Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2853 Thanks!
[Music]
okay um hello everyone so today we will
talk about uh turning Chromebooks into
regular laptops uh we'll go into a sort
of detail of um what does take to
actually make them run Linux because
chromis is in Linux as you will see in a
bit so yeah let's start so what we who
we are uh I'm assistance engineer by day
hacker by night you know the story um we
I contribute to AB Kel feder project
postmarket and so on so on um I'm also
one of three ads in the OR Community um
and I have B hacked Chromebooks as you
know you may know so I'm dy I have toed
with core Boot and Hardware hacking ever
since ThinkPad x230 was still actually a
reasonable laptop to own uh I have been
ner sniped by Ellie into Chromebook
hacking so that's why I'm here and you
may know me from doing absolutely cursed
stuff with bash uh search for this after
the presentation not right
now okay so what are those chromized BS
it's not just Chromebooks there are also
um like uh Chrome bases and um Chrome
boxes so those are devices manufactured
by manufacturers like HP isus Lenovo
according to google specifications like
um for instance they need to use
specific amplifiers embedded controllers
and on the Filmore stack has to be open
source and it's activ maintained by
Google um so we have quite a variety of
Hardware like you can get one for like
30 to 50 on the cheapest side those
usually are made for students and
they're very durable and last like 12
hours on battery so they're great then
you have like middle range uh like
pentiums I with varying um storage and
then you have a highend like ryzen nvme
AMOLED screen 16 by10 so this is um like
a high
stuff um because chromos isn't really um
thing that people want to use
um they are considered e-w which is kind
of sad because the hardware is actually
very good and you can find them very
very cheap on secondhand markets uh like
I mentioned the Germanic devices can
found for like 50 and T or which is what
I have here or gyen can be found for
like €250 which is you know a very great
very good deal search for uh c clearance
sales because sometimes you can get them
for literally no thing like they are
really cheap and like schools get rid of
them constantly because they get abused
by students to students to hel in back
so yes they are really easy to get hold
of yes in fact this one has broken
screen I got it for 20 on the in the
recycling center so uh and they have
great debugging tools um and we'll talk
about in a bit and pretty much most of
the frw stack is open so what's chess uh
it's basically kind of like Android it
uses rux chel but um you know of course
Google has their own patches uh some of
them are up stream some of them are Nots
uh and some people a lot of people
believe that it is based on Gen 2 but
it's actually not Gen 2 uh it does use a
Portage as a build system but uh you
know it's 64 bit and unless you have
like an ARM device with under 4 gigs of
RAM then you have 30p user space uh it
uses upart as an in system which was
known like red hat and res six uh use S
Linux and um user space fully custom for
instance you have Linux containers
called crustin uh that's how you can get
like TB running on it um arvm which you
can makes you POS it possible to run
Android applications chrom audio server
and as replacement for po audio or pip
wire and and then bod as a fingerprint
user space fingerprint driver because s
fprint isn't really cutting it for those
kind device what's important to remember
is that crostini like the Linux
containers uh it is basically lxc with
extra steps but it has quite a lot of
overhead uh not only because well
chromos is still running in the
background so it takes like a gig of RAM
at least but also because uh it has a
lot of indirections uh between the
Hardware so you can basically forget
about running any highly performant
applications on that uh also it's
non-trivial to actually make like X
server applications run on that so like
it's a whole buag of worms it works some
people have used it and loved it but
like we are not about that just so you
know so what is corbut uh it's an open
source
implementation um it's kind of similar
to ubot which is mostly used on arm and
edk2 which you can find on
arm servers and some development
boards uh UI basic edk2 basically
provides like um ufi rtime Services um
so cor Bo you you probably
know yeah and uh yeah so you can you
some of you probably know corot from
like a lot of old think PS uh that's how
it got popular and there's also like
Libra boot which is the bloess
implementation and and uh well those
devices always had the problem of being
like 10 [ __ ] Generations behind so
they weren't really useful for any real
work unless you are die hard and uh what
changes here is that we actually can get
Coro on devices that are recent yes in
fact it took us like a week to get res
7,000 working so you
know um so um you know they ship with
cor by default of course um
implementation isn't really compatible
with Upstream Linux of the books but you
know they mostly Upstream their code and
we can use that to wrak patches for it
