Skip to content

Commit

Permalink
Update guide
Browse files Browse the repository at this point in the history
  • Loading branch information
rainestorme committed Aug 24, 2023
1 parent ae022d8 commit 477b55e
Show file tree
Hide file tree
Showing 6 changed files with 11 additions and 13 deletions.
4 changes: 2 additions & 2 deletions _pages/en_US/choose-halcyon.txt
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Your device is compatible with two exploit chains - E-Halcyon and traditional WP
+ "Just works" exploit, quick and easy setup
+ Cons
+ Requires a USB drive at every boot to startup, will display "ChromeOS is missing or damaged" if E-Halcyon is installed in semi-tethered mode
+ Won't "phone home" to GAC - you'll have to recover every couple of days for device information to updated if that's a concern for you
+ Won't "phone home" to GAC - you'll have to recover every couple of days for device information to update it if that's a concern for you
+ User data isn't saved between reboots due to cryptohome issues
+ Requires a Linux system to build
+ WP-disabled Unenrollment + fakemurk (murkmod)
Expand All @@ -26,7 +26,7 @@ Your device is compatible with two exploit chains - E-Halcyon and traditional WP
+ Policy modification via Pollen, devpolicy modification via Lilac
+ Cons
+ Requires disassembly of Chromebook to disable firmware write-protect
+ Not noob-friendly, requires basic knowledge of using a terminal
+ Not noob-friendly, requires basic knowledge of using a terminal and a Linux system to build

## Section II - Choosing Next Steps

Expand Down
3 changes: 3 additions & 0 deletions _pages/en_US/get-started.txt
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,9 @@ Before starting this guide, we first have to check some key information about yo
![]({{ "./images/find-board-stable-channel.png" | absolute_url }})
{: .notice--info}

If chrome://version is blocked, just hold down `Esc+Refresh+Power` until the recovery screen shows up, and then press `Tab`. At the very top of the text that appears should be your board name.
{: .notice--info}

#### Section II - Crosh Checks

1. Now, we're going to check if various versions of `crosh`, the ChRomeOs developer SHell are accessable on your device.
Expand Down
2 changes: 1 addition & 1 deletion _pages/en_US/home.txt
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ excerpt: "An exploit guide and wiki for a wide variety of chromebook exploits an
Thoroughly read all of the introductory pages (including this one!) before proceeding.
{: .notice--info}

Warning: Downgrading through the typical recovery method is patched on v112 and over. You can still follow this guide on almost any hardware, but you're limited to E-Halcyon if you aren't willing to take apart your device.
Warning: Downgrading through the typical recovery method is patched on v112 and over for non-sh1mmerable boards. You can still follow this guide on almost any hardware, but you're limited to E-Halcyon if you aren't willing to take apart your device.
{: .notice--warning}

## What does this guide do and install?
Expand Down
4 changes: 2 additions & 2 deletions _pages/en_US/identify-wp.txt
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ First, we have to figure out what kind of hardware WP you have on your device, s

If you have a early model (from 2012-2013), your device has a jumper/switch WP.

If you have a pre-CR50 model (from 2014-2017), your device has a WP screw. Chances are, your device falls into this category.
If you have a pre-CR50 model (from 2014-2017), your device has a WP screw.

If you have a CR50 model (2017+), your device could fall into multiple categories:
- Battery-tied (from up to mid-2021) - your WP is tied to whether or not the battery is connected
- Battery-tied (from up to mid-2021) - your WP is tied to whether or not the battery is connected - This is most likely your board if you used one of the publicly leaked shims
- Jumper-based (from 2021 and onward) - your WP is controlled by an unpopulated jumper on the board

A quick google-search will tell you what category your device falls into, based on its release date. You can also check [MrChromebox's Page](https://mrchromebox.tech/#devices) for more information.
Expand Down
9 changes: 2 additions & 7 deletions _pages/en_US/sh1mmer.txt
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,7 @@ title: "SH1MMER Unenrollment"

You need to download a raw RMA (Return Merchandise Authorization) shim for your board, which you found earlier. There are only a few of these that have been publicly leaked, and this tool automatically filters out boards that are not supported. You can get a shim at the following sites:

- https://files.ultimatesrv.com/
- https://rainestorme.github.io/chrome81/
- https://dl.osu.bio/

## Section II - Add the SH1MMER payload (BeautifulWorld)

Expand Down Expand Up @@ -58,13 +57,9 @@ If you were on a version >111 and disabled WP, you will need to run some command

```sh
/usr/share/vboot/bin/set_gbb_flags.sh 0x8090
flashrom --wp-disable
sudo vpd -i RW_VPD -s check_enrollment=0
sudo vpd -i RW_VPD -s block_devmode=0
sudo crossystem block_devmode=0
```

Reboot, and boot into developer mode (`Esc+Refresh+Power` and `Ctrl+D`). Immediately, powerwash the device (`Ctrl+Alt+Shift+R`). After powerwashing, immediately switch into VT2 (Virtual Terminal 2) the second the device begins to boot (`Ctrl+Alt+Forward`). If asked for a username, type `root` and press enter. Now run the following commands, as shown by [this meme](https://akkoma.mercurywork.shop/media/8fdafa97b393dd32ba00c94a488e6b653d005b79820ed0ba802174a44c66c649.png):
Reboot, and boot into developer mode (`Ctrl+D`). Immediately, powerwash the device (`Ctrl+Alt+Shift+R`). After powerwashing, immediately switch into VT2 (Virtual Terminal 2) the second the device begins to boot (`Ctrl+Alt+Forward`). If asked for a username, type `root` and press enter, and if asked for a password, type `test0000`. Now run the following commands, as shown by [this masterpiece of a meme](https://akkoma.mercurywork.shop/media/8fdafa97b393dd32ba00c94a488e6b653d005b79820ed0ba802174a44c66c649.png):

```sh
tpm_manager_client take_ownership
Expand Down
2 changes: 1 addition & 1 deletion assets/js/selecting.js
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ let canRootBoard = (supplied_board) => {
function redirect() {
var waysToRoot = canRootBoard(document.getElementById("board").value);
console.log(waysToRoot);
if (waysToRoot.includes("SH1MMER") && document.getElementById("curVersion").value >= 112) {
if (waysToRoot.includes("SH1MMER") && document.getElementById("curVersion").value >= 111) {
window.location.href="https://chromebook-guide.github.io/choose-halcyon";
} else if (document.getElementById("curVersion").value >= 112){
alert("No exploits are available for your platform, since you're updated past v112 and are incompatible with SH1MMER.");
Expand Down

0 comments on commit 477b55e

Please sign in to comment.