All foreign javascript code is blocked

[Arzumify]

Attempting to execute the code via inspect element caused Gimkit to block it due to a unsafe-eval error, as it only accept several trackers and it’s own js code.

[Arzumify]

P.S, have you considered creating an website with a modified version of Gimkit embeded in a iFrame or something? It might still be able to connect.

[ecc521]

That's really odd - unsafe-eval shouldn't block devtools.
My suspicion is that this is a a result of a recent change by @TreeBronch - is it possible that code is now being injected by the devtools code?

Still not sure if the bot works anyways - I don't really maintain this anymore.

[maxim-kudryashov]

Yes, this is a result of the recent merge I believe,

[maxim-kudryashov]

Wait, are you running the code of bot.js, or new-bot.js? bot.js is the older version, that shouldn't work, but new-bot.js that was made by @DaveH355 should work. I'd ask him, I haven't really looked over much of his code, only the old code. When you can, please reply so that I can either notify @DaveH355 or just fix it myself.

[Arzumify]

Both. Even if i put something like, well literally nothing into the console, it just says unsafe-eval. Perhaps i’m just running a older version of chrome or something.

[Arzumify]

Oh, and i have a suggestion. It says unsafe-eval excludes .google.com domains and a few more. Would it be possible to spoof the webpage? Perhaps a custom dns domain that redirects google.com to something else that redirects to the real site?

[maxim-kudryashov]

I have a thought which is that it's a new anti-cheat update for gimkit. Perhaps your suggestion might work. If you can, try to try it and see if it works.

[ecc521]

Unsafe-eval prevents the use of eval and other dynamic code execution things, but it doesn't prohibit code from being executed in devtools. I tested this just now on the lastest Chrome stable, and if it's not working the same for you, that is a bug in Chrome, not a Gimkit measure.

The problem is that unsafe-eval complicates script injection from Chrome extensions - Since I believe the Webrequest API is being removed, there isn't an easy way to inject scripts anymore.

I don't really do Chrome extension development, but I can guarantee that there is a way to interact with the page from an extension, and if the code execution cannot somehow be done on the site, it can certainly be done from the extension.

Spoofing stuff is definitely not the correct answer. HSTS is going to block any attempts to spoof, especially with the HSTS preload list.