[Chromebooks] nabil2000:
config.txt & blobs...

Yes I know more or less all the topology of Chromium / Chrome OS layouts, vmlinuz, modules, etc - what was missing is how to tinker the blob as I found out this is what is booted from in vanilla real Chromium devices...

I now have a prepped USB with FydeOS 6.0 (Kernel 4.14.83) chromefied with Eve 71/Caroline 71 - will post some more gathering of forensics, check & compare between them, & maybe find out how they do it, so solve it eventually :)

Thanks for your insight about collecting config.txt using:

$ sudo dd if=/dev/sdb2 of=fydeos531.bin

$ vbutil_kernel --verify fydeos531.bin --verbose

Naming of files -

chronos@localhost ~/Downloads/CROS-blobs $ ls

blob67-fydeos-sdb2.img blob83-ATBv72-sdb2.img blob83-fydeos-sdb2.img C720P-sda2-blob.img config.txt make-blobs.txt vmlinuz-4.14.67 vmlinuz-4.14.83 vmlinuz-4.14.96-09859-ga5c3f2f0428a

I will soon compare the blobs, to hack config.txt, will list config for each blob...

Gathering resources for Chrome/Chromium OS Linux kernel blob P2 analysis -

https://twitter.com/inabster/status/1103419248146350080

Partitions / directories identified as kernel related (in command form)

$ cd ~/Downloads

$ mkdir efi

$ sudo mount /dev/sdb12 efi

$ cd efi/syslinux

$ ls

default.cfg ldlinux.c32 ldlinux.sys README root.A.cfg root.B.cfg syslinux.cfg usb.A.cfg vmlinuz.A vmlinuz.B

$ cd /lib/modules

$ ls

4.14.67 4.14.83

$ cd /boot

$ ls

efi syslinux vmlinuz vmlinuz-4.14.67 vmlinuz-4.14.83

$ cd ~/Downloads

$ sudo umount efi

Blob /dev/sdb2 contains signed version of kernel in blob form...

-----------------

List of blob images -

$ vbutil_kernel --verify blob67-fydeos-sdb2.img --verbose

Key block:

Signature: ignored

Size: 0xcb8

Flags: 11 !DEV DEV REC

Data key algorithm: 11 RSA8192 SHA512

Data key version: 1

Data key sha1sum: e78ce746a037837155388a1096212ded04fb86eb

Preamble:

Size: 0xf348

Header version: 2.2

Kernel version: 1

Body load address: 0x100000

Body size: 0x71d400

Bootloader address: 0x816000

Bootloader size: 0x4000

Vmlinuz header address: 0x81a000

Vmlinuz header size: 0x3400

Flags : 0x0

Body verification succeeded.

Config:

console= loglevel=7 init=/sbin/init cros_secure oops=panic panic=-1 root=PARTUUID=%U/PARTNROFF=1 rootwait ro dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=0 dm="1 vroot none ro 1,0 5087232 verity payload=ROOT_DEV hashtree=HASH_DEV hashstart=5087232 alg=sha1 root_hexdigest=7b45dc47af17d4869598148973256b221a133c2c salt=ecac7c3af20fb070704c00595a2a8350465d3dd84dd73aa246de0dd17e82f1e2" noinitrd cros_debug vt.global_cursor_default=0 kern_guid=%U add_efi_memmap boot=local noresume noswap i915.modeset=1 tpm_tis.force=1 tpm_tis.interrupts=0 nmi_watchdog=panic,lapic

-----------------

$ vbutil_kernel --verify blob83-fydeos-sdb2.img --verbose

Key block:

Signature: ignored

Size: 0xcb8

Flags: 11 !DEV DEV REC

Data key algorithm: 11 RSA8192 SHA512

Data key version: 1

Data key sha1sum: e78ce746a037837155388a1096212ded04fb86eb

Preamble:

Size: 0xf348

Header version: 2.2

Kernel version: 1

Body load address: 0x100000

Body size: 0x7a9400

Bootloader address: 0x8a2000

Bootloader size: 0x4000

Vmlinuz header address: 0x8a6000

Vmlinuz header size: 0x3400

Flags : 0x0

Body verification succeeded.

