Downgrading with kernver ending in 3

[HittingSparks]

So, the other day, I was experimenting a bit with the prebuilt images of E-Halcyon, made by Darkn and, idk if this was ever documented before, but I discovered a few things:

1. When we don't have os verification and enrollment, we can downgrade to any version we like, it's just that the chromebook doesn't like it (It shows the Chrome OS is damaged screen), if the device isn't in dev mode.
2. With something such as shimboot, we can load Chrome OS, even if the chromebook is showing the Chrome OS is damaged screen. We boot shimboot the same way we would do it normally.
   With this, can we downgrade to a lower version (such as 119) and do cryptosmite? I have already booted into chrome os 116 using this method, but I just couldn't do the last part (the powerwash step). I may do a step by step guide, if this is too confusing.

[s0urce-c0de]

Interesting! I don't have a chromebook (school took ours away for summer break) so I can't test, but try shimboot with a recovery image. After booting and recovering, try entering developer mode and then rebooting. I would suggest trying a recovery image for v112.0.5615.134 (Platform version: 15359.58.0). So it overwrites kernver (This is the update when it changes from kernver 1 to 2). If you give me your board, I can try to get you a recovery image link. (Find it on chrome://version)

[HittingSparks]

Ok, so after shimbooting it, it just enrolls again, no error or anything, just enrolls as if I done nothing

[s0urce-c0de]

I was checking if we could potentially get a different channel on our chromebooks, but the latest beta recovery image is v120 😭. There are no devmode/canary recovery images.

[s0urce-c0de]

Just a question, do you have devtools (inspect element) with shimboot, and does Pollen work?

[HittingSparks]

I will see, I just will have to do it tomorrow, since my friends windows installation broke, so the sd card is with him now. I also don't really have a spare flash drive that has enough capacity. Btw, I have the inspect element even on enrolled chrome os

[s0urce-c0de]

... your school it stupid. Why would they allow INSPECT ELEMENT of all things? it is 3rd most sought after in exploits to get it.

1. Dev Mode
2. Unblocked Browsing
3. INSPECT ELEMENT
   Also i got a discord. My username is s0urce_c0de. It used to be deleteduser09398. Anyways, I probably won't check it, but feel free to contact me on discord.

[HittingSparks]

Nah, nothing, just problems with extracting the image. Btw, I use a recovery image and then i patch it through the builder, right?

[s0urce-c0de]

Can you also try this @HittingSparks

[HittingSparks]

Everything seems to be fine, no errors or anything in the builder. I will flash it and test afterwards, but I think everything will work

[s0urce-c0de]

K

[HittingSparks]

Well, I could boot and everything, but the actual kernel switching I coudn't do, it just gave an error. Well, I guess there's no KVS for me then

[s0urce-c0de]

:(

[PluckybandYT]

Hey I see in the post that you managed to rollback? if you can id love it if you can provide me the details on how you achieved this

[PluckybandYT]

Before I go the version is 123 so idk if it would help but just to put it out there

[s0urce-c0de]

can you check above?
i don't have much spare time.

[PluckybandYT]

Alright I will thank you

[s0urce-c0de]

i if i remember correctly it goes along the lines of:

• boot a old recovery image like you boot a shim
• restart once it completes
• use shimboot to boot into chrome os.

[Raka-Mahendra]

i if i remember correctly it goes along the lines of:

• boot a old recovery image like you boot a shim
• restart once it completes
• use shimboot to boot into chrome os.

how to boot into chrome os using shimboot?

[kxtzownsu]

2. can we downgrade to a lower version (such as 119) and do cryptosmite?

no, you can't. shimboot runs in devmode recovery (dev=1 reco=1), which FWMP editing/deleting is blocked by the Cr50 / Ti50's TPM2 implementation. the reason you can edit FWMP in regular devmode is because its not recovery (dev=1 reco=0).

So, here are the modes you can edit FWMP in:
dev=0 reco=0 (regular verified mode)
dev=0 reco=1 (verified recovery mode, this is why BadRecovery/OlyBmmer works)
dev=1 reco=0 (regular developer mode)

[levi204]

Yo do you know anything best to remove Ext from new computers?

[mberry6341-a11y]

how do i do this with a Version 140.0.7339.201 (Official Build) (64-bit)

[thatboyo]

I believe their experiment didn't work, so dont get your hopes up, but i would recommend downgrading to 132 (assuming kernver5)

[levi204]

Does anyone know anything that can remove ext from newer Chromebooks