For the fingerprinting part, can you explain the difference with the JShelter browser extension (https://jshelter.org/)?
I checked as you did in your demo video with https://demo.fingerprint.com/playground (using JShelter in Firefox). It produces a fingerprint detector report, like so :
{
"fpd_evaluation_statistics": [
{
"title": "Navigator.prototype.plugins",
"type": "resource",
"resource": "get",
"group": "BrowserProperties",
"weight": 0,
"accesses": 0
},
{
"title": "MediaDevices.prototype.enumerateDevices",
"type": "resource",
"resource": "call",
"group": "BrowserProperties",
"weight": 1,
"accesses": 2
},
[...]However, it appears there is no way to display what was actually produced by the browser.
Was this the reason you had to build your own browser? Or is it possible to extend JShelter to do the same?
Thank you for sharing :)
FWIW I still think a custom browser approach has some benefits (stealth and executing in out of process iframes. could be wrong on the second part, haven’t actually tested!)
EDIT: Oh, it took me a minute!
This article made me consider creating a new CDP domain as a possible option, but tbf I haven't thought about this problem in ages so maybe there's something less stupid that I could do.
While searching for a tool I found several others asking for something similar, so I'm sure there are quite a few who would be interested in the project if you ever do decide to pick it up.
The down sides were that it only works with cached data, and I had to tweak it a couple of times because they changed the format of the cache keys.
edit: actually, wouldn’t you still need to override the global you’d like to instrument? At that point, the toString of the modified function would leak your hook.
see: https://gist.github.com/voidstar0/179990efe918d1028b72f292cf...
Regardless, I do have some interesting ideas that should hopefully make my pain of compiling Chromium for 3 hours worth it though :p
Cheat Engine for site scripts? Who knows. Mostly just using this as an opportunity to learn some browser internals so id say it still paid off :)
toString will be called on the Proxy and not your hook so it won't reveal anything
Build times were way longer on my potato hardware. Since then I haven't touched much C++.
Where's the wait list?
Which for some functionality would have been a bit more portable and involved less effort.
Aside from playing a hooking/patching game of cat and mouse, I don't think this is fully solvable without modifying the browser engine itself - then you can hook things in a way that's completely transparent to the JS in webpages.
FWIW I still think modifying the browser has some positives wrt stealth and hooking out of process frames (could be wrong on the second part, haven’t actually tested!)
Still good to know though will leave a note in the article :-)