N4darae/anti-mage

What it solves

Anti-Mage detects "anti-detect" browsers and bot environments by identifying contradictions within the browser's own reported data. Instead of relying on a database of known tools or signatures, it focuses on whether a browser's various surfaces (like screen geometry, font lists, and hardware capabilities) agree with each other and with the platform they claim to be.

How it works

The project uses a browser-side collector to take 34 measurements across 23 independent readings. It looks for discrepancies in areas such as:

• Platform Consistency: Comparing claimed platforms against installed fonts and hardware decoders.
• Execution Integrity: Checking if native accessors have been modified or if they behave differently across execution scopes.
• ** uma Layout and Metrics:** Verifying agreement between CSS and script paths for text metrics and viewport geometry.
• Hardware and Media: Matching reported graphics interfaces and device names against their actual capabilities and generations.
• Temporal and Network Data: Checking time zone offsets and ICE gathering states.

Findings are categorized as consistent, contradiction, instrumented, inconclusive, or unverified. These are weighted by class—where deliberate contradictions weigh more than self-declared modifications—to produce a final score (0-90) in steps of ten. A score of 0 indicates no disagreements were found.

Who it’s for

Developers and security researchers who need to verify the coherence of a browser environment to identify bots or spoofed browser profiles without relying on static signature lists.

Highlights

• Signature-less Detection: Does not use a database of known tools; it detects contradictions in the browser's own reports.
• High Accuracy: Stock browsers (Chrome, Firefox, Edge) consistently score 0, while anti-detect browsers consistently score 60 or higher.
• Dynamic Probing: Uses randomly generated font family names and dates to prevent pre-computed answers.
• Pure Evaluation Logic: The core assessment engine is a pure function with no external dependencies, making it easy to integrate into Go projects.
• Strict Verification: Reference data is only used for scoring if it has been manually verified against observed systems.