Config:

console= loglevel=7 init=/sbin/init cros_secure oops=panic panic=-1 root=PARTUUID=%U/PARTNROFF=1 rootwait ro dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=0 dm="1 vroot none ro 1,0 5087232 verity payload=ROOT_DEV hashtree=HASH_DEV hashstart=5087232 alg=sha1 root_hexdigest=3633ada3558a1ebdc5e73d768406d1855d3bbba9 salt=e36b0e0ea916736e5f4fd8c9f3ea9248e3672b21f1950f710beec76613f3812a" noinitrd cros_debug vt.global_cursor_default=0 kern_guid=%U add_efi_memmap boot=local noresume noswap i915.modeset=1 tpm_tis.force=1 tpm_tis.interrupts=0 nmi_watchdog=panic,lapic

-----------

$ vbutil_kernel --verify blob83-ATBv72-sdb2.img --verbose

Key block:

Signature: ignored

Size: 0xcb8

Flags: 11 !DEV DEV REC

Data key algorithm: 11 RSA8192 SHA512

Data key version: 1

Data key sha1sum: e78ce746a037837155388a1096212ded04fb86eb

Preamble:

Size: 0xf348

Header version: 2.2

Kernel version: 1

Body load address: 0x100000

Body size: 0x71d400

Bootloader address: 0x816000

Bootloader size: 0x4000

Vmlinuz header address: 0x81a000

Vmlinuz header size: 0x3400

Flags : 0x0

Body verification succeeded.

Config:

console= loglevel=7 init=/sbin/init cros_secure oops=panic panic=-1 root=PARTUUID=%U/PARTNROFF=1 rootwait ro dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=0 dm="1 vroot none ro 1,0 5087232 verity payload=ROOT_DEV hashtree=HASH_DEV hashstart=5087232 alg=sha1 root_hexdigest=7b45dc47af17d4869598148973256b221a133c2c salt=ecac7c3af20fb070704c00595a2a8350465d3dd84dd73aa246de0dd17e82f1e2" noinitrd cros_debug vt.global_cursor_default=0 kern_guid=%U add_efi_memmap boot=local noresume noswap i915.modeset=1 tpm_tis.force=1 tpm_tis.interrupts=0 nmi_watchdog=panic,lapic

-------------

$ vbutil_kernel --verify blob4.4.00-ATBv55-sdb2.img --verbose

Key block:

Signature: ignored

Size: 0x4b8

Flags: 7 !DEV DEV !REC

Data key algorithm: 4 RSA2048 SHA256

Data key version: 1

Data key sha1sum: d6170aa480136f1f29cf339a5ab1b960585fa444

Preamble:

Size: 0xfb48

Header version: 2.2

Kernel version: 1

Body load address: 0x100000

Body size: 0x470800

Bootloader address: 0x569000

Bootloader size: 0x4000

Vmlinuz header address: 0x56d000

Vmlinuz header size: 0x3800

Flags : 0x0

Body verification succeeded.

Config:

console= loglevel=7 init=/sbin/init cros_secure oops=panic panic=-1 root=PARTUUID=%U/PARTNROFF=1 rootwait rw dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=0 dm="1 vroot none rw 1,0 4096000 verity payload=ROOT_DEV hashtree=HASH_DEV hashstart=4096000 alg=sha1 root_hexdigest=8f9b4e702c43034115885f739a44b9d5b13af366 salt=36f7736717c1cb22e793cfc616ceaad7401a631383264d6844e06cbb1c97523e" noinitrd cros_debug vt.global_cursor_default=0 kern_guid=%U add_efi_memmap boot=local noresume noswap i915.modeset=1 tpm_tis.force=1 tpm_tis.interrupts=0 nmi_watchdog=panic,lapic

-------

$ vbutil_kernel --verify blob4.4.21-ATBv58-sdb2.img --verbose

Key block:

Signature: ignored

Size: 0xcb8

Flags: 11 !DEV DEV REC

Data key algorithm: 11 RSA8192 SHA512

Data key version: 1

Data key sha1sum: e78ce746a037837155388a1096212ded04fb86eb

Preamble:

Size: 0xf348

Header version: 2.2

Kernel version: 1

Body load address: 0x100000

Body size: 0x5a2400

Bootloader address: 0x69b000

Bootloader size: 0x4000

Vmlinuz header address: 0x69f000

Vmlinuz header size: 0x3400

Flags : 0x0

Body verification succeeded.

Config:

console= loglevel=7 init=/sbin/init cros_secure oops=panic panic=-1 root=PARTUUID=%U/PARTNROFF=1 rootwait ro dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=0 dm="1 vroot none ro 1,0 4096000 verity payload=ROOT_DEV hashtree=HASH_DEV hashstart=4096000 alg=sha1 root_hexdigest=afb9c4e67f1cfe0f633900a0b3fb88c4643087cf salt=030bed61a45cb837e49bc60cd478d7b24ed95850908c6d9cc2d7d026e8cec8a2" noinitrd cros_debug vt.global_cursor_default=0 kern_guid=%U add_efi_memmap boot=local noresume noswap i915.modeset=1 tpm_tis.force=1 tpm_tis.interrupts=0 nmi_watchdog=panic,lapic

-------

$ vbutil_kernel --verify C720P-sda2-blob.img --verbose

Key block:

Signature: ignored

Size: 0x4b8

Flags: 7 !DEV DEV !REC

Data key algorithm: 4 RSA2048 SHA256

Data key version: 3

Data key sha1sum: ef6c37d745bb9da235efc7bc8fae28ad8f0db574

Preamble:

Size: 0xfb48

Header version: 2.2

Kernel version: 1

Body load address: 0x100000

Body size: 0x454400

Bootloader address: 0x54d000

Bootloader size: 0x4000

Vmlinuz header address: 0x551000

Vmlinuz header size: 0x3400

Flags : 0x0

Body verification succeeded.

