CryptoSmite
FWSmasher, unretained, fallenmoon8080, Catakang#0987
Website Blog GitHub Discord Source
Unenrolling with stateful files.
How it works
Uses stateful backups that allow changing the encrypted contents of the stateful partition to arbritary contents. This data is useful for enrollment status, so it was changed to make the device appear unenrolled. On the OOBE, it starts the AutoEnrollmentController, which chains into the ash ownership system, and then the ownership system checks for a file. If this file exists, it removes firmware management parameters (FWMP).Performing the exploit
- Enter recovery mode.
- On a personal device, download stateful.tar.xz.
- Download CryptoSmite chroot.
- Clone the CryptoSmite repository by executing
git clone https://github.com/FWSmasher/CryptoSmite
in a terminal. - In the terminal, change the directory to the cloned directory that was created.
- Execute
./cryptosmite_host.sh
+ (raw rma shim path) + (cryptsetup chroot path) + (stateful.tar.xz path). - Install the Chromebook Recovery Utility extension.
- Open the "Chromebook Recovery Utility" extension.
- In the extension popup, at the top right, select Use local image.
- Select the local recovery image.
- Insert the USB or SD card you want to flash.
Important: Existing data will be erased from the USB or SD card when flashing with the utility.
- Follow the prompts in the utility.
- On your Chromebook, press Esc + Refresh
, then press Power . - Press Ctrl + D.
An OS verification confirmation message should appear.
- Press Enter.
After a few seconds, a screen should appear indicating that OS verification is off and Developer Mode is blocked. [Image]
- Press Esc + Refresh
, then press Power . The previous screen should appear with OS verification turned off.
- Insert the external memory device with CryptoSmite flashed.
This should inject an RMA shim which boots the Chromebook into the CryptoSmite interface.
- Navigate to the edit stateful bash screen.
Instructions
Using the Recovery Utility
Turn off OS verification by attempting to enable Developer Mode
Important: You may want to back up important local data on your profile before doing this.Unfinished :0