (about:blank) and pull functions from its Document, then comparing it to the tampered function. This is, for example, being done in Krunker to detect function tamper. CanvasBlocker has some good methods to address this.

[hrt]

Yes, if you are hooking functions you should also hook all iframes.

Fun fact: Krunker started doing this after I introduced the use of it in above repo.

[asger-finding]

Yes, if you are hooking functions you should also hook all iframes.

I feel it should also be addressed in this repository, as it's certainly another way to detect tamper.

[doctor8296]

This is hackable by Object.defineProperty + Proxy.
I hacked the krunker after reading this repo)
I simply defined Function, and checked the stack trace to return proxy, only on game file evaluation.
And it's been working for a year now.
After all of that I came up with conclusion that everthing is hackable.
I worked hard for the whole 3 days, and just don't see any solutons.

[hrt]

This is hackable by Object.defineProperty + Proxy.

@redscheme I would like to see an example user script that hooks Array.prototype.join in anyway and gets the pass on https://hrt.github.io/TamperDetectJS/ with chrome.

From what I've understood from your explanation, it wouldn't get the pass.

This is hackable by Object.defineProperty + Proxy. I hacked the krunker after reading this repo) I simply defined Function, and checked the stack trace to return proxy, only on game file evaluation. And it's been working for a year now. After all of that I came up with conclusion that everthing is hackable. I worked hard for the whole 3 days, and just don't see any solutons.

I'm going to have to agree with hrt here, were you using any other browsers? I've tried to recreate your explanation and It does not work.

[doctor8296]

@hrt @Kepler-11
Hi,
Despite the fact that each check can be passed pretty easy, the fastest way to hack current scheme is this:

const join = Array.prototype.join;
Object.defineProperty(Array.prototype, 'join', {
    get() {
       // check "this" or stack to replace the function only when its needed or replace function with original only on checks
        if ( ... ) return new Proxy(join, { ... })
        return join;
    }
});

[hrt]

@redscheme this means that it wouldn't be hooking join.

All krunker or whoever would do is storejoin in a variable, do whatever checks (which you haven't hooked to get passed the checks) and continue using the stored join that passed the checks.

Your get logic only applies to when the page first stores to a variable.

I may adjust the repo to specifically request the user to hook join to return a unique value that can be checked to ensure the user is actually hooking join. This will let the user be sure that they're hooking join rather than not hooking at all.

[doctor8296]

@hrt yes you right, you can easy avoid this just by calling getter once before checks. But it is pretty difficult to store each class and method
separately somewhere and force the new global scope. Difficult but not impossible.

I still believe that it is quite possible to bypass these checks, and sooner or later I will do it, since I have seriously dealt with this topic.

[doctor8296]

That was easy.
It took me 15 minutes.

const Reflect = {
    apply: window.Reflect.apply
};

const console = {log: window.console.log};
window.console.log = () => {};

const originalJoin = Array.prototype.join;
const joinProxy = Array.prototype.join = new Proxy(Array.prototype.join, {});

const originalDateToDateString = Date.prototype.toDateString;
const originalDatetoString = Date.prototype.toString;
const dateToStringProxy = Date.prototype.toString = new Proxy(Date.prototype.toString, {
    apply(target, thisArg, args) {
        switch (thisArg) {
            case joinProxy: {
                throw {stack: '' + originalJoin};
                break;
            }
            case toStringProxy: {
                throw {stack: '' + originalToString};
                break;
            }
            case originalDateToDateString: {
                throw {stack: '' + originalDateToDateString};
                break;
            }
        }
        return Reflect.apply(...arguments);
    }
});

const originalToString = Function.prototype.toString;
const toStringProxy = Function.prototype.toString = new Proxy(Function.prototype.toString, {
    apply(target, thisArg, args) {
        switch (thisArg) {
            case joinProxy: {
                arguments[1] = originalJoin;
                break;
            }
            case toStringProxy: {
                arguments[1] = originalToString;
                break;
            }
            case dateToStringProxy: {
                arguments[1] = originalDatetoString;
                break;
            }
        }
        return Reflect.apply(...arguments);
    }
});

Object.create = new Proxy(Object.create, {
    apply(target, thisArg, args) {
        if (args[0] === joinProxy) throw {stack: ''};
        return Reflect.apply(...arguments);
    }
});

I got back to this theme a week ago. I spent a lot of time on iframe / html render / fight for the event loop etc, but nothing.. and after I losing all hope I got back here just to solve this puzzle for fun and maybe to see something interesting.
Seems I figure something out. The stack of error CANNOT be redefined. I thought it could before, but it seems, if you not calling error through other redefinable functions you cannot reach it. I was really surprized by this fact. Anyway, a week of researches gave me very little bit that I cannot actually use in my goal to create client sided anticheat / checker for redefinitions. Sad. But I'll look into the stack thing.

[hrt]

@doctor8296 Good one.

You've beaten it. If I were to make it harder, I'd first make the checks on the stack traces a little stronger (Proxy is seen everywhere) 😂

(index):152 check_stack_5_toString
----
TypeError: Method Date.prototype.toDateString called on incompatible receiver function toString() { [native code] }
    at Proxy.toDateString (<anonymous>)
    at Array.check_stack_5_toString (https://hrt.github.io/TamperDetectJS/:149:33)
    at https://hrt.github.io/TamperDetectJS/:487:33

[doctor8296]

Well, I mean yeah, you can add extra checks, but I think it just will took me more time to hack it. I am currently looking into the stack thing. I think with this I have a chance to implement some iframe + document.write logic.

[doctor8296]

@hrt WE CAN CHECK EVERYTHING WITH CLEAR toString!

[hrt]

@doctor8296

Not sure I understood that.

---

I likely read your comment wrong but I should also add delete Function.prototype.something where something can be a lot of prototype functions for example toString which would restore the native function or at least let you compare against the native function.

[doctor8296]

@hrt
Yes that what I meant. Did you know about such behavior? I just figure out this today, playing with primitive prototype redefinition, and figured out that it restores itself after deleting, as well as prototype.toString.
So does that mean that the topic completely closed? From my point of view having clear toString solves every our problem, without huge mass of different checks.

[hrt]

@doctor8296 not necessarily: