Bypassing Anti-Bot Systems
Relevant source files
The following files were used as context for generating this wiki page:GeekEZ Browser is engineered to bypass anti-bot systems by creating isolated browser environments with unique and consistent fingerprints. The core strategy is "Native Consistency," which avoids easily detectable JavaScript hooks in favor of native Chromium arguments and subtle noise injection. This approach aims to make each browser profile appear as a legitimate, distinct user device, enabling it to pass advanced detectors like Cloudflare Turnstile and BrowserScan.
The system achieves this through a combination of hardware and software fingerprint randomization, network-level isolation via Xray-core, and the removal of automation-related browser features. Each profile is launched as an independent process with its own data directory, proxy configuration, and a unique set of spoofed characteristics, ensuring strict isolation between accounts.
Sources: README.md, main.js, fingerprint.js
System Architecture
The anti-bot bypass capabilities are a result of the interaction between the Electron main process, Puppeteer for browser control, a custom injection script, and the Xray-core for network management.
This diagram illustrates the high-level flow when a user launches a profile. The main process orchestrates the creation of a unique fingerprint, configures the network proxy, and launches a real Chrome browser instance via Puppeteer with the necessary anti-detection measures in place.
Sources: main.js:370-500, fingerprint.js, utils.js
Fingerprint Spoofing
Fingerprint spoofing is the primary method for evading bot detection. GeekEZ Browser randomizes a wide range of hardware and software attributes for each profile. These fingerprints are generated by the generateFingerprint function and applied at runtime via a content script.
Sources: fingerprint.js:9-92, main.js:94-99
Fingerprint Parameters
The following table details the key parameters that are randomized or spoofed for each profile.
| Parameter | Spoofed Values / Method | Purpose | Source File |
|---|---|---|---|
hardwareConcurrency | Randomly chosen from [4, 8, 12, 16] | Simulates different CPU core counts. | fingerprint.js:86 |
deviceMemory | Randomly chosen from [4, 8, 16] | Simulates different RAM amounts. | fingerprint.js:87 |
screen / window | Randomly chosen from a list of common resolutions (e.g., 1920x1080). | Spoofs screen and window dimensions. | fingerprint.js:4, 63 |
userAgent | Constructed based on the host OS to match a real Chrome v129 UA. | Provides a consistent and modern User-Agent string. | fingerprint.js:12-42 |
platform | Set to Win32, MacIntel, or Linux x86_64 based on host OS. | Ensures navigator.platform is consistent with the User-Agent. | fingerprint.js:12-42 |
languages | Hardcoded to ['en-US', 'en']. | Sets browser language preferences. | fingerprint.js:64 |
canvasNoise | Small random values for R, G, B, A channels. | Adds noise to prevent Canvas fingerprinting. | fingerprint.js:69-74 |
audioNoise | A small random float value. | Adds noise to AudioBuffer to prevent AudioContext fingerprinting. | fingerprint.js:88 |
webgl | Hardcoded to mimic a specific NVIDIA GPU via ANGLE. | Provides a consistent WebGL vendor and renderer string. | fingerprint.js:66-67 |
timezone | Set per profile, defaults to America/Los_Angeles. | Spoofs the browser's timezone to match the proxy location. | fingerprint.js:90, 101 |
Injection and Hooking Mechanism
Fingerprint values are applied by injecting a JavaScript content script into every frame of a webpage at document_start. This is achieved by dynamically creating a temporary Chrome extension named "GeekEZ Guard" for each profile launch.
Sources: main.js:94-106, fingerprint.js:95-98
Timezone Spoofing
Timezone spoofing is particularly complex and involves hooking multiple JavaScript APIs to ensure consistency.
This sequence shows how the injection script intercepts a call to Date.prototype.toString() and returns a value formatted for the profile's specified timezone, effectively masking the user's real location. The script also hooks Intl.DateTimeFormat and Date.prototype.getTimezoneOffset for comprehensive coverage.
