refactor: 将文件从子目录提升到仓库根目录
所有文件从 hello_js_reverse_skill/ 子目录移至仓库根目录， 使项目结构更清晰，便于作为 Skill 直接引用。 Made-with: Cursor
This commit is contained in:
白夜
@@ -0,0 +1,346 @@
|
||||
/**
|
||||
* Hook 代码生成器
|
||||
* 根据逆向目标快速生成 Hook 注入代码
|
||||
*
|
||||
* 使用方式:
|
||||
* node hook-generator.js --type=cookie
|
||||
* node hook-generator.js --type=xhr --target="/api/data"
|
||||
* node hook-generator.js --type=all
|
||||
* node hook-generator.js --type=custom --function="encrypt" --module="CryptoJS"
|
||||
*/
|
||||
|
||||
const HOOK_TEMPLATES = {
|
||||
|
||||
cookie: (options = {}) => {
|
||||
const target = options.target || '';
|
||||
return `(function() {
|
||||
var _cookie = document.cookie || '';
|
||||
Object.defineProperty(document, 'cookie', {
|
||||
set: function(val) {
|
||||
${target ? `if (val.indexOf('${target}') !== -1) {` : '{'}
|
||||
console.log('[Hook:Cookie] Set:', val);
|
||||
console.trace('[Hook:Cookie] 调用栈');
|
||||
}
|
||||
var parts = val.split(';');
|
||||
var mainPart = parts[0];
|
||||
if (_cookie) _cookie += '; ';
|
||||
_cookie += mainPart;
|
||||
},
|
||||
get: function() { return _cookie; },
|
||||
configurable: true
|
||||
});
|
||||
console.log('[Hook:Cookie] Cookie Hook 已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
xhr: (options = {}) => {
|
||||
const target = options.target || '';
|
||||
return `(function() {
|
||||
var _open = XMLHttpRequest.prototype.open;
|
||||
var _send = XMLHttpRequest.prototype.send;
|
||||
var _setHeader = XMLHttpRequest.prototype.setRequestHeader;
|
||||
|
||||
XMLHttpRequest.prototype.open = function(method, url) {
|
||||
this.__hookMethod = method;
|
||||
this.__hookUrl = url;
|
||||
this.__hookHeaders = {};
|
||||
return _open.apply(this, arguments);
|
||||
};
|
||||
|
||||
XMLHttpRequest.prototype.setRequestHeader = function(name, value) {
|
||||
this.__hookHeaders[name] = value;
|
||||
return _setHeader.apply(this, arguments);
|
||||
};
|
||||
|
||||
XMLHttpRequest.prototype.send = function(body) {
|
||||
${target ? `if (this.__hookUrl && this.__hookUrl.indexOf('${target}') !== -1) {` : '{'}
|
||||
console.log('[Hook:XHR] ★', this.__hookMethod, this.__hookUrl);
|
||||
console.log('[Hook:XHR] Headers:', JSON.stringify(this.__hookHeaders));
|
||||
console.log('[Hook:XHR] Body:', body);
|
||||
console.trace('[Hook:XHR] 调用栈');
|
||||
}
|
||||
return _send.apply(this, arguments);
|
||||
};
|
||||
console.log('[Hook:XHR] XHR Hook 已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
fetch: (options = {}) => {
|
||||
const target = options.target || '';
|
||||
return `(function() {
|
||||
var _fetch = window.fetch;
|
||||
window.fetch = function(input, init) {
|
||||
var url = typeof input === 'string' ? input : (input.url || '');
|
||||
${target ? `if (url.indexOf('${target}') !== -1) {` : '{'}
|
||||
console.log('[Hook:Fetch] ★', url);
|
||||
console.log('[Hook:Fetch] Options:', JSON.stringify(init || {}));
|
||||
console.trace('[Hook:Fetch] 调用栈');
|
||||
}
|
||||
return _fetch.apply(this, arguments);
|
||||
};
|
||||
console.log('[Hook:Fetch] Fetch Hook 已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
