ChromeOS Firmware Utility Script

 

ChromeOS Firmware Utility Script

The ChromeOS Firmware Utility Script simplifies the most common functions most users need when interacting with the firmware on their ChromeOS device. It can be run from ChromeOS, or any Linux which has a full Bash shell (so LibreELEC users need to boot a Ubuntu Live USB (eg) and run it from there). Currently, it allows the user to:

• Install/Update the RW_LEGACY firmware with a newer/working/customized version of the SeaBIOS firmware payload
• Install/Update coreboot/UEFI (Full ROM) firmware, built from the latest sources
• Set the Boot Options (GBB Flags) (only for stock ChromeOS firmware)
• Set the device's Hardware ID (only for stock ChromeOS firmware)
• Remove the ChromeOS Developer/Recovery mode Bitmaps (only for stock ChromeOS firmware)
• Restore the ChromeOS Bitmaps (only for stock ChromeOS firmware)
• Restore the Stock BOOT_STUB
• Restore the Stock Firmware

At startup, the Firmware Utility Script will automatically detect the device, OS, and current firmware details, and show a customized menu options based on this information. Some options may be greyed-out/disabled for some devices. Because most of these operations are being done to normally read-only parts of the firmware, the firmware write protect will need to be removed for most of the script's functions. This is documented for each function below, and the script will likewise check and display the write-protect state for each function that requires it to be disabled.

IMPORTANT:

Due to recent changes in ChromeOS' security settings, a new set of commands must be used to run the Firmware Utility Script under ChromeOS. Running it under Linux can use the same old one-line command.
Also, you must execute these commands **as a normal/non-root user**. Running them as root will break things.

To download and run this script under ChromeOS, from a terminal/shell type:
cd; curl -LO mrchromebox.tech/firmware-util.sh
sudo install -Dt /usr/local/bin -m 755 firmware-util.sh
sudo firmware-util.sh
and press enter. (copy/paste these to avoid typos)

To download and run this script under Linux, from a terminal/shell type:
cd; curl -LO mrchromebox.tech/firmware-util.sh && sudo bash firmware-util.sh
and press enter.

If you encounter certificate related errors when downloading the script from ChromeOS, then add -k to the curl command and script command to bypass SSL certificate checking as so:
cd; curl -LOk mrchromebox.tech/firmware-util.sh
sudo install -Dt /usr/local/bin -m 755 firmware-util.sh
sudo firmware-util.sh -k

NOTE: Under ChromeOS, this script must be run from a crosh shell (CTRL+ALT+T, 'shell', enter) or VT2 (CTRL+ALT+F2, login 'chronos'); it cannot be run from a crostini (penguin) terminal as that is a virtualized container and lacks the necessary access to read or modify the firmware.

Firmware Utility Script, on device with stock firmware and WP enabled

Firmware Utility Script, on device with stock firmware and WP disabled

Firmware Utility Script, on device with Full ROM firmware and WP disabled

In the screenshots above, only the script functions available for the device and current firmware are enabled (cyan text); unavailable functions are in grey. Features which require the firmware WP to be disabled are clearly labeled as such, along with the ability of that function to be used based on the current WP state.

Script Functions Explained

• Install/Update the RW_LEGACY Firmware

  This option performs two simple tasks: it sets the crossystem boot flag necessary to enable Legacy Boot mode, and it installs an RW_LEGACY firmware update appropriate for the device. Users will have the option to set the default boot device (internal storage [default] or USB/SD); Haswell/Broadwell Chromebox users will also have the option to enable "headless" (no display attached) booting, which is really only useful if you're going to run the box without a display and connect remotely (eg, via ssh). Changing either of these options requires re-running this script function.

  After updating the RW_LEGACY firmware, Legacy Boot Mode can be accessed via [CTRL+L] on the Developer Mode boot screen. It can also be set as the default by changing the GBB Flags via 'Set Boot Options' feature below.

