I'm looking for Julius Werner...!!!

[Zsolt Furrier]

Please, if you're reading this, help me solve this problem...!

https://groups.google.com/a/chromium.org/g/chromium-os-dev/c/hN9_uR6MKac

[Dominik Behr]

You should recover it with official recovery image downloaded with recovery utility as described in the page you mentioned.

If the previous owner of the device (likely a school district) set no dev mode policy and then sold the device with the policy still applied it cannot be reset by Google or any third party (for obvious reasons).

Please contact the person/company who sold you this device to reset the policy by whoever has set it.

[Jack Rosenthal]

I'm not Julius, but if you reach out on the IRC channel, (#chromium-os on libera.chat), I'm happy to help you live debug it.

On Wed, Apr 5, 2023 at 10:44 AM 'Dominik Behr' via ChromiumOS Development <chromiu...@chromium.org> wrote:

You should recover it with official recovery image downloaded with recovery utility as described in the page you mentioned.

If the previous owner of the device (likely a school district) set no dev mode policy and then sold the device with the policy still applied it cannot be reset by Google or any third party (for obvious reasons).

Please contact the person/company who sold you this device to reset the policy by whoever has set it.

If you read the original thread, you'll notice this device came with UEFI firmware installed and they're trying to restore it to chromiumos firmware... if that's the case, the block_devmode bit is not set from the seller, and reaching out to them wouldn't be useful.  I believe they just need to get a ChromiumOS image installed and pass the enterprise enrollment check for that to work out.

 

On Wednesday, April 5, 2023 at 3:58:05 AM UTC-7 Zsolt Furrier wrote:

Please, if you're reading this, help me solve this problem...!

https://groups.google.com/a/chromium.org/g/chromium-os-dev/c/hN9_uR6MKac

--
--
Chromium OS Developers mailing list: chromiu...@chromium.org
View archives, change email options, or unsubscribe:
https://groups.google.com/a/chromium.org/group/chromium-os-dev

[Zsolt Furrier]

The previous owner used it with Win11 and MrChromebox firmware...
There are no policies in this firmware...
I tried to recover from this state...
Here: https://groups.google.com/a/chromium.org/g/chromium-os-dev/c/4xEFP2drimg

It was the same problem and Julius knew the solution...
I'll write it here too...
I live in Hungary... Here the schools and company management systems are supported by Microsoft, so they don't use Chromebooks...

[Zsolt Furrier]

Thanks for helping me live, but I don't know this IRC thing...
If you could make the custom recovery image and upload it to me on some kind of file sharing, I would appreciate it...
Julius described the process here:
https://groups.google.com/a/chromium.org/g/chromium-os-dev/c/4xEFP2drimg

" 1. Use the Chrome OS recovery tool to create an official recovery USB
stick for your board (e.g. Hana).
2. Insert it into a Linux machine that has the Chromium OS SDK
installed. I'm going to assume you have the USB stick under /dev/sdc,
if not adjust the command line below.
3. Enter the Chromium OS SDK (with cros_sdk). This should put you in a
chroot where /usr/share/vboot/devkeys is available. (You may need to
run 'sudo emerge vboot_reference' once to make sure it's there.)
4. Run: sudo vbutil_kernel --repack /dev/sdc2 --keyblock
/usr/share/vboot/devkeys/recovery_kernel.keyblock --signprivate
/usr/share/vboot/devkeys/recovery_kernel_data_key.vbprivk --oldblob
/dev/sdc2
5. Unplug the USB stick, plug it into your Chromebook, and press
Esc+Refresh+Power to start recovery."

The difference is that I don't need a "HANA" but a "REKS" recovery image...

If you can help, please contact me at zs.fu...@gmail.com
Thanks in advance...!

[Jack Rosenthal]

I'm not sure you need to do all that... if you download a recovery image for reks, you should be able to extract the firmware from that image (mount it using mount_gpt_image.sh in the SDK, and extract /usr/sbin/chromeos-firmwareupdate, it's a zip archive).  Flash that and then booting the recovery image as usual should work fine.

[Zsolt Furrier]

O.K.
But...!
How will I flash...?

[Jack Rosenthal]

On Wed, Apr 5, 2023 at 3:26 PM Zsolt Furrier <zs.fu...@gmail.com> wrote:

O.K.
But...!
How will I flash...?

You obviously flashed the chromebook firmware somehow, right?  How did you do that.

