Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Chrome 78 Canary blocks injection to Chrome renderer processes #597

Open
zheung opened this issue Aug 12, 2019 · 59 comments
Open

Chrome 78 Canary blocks injection to Chrome renderer processes #597

zheung opened this issue Aug 12, 2019 · 59 comments
Labels
waiting third party

Comments

@zheung
Copy link

zheung commented Aug 12, 2019 •
edited
Loading

According Chromium Issue #990640 and Chromium Review #1629607,
Chrome 78 Canary is starting to block injection to Chrome renderer processes. Mactype Beta 6 can not work correctly since 78.0.3874.0.
Currently, we can use --disable-features=RendererCodeIntegrity to avoid block

I think I should bring this messsage to you, no matter that it would be fixed or not.

Here is some screenshots.
It's more obvious and different in Chinese. Please take two screenshots in image viewer, and switch sometimes:
Without any argument. work incorrectly and cannot enable in Process Manager:
without 1
without 2

Work fine with `--disable-features=RendererCodeIntegrity:
with 1
with 2
@snowie2000
Copy link
Owner

Let's see if the change will be kept to the final release.
I'd rather not hook the SetProcessMitigationPolicy API. It's really one of the most important security parts of the Windows 10.

@nanake
Copy link

nanake commented Aug 12, 2019

ditto for recent chrome dev (78.0.3876.0).

@BeLozmen
Copy link

确实，78版本以后，宋体就变成了老样子，用--disable-features=RendererCodeIntegrity才能正常渲染

@BeLozmen
Copy link

我一直使用Mac Type+替换去除hinting的雅黑和宋体配合使用。一开始还没发现这个问题，因为去除Hinting的雅黑和MacType的默认渲染效果差不多，可能只是稍微细了一点。但是今天我访问百度百科，这个网站默认字体是宋体，宋体即便除去了hinting，在小字体下也是强制GridFit的，这点超蛋疼，然后我就发现了实际上是Chrome（我用的是Chromium内核的Edge）无法被渲染了。用--disable-features=RendererCodeIntegrity的话，只能从指定快捷方式打开Chrome，相当不方便，求修复。

@RainkQ
Copy link

RainkQ commented Oct 23, 2019

78.0.3904.70 stable has released.
Blocking has been kept in this version.
image

@snowie2000
Copy link
Owner

Thanks for your report.
Really bad news.

@BeLozmen
Copy link

新版的Edge，不管是稳定通道还是金丝雀通道，这个block都不再起作用了（大概至少一个礼拜之前就是这样了）。不知道是不是微软禁止了这个功能，建议如果在使用Chrome，可以试试Edge。

@snowie2000 snowie2000 mentioned this issue Oct 27, 2019
Closed
@Danita
Copy link

Danita commented Oct 29, 2019

Closed? There's no workaround for this? :(

@hwooo
Copy link
Contributor

hwooo commented Nov 5, 2019

Is this issue solved?

@snowie2000 snowie2000 mentioned this issue Dec 9, 2019
Closed
@kcohar
Copy link

kcohar commented Dec 12, 2019 •
edited
Loading

This issue wasn't present in 78.0.3904.108.
But it's back, and I can see it in Chrome 79.0.3945.79 (latest stable version as of Dec 12, 2019) and the canary version, 81.0.3993.0.

--disable-features=RendererCodeIntegrity seems to fix the issue.

Please see https://support.symantec.com/us/en/article.tech256047.html
It seems that SEP was patched to mitigate this issue.

I think you might have to hook the mitigation policy function after all.

@snowie2000
Copy link
Owner

snowie2000 commented Dec 13, 2019 •
edited
Loading

Sure, however, I already tried too many times pulling the chromium code without success... it's simply too big...

@ShadowLyin
Copy link

新版的Edge，不管是稳定通道还是金丝雀通道，这个block都不再起作用了（大概至少一个礼拜之前就是这样了）。不知道是不是微软禁止了这个功能，建议如果在使用Chrome，可以试试Edge。

目前 Edge Chromium 版本 80.0.361.48 也有这个问题了。

@kpcheong
Copy link

kpcheong commented Mar 4, 2020

Mactype works fine in Chromium Edge(Version 80.0.361.62 (Official build) (64-bit)) with --disable-features=RendererCodeIntegrity.