eval: () => {
|
||||
return `(function() {
|
||||
var _eval = window.eval;
|
||||
window.eval = function(code) {
|
||||
console.log('[Hook:eval] 代码长度:', typeof code === 'string' ? code.length : 'N/A');
|
||||
if (typeof code === 'string' && code.length < 10000) {
|
||||
console.log('[Hook:eval] 内容:', code.substring(0, 500));
|
||||
}
|
||||
return _eval.apply(this, arguments);
|
||||
};
|
||||
|
||||
var _Function = Function;
|
||||
window.Function = function() {
|
||||
var body = arguments[arguments.length - 1];
|
||||
console.log('[Hook:Function] body长度:', body ? body.length : 0);
|
||||
if (body && body.length < 5000) {
|
||||
console.log('[Hook:Function] 内容:', body.substring(0, 500));
|
||||
}
|
||||
return _Function.apply(this, arguments);
|
||||
};
|
||||
window.Function.prototype = _Function.prototype;
|
||||
console.log('[Hook:eval] eval/Function Hook 已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
json: () => {
|
||||
return `(function() {
|
||||
var _parse = JSON.parse;
|
||||
var _stringify = JSON.stringify;
|
||||
|
||||
JSON.parse = function(text) {
|
||||
var result = _parse.apply(this, arguments);
|
||||
console.log('[Hook:JSON] parse:', typeof text === 'string' ? text.substring(0, 200) : typeof text);
|
||||
return result;
|
||||
};
|
||||
|
||||
JSON.stringify = function(obj) {
|
||||
var result = _stringify.apply(this, arguments);
|
||||
console.log('[Hook:JSON] stringify:', result ? result.substring(0, 200) : result);
|
||||
return result;
|
||||
};
|
||||
console.log('[Hook:JSON] JSON Hook 已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
base64: () => {
|
||||
return `(function() {
|
||||
var _atob = window.atob;
|
||||
var _btoa = window.btoa;
|
||||
|
||||
window.atob = function(str) {
|
||||
var result = _atob(str);
|
||||
console.log('[Hook:Base64] atob:', str.substring(0, 80), '→', result.substring(0, 80));
|
||||
return result;
|
||||
};
|
||||
|
||||
window.btoa = function(str) {
|
||||
var result = _btoa(str);
|
||||
console.log('[Hook:Base64] btoa:', str.substring(0, 80), '→', result.substring(0, 80));
|
||||
return result;
|
||||
};
|
||||
console.log('[Hook:Base64] Base64 Hook 已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
websocket: () => {
|
||||
return `(function() {
|
||||
var _WS = window.WebSocket;
|
||||
window.WebSocket = function(url, protocols) {
|
||||
console.log('[Hook:WS] 连接:', url);
|
||||
var ws = new _WS(url, protocols);
|
||||
var _send = ws.send.bind(ws);
|
||||
ws.send = function(data) {
|
||||
console.log('[Hook:WS] 发送:', typeof data === 'string' ? data.substring(0, 200) : '[binary]');
|
||||
return _send(data);
|
||||
};
|
||||
ws.addEventListener('message', function(e) {
|
||||
console.log('[Hook:WS] 接收:', typeof e.data === 'string' ? e.data.substring(0, 200) : '[binary]');
|
||||
});
|
||||
return ws;
|
||||
};
|
||||
window.WebSocket.prototype = _WS.prototype;
|
||||
console.log('[Hook:WS] WebSocket Hook 已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
debugger_bypass: () => {
|
||||
return `(function() {
|
||||
var _Function = Function;
|
||||
Function = function() {
