[CRITICAL] Migrating PHEx to Manifest V3

[LeoBadeaux]

Recently, Chrome announced Manifest V3, a change to how chrome extensions work. Manifest V3 removes many core functions/methods that we use in our PHEx extension. More specifically, Manifest V3 removes and deprecates the networkRequest API, and a new API that does not allow extensions to intercept and modify data sent back to the client. We have to modify network request data in order for the hacks to work.

Why does the extension still work?

Chrome is slowly rolling out this change through stages. Based on our research, the extension will continue to work until 2023, which is when the Chrome browser will no longer run extensions that do not follow manifest V3.

What if I do not use Chrome?

Most browsers are based on Chromium, which is Chrome without Google. Chromium is still managed and ran by Chrome, and chromium will follow this change as well, making Manifest V3 extensions not able to run on chromium-based browsers in 2023. However, some chromium-based browsers will actually continue to accept Manifest V2 extensions. The only browsers I know at this moment that will continue to support manifest V3 are Brave and Firefox. Brave is based on chromium, so PHEx already works and will continue to work for Brave. At the moment, PHEx is not supported on Firefox.

What are we going to do?

That is the million-dollar question. We need to figure out methods to hack Prodigy, and that's where we'll need help to come up with viable options to do this. We may have to release multiple methods for different platforms. The following is a list of possible methods that could work:

Desktop Program

We build a desktop program with the hacked version of Prodigy that can run on macOs, Linux, and Windows. This could be achieved using electron, allowing us to easily build a multi-platform program with a programming language we already know- Javascript.

Pros

• Already allows more freedom than a chrome extension, allowing us to modify Prodigy even more.
• Easy to create using programming languages the development team already knows.

Cons

• Cannot be supported on ChromeOS, which is the primary platform our hacks are used on.

Building a Proxy

We program and create a proxy server that anyone can connect to which modifies requests on our remote server. We would need to figure out how to bypass the SSL prodigy uses as well as bypass the SHA check, which may have to be done with a proxy AND extension.

Pros

• Supported on basically all platforms

Cons

• School administrators typically restrict the privilege of setting a proxy.
• Proxy will likely need to be created in a programming language nobody on our team is proficient with.

We need help coming up with methods that will work to keep the hacks alive.

[PatheticMustan]

hold on, reading the docs, I'm not totally sure if we need to jump to a desktop program or any proxy. Since we're only modifying the game.min.js, and not dynamically editing requests, I don't see why we're not just able to migrate to mv3 normally with chrome.declarativeNetRequest

[PatheticMustan]

if ya wanna be nitty gritty about it, technically we don't actually modify the game files with the networkRequest API, it just runs another script that inserts the modified game files. The thing that's actually going to stop us from doing anything is how they're going to handle remote code

MV3 imposes new restrictions that limit an extension's ability to execute unreviewed JavaScript through a combination of platform changes and policy limitations.
Many extensions are unaffected by this change. However, if your MV2 extension executes remotely hosted scripts, injects code strings into pages, or evals strings at runtime, you'll need to update your code execution strategies when migrating to MV3.

If they just flat out reject our extension, we may just have to go back to manually loading the extension with the developer tools

[LeoBadeaux]

if ya wanna be nitty gritty about it, technically we don't actually modify the game files with the networkRequest API, it just runs another script that inserts the modified game files. The thing that's actually going to stop us from doing anything is how they're going to handle remote code

MV3 imposes new restrictions that limit an extension's ability to execute unreviewed JavaScript through a combination of platform changes and policy limitations.
Many extensions are unaffected by this change. However, if your MV2 extension executes remotely hosted scripts, injects code strings into pages, or evals strings at runtime, you'll need to update your code execution strategies when migrating to MV3.

If they just flat out reject our extension, we may just have to go back to manually loading the extension with the developer tools

I haven't read too much into the documentation, but we could try, but I'm not sure it'll actually work.

[BoredFishRE]

is there possibly a way to get code "approved" by google? if so, we can try that.

[PatheticMustan]

nope lmao

it might be possible to just completely move PNP into PHEx, since it seems like we can replace script.js directly, kinda. https://stackoverflow.com/a/35372809

I'm almost certain the "no remote code" requirement by google isn't enforced by mv3, but just by the chrome store. Unless they have some wild crazy new stuff...?

cc @ArcerionDev

[BoredFishRE]

Not sure, we just gotta look at Mv3 and see what happens.

[BoredFishRE]

could we possibly trick MV3 into thinking it's loading something else but when it gets to the extension, it saves the file in cache, and then executes it?