For anyone lacking a valid backup of their original Chrome OS firmware, I've constructed a ROM image with an invalid serial number from my C710-2847 (the launch model).
C710 Firmware.zip
I've included instructions on how to modify the image to match your actual device before you flash it, which I strongly recommend. I can't predict how Google functionality may be effected by an invalid serial number or the default firmware hardware ID.
Also, please note that these instructions may be specific for the C710-2847 so pay attention if you have another model. There's only one recovery image for the C710, so I'm confident the firmware will work on all models. But, you may need to change more than 8 digits of the serial number with other models, IDK.
[Edit] If you have a C710-842G32ii, then I recommend using the BIOS.BIN contained in the shellball (which is also included). For an explanation & discussion of the implications - see the comments below - specifically, my conversation with Schokobecher.
Showing posts with label Boot. Show all posts
Showing posts with label Boot. Show all posts
Wednesday, November 6, 2013
Monday, October 14, 2013
General Advice on Flashing Firmware
I guess relatively few people are as paranoid as I am, but given the ease and speed of flashing from CrOS or Linux on the C710 itself, I suggest the following process:
1. Before you flash an image, create a backup (BACKUP.BIN) of the current firmware and generate an md5sum for it.
2. Now, generate an md5sum for the image you're about to flash, let's say NEW_FW.BIN.
3. Flash the image.
4. Even if everything appears to go perfectly, create a backup of the firmware again, i.e. READBACK.BIN and either compare it to NEW_FW.BIN or (I prefer to) generate an md5sum for READBACK.BIN and compare the md5sums of the two.
This will allow you to revert to the state of the firmware before you started (with your BACKUP.BIN) and guarantee that the EEPROM now contains what you intended.
1. Before you flash an image, create a backup (BACKUP.BIN) of the current firmware and generate an md5sum for it.
2. Now, generate an md5sum for the image you're about to flash, let's say NEW_FW.BIN.
3. Flash the image.
4. Even if everything appears to go perfectly, create a backup of the firmware again, i.e. READBACK.BIN and either compare it to NEW_FW.BIN or (I prefer to) generate an md5sum for READBACK.BIN and compare the md5sums of the two.
This will allow you to revert to the state of the firmware before you started (with your BACKUP.BIN) and guarantee that the EEPROM now contains what you intended.
Friday, September 20, 2013
How To ... Turn a Brick back into a Chromebook!
As long as you have a valid backup of your original firmware, you can restore your C7 by following these instructions.
But, before you go any further, double check the contents of your backup at address 0x00001000 (like with a Hex Editor). If that byte contains 0xFF, then your backup is invalid and will brick your C7 again, so STOP! I will address this situation in another post soon.
OK now, first of all, you'll need the following gear:
1. A Bus Pirate
2. A Bus Pirate Probe cable
3. A Pomona 5250 SOIC Clip
Do not substitute the 3M part for the Pomona, as it won't work. The Bus Pirate is an inexpensive hacker's tool that can serve as an external chip programmer. It's supported by flashrom and although painfully slow, it does the job quite well. It all cost me ~$60 including shipping.
This presentation will provide a good step-by-step guide to disassembling your C7 to get access to the EEPROM which is on the top side of the motherboard (MB), under the keyboard. It looks like a horrible nightmare, but thanks to these guys, it really isn't too difficult. However, I do recommend disconnecting both the keyboard and the trackpad, their cables and connectors are too fragile to risk leaving connected, IMHO. I will admit that reconnecting them is a royal PITA, though.
https://docs.google.com/file/d/0Bzig09VSdjW1azRKaEtqZk5MZW8/edit?usp=sharing
Here's an ASCII diagram detailing how to connect the Bus Pirate (BP) to the C7's EEPROM.
TXT
PNG
On my MB, the chip is a Macronix MX25L6406E, but yours might differ. You should also be aware that there's more than one probe cable design and the color schemes vary. I'm using the Seeed Studio probe cable design. For more info on the BP, consult:
http://dangerousprototypes.com/docs/Bus_Pirate
For instructions on programming the EEPROM, consult this authority:
http://johnlewis.ie/unbricking-a-samsung-series-5-550-chromebook/
He's using a Samsung 550 Chromebook, but the procedure is the same. The C7's battery pack is, of course, removable. So, as long as the battery is disconnected, it's already "cut."
But, before you go any further, double check the contents of your backup at address 0x00001000 (like with a Hex Editor). If that byte contains 0xFF, then your backup is invalid and will brick your C7 again, so STOP! I will address this situation in another post soon.
OK now, first of all, you'll need the following gear:
1. A Bus Pirate
2. A Bus Pirate Probe cable
3. A Pomona 5250 SOIC Clip
Do not substitute the 3M part for the Pomona, as it won't work. The Bus Pirate is an inexpensive hacker's tool that can serve as an external chip programmer. It's supported by flashrom and although painfully slow, it does the job quite well. It all cost me ~$60 including shipping.
This presentation will provide a good step-by-step guide to disassembling your C7 to get access to the EEPROM which is on the top side of the motherboard (MB), under the keyboard. It looks like a horrible nightmare, but thanks to these guys, it really isn't too difficult. However, I do recommend disconnecting both the keyboard and the trackpad, their cables and connectors are too fragile to risk leaving connected, IMHO. I will admit that reconnecting them is a royal PITA, though.
https://docs.google.com/file/d/0Bzig09VSdjW1azRKaEtqZk5MZW8/edit?usp=sharing
Here's an ASCII diagram detailing how to connect the Bus Pirate (BP) to the C7's EEPROM.
