MercuryWorkshop / sh1mmer

source tree, website, and writeup for the sh1mmer chromebook jailbreak
https://sh1mmer.me
GNU General Public License v3.0
208 stars 81 forks source link

Unenrolling via sh1mmer as well as downgrading are impossible in versions after chromeOS 111 #57

Closed ItsTact closed 1 year ago

ItsTact commented 1 year ago

i don't want to spend 20 more hours trying to get chrome 112 to downgrade with various bash commands that don't work if someone else has found a solution

zeglol1234 commented 1 year ago

CoolElectronics if you want to make the state of the project more obvious, why don't you put it in the README lol

ItsTact commented 1 year ago

Downgrade using Balena Etcher, download a recovery image from chrome100.dev, flash it and it will work.

No it will not.

HAHALOSAH commented 1 year ago

(ONLY WORKS IF YOUR CHROMEBOOK HAS NEVER UPDATED TO 112 BEFORE, NO LONGER FUNCTIONAL) Alright, so this is what worked for me

  1. Use sh1mmer and fix GBB
  2. Downgrade to older ChromeOS with an image from https://chrome100.dev
  3. Go back to sh1mmer, fix GBB & deprovision, then disable updates
  4. Enable OS verification
  5. Go through chromebook setup screen until it asks who is using this, then you can enable developer mode if you want
zeglol1234 commented 1 year ago

dead chat :skull:

TheMemeSniper commented 1 year ago

shut the fuck up

Nametag71 commented 1 year ago

what's the "race condition"

its not really relevant here, its basically how you can get dev mode even with the patch to the security chip (basically there is a brief window in which you can take ownership of it)

how do you do that?

mylesbartlett72 commented 1 year ago

what's the "race condition"

its not really relevant here, its basically how you can get dev mode even with the patch to the security chip (basically there is a brief window in which you can take ownership of it)

how do you do that?

fakemurk sets it up automatically, but to use fakemurk you need to be able to use sh1mmer

you could probably take a look at the fakemurk code and rip that part out, but idk which partition of the shim you would need to put it in (if its the kernel partition, you cant, but if its the rootfs, you probably can if you set everything else up correctly)

velzie commented 1 year ago

112 blocks modification of certain tpm values during recovery boot mode specifically. no commands will help. there are several methods of unenrolling past 112 if you're willing to take write protection off, which requires taking off the back of your chromebook (for example setting gbb flags) if that's out of your scope, you'll have to wait for our semi-patch-bypass to release in a stable state

Nametag71 commented 1 year ago

i don't want to spend 20 more hours trying to get chrome 112 to downgrade with various bash commands that don't work if someone else has found a solution

take out the battery, run the unenroll script and you should see an error, go to bash and type "/usr/share/vboot/bin/set_gbb_flags.sh 0x8090", then you should be able to use dev mode and downgrade because it works in dev mode and sign in and update it afterwards. Hope this helps.

ItsTact commented 1 year ago

i don't want to spend 20 more hours trying to get chrome 112 to downgrade with various bash commands that don't work if someone else has found a solution

take out the battery, run the unenroll script and you should see an error, go to bash and type "/usr/share/vboot/bin/set_gbb_flags.sh 0x8090", then you should be able to use dev mode and downgrade because it works in dev mode and sign in and update it afterwards. Hope this helps.

The problem with this approach is that upon reaching the signing in page the chromebook errors with something something time-lock management something, because the chromebook realizes it's not supposed to be in dev mode but it is. the bottom left sign in with personal account button doesn't work upon clicking

velzie commented 1 year ago

that's not a problem with the method it's an occasional odd chromebook bug that is fixed by powerwashing or recovering

ItsTact commented 1 year ago

but like i tried it about 10 times...

velzie commented 1 year ago

it's not a problem with either sh1mmer nor the gbb method, go somewhere else for your issues

trevorwatkins1129 commented 1 year ago

Hmm. I'm on Dedede with ChromeOS v112.0.5615.134, and it works fine for me.

bobeatsshit commented 1 year ago

Maybe a stupid question but could you just replace the version of an older recovery image and just trick the chromebook check?

ItsTact commented 1 year ago

sh1mmer website was updated with instructions, if they don't work then cope harder

velzie commented 1 year ago

(reopening as full instructions haven't been added yet, will close when we finish with adding the alternative methods)

velzie commented 1 year ago

fixed by https://fog.gay

onsomlem commented 1 year ago

no i used the web builder but i am 100% it was working before i updated to 112 downgrading leads me to google's "this is not a valid thing"

Try doing this: Hold the esc + refresh/f3 + powerbutton, for a little or just press it 🤷. Once your screen stops moving and says insert recovery media just press: ctrl + d, (the letter d on your keyboard guys) and then: enter (to continue how it says on your screen right now if you're following) when your screen says " OS verification is off DO NOT PRESS SPACE instead press: esc + refresh/f3 + powerbutton and then plug your recovery media in once the screen says to. it should not complain about your recovery media not being up to date . If it does not work my knowledge is now obsolete and i quit cuz i put my life force into this 💀

ben10101010 commented 1 year ago

Or, you could follow the intructions on the sh1mmer website, which tells you how to turn off WP, then unenroll your chromebook. Didn’t work for me though, I might have to get a special cable to disable it.

inLnx commented 1 month ago

yall still here?