so you know what's what's the point of
our project like if it's use corbo and
just use corbut right well kind of
because not all parts are upstreamed and
there are differences and SPI tables and
so on so Google uses n as a payload
which requires a Chromo curent partition
scheme like you need to have three
copies of the specific carel partition
um I believe also rout and also uh you
know because of the three SS um you when
they apply the upgrades they can if
let's say an upgrade fails they can roll
it back the problem is that it's not at
all compatible with like anything that
you would expect so this is not useful
to us at all
and uh we have some tools made by the
community to actually work with death
charge but uh again this is not the
direction that we want to go in um death
tools was actually made by alas which is
um who's um depan contributor it's a
great tool that basically th without any
documentation um he basically looks at
an elf header to find out if it the
architecture is x86 or or arm but uh you
know it's still an abstraction layer and
because we have no complant SPI that
results in like broken USB audio input
devices aspiral touch screens and uh
slip so you know we need to fix that in
a firmware because otherwise it doesn't
work uh my isn't well tested like Google
upam STS but we don't think they're
really um testing it uh we find a lot of
regressions like all the time and
basically like constant M and cut cut
Ming yeah the important thing to
remember here is that uh Google
upstreams the code and like just
publishes it only because they are
obligated to and like uh upstreaming
code isn't that much work when you
actually do have it already and you
don't want to be a GPL violator looking
at some chines so
vendors uh but yeah they are not doing
their best they are not putting enough
time to actually make this work uh so we
are the people that are doing those
things yes so Google actually does offer
alternative play DOS like you can um D
has a memory location that can jump to
um you might know C bias from old thing
pads edk2 or ubut but still that still
doesn't fix like SPI tables power
sequencing doesn't have envr support so
basically when you reboot all the
variables are being lost so yeah so this
is basically a cheap way to uh well get
corot get cor
booted uh well it is not useful for us
just because we cannot fix bugs in it
like we could but it involves us
upstreaming into Google and this is kind
of missing the point so uh yeah we
decided to do it ourselves and what is
the importance of open fear mod like we
have already touched uh upon it a bit
but
to reiterate because this is really
important to remember uh if your device
doesn't have a working fare and this is
not only about Chromebooks this is about
your laptop that you may have right now
if something is broken you can either
rely on your manufacturer to actually
fix it maybe
sometime uh or or do nothing there's
there there is nothing else you can do
you can Port cor but this will take like
weeks meanwhile here you can just fix it
you can just compile the code and it fix
your issues and magically you have a
laptop that's no longer a paper weight
and it's actually important to notice
because on most laptops you cannot
transport corbo because of Intel boot
guard which uh basically prevents you
from running man code sign with
manufacturer Keys uh well in this case
we don't have W guard so you know we
don't have that
problem so furthermore uh firware
updates have a lag uh because the
manufacturer of your device that
requires the firmware so for example the
CPU imagine the micro code uh imagine
there's a patch in the micro code it
needs to go through go through the
pipeline of vendor so your motherboard
vendor to you and you need to flash it
meanwhile if you do it yourself then you
can just build your own bios image and
Flash it yourself and pro possibly get
the mitigation in hours instead of days
are weaks sometimes yes in fact uh we're
not even vulnerable to logo fail because
we're up to date with edk2 and that kind
of stuff yeah logo fail was the uh thing
that you may some of you might have
heard in the past months uh basically an
exploit in uh the logo parsing routines
the the boot logo parsing routines and
well we never were vulnerable to it uh
because we had uh DK2 that was recent
enough not to be
yes so we can uh edge cases like we have
people doing all sorts of worky
modifications to those devices and
because the code is open source uh even
for instance other like you want to
replace EMC module with mvme you can do
that with uh if you patch
corbut and
um for instance uh so it doesn't work on
stock firmware but it works if you PCH
and when you flash or builds then you
can just Swap nbme and it
works um there's so many other reasons
like just think about it we literally
have people that started with hacking uh
Chromebooks and ended up in like with
real jobs as firmware developers so
that's really cool yeah for instance Mr
Chromebox precisely um the cool part
about Chromebooks is that the embedded
controller is actually open like this is
something that may
make your eyes open wide because
historically the FSF was really just