PNG
On my MB, the chip is a Macronix MX25L6406E, but yours might differ. You should also be aware that there's more than one probe cable design and the color schemes vary. I'm using the Seeed Studio probe cable design. For more info on the BP, consult:
http://dangerousprototypes.com/docs/Bus_Pirate
For instructions on programming the EEPROM, consult this authority:
http://johnlewis.ie/unbricking-a-samsung-series-5-550-chromebook/
He's using a Samsung 550 Chromebook, but the procedure is the same. The C7's battery pack is, of course, removable. So, as long as the battery is disconnected, it's already "cut."
Sunday, September 8, 2013
C7 Default Firmware
I should also report that the default firmware for the C7 (contained in the recovery image) also has "the hack" enabled. Given the CrOS developers consistent refusal to help anyone bypass the 30 second delay at the scary boot screen, I'm guessing that this may have been how it was discovered.
One consequence of "the hack" is that with only a 1.5 second pause at the scary boot screen, it's rather difficult to boot from USB. It can still be done, but you've got to be quick.
One consequence of "the hack" is that with only a 1.5 second pause at the scary boot screen, it's rather difficult to boot from USB. It can still be done, but you've got to be quick.
Sunday, September 1, 2013
Death of a Chromebook
It's time for me to swallow my pride and admit that I killed my Chromebook. Oh, okay, so maybe it's not really dead, but it might as well be. I guess, technically speaking, it's in a persistant vegetative state - like a coma.
For those who don't yet know, there's a hack circulating the web that will supposedly allow you to shorten the 30 second delay at boot that comes with developer mode to 2-3 seconds with minimal risk of problems. You just have to flash the Read-only firmware. Well, verily, I say unto you, "Don't believe the pipe!" (RIP, Richard). It's a lie!
I wish to state for the record that I'm not exactly a noob at flashing EEPROMs. I've been flashing devices of some sort for probably 35 years and have never bricked anything that I couldn't recover ... until this Chromebook! I flashed the patched firmare and everything seemed to go perfectly. There was no indication of any sort of problem, so I rebooted and ... nada. It hasn't booted up since. It powers on and after 20 seconds or something, the fan kicks in, but thats all it ever does. Now, perhaps, you get the coma analogy. The light comes on, but there's nobody home.
So 2 weeks, $60 in gizmos and probably 120 hours of research and hacking later, all I can say is: Kids, don't try this at home! Please!!
For those who don't yet know, there's a hack circulating the web that will supposedly allow you to shorten the 30 second delay at boot that comes with developer mode to 2-3 seconds with minimal risk of problems. You just have to flash the Read-only firmware. Well, verily, I say unto you, "Don't believe the pipe!" (RIP, Richard). It's a lie!
I wish to state for the record that I'm not exactly a noob at flashing EEPROMs. I've been flashing devices of some sort for probably 35 years and have never bricked anything that I couldn't recover ... until this Chromebook! I flashed the patched firmare and everything seemed to go perfectly. There was no indication of any sort of problem, so I rebooted and ... nada. It hasn't booted up since. It powers on and after 20 seconds or something, the fan kicks in, but thats all it ever does. Now, perhaps, you get the coma analogy. The light comes on, but there's nobody home.
So 2 weeks, $60 in gizmos and probably 120 hours of research and hacking later, all I can say is: Kids, don't try this at home! Please!!
Thursday, August 1, 2013
USB Bootable Media Toolbox
First, let me acknowledge that this is not ready for prime-time! I have only tested it with 2GB, 4GB, 16GB & 32GB media, although theoretically, it should work for all bootable media 512MB and larger. It still contains the CrOS kernel from June 2013, because I haven't had time to debug the issues with the updated kernel. At this point, you will need access to another machine running Debian (or Ubuntu or their progeny) or a working ChrUbuntu install on your Chromebook. You'll still need another machine to install a distro on the media anyway, so I gave up on trying to eliminate this requirement.
The archive contains a "ReadMe.txt" with detailed instructions. In the end, you'll feel like you just did 16 cartwheels to move only a meter, but it works. Be aware that everything I have tried to streamline or clarify the process has failed to produce bootable media, so substitutions or shortcuts of any kind are definitely not recommended. Follow the instructions exactly, and you should end up with a piece of bootable media that you can install a Linux distro on. Without further ado, here's the download:
Toolbox
MD5
Once you have bootable media, but before you install a distro on it (Step 10), you can create a backup of the disk with gdiskdump (included) and then restore it to this condition easily in the future. Once a distro is running from USB, moving it to the HDD or SSD (say to to replace ChrUbuntu) is a relatively simple task.
The archive contains a "ReadMe.txt" with detailed instructions. In the end, you'll feel like you just did 16 cartwheels to move only a meter, but it works. Be aware that everything I have tried to streamline or clarify the process has failed to produce bootable media, so substitutions or shortcuts of any kind are definitely not recommended. Follow the instructions exactly, and you should end up with a piece of bootable media that you can install a Linux distro on. Without further ado, here's the download:
Toolbox
MD5
Once you have bootable media, but before you install a distro on it (Step 10), you can create a backup of the disk with gdiskdump (included) and then restore it to this condition easily in the future. Once a distro is running from USB, moving it to the HDD or SSD (say to to replace ChrUbuntu) is a relatively simple task.
Subscribe to:
Posts (Atom)