$ show 0xsdeo/AntiDebug_Breaker
AntiDebug Breaker is a Chrome extension (Manifest V3) designed for JavaScript reverse engineering and penetration testing. It injects over 30 modular hook scripts into web pages to bypass anti-debugging techniques (e.g., `debugger` statements, `console.clear`, time-diff detection), intercept browser APIs (`XMLHttpRequest`, `fetch`, `localStorage`, `sessionStorage`, `JSON.parse`, `JSON.stringify`, `Math.random`, `Date.now`, `performance.now`), and extract cryptographic operations (CryptoJS, JSEncrypt, SM-crypto). It also detects Vue.js and React Router routes by traversing internal DOM fiber trees and exposes them in a popup UI for copying or opening. The extension operates via a background service worker, a content script injected at `document_start`, and a popup interface that allows per-domain or global script toggling with fine-grained configuration (e.g., keyword filtering, value overrides). Each hook script is a self-contained Tampermonkey-style unit that communicates with the extension via `window.postMessage` and `localStorage` flags, making them usable independently outside the extension. The codebase demonstrates strong practical utility for security researchers, but suffers from monolithic popup logic, reliance on brittle internal framework properties, and a lack of automated tests.
The LLM identified 3 files worth highlighting for reuse:
A self-contained script that restores the original `toString` representation of hooked functions (e.g., `console.log`, `fetch`) to evade anti-debugging checks. It also uses a `Proxy` on `iframe.contentWindow` to propagate hooks into iframes. This pattern is reusable for any environment where hook detection is a concern, and it can be extracted with minimal changes.
Overrides `console` methods using a `Proxy` to make them read-only, preventing the page from silently disabling logging while still allowing hook interception. This is a clean, standalone implementation that can be adapted to protect any global object from being overwritten by third-party code.
Bypasses `debugger;` statements by overriding `Function.prototype.constructor` and `Function.prototype.toString` to neutralize breakpoints. It is a well-known technique but implemented here as a compact, self-contained script that can be injected into any page to disable debugger-based traps.