基于反调试的JavaScript代码保护方法研究

中文摘要: 为了消除攻击者动态调试JavaScript代码给HTML5应用程序带来的安全威胁，提出一种基于反调试的代码保护方法。在深入分析Firefox及Chrome浏览器中调试器工作原理的基础上，探索了主流浏览器平台中调试器运行时的特征。基于调试器特征构造检测调试行为的JavaScript代码片，并结合针对调试行为的响应策略达到反动态调试目的。通过攻击实例验证了该方法的有效性，在不影响程序性能的前提下提升了Web应用程序的安全性。
Abstract:In order to eliminate the security threat to HTML5 applications posed by debugging JavaScript code during attack process, a method of protecting JavaScript code through anti-debugging was proposed. The JavaScript debugging principle on Firefox and Chrome was analyzed, and the runtime features introduced by these mainstream browsers’ debuggers were explored. Then combined with these features and some penalties to the debugging behavior, some anti-debugging approaches were devised and applied to achieve anti-debugging protection on Web applications. The experiments showed that these anti-debugging approaches can effectively protect Web applications from being debugged dynamically without much overhead.