For reks, since it doesn't support CCD, it's probably easiest to just clip onto the SPI flash chip and use an external programmer (e.g., ch341a, buspirate, or dediprog).

[Julius Werner]

Look ma, I'm famous!

The case in https://groups.google.com/a/chromium.org/g/chromium-os-dev/c/4xEFP2drimg
was very different from yours because the user there had reflashed
their Chromebook with developer keys, which meant normal recovery
images don't boot anymore. You don't have that problem, so you don't
need that complicated solution. Your Chromebook still has the official
firmware keys so a normal recovery image should just work for you
(here's the correct one for Reks:
https://dl.google.com/dl/edgedl/chromeos/recovery/chromeos_14816.131.0_reks_recovery_stable-channel_mp-v4.bin.zip
). If this doesn't work then post a video of the recovery process so
we can better understand why it's failing. Try pressing
Ctrl+Alt+Refresh(F3) or Ctrl+Alt+BackArrow(F2) in the recovery UI to
get more log output.

[Julius Werner]

Ohh... wait, I think I understand the problem. So are you saying that
you can run a recovery image, and it seems to run successfully, but
then after the reboot you still get the "device owner has disabled
Developer Mode" screen and get stuck in a reboot loop?

Okay, that's because your device is force-enrolled but your GBB flags
are stuck at 0x39. Wonder how you managed to get that...

Breaking out of force-enrollment is not allowed, so as a Google
employee I can't give you instructions on how to do it. People keep
finding new tricks to unenroll their school laptops all the time and
we have to keep coming up with new ways to stop them. Only just
recently some high schoolers made this sh1mmer.me website that
distributes custom USB images for some Chromebooks (including Reks)
that can break them out of enrollment. That's not official Google code
and possibly not legal, so you should definitely not try to use that.

[Zsolt Furrier]

https://www.howtogeek.com/279308/how-to-restore-your-chromebooks-original-bios-and-software/

I did it as described... (Booted from USB with UEFI...)
But since I didn't have the original firmware backup, the script took the firmware from the internet, supposedly decrypted from the official recovery image, which caused this problem... :(

I don't have a USB programmer, and since one would cost more than the LenovoN22 Chromebook cost, I have no intention of buying one...

[Jack Rosenthal]

On Thu, Apr 6, 2023 at 1:48 AM Zsolt Furrier <zs.fu...@gmail.com> wrote:

https://www.howtogeek.com/279308/how-to-restore-your-chromebooks-original-bios-and-software/

I did it as described... (Booted from USB with UEFI...)
But since I didn't have the original firmware backup, the script took the firmware from the internet, supposedly decrypted from the official recovery image, which caused this problem... :(

Well the recovery images aren't encrypted... :/

I guess you can prevent yourself from ending up in this scenario again by extracting it yourself.

 

I don't have a USB programmer, and since one would cost more than the LenovoN22 Chromebook cost, I have no intention of buying one...

A ch341a is only $3.25 on AliExpress (I can't make any guarantees of the quality of this product listing... there are some knock off ch341a's out there that'll eat your flash chip with too many volts... check the voltage of the spi lines before using it).

[Zsolt Furrier]

Thank you Julius...!
I knew you would be the key to solving the problem...

Maybe there is some trick to update the OS to the current version...?
Or should I use ChromeOS Flex as an alternative...?
Can Flex be installed on a machine with original Chromebook firmware...?

[Julius Werner]

> Maybe there is some trick to update the OS to the current version...?
> Or should I use ChromeOS Flex as an alternative...?
> Can Flex be installed on a machine with original Chromebook firmware...?
> Julius Werner a következőt írta (2023. április 6., csütörtök, 0:08:42 UTC+2):

The OS is at the correct version. You can't install anything else
because you can't boot (right?). Your problem is that your device has
a setting (VPD flag block_devmode=1) stuck that tells it that it is an
enterprise-managed device that is not allowed to be in developer mode,
and another setting (GBB flag 0x39) that tells it it must always be in
developer mode. That is why the OS doesn't allow you to boot (it's
always trying to reboot to disable developer mode, but if developer
mode is forced by a GBB flag it cannot be disabled like this). These
two settings are never supposed to be enabled together, but since
someone removed the firmware write protection and installed unofficial
firmware on the device they got it into an inconsistent state.