like fine with the state of think part
Ed controllers being closed just like H
we can't do anything about it let's just
maybe someday so yeah here it's just
open why the air codes though well
basically Google has pulled a Google
again so uh they publish code but they
do the least amount of work to actually
make it usable for us so we need a uh CH
route to uh like a specific uh board for
of chrom os uh to actually build uh a
specific uh cross at a uh firmware so
this is a pain but well technically you
can hack on it and we will uh probably
work on making this situation better in
the future so look forward to that I
guess yeah because they switch to Z
inent machines yeah that's uh also
important um also because there crossi
isn't used only in Chromebooks it's also
used in some framework laptops so yeah
there this there's a whole ecosystem and
hopefully this is going to expand even
further um so yeah about our project uh
the Cru trook project go ahead so
basically we fix Google S that's yeah
whether they like it or
not so we basically patch acpi tables or
in case of arm with started working on
arm devices we patch device trees and
you know carel
modules um there we have like platform C
like backlight dcss controller uh Intel
moxes like uh Power sequencing for
touchcreen and other sequency devices
because uh know touchcreen will not work
on stock firmware well the situation is
actually getting better as Google is
pulling all Patches from Upstream but
you know it takes
time and then a lot of debugging like
edk to which we're using to provide ufi
Righttime services for those machines
and we add a sec Boot and P in release
4.20 and uh you know then debugging like
nbme USB anation EMC um you know and uh
there's also go which initializes the
display and provides users with uh frame
buffer
basically and a lot lot uh the bugging
and book fixing like this is platform
specific every different laptop has
different quirks and there's nothing you
can do to fix them globally because
Hardware is different Hardware is a real
world yes um what do we do in the Linux
Kel uh this is like we are repeating
ourselves a bit with the the Coro stuff
because well we need support on both
sides to make this correct so uh acpi
tables once again uh we uh well do the
same dance with actually testing uh the
code that we're running because we have
a community that relies on it uh and we
daily drive those machines in yes like
this laptop is literally a Chromebook
this laptop which you might mistake for
a think but it's also a
Chromebook and then you know a lot of
specific uh vendors like Intel power
management box introduced in Tiger Lake
and older Lake machines uh gave us a lot
of headaches and even though the
workaround was simple it took us a while
to fix it because you know we all have
four lives um then you have uh specific
hooks for Chrome OS Ed controller like
um ice s c Tunnels for the sensors for
the lead and that kind of stuff um you
know and then audio because all post
2016 machines had broken AIO for years
and you know um so yeah AIO is like a
whole other bug of worms uh you
basically have Hardware that is bespoke
and no Intel HD for you over here we
have codex uh and DSP Jeeps so it is uh
really uh different compared to what you
might expect in a PC platform uh
nowadays we have like good Kel support
mainly because we have worked on it for
so long that we actually like fixed a
lot of those uh issues uh we working
with Upstream D chose to include uh the
kernel modules that are are actually in
Linux already just including those in
the standard kernel builds and we've had
great success so far except for
canonical F canonical uh then we have uh
device using DSP uh those are like post
Sky machines for um
for Intel and on ryzen 7000 and steam de
OLED started using sound open firmware
as well um so we also brought our own
use case manager configuration files
because they're not one to un compatible
we have to actually rewrite them basing
on chromos and that's how we get Al to
work and also
PM is basically the thing that tells the
kernel about the topology of your sound
card so where the mixers are uh what the
pipelines look like inputs outputs and
like all of this so this is required to
get audio to work yes and then uh we
have audio voice speech which is a new
car module introduced
byki and
um B bz so Google implemented those
limits in user space because they have
full control over uh what they ship on
those machines like every board has
their own builds uh but we don't control
user Place nearly as much and we want to
be distro agnostic we don't want to
people to rely on like one distribution
like there used to be um Gallum OS which
has died like 3 years ago and
contributors had disappeared and there's
no duplication notice so you know we are
trying to up the stuff as much as
possible uh of course this is still is
not finished we're working on it and
that's why on some devices we don't
enable speakers yet so and if you think
that we're accelerating you know that's
uh what happens if you try to actually
run those machines without any limits
this is a Chromebook called Snappy HP