Thanks for the solution.

@kcohar
Copy link

kcohar commented Mar 4, 2020 via email •
edited
Loading

@BeLozmen
Copy link

BeLozmen commented Mar 4, 2020

You could also insert the DWORD "RendererCodeIntegrityEnabled" with the value of 0 into - HKLM\Software\Politics\Chromium, for Chromium - HKLM\Software\Politics\Google\Chrome, for Chrome - I'm assuming HKLM\Software\Politics\Microsoft\Edge, for Edge I don't have a computer at hand at the moment so I can't test it sorry...
…
On Wed, Mar 4, 2020, 4:17 AM kpcheong @.***> wrote: Mactype works fine in Chromium Edge(Version 80.0.361.62 (Official build) (64-bit)) with --disable-features=RendererCodeIntegrity. Thanks for the solution. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#597?email_source=notifications&email_token=ALJKQE3BPGBY42N5OCLPUSLRFXB4BA5CNFSM4IK5PPGKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENWFUWI#issuecomment-594303577>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ALJKQEZ5B73Z2R6KQ2KU7L3RFXB4BANCNFSM4IK5PPGA .

亲测有效，谢谢。it works thanks

@snowie2000
Copy link
Owner

snowie2000 commented Mar 5, 2020 •
edited
Loading

You could also insert the DWORD "RendererCodeIntegrityEnabled" with a value of 0 into - HKLM\Software\Policies\Chromium, for Chromium - HKLM\Software\Policies\Google\Chrome, for Chrome - I'm assuming HKLM\Software\Policies\Microsoft\Edge, for Edge I don't have a computer at hand at the moment so I can't test it sorry... EDIT: policies typo
…
On Wed, Mar 4, 2020, 4:17 AM kpcheong @.***> wrote: Mactype works fine in Chromium Edge(Version 80.0.361.62 (Official build) (64-bit)) with --disable-features=RendererCodeIntegrity. Thanks for the solution. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#597?email_source=notifications&email_token=ALJKQE3BPGBY42N5OCLPUSLRFXB4BA5CNFSM4IK5PPGKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENWFUWI#issuecomment-594303577>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ALJKQEZ5B73Z2R6KQ2KU7L3RFXB4BANCNFSM4IK5PPGA .

You are really a life saver. Wiki updated. Thank you!

@kcohar
Copy link

kcohar commented Mar 5, 2020 •
edited
Loading

My pleasure!

I tried using it with the --disable-features setting but it wouldn't work if I opened it up from a link or something, this is more of a global workaround.

@kpcheong
Copy link

kpcheong commented Mar 6, 2020

You could also insert the DWORD "RendererCodeIntegrityEnabled" with a value of 0 into - HKLM\Software\Policies\Chromium, for Chromium - HKLM\Software\Policies\Google\Chrome, for Chrome - I'm assuming HKLM\Software\Policies\Microsoft\Edge, for Edge I don't have a computer at hand at the moment so I can't test it sorry... EDIT: policies typo
…
On Wed, Mar 4, 2020, 4:17 AM kpcheong @.***> wrote: Mactype works fine in Chromium Edge(Version 80.0.361.62 (Official build) (64-bit)) with --disable-features=RendererCodeIntegrity. Thanks for the solution. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#597?email_source=notifications&email_token=ALJKQE3BPGBY42N5OCLPUSLRFXB4BA5CNFSM4IK5PPGKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOENWFUWI#issuecomment-594303577>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ALJKQEZ5B73Z2R6KQ2KU7L3RFXB4BANCNFSM4IK5PPGA .

Maybe Microsoft has heard our solution of --disable-features=RendererCodeIntegrity, now this code fails in the latest Chromium Edge (Version 80.0.361.66 (Official build) (64-bit)). Fortunately the DWORD solution still work!!! Thank you, @kcohar !