Once you manage to boot something that gives you a shell on the board,
you should be able to easily solve the situation by running either
`vpd -i RW_VPD -s block_devmode=0` or
`/usr/share/vboot/bin/set_gbb_flags.sh 0` (or, if neither of those
utilities are available, `flashrom -i RW_VPD -E` should also do the
trick). Your should be able to boot a correctly formatted USB stick
with Ctrl+U, you just need to find one (an official recovery image
doesn't help with this because it doesn't give you a shell). You can
probably find some unofficial image that would work for this on the
internet but I can't help you with that. Or you could install the SDK
and build a test image from source.

[Zsolt Furrier]

[Zsolt Furrier]

Julius Werner a következőt írta (2023. április 7., péntek, 21:29:12 UTC+2):

[Zsolt Furrier]

Julius Werner a következőt írta (2023. április 7., péntek, 21:29:12 UTC+2):

[Zsolt Furrier]

Julius Werner a következőt írta (2023. április 7., péntek, 21:29:12 UTC+2):

[Zsolt Furrier]

It can be updated to the latest version using some trick, which I know is 111...?
Or can I install a newer version only from ChromeOS Flex...?
If only from ChromeOS Flex, is it possible to somehow install ChromeOS Flex with the original firmware of the chromebook...?

Julius Werner a következőt írta (2023. április 7., péntek, 21:29:12 UTC+2):

[Julius Werner]

> It can be updated to the latest version using some trick, which I know is 111...?
> Or can I install a newer version only from ChromeOS Flex...?
> If only from ChromeOS Flex, is it possible to somehow install ChromeOS Flex with the original firmware of the chromebook...?

We no longer ship updates to the Reks Chromebook model. Version 103 is
the last ChromeOS release that is available for it. You can find a
list of dates how long we will ship updates to each kind of Chromebook
here: https://support.google.com/chrome/a/answer/6220366?hl=en

There is no official way to install ChromeOS Flex on an old Chromebook
-- there may be unofficial guides about how to do it on the internet
but it's probably not easy, and even if you succeed not all parts of
your device may be fully supported.

[Zsolt Furrier]

According to ChromeOS Flex Help, the LenovoN22 is "certified" and supported until 2027...
The question is, do you absolutely need an alternative UEFI firmware to install it, or can it be installed on the chromebook's original firmware if I set it to boot from USB...?

Or should I try LaCrOS...?

[Julius Werner]

> According to ChromeOS Flex Help, the LenovoN22 is "certified" and supported until 2027...

I believe there's a difference between the "Lenovo N22" (a windows
laptop) and the "Lenovo N22 Chromebook". Flex is certified for the
former, not the latter. There is no official way to run Flex on a
Chromebook at this time. (As for what you can hack up unofficially and
how well you could get that to work, I do not know.)

Lacros is something internal to ChromeOS and not yet supported in the
last version released for Reks, so it cannot help you here.

[Zsolt Furrier]

Hi Julius...!
I put the mrchromebox coreboot firmware back on the machine and installed ChromeOs Flex...
I had 2 problems with it that I don't know how to solve...
1. No sound...
2. "Your Chromebook has been locked due to a known issue. You can log in again after this amount of time: x hours x minutes x seconds. During this time, your Chromebook must remain on and connected to a power source. Make sure that the charger and adapter cables are fully connected should be for both the chromebook and the outlet. Do not turn off the chromebook." - message on login screen...
Thank you in advance for your answer...!

[Julius Werner]

These sound like issues specific to Flex that I can't help you with,
sorry. I only know firmware.

[Zsolt Furrier]

Do you know anything about whether the OS kernel is being updated...?
It currently has Linux kernel 5.10 under it, even though the last stable kernel version is 6.3.3...

[Nicholas Bishop]

ChromeOS Flex just switched from 5.10 to 5.15 in the 115 release. If
you're on an earlier release, the 5.10 kernel is expected.

> --
> --
> Chromium OS Developers mailing list: chromiu...@chromium.org
> View archives, change email options, or unsubscribe:
> https://groups.google.com/a/chromium.org/group/chromium-os-dev
> ---

> To unsubscribe from this group and stop receiving emails from it, send an email to chromium-os-d...@chromium.org.

[Zsolt Furrier]

how can i get it...?

[Nicholas Bishop]

115 hasn't been released yet. See
https://chromiumdash.appspot.com/schedule for the schedule. So you'd
have to build it yourself to get a 115 build.