This package contains a set of tools to deal with Chromebook internals, and the verified version of u-boot. Namely: bmpblk_font bmpblk_utility chromeos-tpm-recovery crossystem dev_debug_vboot dev_make_keypair dumpRSAPublicKey eficompress efidecompress enable_dev_usb_boot load_kernel_test pad_digest_utility signature_digest_utility tpm-nvsize tpm_init_temp_fix tpmc vbutil_what_key verify_data. The programs previously included in this package: dump_fmap dump_kernel_config futility gbb_utility vbutil_firmware vbutil_key vbutil_keyblock, are now grouped in the futility program in the package vboot-kernel-utils. Most users don't need this package, and should look for the cgpt and vboot-kernel-utils packages instead.
chromeos-tpm-recovery
root@kali:~# chromeos-tpm-recovery -h
ERROR: You must put a test image on a USB stick and boot it in recovery mode (this means Esc+Refresh+Power, *not* Ctrl-U!) to run this
exiting
crossystem
Chrome OS firmware/system interface utility
root@kali:~# crossystem -h
Usage:
crossystem [--all]
Prints all parameters with descriptions and current values.
If --all is specified, prints even normally hidden fields.
crossystem [param1 [param2 [...]]]
Prints the current value(s) of the parameter(s).
crossystem [param1=value1] [param2=value2 [...]]]
Sets the parameter(s) to the specified value(s).
crossystem [param1?value1] [param2?value2 [...]]]
Checks if the parameter(s) all contain the specified value(s).
Stops at the first error.
Valid parameters:
arch [RO/str] Platform architecture
backup_nvram_request [RW/int] Backup the nvram somewhere at the next boot. Cleared on success.
battery_cutoff_request [RW/int] Cut off battery and shutdown on next boot
block_devmode [RW/int] Block all use of developer mode
clear_tpm_owner_done [RW/int] Clear TPM owner done
clear_tpm_owner_request [RW/int] Clear TPM owner on next boot
cros_debug [RO/int] OS should allow debug features
dbg_reset [RW/int] Debug reset mode request
debug_build [RO/int] OS image built for debug features
dev_boot_altfw [RW/int] Enable developer mode alternate bootloader
dev_boot_signed_only [RW/int] Enable developer mode boot only from official kernels
dev_boot_usb [RW/int] Enable developer mode boot from external disk (USB/SD)
dev_default_boot [RW/str] Default boot from disk, altfw or usb
dev_enable_udc [RW/int] Enable USB Device Controller
devsw_boot [RO/int] Developer switch position at boot
devsw_cur [RO/int] Developer switch current position
diagnostic_request [RW/int] Request diagnostic rom run on next boot
disable_dev_request [RW/int] Disable virtual dev-mode on next boot
ecfw_act [RO/str] Active EC firmware
post_ec_sync_delay [RW/int] Short delay after EC software sync (persistent, writable, eve only)
fw_prev_result [RO/str] Firmware result of previous boot
fw_prev_tried [RO/str] Firmware tried on previous boot (A or B)
fw_result [RW/str] Firmware result this boot
fw_tried [RO/str] Firmware tried this boot (A or B)
fw_try_count [RW/int] Number of times to try fw_try_next
fw_try_next [RW/str] Firmware to try next (A or B)
fw_vboot2 [RO/int] 1 if firmware was selected by vboot2 or 0 otherwise
fwb_tries [RW/int] Try firmware B count
fwid [RO/str] Active firmware ID
fwupdate_tries [RW/int] Times to try OS firmware update (inside kern_nv)
hwid [RO/str] Hardware ID
inside_vm [RO/int] Running in a VM?
kern_nv [RO/int] Non-volatile field for kernel use
kernel_max_rollforward [RW/int] Max kernel version to store into TPM
kernkey_vfy [RO/str] Type of verification done on kernel keyblock
loc_idx [RW/int] Localization index for firmware screens
mainfw_act [RO/str] Active main firmware
mainfw_type [RO/str] Active main firmware type
minios_priority [RW/str] miniOS image to try first (A or B)
nvram_cleared [RW/int] Have NV settings been lost? Write 0 to clear
display_request [RW/int] Should we initialize the display at boot?
phase_enforcement [RO/int] Board should have full security settings applied
recovery_reason [RO/int] Recovery mode reason for current boot
recovery_request [RW/int] Recovery mode request
recovery_subcode [RW/int] Recovery reason subcode
recoverysw_boot [RO/int] Recovery switch position at boot
recoverysw_cur [RO/int] Recovery switch current position
recoverysw_ec_boot [RO/int] Recovery switch position at EC boot
ro_fwid [RO/str] Read-only firmware ID
tpm_attack [RW/int] TPM was interrupted since this flag was cleared
tpm_fwver [RO/int] Firmware version stored in TPM
tpm_kernver [RO/int] Kernel version stored in TPM
tpm_rebooted [RO/int] TPM requesting repeated reboot
tried_fwb [RO/int] Tried firmware B before A this boot
try_ro_sync [RO/int] try read only software sync
vdat_flags [RO/int] Flags from VbSharedData
vdat_lfdebug [RO/str] LoadFirmware() debug data (not in print-all)
wipeout_request [RW/int] Firmware requested factory reset (wipeout)
wpsw_cur [RO/int] Firmware write protect hardware switch current position
For more information, please see:
https://chromium.googlesource.com/chromiumos/docs/+/HEAD/os_config.md#crossystem
dev_debug_vboot
root@kali:~# dev_debug_vboot -h
Usage: dev_debug_vboot [options] [DIRECTORY]
This logs as much as it can about the verified boot process. With no arguments
it will attempt to read the current BIOS, extract the firmware keys, and use
those keys to validate all the ChromeOS kernel partitions it can find. A
summary output is printed on stdout, and the detailed log is copied to
/var/log/debug_vboot_noisy.log afterwards.