@kcohar
Copy link

kcohar commented Mar 6, 2020 via email

@kcohar
Copy link

kcohar commented Mar 8, 2020

By the way I managed to get it to work in Brave too by adding "RendererCodeIntegrityEnabled" with the value 0 to HKLM\Software\Policies\BraveSoftware\Brave

@littleghost2016
Copy link

littleghost2016 commented Mar 10, 2020 •
edited
Loading

It works on Chromium Edge 81.0.416.28 (Official build) beta (64-bit). Thanks for your solution!
image

@hamjin
Copy link

hamjin commented Mar 22, 2020 •
edited
Loading

也许签名DLL和程序能解决？
chrome://conflicts/ 这下面只有MacType没有签名
Edit:签名要Microsoft签名，这一点够呛了。

@snowie2000
Copy link
Owner

不行的，如你补充的，必须是Microsoft签名或者是几种高级别的签名才行，一般软件签名是没用的，只能禁止验证。

@hamjin
Copy link

hamjin commented Mar 28, 2020

不行的，如你补充的，必须是Microsoft签名或者是几种高级别的签名才行，一般软件签名是没用的，只能禁止验证。

Sorry,忘记补充自己的结果了，是没用的。而且Chrome甚至能覆盖Windows Defender里面的相关开关，只能注册表了。但那个组织管理真令人窒息

@jxcangel
Copy link

Even Micrsoft Edge Enabled in Mactype, font render seems still terrible. Do anyone know whether Mactype implemented for Edge?

@snowie2000
Copy link
Owner

What you're looking for is a better way to intercept DirectWrite which, AFAIK, doesn't exist.

@hamjin
Copy link

hamjin commented Apr 26, 2020 •
edited
Loading

I found an script
https://github.com/syhyz1990/mactype
Edit: ONLY USE IT WHEN YOU CANNOT USE MACTYPE

@hamjin
Copy link

hamjin commented Apr 26, 2020 •
edited
Loading

https://chromium-review.googlesource.com/c/chromium/src/+/1629607
According to the review, the chrome_child.dll and chrome_elf.dll is in the white list now.
Maybe patch them?
Edit:
https://chromium-review.googlesource.com/c/chromium/src/+/1629607/20/chrome/browser/chrome_content_browser_client.cc#3713
chrome_elf.dll is always loaded and it is an render dll. Maybe hook it will be better.

@snowie2000
Copy link
Owner

You have no way to hook it since you have no way to inject mactype dll in the first place.

@snowie2000
Copy link
Owner

snowie2000 commented Apr 26, 2020 •
edited
Loading

I found --no-sandbox to be a functional workaround for 81.0.4044.113

You don't have to. Simple creating a policy for Chrome would solve the problem:
https://githubfast.com/snowie2000/mactype/wiki/Google-Chrome#policy-thanks-to-kcohar

Disabling sandbox is completely overkilling.

@kcohar
Copy link

kcohar commented Apr 26, 2020 via email

@snowie2000
Copy link
Owner

Our Google support contact says the ability to suppress the feature will be removed after the next few versions.

That will be a disaster for us then...

@hamjin
Copy link

hamjin commented Apr 26, 2020 via email

@snowie2000
Copy link
Owner

snowie2000 commented Apr 26, 2020 •
edited
Loading

The problem is I haven't understood the way Chrome whitelist dlls, if I can somehow figure out how they did it, I may have a chance to hook and insert our dll to be part of it.

@hamjin
Copy link

hamjin commented Apr 26, 2020 via email

@snowie2000
Copy link
Owner

snowie2000 commented Apr 26, 2020 •
edited
Loading

The source code is too huge to be examined ... or searched ...

@hamjin
Copy link

hamjin commented Apr 26, 2020 via email

@snowie2000
Copy link
Owner

snowie2000 commented Apr 26, 2020 •
edited
Loading

The src is too crazy that even right-click on a source file can freeze my explorer for seconds

@snowie2000
Copy link
Owner

I knew that this is the key:

result = policy->AddRule(sandbox::TargetPolicy::SUBSYS_SIGNED_BINARY,
                             sandbox::TargetPolicy::SIGNED_ALLOW_LOAD,
                             GetModulePath(dll).value().c_str());

But I failed to figure how the rule is added😕

@kcohar
Copy link

kcohar commented Apr 26, 2020 via email

@snowie2000
Copy link
Owner

I have never thought they would provide us a way to add external dlls as it's sandbox exceptions.

