Repository navigation
Feature Request: prolonging MV2 in Chromium 140+ #108
Description
Activity
Another method of automatic patching can be based on toggling the two features in the dll directly:
- find
ExtensionManifestV2UnsupportedinrdataPE section - find the address of the match in
dataPE section - change
01to00right afterwards - repeat for
ExtensionManifestV2Disabled
Reacted by Κριστιάν3β- find
Thank you for these great findings! I'm currently not working on my patcher anymore because of a lack of time
@tophf
If you want to take up on a big challenge, you could fork this and edit this patterns file:
http://github.com/Ceiridge/Chrome-Developer-Mode-Extension-Warning-Patcher/blob/master/patterns.xmlReacted by Κριστιάν3βYou can also do a search for a existing fork that will handle it (in the sense that he came up with the same thing or something very similar).
It is more difficult to filter projects forked using unofficial methods (e.g., manual publication as a gist).
Here's the patcher in PowerShell based on the original dev-warning-patch: https://gist.github.com/tophf/3fac58988fb94bd83aef69c9f18d1948
Reacted by Κριστιάν3βReacted by Κριστιάν3βReacted by Κριστιάν3βReacted by Κριστιάν3βReacted by Κριστιάν3βWell, it works for me. If you're interested in helping debug it, you can comment in the gist. To preserve the output you can run it from the command prompt. It's quite possible your machine doesn't allow running ps1 files because this is the default setting in Windows.
Reacted by Κριστιάν3βIt allows to run it (unless it has to be a copy-paste, save locally excluding saving from the browser or, for example, cURL/wget and marking the file as trusted). It supposedly made patches (changed dll and created correctly backups), but even after a minute, none of them turned on from the icon in the start menu.
debug.logsays:\chrome.dll: Denial of access. (0x5)
It turns out that ESET does not like the replaced dll file, so you probably have to stand on your head to get it to work without reverting to Defender or another liberal programme (I assume this has been known since the project was launched) (those who wish to may play around with Eset settings and recommend how to circumvent it).
How about ....
"
Is there a way to use any of the following inside the insecure origin flag box to enable mv2 in the latest dev build of chromeOS ?
1.)
Null-Byte Termination Bypass
2.) Command-Line Injection (CLI) Breakout
3.) 4KB Buffer Boundary Probe
4.) Environment Variable Smuggler
5.) Unicode Normalization Attack
6.) Heap-Spray Initialization
7.) Format String Vulnerability
8.) Recursive Redirect Loop
9.) Path Traversal Injection
10.) Final Shutdown Race Condition Payload144~147 (and probably earlier) doesn't let me use AdNauseam.
"
Reacted by Κριστιάν3β and viridivn
I've patched the binary locally.
Chrome 140:
mov ecx,3; test al,al; jnz...), there'll be several occurrences, use the one that is followed byxx xx xx xx 89(i.e. ignore 4 bytes and look at89)jnz)Chrome 141:
use the above instruction with B902 when finding (02 instead of 03) and B900 when patching (00 instead of 01).
0or1is the value of MV2ExperimentStage::kWarning depending on the binary version (source)This is effectively the same as adding
--disable-features=ExtensionManifestV2Unsupported,ExtensionManifestV2Disabledto the command line.