Feature Request: prolonging MV2 in Chromium 140+

[tophf]

I've patched the binary locally.

Chrome 140:

1. find B90300000084C00F84 (which means mov ecx,3; test al,al; jnz...), there'll be several occurrences, use the one that is followed by xx xx xx xx 89 (i.e. ignore 4 bytes and look at 89)
2. overwrite with B901000000 90*8 (mov ecx,1; nop 8 times to overwrite jnz)

Chrome 141:
use the above instruction with B902 when finding (02 instead of 03) and B900 when patching (00 instead of 01).

0 or 1 is the value of MV2ExperimentStage::kWarning depending on the binary version (source)

---

This is effectively the same as adding --disable-features=ExtensionManifestV2Unsupported,ExtensionManifestV2Disabled to the command line.

[tophf]

Another method of automatic patching can be based on toggling the two features in the dll directly:

1. find ExtensionManifestV2Unsupported in rdata PE section
2. find the address of the match in data PE section
3. change 01 to 00 right afterwards
4. repeat for ExtensionManifestV2Disabled

[Ceiridge]

Thank you for these great findings! I'm currently not working on my patcher anymore because of a lack of time
@tophf
If you want to take up on a big challenge, you could fork this and edit this patterns file:
https://github.com/Ceiridge/Chrome-Developer-Mode-Extension-Warning-Patcher/blob/master/patterns.xml

[krystian3w]

You can also do a search for a existing fork that will handle it (in the sense that he came up with the same thing or something very similar).

It is more difficult to filter projects forked using unofficial methods (e.g., manual publication as a gist).

[tophf]

Here's the patcher in PowerShell based on the original dev-warning-patch: https://gist.github.com/tophf/3fac58988fb94bd83aef69c9f18d1948

[krystian3w]

It doesn't work with my installations 142 (Stable), 143 (beta), 144 (dev/Canary(SxS)) (I didn't look at the event log or what it spits out to the terminal, as if I had launched it and Chromium supported such debugging on Windows 11 Pro 26H1/26H2). I did not keep editions 140 or 141. (Bugged by Eset, I can't recommend what to add to the exceptions list or how to add them correctly in ESET)

[tophf]

Well, it works for me. If you're interested in helping debug it, you can comment in the gist. To preserve the output you can run it from the command prompt. It's quite possible your machine doesn't allow running ps1 files because this is the default setting in Windows.

[krystian3w]

It allows to run it (unless it has to be a copy-paste, save locally excluding saving from the browser or, for example, cURL/wget and marking the file as trusted). It supposedly made patches (changed dll and created correctly backups), but even after a minute, none of them turned on from the icon in the start menu.

debug.log says:

\chrome.dll: Denial of access. (0x5)

It turns out that ESET does not like the replaced dll file, so you probably have to stand on your head to get it to work without reverting to Defender or another liberal programme (I assume this has been known since the project was launched) (those who wish to may play around with Eset settings and recommend how to circumvent it).

[5dl0g1st1ca0]

How about ....

"

Is there a way to use any of the following inside the insecure origin flag box to enable mv2 in the latest dev build of chromeOS ?

1.)
Null-Byte Termination Bypass
2.) Command-Line Injection (CLI) Breakout
3.) 4KB Buffer Boundary Probe
4.) Environment Variable Smuggler
5.) Unicode Normalization Attack
6.) Heap-Spray Initialization
7.) Format String Vulnerability
8.) Recursive Redirect Loop
9.) Path Traversal Injection
10.) Final Shutdown Race Condition Payload

144~147 (and probably earlier) doesn't let me use AdNauseam.

"