What you will need for this exploit
- A USB drive or SD card; with at least 8 GB of storage that is required for booting into SH1MMER
- A personal computer or Chromebook; note that you need administrator permissions on Windows/MacOS
Flashing a USB drive
First, you'll need to find your Chromebook's board name. This can be done by going to chrome://version on your Chromebook and copying the word after stable-channel, or with a variety of other methods.
If your board name is in the list below, your board has a publicly leaked RMA shim, duh. If it's not, you'll have to source it on your own... somehow.
ambassador, banon, brask, brya, clapper, coral, corsola, cyan, dedede, edgar, elm, enguarde, fizz, glimmer, grunt, hana, hatch, jacuzzi, kalista, kefka, kukui, lulu, nami, nissa, octopus, orco, puff, pyro, reef, reks, relm, sand, sentry, stout, strongbad, tidus, trogdor, ultima, volteer, zorkFirst you need to download a SH1MMER bin at dl.sasquatch9228.dev (or any other source), since the original domain; dl.sh1mmer.me was taken down by Google beacuse of legal reasons.
Then build an injected shim using your bin at the
SH1MMER Web Builder
You can also use the desktop version of wax for linux/WSL, located in the
GitHub repository.
Once you've obtained a MODIFIED/INJECTED SHIM (NOT A RAW SHIM), you can continue.
Download the Chromebook Recovery Utility extension on your personal computer as well.
Once the downloads are complete, launch the recovery utility and plug your USB drive into your personal computer.
IMPORTANT NOTE: Your USB drive will be completely erased and partitioned.In the recovery utility window, click the settings icon (⚙) and press "Use local image".
Select your shim file, identify your USB drive, and start the writing process. This can take anywhere between 30 seconds and 20 minutes, depending on the speed of your USB drive.
You can also use a tool such as Rufus, BalenaEtcher, or Win32DiskImager to flash on Windows, as these often work better than the Chromebook Recovery Utility. If you're on Linux, dd is recommended.Executing on Chromebook
Once writing is complete, enter recovery mode on your Chromebook. This is done by pressing the power button (⏻), reload key (↻), and ESC key at the same time. Your screen should look one of the images below:
Press CTRL + D on this screen, then press enter.
It will now say something about "confirm returning to secure mode" or that "OS verification is off". You will not actually be in the developer mode, but the exploit will work regardless. Your screen should now look like one of the images below:
On this screen, press the power button (⏻), reload key (↻), and ESC key at the same time again! This step is very important and cannot be skipped.
Once it re-shows the original recovery screen, plug your shimmed USB drive into your Chromebook. After a brief black-and-white loading screen, you should be in the SH1MMER menu.
Play around with the UI, exit, and reboot.
What now?
You will now be able to, among other things, unenroll your Chromebook. It will now behave entirely as if it is a personal computer and no longer contain spyware or blocker extensions. After you do this and get past the "determining device configuration" screen, you will be able to actually turn developer mode on.
Note that while unenrolled, it is recommended to add your personal account first, then add your school account, then switch between the two as needed. Mercury Workshop does not condone the use of SH1MMER or unenrolling to cheat or plagiarize in school.
The biggest challenges with unenrolling are connecting to the school network and taking state or national exams (since there are no kiosk apps anymore).
There are many methods to get a school Wi-Fi password while enrolled, including the policy netlog trick. While on a school account and unenrolled, you can bypass some network-level blocks by using a secure DNS such as Cloudflare 1.1.1.1 from chrome://os-settings/osPrivacy. It is also recommended to enable "MAC Address Randomization" in chrome://flags to stay hidden.
To take a kiosk exam, the safest option is to re-enroll temporarily. Instructions for doing that are hosted here: Kiosk Instructions, or alternatively, the original text file (for local copies): Kiosks.txt Saving a copy of this text file for future reference is probably a smart move to do.
You can also use fakemurk as a way to enroll your device but stay in developer mode and have control over policies and extensions. You may need to use this to get Wi-Fi passwords if chrome://net-export is blocked.
The Fog...
(Google's response, and why this might not be working for you)
Downgrading and unenrollment has been patched* by google. If your chromebook has never updated to version 112 before (check in chrome://version), then you can ignore this and follow the normal instructions. If not, unenrollment will not work as normal.
If you aren't willing to take apart your chromebook to unenroll, you can use an affiliated project, E-HALCYON to boot into a deprovisioned environment temporarily.
How to use the SH1MMER exploit on version 111 → version 113
(if you're willing to take the back cover off your Chromebook)
You only need to do this once, and it will let you use the SH1MMER exploit even after it's been completely patched.
Instructions on how to do this:
1. Unplug everything, open the back panel, disconnect the battery to disable Write Protection, plug in the charger.
2. Boot into SH1MMER and use "Un-Enroll / Deprovision" (yes it will show an error, but that doesn't matter) (you will also need to run "Disable block_devmode" if you are using the old legacy version).
3. Go to the bash shell and run this command: /usr/share/vboot/bin/set_gbb_flags.sh 0x8090. Do not use "Reset GBB Flags" after this.
4. Exit SH1MMER, unplug everything, reconnect the battery, and reconnect the charger.
5. Boot up and press CTRL + D to enter the ChromeOS developer mode.
6. When this step is completed, use CTRL + ALT + SHIFT + R to powerwash the Chromebook.
7. After powerwashing the Chromebook, immediately enter VT2 with CTRL + ALT + F2 (→), login as "root" and run these two commands:
tpm_manager_client take_ownership cryptohome --action=remove_firmware_management_parameters
If it fails, try downgrading to version 110 if possible. If you cannot do so, use E-Halcyon instead.
8. Press CTRL + ALT + F1 (←), and use CTRL + ALT + SHIFT + R to powerwash the Chromebook once more.
IMPORTANT NOTE: If you have a dedede board, your Write Protection method is probably different. Look your model up online to find the WP method.
This just is a shortened version of the instructions for the Unpatch section, duh. If you want the full instructions, go the the section linked below.
If you are willing to take apart your Chromebook to unenroll, then go to the guides
here: Unpatch and Unfog.
Also, see Darkn's great blog post here for the "pencil exploit".