rustenium-identity 0.1.9

A versatile stealth overlay for rustenium
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

// Runs as the first code inside every same-origin classic worker we re-host.
// `__url` is the worker's original script URL, passed in by worker_hook.js.
//
// This exists because a fingerprint that differs between the main thread and a
// worker is a one-comparison giveaway — the standard check is literally
// `mainThreadRenderer !== workerRenderer`. Worker realms are not covered by
// document-level script injection, so they have to be reached explicitly.

// ---- WorkerNavigator ----
// Note these are WorkerNavigator.prototype, not Navigator.prototype: the two are
// separate interfaces and the worker realm only has the former.
if (typeof WorkerNavigator !== 'undefined') {
  PropertyModifier.spoofProperty(WorkerNavigator.prototype, 'hardwareConcurrency', {{HARDWARE_CONCURRENCY}});
  PropertyModifier.spoofProperty(WorkerNavigator.prototype, 'deviceMemory', {{MEMORY}});
  PropertyModifier.spoofProperty(WorkerNavigator.prototype, 'platform', "{{NAVIGATOR_PLATFORM}}");
  PropertyModifier.spoofProperty(WorkerNavigator.prototype, 'language', "{{LANGUAGE_0}}");
  PropertyModifier.spoofProperty(WorkerNavigator.prototype, 'languages', Object.freeze({{LANGUAGES_JSON}}));
  // The CDP user-agent override applies to the page target; whether it reaches a
  // dedicated worker is not guaranteed, and a worker still reporting HeadlessChrome
  // while the page reports the persona is checked for directly. Empty means the
  // caller could not build a UA, in which case leave the native one alone.
  var UA = "{{USER_AGENT}}";
  if (UA) PropertyModifier.spoofProperty(WorkerNavigator.prototype, 'userAgent', UA);
}

// ---- WebGL via OffscreenCanvas ----
// Identical substitution rule to the main thread so the two agree exactly.
(function () {
  var vendor = "{{WEBGL_VENDOR}}";
  var renderer = "{{WEBGL_RENDERER}}";
  function hook(target) {
    if (typeof target === 'undefined' || !target) return;
    PropertyModifier.spoofMethod(target.prototype, 'getParameter', function (orig) {
      return function getParameter(parameter) {
        var real = orig.apply(this, arguments);
        if (parameter !== 37445 && parameter !== 37446) return real;
        if (real === null || real === undefined) return real;
        return parameter === 37445 ? vendor : renderer;
      };
    });
  }
  hook(typeof WebGLRenderingContext !== 'undefined' ? WebGLRenderingContext : null);
  hook(typeof WebGL2RenderingContext !== 'undefined' ? WebGL2RenderingContext : null);
})();

// NOTE: no WorkerLocation spoof here.
// An earlier version re-hosted workers from a blob: URL in order to prepend this
// file, which moved self.location to the blob and had to be papered over. This
// script is now delivered by CDP — auto-attach freezes the worker before its first
// statement and we Runtime.evaluate into it — so the worker loads from its real
// URL and location is genuinely correct. Nothing to hide.