|
||||
var body = arguments[arguments.length - 1];
|
||||
if (typeof body === 'string' && body.indexOf('debugger') !== -1) {
|
||||
arguments[arguments.length - 1] = body.replace(/debugger\\s*;?/g, '');
|
||||
}
|
||||
return _Function.apply(this, arguments);
|
||||
};
|
||||
Function.prototype = _Function.prototype;
|
||||
|
||||
var _si = window.setInterval;
|
||||
window.setInterval = function(fn, ms) {
|
||||
if (typeof fn === 'function' && fn.toString().indexOf('debugger') > -1) return -1;
|
||||
if (typeof fn === 'string' && fn.indexOf('debugger') > -1) return -1;
|
||||
return _si.apply(this, arguments);
|
||||
};
|
||||
|
||||
var _st = window.setTimeout;
|
||||
window.setTimeout = function(fn, ms) {
|
||||
if (typeof fn === 'function' && fn.toString().indexOf('debugger') > -1) return -1;
|
||||
if (typeof fn === 'string' && fn.indexOf('debugger') > -1) return -1;
|
||||
return _st.apply(this, arguments);
|
||||
};
|
||||
console.log('[Hook:AntiDebug] debugger 绕过已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
stealth: () => {
|
||||
return `(function() {
|
||||
Object.defineProperty(navigator, 'webdriver', { get: function() { return undefined; }, configurable: true });
|
||||
|
||||
window.chrome = window.chrome || {};
|
||||
window.chrome.runtime = window.chrome.runtime || {};
|
||||
|
||||
Object.defineProperty(navigator, 'plugins', {
|
||||
get: function() {
|
||||
return [
|
||||
{ name: 'Chrome PDF Plugin', filename: 'internal-pdf-viewer' },
|
||||
{ name: 'Chrome PDF Viewer', filename: 'mhjfbmdgcfjbbpaeojofohoefgiehjai' },
|
||||
{ name: 'Native Client', filename: 'internal-nacl-plugin' }
|
||||
];
|
||||
}
|
||||
});
|
||||
|
||||
Object.defineProperty(navigator, 'languages', {
|
||||
get: function() { return ['zh-CN', 'zh', 'en']; }
|
||||
});
|
||||
|
||||
var _getParameter = WebGLRenderingContext.prototype.getParameter;
|
||||
WebGLRenderingContext.prototype.getParameter = function(param) {
|
||||
if (param === 37445) return 'Intel Inc.';
|
||||
if (param === 37446) return 'Intel Iris OpenGL Engine';
|
||||
return _getParameter.apply(this, arguments);
|
||||
};
|
||||
|
||||
console.log('[Hook:Stealth] 隐身模式已注入');
|
||||
})();`;
|
||||
},
|
||||
|
||||
custom: (options = {}) => {
|
||||
const funcName = options.function || 'targetFunction';
|
||||
return `(function() {
|
||||
// 追踪 ${funcName} 函数
|
||||
if (typeof ${funcName} !== 'undefined') {
|
||||
var _orig = ${funcName};
|
||||
${funcName} = function() {
|
||||
console.log('[Hook:Custom] ${funcName} 调用');
|
||||
console.log('[Hook:Custom] 参数:', JSON.stringify(Array.from(arguments)));
|
||||
var result = _orig.apply(this, arguments);
|
||||
console.log('[Hook:Custom] 返回:', JSON.stringify(result));
|
||||
console.trace('[Hook:Custom] 调用栈');
|
||||
return result;
|
||||
};
|
||||
console.log('[Hook:Custom] ${funcName} Hook 已注入');
|
||||
} else {
|
||||
console.warn('[Hook:Custom] ${funcName} 未定义，等待加载...');
|
||||
// 使用 getter 延迟 Hook
|
||||
var _origVal;
|
||||
Object.defineProperty(window, '${funcName}', {
|
||||
get: function() { return _origVal; },
|
||||
set: function(val) {