Chromebook whatever um and um you can
notice in the background that Maxim 98
357a amplifier is getting hold over here
yes and the left speaker actually got
damaged it got to many degrees and the
voice call had melted so we really do
not recommend running without n limits
it's worth noting that this is a time
lapse from like 2 minutes but uh the
heat up like literally takes only a few
seconds so it doesn't take much to
damage your speakers per permanently yes
because I increased volume in ALA in
incrementals because I didn't want to
lower them D
so so uh it's worth mentioning that like
we have been praising the platform for
being so open so false but it's actually
not all false so like micro code is not
false I think that everyone has expected
that uh and there is a whole bunch of
stuff uh especially like the management
engine and the AMD PSP that is uh not
open at the and it will probably never
will be uh but uh there is some progress
with uh like upstreaming parts of it uh
parts of the uh firmware that's still
blobs
uh Bic platform in code yeah uh so this
is our work in progress who AMD maybe
maybe we'll have like more open laptops
uh on arm 64 basically the same story
like uh we have better a bit better we
have drum training code uh power
management and a bunch of other things
that are just bepoke and closed uh
actually when you go to Qualcomm it gets
a bit worse in my opinion because you
have the always on processor this is
just like the uh Intel me uh worth
noting about qualcom we don't have that
many information about it because uh
those devices are expensive and well we
pay with our own pockets for all of the
development so just we haven't done much
reversing on them yet but this is a work
in progress again yeah for instance in
America they cost like
$150 and here they cost like 600 or so
yeah and actually the same is true in
other direction like you can get some
devices in the US much cheaper than here
so just look around um this is a fun
slide uh so many years ago uh there used
to be those eBay sellers uh proclaiming
that oh we have made a privacy a wear
laptop running Libra Boot and no bloves
it's so secure so let's maybe compare
those laptops to our offering so of
course we have open bios like this is a
given
uh but on our end we also has have open
eded controller that's kind of cool uh
unfortunately on neither of those ends
we have uh the Intel management engine
mpsp actually open like except the x60
but that's like all it it will be legal
to to drink like so so old in a few
years like and we can disable management
engine on those platforms because uh DSP
firware that is being loaded onto
separate core that is doing a the
processing uh has um needs to be
verified by management engine so if the
code for instance needs to be signed
with in keys and we sign it with
Community Keys then the F will refuse to
boot and same case is that if we disable
management engine the handshake will
fail and DSP will refuse to boot the
finware so you know yeah next Point uh
usually required special tools to flash
so like uh either an external flasher or
in some cases you could have gotten
around with uh using like uh exploits to
flash Coro but those uh like except for
a few cases those were really unreliable
personally I have breaked like four x60s
using the exploit so like I wouldn't
recommend it um but yeah on our end we
just need a paper clip if you're like
really unlucky and sometimes just a
screwdriver that's nothing
um is it available new well Chromebooks
yes thinkpads no unless you're willing
to pay like really big
margins uh is it reasonably fast and
like a lot of you will probably see this
and think oh gosh we are overreacting
2012 wasn't that long
ago and look let me tell you when I see
prices of Chromebooks compared to their
performance and I compare to thinkpads
there is no comp competition like
seriously the Chromebooks are
Chromebooks are
winning uh and yeah the price like a
10-year-old device surprisingly
expensive uh thinks have this stigma
around them or maybe like just like they
are really expensive because they are
popular they are hackery they are cool
and well we strive to make Chromebooks
cool as well so like maybe after this
presentations you will get some hacker
credit for using one but
like
and yeah long story short you cannot
Escape blobs so it's not Liber but uh in
practice it's better than it was 10
years ago and by a big margin and we are
heading towards like making making it
even
better uh this is the Practical part of
the presentation I'm hooked I want a
homebook uh how do I hack it so first
thing you need to pick up fun device we
will have another section about
precisely this in a second uh and most
of them can be had for really cheap you
should just look around uh the easiest
uh way to do it is like x86 with from
Intel uh great support just nothing to
be said uh hard mode is AMD we have some
problems on some platforms but like
ryzon is cool uh and expert mode is arm
64 basically no support but we're
working on it Ellie actually has like
the only Chrome r64 Chromebook in
existence that's running Fedora so like
that's really cool uh uh yeah Second