  Supported Devices: All Haswell, Broadwell, and Baytrail, Braswell, Skylake, ApolloLake, Kabylake, Whiskeylake, Jasperlake, and Picasso/Dali (Zen2) ChromeOS devices, Cometlake Chromeboxes, plus the Chromebook Pixel 2013

  Requires firmware write-protect disabled: NO



• Install/Update UEFI (Full ROM) Firmware

  As this is a full replacement firmware, the script will offer users the option to back up their stock firmware on USB (required if the script is not capable of providing a stock firmware image).

  As Chromeboxes store their Ethernet MAC address in the RO_VPD (read-only vital product data) region of the stock firmware, the script will extract that region from the stock firmware and inject it into the new firmware ensuring the unique MAC address isn't lost. It will also persist the VPD region across firmware updates, so this is all transparent to the user.

  After installing the UEFI (Full ROM) Firmware, your device will boot directly in UEFI Mode; ChromeOS will not be able boot. Your ChromeOS device is now a "regular PC," and you can install the OS of your choice without any special instructions.

  Supported Devices: All SandyBridge, IvyBridge, Haswell, Broadwell, Baytrail, Braswell, Skylake, Kabylake, Cometlake, and AMD StoneyRidge ChromeOS devices

  Requires firmware write-protect disabled: YES



• Set Boot Options (GBB Flags)

  This script function allows one to change the timeout for the Developer Mode boot screen (2s or 30s) and the default boot target (ChromeOS or Legacy Boot Mode). Setting the boot target to Legacy Boot removes the requirement of pressing [CTRL+L] at boot; instead, you must press [CTRL+D] to boot ChromeOS. This function is just a wrapper around the gbb_utility application built into ChromeOS that will read the GBB region from the stock firmware, set the GBB flags based on user input, and write it back to flash. For all options except 'Factory Default,' the GBB flags will also be set to force-enable legacy booting (GBB_FLAG_FORCE_DEV_BOOT_LEGACY), which overrides the crosssytem dev_boot_legacy flag, and to force-enable Developer Mode (GBB_FLAG_FORCE_DEV_SWITCH_ON), which prevents exiting Developer Mode via the spacebar (either accidentially or intentionally).

  Regardless of which default boot mode is selected, one can always override the default via keystroke: [CTRL+D] for ChromeOS Developer Mode, or [CTRL+L] for Legacy Boot Mode.

  Note: Whenever the GBB Flags are set to anything besides the Factory Default, their current value will be displayed in a small black box in the upper-left corner of the Developer Mode boot screen, along with other some other firmware/OS-related info. This is normal and no cause for alarm, though you'll need to re-run the script and reset them to the Factory Default before exiting Developer Mode (should you want to do so).

  After setting the Boot Options / GBB flags, the boot timeout and default OS will be whatever you selected, and can be changed at any time by re-running this script function.

  Supported Devices: All ChromeOS devices running stock (or stock + RW_LEGACY) firmware

  Requires firmware write-protect disabled: YES



• Set Hardware ID (HWID)

  This script function is also just a wrapper around the gbb_utility application built into ChromeOS. It will read the GBB region from the stock firmware, set the HWID based on user input, and write it back to flash. The only time this function is needed is if one flashed a generic recovery image firmware (aka a shellball ROM) from a source *other than this script* instead of restoring a backup of their own device firmware. Shellball ROMs extracted from a recovery image (or obtained from other sites/sources) have a generic HWID embedded which ChromeOS does not recognize as valid for purposes of OS and firmware updates (among other things), so it's necessary to set a valid one. HWIDs aren't unique, so any valid one will do.

  Note: If you restored your stock firmware using the option from this script, it is not necesary to set the HWID afterward.

  After setting a valid HWID, simply reboot and ChromeOS updates should work normally.

  Supported Devices: All ChromeOS devices running stock (or stock + RW_LEGACY) firmware

  Requires firmware write-protect disabled: YES



• Remove ChromeOS Bitmaps

  This function removes the ChromeOS bitmap (image) files used to display the Developer Mode and Recovery boot screens, leaving you with a simple black screen with white terminal text -- much easier on the eyes, esp when booting in a darkened environment.

    becomes  

  Note: ChromeOS updates might occasionally restore the missing bitmaps, so if you're still running ChromeOS you may need to re-run this function as needed.

