Hacker News Reader

Comment by robbyking | Hacker News Reader

I recently came across an image I wasn't able to download using dev tools and was shocked. I wish I had had the time to figure it out.

View on HN

If it's visible, it's capturable, it's simply a matter of how obfuscated it is and how much effort you want to spend capturing it. In highly dynamic web apps these days, it could be simple as a right click or as complex as figuring out their rendering system, source data stream, generated key handshake to verify it's the script accessing the data and not a person, and so on. I see this sort of trash a lot more than I care to.

Well, you can just PrntScrn it as a last resort, if it's not a background image :-)

I once broke the "DRM" of a site which displayed images by downloading them obfuscated and using a big blob of JS to unfsck them and display them on a canvas. Grabbing the image should be easy, no? Just use `.toDataURL()`, right? Well, this site deleted all the methods on the canvas object which could be used to grab the image data, and then `.freeze()` (or maybe it was `.seal()`, this was a while ago) to prevent the method being added back in.

In the end I said 'fuck it' and made a patched firefox build in a VM with freeze and/or seal disabled completely, then a small jetpack addon (remember them?) to unfsck the canvas element and grab them images.

You probably could've used `HTMLCanvasElement.prototype.toDataURL.call` on the canvas element

Hah, I knew a JS wizard would come up with an easier solution after I posted that. Perhaps I'll have to re-sub to that site to see if they've changed their DRM scheme...

That's easier than my solution. I've got a user script that backs up some methods that runs before the page loads, and a corresponding bookmarklet to restore them.

Link the page please?:)

Reply on news.ycombinator.com