Step obtain or make a suq cable uh this
is not like this is recommended but this
is totally optional you don't need this
but this gives you awesome uh like tools
to debug and uh hack your Chromebook
later so for example you can uh use this
to UNP your Chromebook with flash Ro
just from another device and it also
exposes a bunch of U
ports uh bonus if you make uh you cable
yourself you can debac some uh phones
with it some Google pixels Google pixels
with tensor chip you just need to add
TTL converter instead of plugging into
USB port yeah uh First Step unlock right
prodect and this really varies between
devices we have documentation so like
just figure it out what it is for your
for yours it is always possible and it
is never problematic like on Android
phones where you need to unlock the boot
loader and wait so you'll be fine and
yeah Flash and enjoy this is literally
doable with no tools whatsoever you just
need to unlock Developer mode on Chrome
or use AO cable and you're goal then and
yeah cool devices because we've talked
uh a lot of a lot about meta but not
about the devices so there is this Frame
framework Chromebook it really has no
point being a Chromebook besides I don't
know uh it has Thunderbolt 4 this is
really cool it has a really my screen
it's actually quite fast and yeah on the
picture here you can see uh cool star
running uh like cyberp Punk 277 on the
Chromebook with an GPU so this is insane
this is something that's not possible on
the original F let me tell you she also
installed like 64 gigs of ram in it yeah
it has so cable Ram this is really cool
for like a laptop that's produced
[Applause]
nowadays
then there is the our personal favorite
the crane Lenovo do and uh it's an arm
Chromebook uh unfortunately it only has
4 gigs of RAM but it has great moding
potential so it has a detachable
keyboard and it has Pogo pins we have
actually reverse engineered what they do
so this is like three volts then USB
pins then uh ground and one GPI open to
measure like a resistor to check what's
connected uh we're not finished with any
with doing anything with it but like
we're planning to release uh like models
for making a mechanical keyboard for it
that would be really cool like
mechanical keyboard and like expansion
ports basically and yeah it's just a
really cool device it's really
lightweight it's like 10 in and I would
recommend it and yeah my personally
personal favorite because I'm a think
about Die Hard
uh we have a device that has a track
point and uh it has a ryzen CPU 16 gigs
of ram in the top
configuration uh an M2 slot inside
actually and yeah the outside iio is
quite good as well and as a bonus it's a
tablet so uh it has an integrated stylus
that's uh USI compatible and you can
just drw that's really cool and uh some
of you might have heard of this one from
like a video that was published by last
last week by bringo Studios uh this is
basically a conferencing uh room device
but if you open it you find some really
interesting things like you have
socketed Ram an M2 slot uh the best
party trick of them all is the HDMI in
like I love that and just think about
what you can do with this it also comes
with Google coral a module installed
yeah so we can do fun stuff prably home
assistant yeah yeah so we'd like to
thank than all of those people
especially people at faps collabora
people at chromium linaro and yubo uh
our community as well because it
wouldn't be possible without them and
well everyone that has helped with us
with the presentation so yeah many
thanks great and yeah contributions
welcome this is basically everything if
I have if you have any questions then
feel free to ask
them
[Music]
wow cool thanks a lot for this
presentation uh so we have uh about 8
minutes for Q&A so please line up to the
microphones I think we start with
microphone number whatever number two
hello so thanks for the talk uh I have
two questions one is simple one so have
you ever seen the Chromebook without a
pouch battery something more kind
of
18650 Define power battery uh the the
the okay I get it um there are some
really old Chromebooks with 18650s uh
I'm thinking ThinkPad
x131e uh but I wouldn't recommend
getting them because they suck royally
in terms of performance so yes but
actually
no okay and the second question is like
how modifi you mentioned the EC firmware
is open source but how modifiable this
how Is it feasible to change like a
charging Behavior or something like
that yes you can change basically
whatever you want you can make it so it
wouldn't wake up if you open the lid you
can change like um charging constraints
we actually have a user space tool WR by
our community that can limit a charge
like let say
85% and you can also control the fun and
also like PW backlight and all sorts of
stuff so you know and most of those
features are actually in stock so if you
laune e tool that's an open source tool
by Google uh then you can just send
comments to to the E to like either
engage the fans or uh disable them or
like just do stuff that's really
cool wow we we're going we're getting a
demo yes so I as long as you prepare the
demo I will just announce that we're
