A Reasonably Modern Guide to Hacking Your Chromebook

Written by rainestorme with help from the Cognito Inc. team

Table of Contents

Preface and Prerequisites

“As long as a government can come and shoot you, you can’t jump on the Internet to freedom.”
-Esther Dyson

Chromebooks. Love them or hate them, we’ve all used one before - otherwise, you wouldn’t be reading this guide. The only problem is how terribly slow and laden with spyware they tend to be when under enterprise enrollment.

Okay, let’s cut to the chase. We both know why you’re here, and it’s not to read this (marvelously well-written) preface. Unfortunately, there’s some stuff that needs to be covered before we can continue:

This guide (the “Guide”) has been created purely for the purposes of academic research and for the development of effective defensive techniques. It is not intended to be used to attack, steal, or harm systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the Guide or related software. Any personal, professional, or financial harm that may arise out of following the Guide is entirely the fault of the individual following the guide, not the authors. This guide involves disassembly of the target device (the “Device”), which will most likely void any and all warranties that are held over the Device. Use responsibly.

My lawyer told me to put that there.

Now that we’ve got that out of the way, let’s get to the fun part! This guide will involve some disassembly, and may require specialized hardware. Here’s a list of everything you could possibly need, regardless of your target device:

Got everything you need? Great. Let’s get started.

Continue to I - Identifying Device Information

I - Identifying Device Information

“Military intelligence is the key to war; without it, you cannot win.”
-Sun Tzu

In this section, we determine the necessary version and board information of the target device, which will be required later. If you already know this information, you can safely skip to Step 3.

1. Identifying chromeOS’s Release Milestone

If you are able to log into the device:

If you are unable to log into the device:

chromeOS’s version is visible on its login screen in the top right corner. Find the first number in the version string (see image below). This is your release milestone, or as it is sometimes referred to, your chromeOS version. For example, the release milestone of the device of which the picture below was taken is 72, or as it is commonly abbreviated, v72.

identify chrome milestone no login

2. Identifying the Device’s Board

If you are able to log into the device:

If you are unable to log into the device:

3. Next Steps

If your target device’s board is in this list:

  • (A-B) ambassador, brask, brya
  • (C) clapper, coral, corsola
  • (D-E) dedede, enguarde
  • (G) glimmer, grunt
  • (H) hana, hatch
  • (J-N) jacuzzi, kukui, lulu, nami
  • (O) octopus, orco
  • (P-R) pyro, reks
  • (S) sentry, stout, strongbad
  • (T-Z) tidus, ultima, volteer, zork

Then you should proceed to Step 4.
Otherwise, continue to III - Setting GBB Flags (Ch341a)

4. Next Steps - SH1mmer

Your target device is vulnerable to the SH1mmer exploit. Now, we must asses the current chromeOS version on the device to determine the next steps.

If your device is on a version lower than v114, then continue to II - Setting GBB Flags (Pre-Tsunami)

If your device is on a version equal to or higher than v114, then continue to III - Setting GBB Flags (Ch341a)

II - Setting GBB Flags (Pre-Tsunami)

““It strikes me that the only real reason to take apart a pocket watch, or a car engine, aside from the simple delight of disassembly, is to find out how it works. To understand it, so you can put it back together again better than before, or build a new one that goes beyond what the old one could do.”
-Kurt Busiek

This section requires use of a screwdriver appropriate to fit the case screws of your target device, usually Phillips or Torx.

In this section, we disassemble the device partially in order to disable hardware write-protect, then build SH1mmer and flash it to a drive in order to use it to set the GBB flags to unblock developer mode permanently.

1. Removing the Back Cover

2. Determining Write-Protect Type

This is where the path diverges.

If the target device uses CR50 (battery) write-protect, continue to Step 3

If the target device uses CR50 (jumper) write-protect, continue to Step 4

If the target device uses a different type of write-protect then those listed here, you are in a very rare scenario and should consult MrChromebox’s wiki page on the topic for more help, then continue to Step 5

3. Disabling Write-Protect (CR50, battery)

Continue to Step 5

4. Disabling Write-Protect (CR50, jumper)

Continue to Step 5

5. Booting SH1mmer and Setting GBB

6. Next Steps

If your goal is to keep your device enrolled while still disabling extensions and having developer mode functionality, continue to IV - Flashing murkmod (SH1mmer-SMUT)

Otherwise, if you want to fully unenroll your device, continue to V - Unenrolling (SH1mmer)

III - Setting GBB Flags (Ch341a)

“Science isn’t about why - it’s about why not. Why is so much of our science dangerous? Why not marry safe science if you love it so much? In fact, why not invent a special safety door that won’t hit you in the butt on the way out, because you are fired!”
-Cave Johnson, Portal 2

This section requires use of a screwdriver appropriate to fit the case screws of your target device, usually Phillips or Torx, a Ch341a USB flash programmer, and a chip clip/probe appropriate for the type of flash that your Chromebook uses, usually 3v WSON-8 (for newer models). You will also need an external Linux device, preferably running Ubuntu 23.04 - other distros will work, but these instructions will not cover discrepancies.

In this section, we disassemble the device and remove the motherboard in order to flash custom GBB flags directly to the read-only firmware on the device.

