search

Prodigy-Hacking / ProdigyMathGameHacking

Prodigy Hacking: Hacking for the right reasons. | Questions? Ask on our Discord. https://discord.gg/XQDfbfq
https://prodigyhacking.com
Other
17 stars 10 forks source link

[CRITICAL] Migrating PHEx to Manifest V3 #1231

Open LeoBadeaux opened 2 years ago

LeoBadeaux commented 2 years ago

Recently, Chrome announced Manifest V3, a change to how chrome extensions work. Manifest V3 removes many core functions/methods that we use in our PHEx extension. More specifically, Manifest V3 removes and deprecates the networkRequest API, and a new API that does not allow extensions to intercept and modify data sent back to the client. We have to modify network request data in order for the hacks to work.

Why does the extension still work?

Chrome is slowly rolling out this change through stages. Based on our research, the extension will continue to work until 2023, which is when the Chrome browser will no longer run extensions that do not follow manifest V3.

What if I do not use Chrome?

Most browsers are based on Chromium, which is Chrome without Google. Chromium is still managed and ran by Chrome, and chromium will follow this change as well, making Manifest V3 extensions not able to run on chromium-based browsers in 2023. However, some chromium-based browsers will actually continue to accept Manifest V2 extensions. The only browsers I know at this moment that will continue to support manifest V3 are Brave and Firefox. Brave is based on chromium, so PHEx already works and will continue to work for Brave. At the moment, PHEx is not supported on Firefox.

What are we going to do?

That is the million-dollar question. We need to figure out methods to hack Prodigy, and that's where we'll need help to come up with viable options to do this. We may have to release multiple methods for different platforms. The following is a list of possible methods that could work:

Desktop Program

We build a desktop program with the hacked version of Prodigy that can run on macOs, Linux, and Windows. This could be achieved using electron, allowing us to easily build a multi-platform program with a programming language we already know- Javascript.

Pros

Building a Proxy

We program and create a proxy server that anyone can connect to which modifies requests on our remote server. We would need to figure out how to bypass the SSL prodigy uses as well as bypass the SHA check, which may have to be done with a proxy AND extension.

Pros

We need help coming up with methods that will work to keep the hacks alive.

PatheticMustan commented 2 years ago

hold on, reading the docs, I'm not totally sure if we need to jump to a desktop program or any proxy. Since we're only modifying the game.min.js, and not dynamically editing requests, I don't see why we're not just able to migrate to mv3 normally with chrome.declarativeNetRequest

PatheticMustan commented 2 years ago

if ya wanna be nitty gritty about it, technically we don't actually modify the game files with the networkRequest API, it just runs another script that inserts the modified game files. The thing that's actually going to stop us from doing anything is how they're going to handle remote code

MV3 imposes new restrictions that limit an extension's ability to execute unreviewed JavaScript through a combination of platform changes and policy limitations. Many extensions are unaffected by this change. However, if your MV2 extension executes remotely hosted scripts, injects code strings into pages, or evals strings at runtime, you'll need to update your code execution strategies when migrating to MV3.

If they just flat out reject our extension, we may just have to go back to manually loading the extension with the developer tools

LeoBadeaux commented 2 years ago

if ya wanna be nitty gritty about it, technically we don't actually modify the game files with the networkRequest API, it just runs another script that inserts the modified game files. The thing that's actually going to stop us from doing anything is how they're going to handle remote code

MV3 imposes new restrictions that limit an extension's ability to execute unreviewed JavaScript through a combination of platform changes and policy limitations. Many extensions are unaffected by this change. However, if your MV2 extension executes remotely hosted scripts, injects code strings into pages, or evals strings at runtime, you'll need to update your code execution strategies when migrating to MV3.

If they just flat out reject our extension, we may just have to go back to manually loading the extension with the developer tools

I haven't read too much into the documentation, but we could try, but I'm not sure it'll actually work.

BoredFishRE commented 2 years ago

is there possibly a way to get code "approved" by google? if so, we can try that.

PatheticMustan commented 2 years ago

nope lmao

it might be possible to just completely move PNP into PHEx, since it seems like we can replace script.js directly, kinda. https://stackoverflow.com/a/35372809

I'm almost certain the "no remote code" requirement by google isn't enforced by mv3, but just by the chrome store. Unless they have some wild crazy new stuff...?

cc @ArcerionDev

BoredFishRE commented 2 years ago

Not sure, we just gotta look at Mv3 and see what happens.

BoredFishRE commented 2 years ago

could we possibly trick MV3 into thinking it's loading something else but when it gets to the extension, it saves the file in cache, and then executes it?

BoredFishRE commented 2 years ago

Because we want people to easily get the hacks to make a point to prodigy, and sideloading the extension or using a desktop app isn't really accessible

LeoBadeaux commented 2 years ago

Because we want people to easily get the hacks to make a point to prodigy, and sideloading the extension or using a desktop app isn't really accessible

Very aware that these alternative methods can and will be confusing for users. This is unfortunate.

ArcerionDev commented 2 years ago

nope lmao

it might be possible to just completely move PNP into PHEx, since it seems like we can replace script.js directly, kinda. https://stackoverflow.com/a/35372809

I'm almost certain the "no remote code" requirement by google isn't enforced by mv3, but just by the chrome store. Unless they have some wild crazy new stuff...?

cc @ArcerionDev

I don't think this is possible to directly put P-NP into PHEx. It would definitely keep hacks from being down more often, but the extension will still need to fetch from Prodigy's gamemin to modify it, and if you're fetching the regular gamemin, you might as well just fetch the modified one, it doesn't make a difference.

ArcerionDev commented 2 years ago

wait nvm I just read the stackoverflow

ArcerionDev commented 2 years ago

yeah it's possible

LeoBadeaux commented 2 years ago

Little update on this, Arcerion tried getting it to work for 3 hours and apparently couldn't figure it out, but he's going to try to get someone else to do it.

ArcerionDev commented 2 years ago

Little update on this, Arcerion tried getting it to work for 3 hours and apparently couldn't figure it out, but he's going to try to get someone else to do it.

@PatheticMustan is working on it

PatheticMustan commented 2 years ago

1316