probably running out of time for all the
questions so maybe we can go no worries
maybe we can have one from the internet
in between is that possible uh yes it is
um the question is on Modern Chromebook
there are UND undocumented jumpers how
you can find them to unlock the uh
flashh uh well uh for most of them we
have documentation on our Wiki for the
ones that we don't uh there isn't going
to be that many of those jumpers on the
mod mod so you are probably going to
find
the spot that looks like you should
Bridge it and if it looks like it should
if it looks like a duck it's probably a
duck you know uh worst case you can also
just short the pin three and eight which
is pulling right protect pin High to VCC
Rail and that way you can also bypass
Hardware by product it's documented in
SPI documentation
so interesting microphone number one
please now uh so uh are you aware of the
speaker safety demon that's U developed
as a part of the asaki project uh
because well that's kind of similar to
what you're trying to achieve with the a
the limiting things great question uh we
actually don't have Smart amplifiers the
problem with that uh is that sound open
firmware introduces uh limits in
firmware and uh from user space you
don't know that the limit is even there
uh but those amplifiers are like a dump
amplifiers so the only control you have
over is setting GP open low and high
then in the driver if there's nothing
playing for 15 seconds it says GPI op
low but we don't have any control like
for temperature monitoring or anything
like that so it has to be done either in
the firmware or we have to do like
explicit curve how to limit the power
that uh amplify is
outputting uh we're working with guys
from interet but uh you know it's um
it's uh work in
progress good let's take microphone one
again hi great talk um I just saw the
bringer studio video recently I guess
you are the people that help them
getting this Abomination to work um so I
have a question about this uh in the
video you can see that the performance
of his device is not that great is this
in some way F related or is this just
misconfigured no it's because it's a k
lake mobile platform it's like I think
core A5
1850 U which is really not very you he
made a video about gaming which is not
for gaming but for us hackers it will be
a great potential for running like um
open RT onet or pfSense so you know it
could also be a great streaming PC
because it has like Hardware encoding so
you can possibly capture the HDMI
probably mix in a camera and upload that
to Twitch or YouTube like that would be
cool all right thanks you're welcome
good we have another question from the
internet
please yes this is a more general
question um are there many Chromebooks
with easily upgradeable
Ram um unfortunately the only one we
know about is um very old one I think
parro which is hell and the framework
chork that we have have talked about so
unfortunately most of them is soldered
and you have like SPD profiles in Coro
so uh you probably could upgrade it if
you have a hot but you know then if you
have a hot a then you can do whatever
you want so it's important to remember
that Chromebooks are like 10 years old
and some of the old old devices did have
socketed Ram but you shouldn't really
get anything older than 2018 uh do the
Chrome boxes do actually have
upgradeable R
yep okay microphone number two now
please uh yes I have a question on the
AVS uh and uh have you verified if
there's any DC current through
differential driver of that speaker
causing the heat up instead of the audio
content Equalization of it yes we poked
it with the oscilloscope and we found
that
basically uh how does it work is that
some in some of the open fiware they've
put like um a limit um we're not exactly
sure how that works because then again
uh even though it's open source we have
a lot of things to do uh we know that
with open so open some
with sof uh you can run it on some
machines and but you won't get like
headphone check working but then on ABS
you can uh get it working with just a
headphone check for now um and we know
that ABS fare does have it implemented
um from what we've heard
from but uh we don't have topology for
this yet so you know and apparently
that's a problem with some kind of
vendor and you know sorry okay okay so
we take one more question from the
internet and all the other questions I
think we don't have time for them but
you can come to the stage later on and
talk to the speakers and uh probably ask
your questions um
yourself yeah okay um one question was
uh at the beginning of the talk you
talked about the IMD ryen CPUs running
within a week uh how did you get
the
AGA updates for right so AMD CPUs are
right right now are a terrible hack we
have a verified boot to load bir stage
design bir stage on arm core from stock
funer and we basically hacked the V boot
API to boot up toate corbo builds it is
a terrible hack and we're hoping to get
updated builds soon but for now um you
know it's a it's a hack and uh it it can
be a unstable so we're really careful
with the builds we're
publishing okay and dmy thank you again
for this nice
[Applause]
[Music]
talk