1. Removing the Back Cover

2. Wait, Should I Remove the Motherboard?

This is a question I’ve been asked time and time again. Although kindred Chromebooks are used for reference throughout Step 3, you should not remove the motherboard of a kindred chromebook to reprogram your SPI flash chip. On kindred (and many other newer) devices, the flash chip is in a WSON-8 format on the front of the motherboard, and looks like the image below:
enter image description here
If you do not need to remove your motherboard to access the flash chip, skip to Step 4.

3. Removing the Motherboard

Heads up: If you have it, wear ESD gear - it will reduce the chances of you damaging your Chromebook while poking around inside.

4. Flashing New GBB Flags

Careful: this step writes to the flash chip and it is critical that you make sure it finished correctly before reassembling the device!

5. Replacing the Motherboard

Confident you can do this yourself? Go right ahead - it should be the exact reverse of the steps above. Since you already know what you’re doing from before, I’ll just gloss over the steps required to replace the motherboard back in your target device:

Side note: now is a good time to make modifications to the cooling of the device - eg. replacing the fan or heatsink, adding custom components, etc.
Remember that any aftermarket parts are not guaranteed to fit and your mileage may vary depending on what components you may choose to add. Generally, custom design and manufacture (eg. 3D printing) of specific components to fit the exact model and dimensions of Chromebook you’re working with will be your best choice.

6. Replacing the Back Cover

7. Next Steps

If your goal is to keep your device enrolled while still disabling extensions and having developer mode functionality, continue to VI - Installing murkmod (Devmode)

Otherwise, if you want to fully unenroll your device, continue to Step 8

8. Next Steps - Unenrollment

If your target device’s board is in this list:

  • (A-B) ambassador, brask, brya
  • (C) clapper, coral, corsola
  • (D-E) dedede, enguarde
  • (G) glimmer, grunt
  • (H) hana, hatch
  • (J-N) jacuzzi, kukui, lulu, nami
  • (O) octopus, orco
  • (P-R) pyro, reks
  • (S) sentry, stout, strongbad
  • (T-Z) tidus, ultima, volteer, zork

Then you should proceed to Unenrolling (SH1mmer).
Otherwise, proceed to Unenrolling (Devmode)

IV - Flashing murkmod (SH1mmer-SMUT)

This section is outdated and is only kept here for posterity. It is reccomended that you use the murkmod developer mode installer unless you plan to flash a large quantity of devices in a row with murkmod, or plan to re-flash later.

“Heh… SMUT… you know, that’s actually an acronym. Yeah, an acronym for SH1mmer Multiboot UTility. I did that on purpose - it’s funny as fuck - and I think MercuryWorkshop still hates me for it!”
-rainestorme

1. Booting SH1mmer-SMUT

2. Flashing murkmod

3. Performing Initial Setup

4. Configuring murkmod

Continue to VIII - Configuring murkmod

V - Unenrolling (SH1mmer)

“No prison can hold me; no hand or leg irons or steel locks can shackle me. No ropes or chains can keep me from my freedom.”
-Harry Houdini

1. Booting SH1mmer

If you haven’t already, follow the instructions in A. Building SH1mmer to prepare a drive with SH1mmer.

2. Unenrolling

3. What Now?

At this point, the target device should be fully unenrolled and it should be usable as a personal Chromebook, free of all restrictions. What you do from here is up to you. Have fun!

View appendix entry C. Reverting Unenrollment for a guide on how to revert the device back to being enrolled.

VI - Installing murkmod (Devmode)

“Your work is going to fill a large part of your life, and the only way to be truly satisfied is to do what you believe is great work.”
-Steve Jobs

1. Enabling Developer Mode

2. Installing murkmod (Devmode Installer)

3. Performing Initial Setup

4. Configuring murkmod

Continue to VIII - Configuring murkmod

VII - Unenrolling (Devmode)

“The only thing we have to fear is fear itself. Oh, and also the IT department.”
-rainestorme

1. Enabling Developer Mode

2. Setting VPD

3. What Now?

At this point, the target device should be fully unenrolled and it should be usable as a personal Chromebook, free of all restrictions. What you do from here is up to you. Have fun!

View appendix entry C. Reverting Unenrollment for a guide on how to revert the device back to being enrolled.

VIII - Configuring murkmod

“It is not the strongest of the species that survive, nor the most intelligent, but the one most responsive to change.”
-Charles Darwin

1. Getting to Crosh

3. Properly Disabling Admin-Installed Extensions

Select “Hard Disable Extensions” and, at the prompt, enter the extension ID corresponding to the extension you want to disable:

4. Installing the Aurora Store

5. Installing the murkmod helper Extension

6. What now?

The target device is now fully configured to use murkmod with the recommended settings and plugins. From here, what you do is your choice. Have fun!

View appendix entry B. Reverting murkmod for a guide on how to revert the target device back to a stock state.

Appendix and Common Procedures

“I have not failed. I’ve just found 10,000 ways that won’t work.”
-Thomas A. Edison

A. Building SH1mmer

B. Reverting murkmod

C. Reverting Unenrollment

vpd -i RW_VPD -s check_enrollment=1
vpd -i RW_VPD -s block_devmode=1
crossystem block_devmode=1
echo "fast safe" > /mnt/stateful_partition/factory_install_reset
reboot

D. Finding Recovery Images

Credits

“Alone we can do so little; together we can do so much.”
-Helen Keller

The following people and groups greatly assisted with the development of this guide: