Implement dir-string snippet

[mjethani]

Background

Some websites use a technique to detect that Chrome's DevTools is open and hide all their ads to prevent filter list authors from examining them and writing any filters for them.

The specific technique used is as follows:

let re = /foo/;
let n = 0;

re.toString = function()
{
  if (++n > 1)
  {
    // Detected: DevTools is open!
  }

  return "";
};

console.dir(re);

On Chrome, if DevTools is open, the toString method of the RegExp object re here is called twice; otherwise it's called only once.

This can be used to trick the site into believing that DevTools is open and hiding the ads itself, by wrapping the dir function of the console object and always calling the toString method of the first argument. Additionally, the snippet could take a parameter to call the toString method n times. This would allow it to work on Firefox as well, which doesn't call the toString method at all if DevTools is closed and calls it once if it's open.

What to change

Write a snippet with the following signature:

function dirString(times = "1")

It should wrap the ​console.dir API and call the first argument's toString method n times before forwarding the call to the original function.

Hints for testers

You could use the follow HTML document to test this snippet on Chrome:

<!-- test.html -->
<div>
  Lorem ipsum dolor sit amet, consectetur
  adipiscing elit, sed do eiusmod tempor
  incididunt ut labore et dolore magna aliqua.
</div>
<div class="atsy2tvyg9">Ad</div>
<script>
  setTimeout(() =>
  {
    let re = /foo/;
    let n = 0;

    re.toString = function()
    {
      if (++n > 1)
      {
        for (let element of document.getElementsByClassName("atsy2tvyg9"))
          element.parentElement.removeChild(element);

        delete re.toString;
      }

      return "";
    };

    console.dir(re);
  },
  500);
</script>

Follow these steps:

1. Load the document: the element "Ad" will be visible.
2. Open the DevTools console for the tab: now the element "Ad" will be hidden.
3. Close the DevTools console, add the filter #$#dir-string, and reload the document: now the element "Ad" will be hidden even when DevTools is closed.

On Firefox, change ++n > 1 to ++n > 0 in the HTML document's source and try the same steps.

[abpbot]

A commit referencing this issue has landed:
​Issue 6964 - Implement dir-string snippet

[abpbot]

A commit referencing this issue has landed:
​Issue 6964 - Implement dir-string snippet

[Ross]

This seems to work in the latest browser versions but not in min supported versions. I'm guessing the detect devtools method does not work in past browser versions?

Does the following behaviour sound correct?

Chrome 69: Ad hidden when devtools are opened. Ad hidden with snippet (devtools closed)
Chrome 49: Ad not hidden when devtools are opened. Ad not hidden with snippet (devtools closed)
Firefox 62: Ad hidden when devtools->console is focused. Ad hidden with snippet (devtools closed)
Firefox 51: Ad not hidden with devtools open. Ad hidden with snippet (devtools closed)
Opera: Same as Chrome.

ABP 3.3.2.2175
Firefox 62 / 51 / Windows 10
Chrome 69 / 49 / Windows 10
Opera 56 / 36 / Windows 10

[mjethani]

It's possible that the DevTools detection technique described in the ticket doesn't work on older versions of the browsers. The ​console.dir API is experimental. If the ad is not hidden when DevTools is open, I would not expect it to be hidden with the snippet (since this is what the snippet simulates).

[Ross]

Ah okay. That makes sense. This looks fine then.

ABP 3.3.2.2175
Firefox 62 / 51 / Windows 10
Chrome 69 / 49 / Windows 10
Opera 56 / 36 / Windows 10

[agiammarchi]

Possibly irrelevant, and just for documentation sake, I'd like to add another way to know if the console is open:

console.log(
  Object.defineProperty(
    new Image,
    'id',
    {get() {
      requestAnimationFrame(console.clear);
      alert('console is open');
    }
  })
);

It'd be great to find out if there are sites using similar technique (we would need to patch Object.defineProperty upfront though).