15

Since a short while, google chrome extensions are 'content verified', meaning other apps can't 'hack' them. Sort of a good thing, but incredibly annoying, because I hack them all the time, to tweak and improve.

Almost immediately after saving an extension file, the extension is disabled and a message shows on the local extensions page:

This extension may have been corrupted

Is there a way I can disable this 'security' feature and keep hacking? I'd like to be the boss of my browser, not the other way around.

There is a chrome flag (extension-content-verification), but as the description says:

This can be used to turn on this feature if it would not otherwise have been turned on, but cannot be used to turn it off (because this setting can be tampered with by malware).

migrated from webapps.stackexchange.com Dec 4 '14 at 21:13

This question came from our site for power users of web applications.

  • Google doesn't let you disable it, so looks like your only option is to use the canary edition of Google Chrome, which is intended for developers like you. – Tomer Feb 17 '15 at 16:05
  • I don't want to dev on Chrome, but some extensions. I don't use Canary for daytoday Chroming. Weird it's not disablable. It's new. Somehow wasn't an issue last 4 years? – Rudie Feb 17 '15 at 18:27
  • It's a new feature that supposed to prevent malicious software from adding its own extension into Chrome without the user's knowlage. – Tomer Feb 18 '15 at 14:54
  • What you can try is to block certain URLs that chrome uses for getting the hases of the extensions. (using an HTTPS proxy) – Tomer Feb 18 '15 at 14:57
  • Adding chrome.google.com to my hosts doesn't do it =( They probably have their own DNS system or something. There is a flag, but "[..] cannot be used to turn it off (because this setting can be tampered with by malware)". Damnit. – Rudie Feb 18 '15 at 17:08
10

There is a fourth way to manage this problem and avoid the detection system entirely. Since you mention you want to hack your extensions, this implies you have some knowledge of extension development. It is also to be understood that extensions are, by their very nature, source code. This means that you have the entire source to fiddle with. That being said...

The fourth method is relatively simple as follows:

  1. Find the extension in the Extensions folder under Chrome's Application Data
  2. Copy that entire Extension's folder and paste it somewhere else
  3. Disable the original extension in Chrome
  4. Rename the newly copied abcsoupname extension folder to MyNewExtension
  5. Change to MyNewExtension folder
  6. Delete _metadata
  7. Edit manifest.json and remove key and update_url sections. Change the name and short_name sections to avoid any confusion with the other disabled extension.
  8. Validate and correct your manifest.json at jsonlint.com
  9. Go to the Settings=>Extensions
  10. Enable Developer Mode and then 'Load Unpacked Extension' on the new folder you just created.
  11. Voila. A new version of this extension not under Content Control.

You can now edit, manipulate and manage this extension as you desire. You'll need to click Reload from the extensions area whenever you make a change. Also, you won't receive updates from the original developer. So, you'll need to update periodically and figure out a way to merge updated changes into your separate extension code. You may be able to leave the update_url intact, but it will likely wipe out any changes you make on the next update. This is why I suggest removing it. Though, feel free to experiment.

By leaving the original extension disabled, this will allow you to enable it and periodically receive updates for the author's version. You can then compare the differences between your custom version and the author's version and merge in any necessary changes. I highly recommend this update approach to your new custom extension. If you choose to leave the update_url active, it will likely wipe out your changes on the next update (assuming this even works correctly on a modified extension). Since some extensions don't update very often, this could leave you scrambling to determine what you changed months later when the next update is released.

You will also need to perform these steps on any extension where you want to modify it. Effectively, you're creating a brand new extension using an existing extension's code base and then putting this extension in developer mode.

Note, don't use Mac's TextEdit to edit json files or it will replace " with “ or ” and fail the json syntax check.

  • This was mentioned before. It's a decent solution, but I'd like to get updates. Instead, I've accepted flaws and I feel big about it. Thanks for the steps =) – Rudie Jul 5 '15 at 0:13
  • 1
    The difficulty is you want to edit the extension and have updates. That's mutually exclusive. If you edit an extension, upon update you'll potentially lose all your changes having to remember what you changed. This can be difficult if it's months later. Disabling updates and manually merging changes is the only feasible way to manage this. – Commorancy Jul 5 '15 at 0:58
  • An update is just a merge into my hacked version. Merges can be smart. If not, it's a merge conflict I can solve. Instead I've chosen the paranoid aproach and not use any contrib extension, just copied & hacked like you're saying. Very late reply, sorry. – Rudie May 19 '16 at 21:47
  • This no longer works. If your extension is not available on the app store, it will be disabled and cannot be re-enabled without removing and adding it again. – Wolfish Sep 6 '16 at 13:36
  • Hi Wolfish, this is definitely not true. Developers must be able to develop extensions locally on their system. This is the reason Chrome offers a Developer Mode. You'll notice at step 10 that you'll need to enable Developer Mode. This is the key. Without dev mode enabled, you cannot load external extensions. Developers cannot create extensions by being forced to upload them to the store for testing which also exposes unfinished code to the public (even more risky). However, Chrome is very diligent at asking you to turn off dev mode on each restart of Chrome. – Commorancy Sep 8 '16 at 6:21
6

Because Google doesn't let you disable the Extension Content Verification feature in any way, your possible workarounds are basically:

  1. Use the canary edition of Chrome, which lets you edit extensions and add your own extensions without any warnings
  2. Copy the extension directory to somewhere else, delete the _metadata folder and load it in developer mode. The drawback of this workaround is that every time you open chrome you will see a message asking you to disable the extension. (because it is in the developer mode)
  3. Prevent Chrome from getting the hashes of the extension, so that it won't be able to verify its content. The drawback of this workaround is that you may not be able to download\update other extensions.

    To do this:

    1. Add the line 127.0.0.1 clients2.googleusercontent.com into your hosts file (usually under C:\Windows\System32\drivers\etc)
    2. Clear the DNS cache of chrome or wait a few minutes
    3. Close Chrome and make some changes to the extension
    4. Delete the _metadata folder from the extension's directory (which stores the original hashes)
    5. Relaunch Chrome

You can also use an HTTPS proxy server to block only the relevant requests, but that would be too much hacky.

  • 1. seems to do something =) but now I can't download extensions, and it's still blocked. Attempt # 2. More tomorrow. – Rudie Feb 18 '15 at 21:25
  • Does it still say it's corrupted? try to delete the _metadata folder which stores the hashes from Google. – Tomer Feb 19 '15 at 13:00
  • This works, but now I can't download other extensions... Why wouldn't it just download from chrome.google.com, but check on a different domain? Always have to make this hard. I don't think an HTTPS proxy is possible. They probably have the MITM approach covered. (2) is probably the best solution, I already have a few dev ext running anyway. No updates though =( Thanks! – Rudie Feb 20 '15 at 20:43
  • Okay, but I don't think they can really do anything about MITM if you tell your computer to trust your own certificate authority. maybe try mitmproxy or something. – Tomer Feb 20 '15 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.