Tools to hook browser's Javascript function implementations

Question

I'm wondering if there is a way to hook or inject code into Javascript's implementation of a native function. For example, print the calling parameters whenever an encrypt() function is called. I not looking for a solution that works from inside the browser e.g. some kind of extension because it may break the behavior of my program or may get detected. I'm looking a way to patch a Javascript's implementation of a method something probably faster than patching the V8 (or whatever engine is used).

Thanks you for your time.

Answer 1

If you have access to the DevTools console and you're able to make the call to encrypt happen whenever you want after the page loads, then you could just redefine the encrypt method to log what's being passed to it:

let encryptCopy = crypto.subtle.encrypt;

crypto.subtle.encrypt = function() {
    console.log(arguments);
    encryptCopy.apply(this, arguments);
};

If you need to redefine before the document fully loads, then you could do the following:

1. Open DevTools.
2. Click on the Network tab.
3. Click where it says "No Throttling" and set that to "Slow 3G" (or create your own custom slower speed).
4. Click the Sources tab.
5. As soon as you hit Enter in the address bar to visit your page, click on the pause button in the DevTools debugger.
6. Paste the code above into the console and hit enter to redefine the method.
7. Unpause execution, then go back to the Network tab and disable throttling so you're not waiting 8 bajillion years for the page to load. =)

I know you said no extensions, but instead of doing that stuff above, if you can use Tampermonkey, then you could create a userscript to run at document-start, then place the code above inside of a MutationObserver so that your version of encrypt is used when the page loads.

Example:

// ==UserScript==
// @name         Sniff encrypt()
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  Redefine encrypt to view its params.
// @author       dsasmblr
// @match        https://*.PutYourSiteHere.com/*
// @grant        none
// @run-at       document-start
// ==/UserScript==

(function() {
    'use strict';

    const t = document.body;
    const c = { childList: true, subtree: true };

    const cb = (mutList, obs) => {
        if (mutList) {
            let encryptCopy = crypto.subtle.encrypt;

            crypto.subtle.encrypt = function() {
                console.log(arguments);
                encryptCopy.apply(this, arguments);
            };
        };

        obs.disconnect();
    };

    const obs = new MutationObserver(cb);

    obs.observe(t, c);
})();

(Make sure you change the @match line to contain your domain name of interest. Keeping the asterisks where they are means the script will run on every page of the domain, so change that to be the specific page you want it to run on if need be.)

If you have problems with trap debugger statements to catch DevTools, then click the Deactivate breakpoints button in the Sources tab (its to the far-right of the pause/play execution button). If there are window dimension checks that seem to be happening when opening DevTools, undock DevTools from the window (via the hamburger menu options where you can choose where you want to dock DevTools).

Short of that, you could try compiling your own build of Chromium with a console.log() added in the definition of encrypt (which I gather you don't quite want to do if you can avoid it).

My final initial suggestion is that you could try utilizing instrumentation like FridaJS to hook your browser and intercept the data.