  Credit to Joshua Stein for bringing this to my attention via his blog which I stumbled upon somehow.

  Supported Devices: All pre-Skylake/pre-ApolloLake ChromeOS devices running stock (or stock + RW_LEGACY) firmware

  Requires firmware write-protect disabled: YES



• Restore ChromeOS Bitmaps

  This script function reverses the function above :)

  Supported Devices: All pre-Skylake/pre-ApolloLake ChromeOS devices running stock (or stock + RW_LEGACY) firmware

  Requires firmware write-protect disabled: YES



• Restore Stock BOOT_STUB

  This script function will restore the stock BOOT_STUB for any device running a modified BOOT_STUB firmware. It will first attempt to use the built-in backup created by this script, and failing that, will download the firmware from a recovery image (a shellball ROM) and extract the stock BOOT_STUB from that. This option is only displayed on devices running BOOT_STUB firmware.

  After restoring the stock BOOT_STUB, you will need to reboot and reinstall ChromeOS from the recovery media. You can also install the RW_LEGACY firmware if you're switching to it for some reason.

  Supported Devices: All Haswell, Broadwell, and Baytrail ChromeOS devices running modified BOOT_STUB firmware (whether installed from this script or another)

  Requires firmware write-protect disabled: YES



• Restore Stock Firmware

  This script function will restore the stock firmware, preferably from a backed-up copy on USB. For most devices, if a user-provided backup is not available, the script will download the firmware from a recovery image (a shellball ROM). For Chromeboxes, if the current fimware contains an embedded VPD region, it will be extracted and merged before flashing. These (device-specific) shellball ROMs have been modified to include a valid hardware ID (HWID), so ChromeOS updates will work normally. Support for flashing shellball ROMs for additional devices is planned for the near future.

  After restoring the stock firmware, you will need to reboot and reinstall ChromeOS from the recovery media. After booting ChromeOS, you will need to re-run this script and reset the Boot Flags/GBB Flags in order to exit Developer Mode and fully return to stock.

  Supported Devices: All ChromeOS devices running non-stock firmware (shellball ROMs provided for all SandyBridge, Ivy Bridge, Haswell, Broadwell, Baytrail, Braswell, and Skylake devices)

  Requires firmware write-protect disabled: YES

The Reboot and Power Off options are (hopefully) sufficiently self-explanitory :)

If running UEFI Full ROM firmware, there will be an additional option to clear the NVRAM. This will delete all bootorder entries stored in NVRAM, and they will be created again on the next boot (or next time grub is updated).

The source for the Firmware Utility Script (as well as all helper/accessory scripts) can be found on my 'scripts' github repository. Any issues, feature requests, and/or improvements can be reported via the issue tracker or a pull request.

How to Run Google Chrome OS From a USB Drive

You don’t need to buy a Chromebook to enjoy the features of Google’s desktop operating system (OS). In fact, all you need is a working computer and a USB Drive.

Google doesn’t officially offer a way to try it out, but developers have figured out ways for you to experiment with the open-source OS. This method works whether you are running Windows, macOS, or Linux. And no, you won’t be overwriting your existing OS.

Here’s what you need to know.

Running Chrome OS from USB

We will basically create a bootable USB drive, loaded with the Chromium OS disk image. But you will need a few things before you start.

• a working computer with a USB port
• a USB drive of at least 4 GB capacity
• a 7-Zip extractor: 7-Zip for Windows | Keka for macOS | p7zip for Linux
• Etcher image burner for Windows, macOS, or Linux

Note: The USB drive will be completely erased in the installation process. If you have any valuable data on the drive, please save it elsewhere.

Step 1: Download the Latest Chromium OS image

Google doesn’t have an official Chromium OS build that you can download. The best alternative source is Arnold The Bat.