|
||||
if (typeof val === 'function') {
|
||||
var _fn = val;
|
||||
_origVal = function() {
|
||||
console.log('[Hook:Custom] ${funcName} 调用');
|
||||
console.log('[Hook:Custom] 参数:', JSON.stringify(Array.from(arguments)));
|
||||
var result = _fn.apply(this, arguments);
|
||||
console.log('[Hook:Custom] 返回:', JSON.stringify(result));
|
||||
return result;
|
||||
};
|
||||
} else {
|
||||
_origVal = val;
|
||||
}
|
||||
},
|
||||
configurable: true
|
||||
});
|
||||
}
|
||||
})();`;
|
||||
},
|
||||
};
|
||||
|
||||
function generateHook(type, options = {}) {
|
||||
const generator = HOOK_TEMPLATES[type];
|
||||
if (!generator) {
|
||||
throw new Error(`未知的 Hook 类型: ${type}。可用类型: ${Object.keys(HOOK_TEMPLATES).join(', ')}`);
|
||||
}
|
||||
return generator(options);
|
||||
}
|
||||
|
||||
function generateAllHooks(options = {}) {
|
||||
const hooks = [
|
||||
HOOK_TEMPLATES.debugger_bypass(),
|
||||
HOOK_TEMPLATES.stealth(),
|
||||
HOOK_TEMPLATES.cookie(options),
|
||||
HOOK_TEMPLATES.xhr(options),
|
||||
HOOK_TEMPLATES.fetch(options),
|
||||
HOOK_TEMPLATES.eval(),
|
||||
HOOK_TEMPLATES.base64(),
|
||||
];
|
||||
return hooks.join('\n\n');
|
||||
}
|
||||
|
||||
// CLI
|
||||
if (require.main === module) {
|
||||
const args = process.argv.slice(2);
|
||||
const options = {};
|
||||
|
||||
args.forEach(arg => {
|
||||
if (arg.startsWith('--type=')) options.type = arg.substring(7);
|
||||
else if (arg.startsWith('--target=')) options.target = arg.substring(9);
|
||||
else if (arg.startsWith('--function=')) options.function = arg.substring(11);
|
||||
else if (arg.startsWith('--output=')) options.output = arg.substring(9);
|
||||
});
|
||||
|
||||
if (!options.type) {
|
||||
console.log('用法: node hook-generator.js --type=<type> [options]');
|
||||
console.log('');
|
||||
console.log('类型:');
|
||||
console.log(' cookie Cookie setter 拦截');
|
||||
console.log(' xhr XMLHttpRequest 拦截');
|
||||
console.log(' fetch Fetch API 拦截');
|
||||
console.log(' eval eval/Function 拦截');
|
||||
console.log(' json JSON.parse/stringify 拦截');
|
||||
console.log(' base64 atob/btoa 拦截');
|
||||
console.log(' websocket WebSocket 拦截');
|
||||
console.log(' debugger_bypass debugger 反调试绕过');
|
||||
console.log(' stealth 浏览器指纹隐身');
|
||||
console.log(' custom 自定义函数拦截');
|
||||
console.log(' all 生成所有 Hook（组合包）');
|
||||
console.log('');
|
||||
console.log('选项:');
|
||||
console.log(' --target=<url> 目标接口路径过滤');
|
||||
console.log(' --function=<name> 自定义函数名（type=custom 时）');
|
||||
console.log(' --output=<file> 输出到文件');
|
||||
process.exit(0);
|
||||
}
|
||||
|
||||
let code;
|
||||
if (options.type === 'all') {
|
||||
code = generateAllHooks(options);
|
||||
} else {
|
||||
code = generateHook(options.type, options);
|
||||
}
|
||||
|
||||
if (options.output) {
|
||||
const fs = require('fs');
|
||||
fs.writeFileSync(options.output, code);
|
||||
console.log(`Hook 代码已保存到: ${options.output}`);
|
||||
} else {
|
||||
console.log(code);
|
||||
}
|
||||
}
|
||||
|
||||
module.exports = { generateHook, generateAllHooks, HOOK_TEMPLATES };
|
||||
Reference in New Issue
Block a user