hrt/tamperdetectjs

Finding new methods to detect tampering of native functions in JS (chrome V8)

https://hrt.github.io/TamperDetectJS/

Detecting alterered native functions / prototypes in Javascript

"It is impossible to determine whether an object is a proxy or not (transparent virtualization)." - https://exploringjs.com/es6/ch_proxies.html

Detecting altered prototypes is useful for when you don't want 3rd party scripts from messing with your page - including anti cheats for certain games. This repo explores methods of detecting if a method has been tampered with as well as methods to get around such detections.

In conclusion, it's possible to determine if a proxy of a native function is a proxy. There are many tells.

---

index.html is a standalone page with embeded javascript that will check if Array.prototype.join has been tampered with.

You can view index.html on your browser here https://hrt.github.io/TamperDetectJS/

I've included two tampermonkey content script that tampers with Array.prototype.join.

One is a simple proxy that gets detected. The other attempts to conceal the proxy but still fails...

---

Big thonks to Lemons1337 for chipping in.

Note: This is meant only for chromium based browsers. You will get false detections on others.

tamperdetectjs's Issues

Detecting tamper via strict comparison to native function pulled from iframe

It's possible to create a new iframe (about:blank) and pull functions from its Document, then comparing it to the tampered function. This is, for example, being done in Krunker to detect function tamper. CanvasBlocker has some good methods to address this.