If a directory is given, it will attempt to use the components from that
directory and will leave the detailed log in that directory.
Options:
-b FILE, --bios FILE Specify the BIOS image to use
-i FILE, --image FILE Specify the disk image to use
-k FILE, --kernel FILE Specify the kernel partition image to use
-v Spew the detailed log to stdout
-c, --cleanup Delete the DIRECTORY when done
-h, --help Print this help message and exit
dumpRSAPublicKey
root@kali:~# dumpRSAPublicKey -h
Usage: dumpRSAPublicKey <-cert | -pub> <file>
dump_fmap
root@kali:~# dump_fmap --help
Usage: futility dump_fmap [OPTIONS] FLASHIMAGE [NAME...]
Display (and extract) the FMAP components from a BIOS image.
Options:
-x Extract the named sections from the file
-h Use a human-readable format
-H With -h, display any gaps
-p Use a format easy to parse by scripts
-F Use the format expected by flashrom
Specify one or more NAMEs to dump only those sections.
dump_kernel_config
root@kali:~# dump_kernel_config --help
Usage: futility dump_kernel_config [--kloadaddr ADDRESS] KERNEL_PARTITION
enable_dev_usb_boot
A documentação do Kali não publica a saída de ajuda deste comando.
gbb_utility
root@kali:~# gbb_utility --help
Usage: futility gbb_utility [-g|-s|-c] [OPTIONS] bios_file [output_file]
GET MODE:
-g, --get (default) Get (read) from bios_file, with following options:
--hwid Report hardware id (default).
--flags Report header flags.
--digest Report digest of hwid (>= v1.2)
-k, --rootkey=FILE File name to export Root Key.
-b, --bmpfv=FILE File name to export Bitmap FV.
-r --recoverykey=FILE File name to export Recovery Key.
SET MODE:
-s, --set Set (write) to bios_file, with following options:
-o, --output=FILE New file name for ouptput.
--hwid=HWID The new hardware id to be changed.
--flags=FLAGS The new (numeric) flags value.
-k, --rootkey=FILE File name of new Root Key.
-b, --bmpfv=FILE File name of new Bitmap FV.
-r --recoverykey=FILE File name of new Recovery Key.
CREATE MODE:
-c, --create=hwid_size,rootkey_size,bmpfv_size,recoverykey_size
Create a GBB blob by given size list.
SAMPLE:
gbb_utility -g bios.bin
gbb_utility --set --hwid='New Model' -k key.bin bios.bin newbios.bin
gbb_utility -c 0x100,0x1000,0x03DE80,0x1000 gbb.blob
tpm-nvsize
root@kali:~# tpm-nvsize -h
running tpmc definespace 0xf004 0x1 0x1
tpmc
A documentação do Kali não publica a saída de ajuda deste comando.
vbutil_firmware
root@kali:~# vbutil_firmware --help
Usage: futility vbutil_firmware <--vblock|--verify> <file> [OPTIONS]
For '--vblock <file>', required OPTIONS are:
--keyblock <file> Keyblock in .keyblock format
--signprivate <file> Signing private key in .vbprivk format
--version <number> Firmware version
--fv <file> Firmware volume to sign
--kernelkey <file> Kernel subkey in .vbpubk format
optional OPTIONS are:
--flags <number> Preamble flags (defaults to 0)
For '--verify <file>', required OPTIONS are:
--signpubkey <file> Signing public key in .vbpubk format
--fv <file> Firmware volume to verify
For '--verify <file>', optional OPTIONS are:
--kernelkey <file> Write the kernel subkey to this file
vbutil_key
root@kali:~# vbutil_key --help
Usage: futility vbutil_key --pack <outfile> [PARAMETERS]
Required parameters:
--key <infile> RSA key file (.keyb or .pem)
--version <number> Key version number (required for .keyb,
ignored for .pem)
--algorithm <number> Signing algorithm to use with key:
0 = (RSA1024 SHA1)
1 = (RSA1024 SHA256)
2 = (RSA1024 SHA512)
3 = (RSA2048 SHA1)
4 = (RSA2048 SHA256)
5 = (RSA2048 SHA512)
6 = (RSA4096 SHA1)
7 = (RSA4096 SHA256)
8 = (RSA4096 SHA512)
9 = (RSA8192 SHA1)
10 = (RSA8192 SHA256)
11 = (RSA8192 SHA512)
12 = (RSA2048 EXP3 SHA1)
13 = (RSA2048 EXP3 SHA256)
14 = (RSA2048 EXP3 SHA512)
15 = (RSA3072 EXP3 SHA1)
16 = (RSA3072 EXP3 SHA256)
17 = (RSA3072 EXP3 SHA512)
OR
Usage: futility vbutil_key --unpack <infile>
Optional parameters:
--copyto <file> Write a copy of the key to this file.
vbutil_keyblock
root@kali:~# vbutil_keyblock --help
Usage: futility vbutil_keyblock <--pack|--unpack> <file> [OPTIONS]
For '--pack <file>', required OPTIONS are:
--datapubkey <file> Data public key in .vbpubk format
Optional OPTIONS are:
--signprivate <file> Signing private key in .vbprivk format.
OR
--signprivate_pem <file>
--pem_algorithm <algo>
Signing private key in .pem format and algorithm id.
(If one of the above arguments is not specified, the keyblock will
not be signed.)
--flags <number> Specifies allowed use conditions.
--externalsigner "cmd" Use an external program cmd to calculate the signatures.
For '--unpack <file>', optional OPTIONS are:
--signpubkey <file> Signing public key in .vbpubk format. This is required to
verify a signed keyblock.
--datapubkey <file> Write the data public key to this file.