Download: The latest Chromium OS daily build

Step 2: Extract the Zipped Image

You will now have a 7-Zip file on your hard drive. Extract this file using one of the 7-Zip apps mentioned above.

Step 3: Format the USB Drive

Plug the USB drive into a port and format it as FAT32. The process is simplest on Windows, but macOS and Linux aren’t difficult either.

For mac OS users, the built-in Disk Utility can format it as FAT32. If you see it labeled as “MS-DOS FAT” instead, don’t worry, it’s the same thing.

If the Windows or Mac methods are confusing or overwhelming for you, then you can also use the SD Association’s official Card Formatter apps.

Download: SD Card Formatter for Windows (Free) or for Mac (Free)

For Linux users, we recommend the GParted app. If you’re comfortable with the shell / Terminal commands, use our guide on formatting external storage on Linux.

Download: GParted for Linux

For added comfort, when asked to name the new drive, give it the name “Chrome”.

Step 4: Download and Install Etcher

There are plenty of software tools to install images to external drives, but we reckon Etcher is the best of them. It’s cross-platform, which means it works the same way on Windows, macOS, or any Linux distro. More importantly, it validates the burning process i.e. once it’s done creating the image on the USB drive, it will verify that everything is right.

Download: Etcher for Windows, Mac, or Linux (Free)

Step 5: Run Etcher and Install the Image

By now, you should have a fully formatted USB drive, named “Chrome”, plugged into one port of the computer (as shown in step three). You will also have an unzipped image file of the latest Chromium OS (as shown in steps one and two). And you have Etcher installed on your computer (as shown in step four). Start Etcher.

1. Click Select Image and browse to where the Chromium OS image file is. Add it in Etcher.
2. Click Select Drive and choose the Chrome USB Drive you have created.
3. Click Flash to begin the process of installing the image and validating the installation.

Once Etcher finishes, this will be a bootable USB drive with Chromium OS.

Step 6: Reboot Your Computer and Enter Boot Options

“Boot” is the process of choosing the OS. Every computer lets you select which drive it should boot the OS from, whether it’s a hard drive, a USB drive, or even a DVD drive.

For a Windows or Linux PC: Different computers have different BIOS settings. Usually, the Boot Options menu has the keyboard shortcut F5, F8, or F12. If you’re unsure, you can enter the BIOS settings of your PC.

For a Mac: As soon the Mac shuts down and restarts, press and hold the Option key. You will be doing this while it’s a black screen, but that’s okay. Keep holding it till you see the boot menu, which lets you choose between a Macintosh hard drive or the USB drive you have plugged in (usually denoted as “EFI”).

Step 7: Boot Into Chrome OS

Choose the USB drive in the boot menu, hit enter, and the computer will boot from the drive. You are now experiencing all the glory of Chrome OS, without affecting your main hard drive and OS. You won’t have any trouble, it’s simple enough that Chromebooks are ideal for elderly people or as a first computer for kids.

Don’t worry, this setup is only during the first time you boot up. Whenever you run it in the future, it will go directly to the login screen.

Do You Run any OS From a USB?

The idea of running an operating system from a USB drive has some merit. After all, you’re basically carrying your PC with you, and are ready to turn any computer into your own.

But is that convenience worth using an OS on a USB stick regularly? Do you run any operating system from a USB drive? Would you rather run Chrome OS from a computer?

Installing Ubuntu on your Chromebook

Installing Ubuntu on your Chromebook

1. Overview

Today we'll be installing Ubuntu on your Chromebook, while preserving your original ChromeOS system.

We will use a third-party script called crouton to install Ubuntu using a chroot, giving Ubuntu its own "pretend" root directory system on your machine. This lets you run ChromeOS and Ubuntu side-by-side, being able to flip between the two on-the-fly.

What you'll learn

• How to put your Chromebook into developer mode
• How to install Ubuntu in a chroot on it
• Practical and entertaining uses for Ubuntu on Chromebooks

What you'll need

• A Chromebook (Intel/ARM CPU)
• Some basic command-line knowledge
• At least 1 GB of free storage space

crouton is not part of the Ubuntu project
While we love the value that crouton provides, please note that crouton is a third-party script. It is not provided by nor supported by Canonical nor by the Ubuntu project. Use of crouton is at your own risk.

