js逆向之补环境代理模板

let setProxyArr = function (proxyObjArr) {for (let i = 0; i < proxyObjArr.length; i++) {const handler = `{get:function(target,property,receiver){console.log("方法:","get","对象","${proxyObjArr[i]}","属性:",
property,"属性类型:",typeof property,"属性值:",target[property],"属性值类型:",typeof target[property]);
return Reflect.get(...arguments)},set:function(target,property,value,receiver){console.log("方法:","set","对象:","${proxyObjArr[i]}","属性:",
property,"属性类型:",typeof property,"属性值:",value,"属性值类型:",typeof target[property]);return Reflect.set(...arguments);}}`;eval(`try{${proxyObjArr[i]};${proxyObjArr[i]} = new Proxy(${proxyObjArr[i]},${handler});} catch (e){${proxyObjArr[i]} = {};${proxyObjArr[i]} = new Proxy(${proxyObjArr[i]},${handler});}`);}
}
function watch(object) {const handler = {get: function (target, property, receiver) {if (property !== 'isNaN' && property !== 'encodeURI' && property !== "Uint8Array" && property !== 'undefined' && property !== 'JSON') {console.log("方法:", "get", "对象", target, "属性:",property, "属性类型:", typeof property, "属性值:", target[property], "属性值类型:", typeof target[property]);}return Reflect.get(...arguments)},set: function (target, property, value, receiver) {console.log("方法:", "set", "对象:", target, "属性:",property, "属性类型:", typeof property, "属性值:", value, "属性值类型:", typeof target[property]);return Reflect.set(...arguments);}}return new Proxy(object, handler)
}
const safeFunction = function safeFunction(func) {//处理安全函数Function.prototype.$call = Function.prototype.call;const $toString = Function.toString;const myFunction_toString_symbol = Symbol('('.concat('', ')'));const myToString = function myToString() {return typeof this === 'function' && this[myFunction_toString_symbol] || $toString.$call(this);}const set_native = function set_native(func, key, value) {Object.defineProperty(func, key, {"enumerable": false,"configurable": true,"writable": true,"value": value});}delete Function.prototype['toString'];set_native(Function.prototype, "toString", myToString);set_native(Function.prototype.toString, myFunction_toString_symbol, "function toString() { [native code] }");const safe_Function = function safe_Function(func) {set_native(func, myFunction_toString_symbol, "function" + (func.name ? " " + func.name : "") + "() { [native code] }");}return safe_Function(func)
}//创建函数
const makeFunction = function makeFunction(name) {// 使用 Function 保留函数名let func = new Function("v_log", `return function ${name}() {v_log('函数${name}传参-->', arguments);};`)(v_log); // 传递 v_log 到动态函数safeFunction(func);func.prototype = myProxy(func.prototype, `方法${name}.prototype`);return func;
}
window = global
window.Buffer = Buffer
window.Window = function Window() { }
Object.setPrototypeOf(window, window.Window.prototype)
window.Document = function Document() { }
delete global
delete Buffer
delete __dirname
delete __filename
delete process
safeFunction(window.Window)
safeFunction(window.Document)function HTMLDocument() {}
Object.setPrototypeOf(HTMLDocument.prototype, window.Document.prototype)
HTMLDocument.prototype.constructor = HTMLDocument
document = new HTMLDocument()
window.HTMLDocument = HTMLDocument
safeFunction(window.HTMLDocument)function Navigator() {}
navigator = new Navigator()
window.Navigator = Navigator
safeFunction(window.Navigator)function Screen() {}
screen = new Screen()
window.Screen = Screen
safeFunction(window.Screen)function History() {}
history = new History()
window.History = History
safeFunction(window.History)function Location() {}
location = new Location()
window.Location = Location
safeFunction(window.Location)
setProxyArr(['window', 'document', 'location', 'history', 'screen', 'navigator'])