Wirebrowser Documentation

Wirebrowser is a runtime instrumentation platform built on top of the Chrome DevTools Protocol (CDP).

It provides a unified API to:

• instrument JavaScript execution (hooks)
• inspect and search runtime memory
• automate browser behavior

---

🔥 What you can do

• Force any feature flag → ctx.return(true)
• Modify internal variables → ctx.setVariable(...)
• Track async flows → ctx.followReturn()
• Condtional stepping → if(condition) ctx.stepOut()
• Search secrets in memory → searchHeapSnapshot()

---

📦 Modules Overview

Wirebrowser is composed of multiple subsystems:

Runtime Instrumentation

Hook and modify JavaScript execution at runtime.

• WB.Node.Instrumentation

---

Memory Inspection

Search and analyze JavaScript objects in memory.

• WB.Node.Memory

---

⚡ Quick Examples

Hook a function

WB.Node.Instrumentation.addHook({file: 'auth.js', line: 10, col: 20}, {
  onEnter(ctx){
    ctx.log(ctx.stackTrace)
  },
  onLeave(ctx) {
    ctx.return(true)
  }
});
await WB.Node.Instrumentation.startHooks(pageId);
Copy

Find objects in heap snapshot

const results = await WB.Node.Memory.searchHeapSnapshot(pageId, {
  valueSearch: [".*accessToken.*", { useRegexp: true }]
})
Copy

---

🧠 Instrumentation Examples

Follow return value to its consumer (best-effort async tracking)

WB.Node.Instrumentation.addHook({file: 'auth.js', line: 10, col: 20}, {
  onLeave(ctx){
    ctx.followReturn()
  },
  onReturnFollowed(ctx, previousStep){
    // override internal state
    ctx.setVariable("price", 0)
  }
});
await WB.Node.Instrumentation.startHooks(pageId);
Copy

---

Override return value (sync only)

WB.Node.Instrumentation.addHook({file: 'auth.js', line: 10, col: 20}, {
  onLeave(ctx){
    ctx.return("admin")
  },
});
await WB.Node.Instrumentation.startHooks(pageId);
Copy

---

Conditional stepping

WB.Node.Instrumentation.addHook({file: 'auth.js', line: 10, col: 20}, {
  onEnter(ctx){
    if ( ctx.arguments.user !== "admin"){
      ctx.stepIntoAsync()
    }
  },
  onStep(ctx, previousStep){
    if ( ctx.arguments.user !== "admin"){
      ctx.stepIntoAsync()
    } else {
      ctx.log(previousStep.stackTrace)
    }
  }
});
await WB.Node.Instrumentation.startHooks(pageId);
Copy

---

Combine with Memory search

WB.Node.Instrumentation.addHook({file: 'auth.js', line: 10, col: 20}, {
    onLeave(ctx){
      ctx.send({isAdmin: ctx.returnValue === 'admin' || ctx.variables.isAdmin})
    }
  },
  async (result, logger) => {
    if(result.messages?.[0]?.isAdmin){
      const results = await WB.Node.Memory.searchHeapSnapshot(pageId, {
        valueSearch: [".*accessToken.*", {useRegexp: true}]
      })
      logger.log(result)
  }
);
await WB.Node.Instrumentation.startHooks(pageId);
Copy

---

Override variable

WB.Node.Instrumentation.addHook({file: 'auth.js', line: 10, col: 20}, {
  onEnter(ctx){
    if(ctx.variables.isAdmin){
      ctx.setVariable("isAdmin", true)
    }
  }
});
await WB.Node.Instrumentation.startHooks(pageId);
Copy

---

🔍 Memory Examples

---

Search objects in memory

const results = await WB.Node.Memory.searchLiveObjects(pageId, {
  valueSearch: 'authkey'
})
Copy

---

⚠️ Limitations

Async instrumentation

• ctx.return() is reliable only for synchronous functions
• async functions with await may ignore overridden values

(CDP / V8 limitation)

---

Event correlation

• hook events are independent
• async flows may not correlate reliably

---

🎯 Mental Model

Wirebrowser is not just a debugger.

It is a runtime instrumentation layer that allows you to:

• observe execution
• search memory
• modify behavior