NVidia Tegra CPUs
The Tegra CPU needs additional drivers not covered in this tutorial. We will add a tutorial covering this in the future (or why not contribute one?).

2. Enabling Developer Mode

By default, Chromebooks don't allow us to use chroots out-of-the-box. We will need to put our machine into Developer Mode to grant us this power.

Before Getting Started
Placing your device into Developer Mode will wipe all data and user information from it. Since ChromeOS is an online-centric operating system, the vast majority of your data will be stored remotely, but make sure you've backed up everything important that's local to your machine before you begin. This could include important data like any files you've downloaded, or locally cached passwords.
The use of Developer Mode may void your Chromebook's warranty.

To get to Developer Mode, we need to first reboot into Recovery Mode. On most Chromebooks, you do so by turning the device off, then holding down the ESC and Refresh keys while you press the Power button.

Once in this mode, press Ctrl-D. You will be prompted with an opportunity to "turn OS verification OFF". Press Enter to do so.

When you boot up your Chromebook, it will begin with a warning screen noting that "OS verification is OFF". You will need to press Ctrl-D to continue. Your device will now transition to Developer Mode.

Every boot thereafter will also begin with that warning screen, and a need to press Ctrl-D to continue. Do not follow the onscreen instructions to turn OS verification on, or you risk wiping your machine's data and turning Developer Mode off.

3. Installing Ubuntu with crouton

Empowered with Developer Mode, we will download the crouton script at this link.

Then we will open up a shell by pressing Ctrl-Alt-T, and then typing shell. Now we have a full bash shell at our fingertips.

For a simple setup, we're going to type sudo sh ~/Downloads/crouton -t unity. This will download the Ubuntu 16.04 packages with the default Unity desktop environment.

You'll see your terminal processing these packages one by one. This will take some time, so feel free to browse the web on ChromeOS, have a snack, or browse the web while having a snack.

Alternative Installation Options
Depending on the specification of your device, the Unity desktop may be too demanding to work well for you. If you want a more lightweight system, you can install LXDE or XFCE by replacing -t unity with -t lxde or -t xfce. GNOME fans can also try -t gnome instead.
You can also encrypt your chroot with a passphrase by adding -e to the end of the installation command before excuting it. This will require that you type in the encryption password you've chosen each time you enter the chroot environment.

4. Switching between OSes

With the installation complete, you will be prompted to enter a username and a password. You will then be brought into a bare-bones Ubuntu setup.

Pressing Ctrl-Alt-Shift-Back and Ctrl-Alt-Shift-Forward will rotate you between ChromeOS and Ubuntu. Logging out of Ubuntu will drop you back into the ChromeOS terminal tab that ran the system.

You can get back to Ubuntu in future sessions by typing sudo startunity into your bash shell.

5. Practical and fun uses for your system

Like playing games? sudo apt install steam in a terminal gets you Valve's Steam gaming client for Linux-based desktop gaming on your Chromebook. If you're not a previous Steam user, you'll need to register an account.

Enjoy irony? sudo apt install firefox. Have fun running Firefox on ChromeOS!

Want to browse for other ideas? sudo apt install gnome-software ubuntu-software gets you the Software tool for access to a wide variety of useful applications. Install LibreOffice for full office productivity, GIMP for desktop image editing, Audacity for audio editng, or Kodi for your multimedia enjoyment. If you're a developer, install your IDE of choice and hack away!

Really, practically anything you could run on a "real Ubuntu laptop" could be run here. Have fun!

6. Conclusion

Next steps

• The crouton project is active on GitHub. More documentation is available there to use the tool in additional ways.
• If you need support, Reddit's ChromeOS community at r/chromeos is helpful, with many crouton users active there.

Further readings

• Read more about the project on its GitHub page.
• Look up how to get your particular device into Developer Mode here.