CRX2 is the older form of the format, with a single key and a single signature. Chromium’s current verifier accepts only version 3, so a CRX2 file no longer installs in Chrome, but old ones are still found. All numbers are unsigned and little-endian.
The file
0Magic number43 72 32 34,Cr244 bytes4Version02 00 00 004 bytes8Public key size K4 bytes12Signature size S4 bytes16Public keyK bytes16+KSignatureS bytes16+K+SZIP archive the extension’s filesthe rest
| Offset | Size | Name | Description |
|---|---|---|---|
0 | 4 | Magic | The ASCII characters Cr24. |
4 | 4 | Version | 2. |
8 | 4 | Public key size | The length of the public key in bytes. Chromium accepted at most 65,536. |
12 | 4 | Signature size | The length of the signature in bytes. Chromium accepted at most 65,536. |
16 | K | Public key | An RSA public key, as a DER-encoded X.509 SubjectPublicKeyInfo. |
16+K | S | Signature | An RSA signature with SHA-1 (PKCS #1 v1.5) of the ZIP archive that follows. |
16+K+S | Archive | A ZIP archive, to the end of the file. Its offsets count from its own start. |
Only the archive is signed, not the header. The extension’s ID comes from the public key: see Signing and IDs.