Sources: fingerprint.js:104-168
Canvas & Audio Noise
To defeat media fingerprinting, the script adds a small amount of noise to Canvas and Audio data.
- Canvas: The
CanvasRenderingContext2D.prototype.getImageDatafunction is hooked. A small, seeded noise value is added to the alpha channel of certain pixels, altering the final hash of the rendered image. - Audio: The
AudioBuffer.prototype.getChannelDatafunction is hooked. A tiny random value is added to the first 100 samples of the audio data, which is enough to change the audio fingerprint hash.
Sources: fingerprint.js:171-193, CHANGELOG_v1.2.3.md
Automation Evasion
The browser actively hides traces of being controlled by automation software like Puppeteer.
Key Evasion Techniques
| Technique | Implementation | Source File |
|---|---|---|
Remove navigator.webdriver | The injection script sets navigator.webdriver to false. | fingerprint.js:102-104 |
| Disable Automation Features | The --disable-blink-features=AutomationControlled launch argument is used. | main.js:467 |
| Ignore Default Automation Args | The ignoreDefaultArgs: ['--enable-automation'] option is passed to puppeteer.launch. | main.js:493 |
Use puppeteer-extra-plugin-stealth | This dependency provides a suite of additional stealth patches. | package.json:62 |
These measures help the browser pass checks that specifically look for the navigator.webdriver flag or other artifacts left by automated control frameworks.
Sources: main.js:467, 493, fingerprint.js:102-104, package.json:62
Network-Level Evasion
Network characteristics are a critical part of a browser's fingerprint. GeekEZ Browser addresses this at multiple levels.
TLS Fingerprint Safety
The browser uses a real, unmodified Chrome binary downloaded via @puppeteer/browsers. This ensures that the TLS handshake (JA3 fingerprint) is identical to that of a standard Chrome browser, making it indistinguishable from legitimate traffic at the transport layer. This is a key feature highlighted for its safety, especially for Amazon seller accounts.
Sources: README.md, CHANGELOG_v1.2.3.md, setup.js:105-121
WebRTC IP Leak Protection
Real IP address leakage via WebRTC is a common vulnerability. GeekEZ Browser prevents this using two methods:
- Launch Argument: The
--force-webrtc-ip-handling-policy=disable_non_proxied_udpargument is passed to Chrome, which is a native policy to prevent WebRTC from using non-proxied UDP connections. - API Hooking: The injection script wraps
RTCPeerConnectionto enforce aniceTransportPolicyofrelay, forcing connections through TURN servers and preventing direct P2P connections that could expose the local IP.
Sources: main.js:468, fingerprint.js:196-202, README.md
Proxy Architecture
All browser traffic is routed through a proxy configured for the profile. This is managed by the Xray-core, which is spawned as a separate process.
This diagram shows that the browser is configured to send all its traffic to a local SOCKS5 port managed by Xray. Xray then routes this traffic through an optional pre-proxy (for hiding the user's real IP from the main proxy provider) and finally through the main proxy associated with the browser profile.
Sources: main.js:419-434, 461, utils.js:205-224, renderer.js:1003-1019
Profile Launch Sequence
The entire anti-detection system comes together during the profile launch sequence, orchestrated by the launch-profile IPC handler in main.js.
This diagram details the step-by-step process, from the user's click in the UI to the launch of a fully configured and sandboxed Chrome instance.
Sources: main.js:370-500, renderer.js:612-616
Summary
GeekEZ Browser's approach to bypassing anti-bot systems is multi-layered and focuses on emulating a real user's environment as closely as possible. It combines randomized hardware and software attributes with robust network isolation and the removal of automation tells. By using a real Chrome browser and injecting minimal, targeted modifications at the earliest possible stage, it aims to create browser profiles that are both unique and internally consistent, thereby passing the scrutiny of modern detection systems.
Sources: README.md, CHANGELOG_v1.2.3.md