@hamjin
Copy link

hamjin commented Apr 26, 2020 via email

@snowie2000
Copy link
Owner

snowie2000 commented Apr 26, 2020 •
edited
Loading

Why can't we hook it? (despite doing it for good or bad)

@snowie2000
Copy link
Owner

I happened to find out a way to walkaround this and successfully tricked chrome to disable the integrity check, but I'm still looking for more "secure" ways to do it.

@hamjin
Copy link

hamjin commented Apr 26, 2020

I happened to find out a way to walkaround this and successfully tricked chrome to disable the integrity check, but I'm still looking for more "secure" ways to do it.

You can show it for those who doesn't need a safe browser

@snowie2000
Copy link
Owner

My method does disable some of the new safety measurements but still have the sandbox enabled and all the basic protections are still working. So it’s technically speaking it is still safe but I want the impact to be as least as possible.

@snowie2000
Copy link
Owner

The problem of my new method is that it doesn’t only allow Mactype to be injected into the chrome. Like disabling code integrity check, all the other tools can be injected.

@hamjin
Copy link

hamjin commented Apr 26, 2020

The problem of my new method is that it doesn’t only allow Mactype to be injected into the chrome. Like disabling code integrity check, all the other tools can be injected.

I think the CIG is not suitable for Chrome because the browser's dynamic libraries like chrone_elf.dll is in the whitelist, so it doesn't need Microsoft's certificate. We can make an new dynamic library which only add an rule to whitelist and pass other functions to the original chrome_elf.dll

@snowie2000
Copy link
Owner

chrome
As you can see, Chrome was started without any command-line parameters and I didn't set any policy to it, yet it loads MacType correctly in Windows 10.

I tried several other ways today and they are either too hard to implement or have potential risks that I'd rather not put them into the final release.

I know I can just hook SetProcessMitigationPolicy and stop some mitigations from applying, but I'd prefer to treat it as our last hope.

@snowie2000
Copy link
Owner

snowie2000 commented Apr 28, 2020 •
edited
Loading

Update:

I figured out a perfect way to load MacType into the latest Chrome in Windows 10, and the method also worked for Microsoft Edge (chromium-based) with very little compromise on security.
edge

@kcohar
Copy link

kcohar commented Apr 30, 2020 via email

@Alex-Hou
Copy link

awesome

@sky31even
Copy link

update: this version of chromium Edge (83.0.478.54 ) still works under "--disable-features=RendererCodeIntegrity"

@sky31even
Copy link

Update:

I figured out a perfect way to load MacType into the latest Chrome in Windows 10, and the method also worked for Microsoft Edge (chromium-based) with very little compromise on security.
edge

looking forward it lollllll

@gettinwet gettinwet mentioned this issue Jan 14, 2021
Open
@Lucire
Copy link

Lucire commented Apr 9, 2021 •
edited
Loading

Hi there, for a while I’ve used the solution of the command line "C:\Program Files\Vivaldi\Application\vivaldi.exe" --disable-features=RendererCodeIntegrity and forcing Windows 8 compatibility in order for MacType to work inside Vivaldi. However, after Windows updates KB5000842 and KB4589212 were installed, this no longer seems to work.

I’ve never been able to do the registry method outlined above as the keys simply are not there for Vivaldi. Under HKLM\Software\Policies I only have Adobe and Microsoft, and no Google. Is there somewhere else I can add the registry key(s)?

Edit: I have updated MacType to the latest version. Also one of my shortcuts was missing the --disable-features=RendererCodeIntegrity; I’ve now added --disable-lcd-text as well. This appears to have solved the problem.

@kcohar
Copy link

kcohar commented Apr 11, 2021 via email •
edited
Loading

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
waiting third party
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests