逆向常见hook(转自网络)

1 headers hook 当header中包含Authorization时，则插入断点

var code = function(){
var org = window.XMLHttpRequest.prototype.setRequestHeader;
window.XMLHttpRequest.prototype.setRequestHeader = function(key,value){
    if(key=='Authorization'){
        debugger;
    }
    return org.apply(this,arguments);
}
}
var script = document.createElement('script');
script.textContent = '(' + code + ')()';
(document.head||document.documentElement).appendChild(script);
script.parentNode.removeChild(script);

2 请求hook 当请求url里包含anlysis时，插入断点

(function () {
    var open = window.XMLHttpRequest.prototype.open;
    window.XMLHttpRequest.prototype.open = function (method, url, async) {
        if (url.indexOf("analysis") != -1) {
            debugger;
        }
        return open.apply(this, arguments);
    };
})();

3 过debugger—1 constructor 基于构造器实现的

var _constructor = constructor;
Function.prototype.constructor = function(s) {
    if (s == "debugger") {
        console.log(s);
        return null;
    }
    return _constructor(s);
}

4 过debugger—2 eval的

(function() {
    'use strict';
    var eval_ = window.eval;
    window.eval = function(x) {
        eval_(x.replace("debugger;", "  ; "));
    }
    ;
    window.eval.toString = eval_.toString;
}
)();

5 JSON HOOK

var my_stringify = JSON.stringify;
JSON.stringify = function (params) {
    //这里可以添加其他逻辑比如 
    debugger
    console.log("json_stringify params:",params);
    return my_stringify(params);
};
var my_parse = JSON.parse;

JSON.parse = function (params) {

//这里可以添加其他逻辑比如

debugger

console.log("json_parse params:",params);

return my_parse(params);

};

6 对象属性hook 属性自定义,hook cookie操作

这种操作只是针对通过js生成的cookie，若cookie是服务器后台返回的则不起效果

(function(){
    // 严格模式，检查所有错误
    'use strict'
    // document 为要hook的对象 ,属性是cookie
    Object.defineProperty(document,'cookie',{
        // hook set方法也就是赋值的方法，get就是获取的方法
        set: function(val){
            // 这样就可以快速给下面这个代码行下断点，从而快速定位设置cookie的代码
            debugger;  // 在此处自动断下
            console.log('Hook捕获到set-cookie ->',val);
            return val;
        }
    })
})();
// 只针对Cookie的某个值进行hook----------------------------------

(function(){

'use strict'

Object.defineProperty(document,'cookie',{

set: function(val){

if (val == "xxxx"){

debugger;

}

console.log('Hook捕获到set-cookie ->',val);

return val;

}

})

})();

7 hook canvas（定位定位图片生成的地方）

(function() {
    'use strict';
    let create_element = document.createElement.bind(doument);

<span class="hljs-variable language_">document.<span class="hljs-property">createElement = <span class="hljs-keyword">function (<span class="hljs-params">_element) {
    <span class="hljs-variable language_">console.<span class="hljs-title function_">log(<span class="hljs-string">"create_element:",_element);
    <span class="hljs-keyword">if (_element === <span class="hljs-string">"canvas") {
        <span class="hljs-keyword">debugger;
    }
    <span class="hljs-keyword">return <span class="hljs-title function_">create_element(_element);
}


<span class="hljs-variable language_">document.<span class="hljs-property">createElement = <span class="hljs-keyword">function (<span class="hljs-params">_element) {
    <span class="hljs-variable language_">console.<span class="hljs-title function_">log(<span class="hljs-string">"create_element:",_element);
    <span class="hljs-keyword">if (_element === <span class="hljs-string">"canvas") {
        <span class="hljs-keyword">debugger;
    }
    <span class="hljs-keyword">return <span class="hljs-title function_">create_element(_element);
}
})();

8 setInterval 定时器

(function() {
    setInterval_ = setInterval;
    console.log("原函数已被重命名为setInterval_")
    setInterval = function() {}
    ;
    setInterval.toString = function() {
        console.log("有函数正在检测setInterval是否被hook");
        return setInterval_.toString();
    }
    ;
}
)();

9 setInterval 循环清除定时器

for(var i = 0; i < 9999999; i++) window.clearInterval(i)