handle.js

// 1. filter out toxic function
let _key = userFns.filter(key=> {
    let fn = window[key]
    if (testHack(fn)) return key
    return false
})[1];
window[_key] = function() {}

// 2. then, wrap all functions
function _wrap(k) {
    let orig = window[k];
    let wrap = function() {
        console.log(k);
        return orig.apply(this, arguments);
    }
    window[k] = wrap;
}
userFns.map(_wrap)

inject_browserify.js

var script = document.createElement('script');
script.src = 'http://localhost:5000/bundle.js';
script.type = 'text/javascript';
document.getElementsByTagName('head')[0].appendChild(script);

parser.js

// browserify parser.js > bundle.js 

let parse = require("shift-parser").parseScript;
let scope = require("shift-scope").default;
let gen = require("shift-codegen").default;

/*
 * function _$ta() {
 *   _$yX = _$yU;
 *   _$yU = _$cp
 * };
 */
function testHack(fn) {
    if (!fn || typeof fn != "function") {
        return false
    }
    let ast
    try {
        ast = scope(parse(fn.toString())).astNode.statements[0]
    } catch (err) {
        console.log(err, fn.toString())
        return false
    }
    return ast.type === "FunctionDeclaration" &&
           ast.params.items.length === 0 &&
           ast.body.statements.length === 2 &&
           ast.body.statements.filter(stmt => {
                return stmt.type === "ExpressionStatement" && 
                       stmt.expression.type === "AssignmentExpression"
           }).length === 2
}

/*
 * function _$pP() {
     this._$rJ();
 * }
 */
function filterConstructor(fn) {
    if (!fn || typeof fn != "function") {
        return false
    }
    let ast, result = false
    try {
        ast = scope(parse(fn.toString())).astNode.statements[0]
        result =  ast.type === "FunctionDeclaration" &&
           ast.params.items.length === 0 &&
           ast.body.statements.length === 1 &&
           ast.body.statements[0].expression.type === "CallExpression" &&
           ast.body.statements[0].expression.callee.object.type === "ThisExpression" 
    } catch (err) {
        console.log(err, fn.toString())
        return false
    }
    return result
}

global.testHack = testHack
global.filterConstructor = filterConstructor

pre_work.js

// select user defined functions
let userFns = Object.entries(window).filter(e=>e[0].startsWith("_$")).map(e=>{
    let[key,val] = e;
    if (!val) {
        return null
    }
    let s = val.toString();
    if (typeof val === "function") {
        let fn = val;
        let result;
        if (s.indexOf("native code") !== -1) {
            return null
        } else {
            return key
        }
    }
}).filter(_=>_)