Config:

console= loglevel=7 init=/sbin/init cros_secure root=/dev/dm-0 rootwait ro dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=1 dm="1 vroot none ro 1,0 2539520 verity payload=PARTUUID=%U/PARTNROFF=1 hashtree=PARTUUID=%U/PARTNROFF=1 hashstart=2539520 alg=sha1 root_hexdigest=079b65ad8962c15cc20a962fe253d678e27485e0 salt=48257cf2686fef8d85c30df16d4c735bd7ba74da8fd7bcd8f15dcd1c78c8c7d3" noinitrd vt.global_cursor_default=0 kern_guid=%U add_efi_memmap boot=local noresume noswap i915.modeset=1 tpm_tis.force=1 tpm_tis.interrupts=0 nmi_watchdog=panic,lapic iTCO_vendor_support.vendorsupport=3

-------

$ vbutil_kernel --verify C720P-usb-sdb2-blob.img --verbose

Key block:

Signature: ignored

Size: 0x4b8

Flags: 7 !DEV DEV !REC

Data key algorithm: 4 RSA2048 SHA256

Data key version: 1

Data key sha1sum: d6170aa480136f1f29cf339a5ab1b960585fa444

Preamble:

Size: 0xfb48

Header version: 2.2

Kernel version: 1

Body load address: 0x100000

Body size: 0x3e7400

Bootloader address: 0x4e0000

Bootloader size: 0x4000

Vmlinuz header address: 0x4e4000

Vmlinuz header size: 0x3400

Flags : 0x0

Body verification succeeded.

Config:

console= loglevel=7 init=/sbin/init cros_secure oops=panic panic=-1 root=PARTUUID=%U/PARTNROFF=1 rootwait rw dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=0 dm="1 vroot none ro 1,0 2506752 verity payload=ROOT_DEV hashtree=HASH_DEV hashstart=2506752 alg=sha1 root_hexdigest=bb988a39ae3c27f2c432d36c6a454f6adccb9942 salt=c7d8352a11635f8174b95160d9c0b0b9fb7dd6048b3de0c42e6e1025819bf256" noinitrd vt.global_cursor_default=0 kern_guid=%U add_efi_memmap boot=local noresume noswap i915.modeset=1 tpm_tis.force=1 tpm_tis.interrupts=0 nmi_watchdog=panic,lapic iTCO_vendor_support.vendorsupport=3

-----

Hopefully enough to figure out how this works :)

Next section / post will copy & paste the configs with appropriate headers for kernels & comment on bootability...

I think I will add to the list ATB v69 which also booted Acer CB C720P, later...

$ vbutil_kernel --verify blob4.14.65-ATB69-sdb2.img --verbose

Key block:

Signature: ignored

Size: 0xcb8

Flags: 11 !DEV DEV REC

Data key algorithm: 11 RSA8192 SHA512

Data key version: 1

Data key sha1sum: e78ce746a037837155388a1096212ded04fb86eb

Preamble:

Size: 0xf348

Header version: 2.2

Kernel version: 1

Body load address: 0x100000

Body size: 0x825400

Bootloader address: 0x91e000

Bootloader size: 0x4000

Vmlinuz header address: 0x922000

Vmlinuz header size: 0x3400

Flags : 0x0

Body verification succeeded.

Config:

console= loglevel=7 init=/sbin/init cros_secure oops=panic panic=-1 root=PARTUUID=%U/PARTNROFF=1 rootwait ro dm_verity.error_behavior=3 dm_verity.max_bios=-1 dm_verity.dev_wait=0 dm="1 vroot none ro 1,0 4096000 verity payload=ROOT_DEV hashtree=HASH_DEV hashstart=4096000 alg=sha1 root_hexdigest=d332a331083b70e95225bca300e7406046d39047 salt=4acbfe7cfded37f9ff79a0d7fb301792cc3bf5ce8a8b3c40f824c1c7b2cb5406" noinitrd cros_debug vt.global_cursor_default=0 kern_guid=%U add_efi_memmap boot=local noresume noswap i915.modeset=1 tpm_tis.force=1 tpm_tis.interrupts=0 nmi_watchdog=panic,lapic