Aerialite Labs Logo

Aurora

A tool similar to Ventoy for ChromeOS RMA shims and recovery images based on Alpine Linux

What works? What doesn’t?

Recovery ✅
Payloads menu ✅
Booting other shims ✅
Wifi ✅
Synaptic ❌

Priorities

  1. Wifi on all possible ARM boards
  2. general improvement
  3. aurora 2.0
  4. docs

Building

Dependencies

Arch Linux:

sudo pacman -Sy wget curl gptfdisk rsync binwalk e2fsprogs && yay -S vboot-utils

Debian:

sudo apt install wget curl bash e2fsprogs gdisk cgpt rsync

Alpine:

apk add curl wget bash e2fsprogs gptfdisk sgdisk cgpt rsync

Building

git clone --recursive https://github.com/AerialiteLabs/Aurora.git
cd Aurora

Run the next command with a raw shim and the architecture of the chromebook you have.

sudo bash Aurora /path/to/shim.bin

Alternatively, you can automatically download a nanoshim and build with it with the following command:

sudo bash Aurora <board> --auto

If you don’t want to build a shim yourself (or aren’t able to), prebuilts are available on the download server.

Flashing

Linux/FreeBSD:

Assuming you’re still in the Aurora/ directory and have just built it:

First run lsblk and look for the usb’s identifier (the letter after sd), replace “X” with it.

sudo dd if=<board>-aurora.bin of=/dev/sdX bs=1M status=progress

Otherwise, do if=/path/to/<board>-aurora.bin if you aren’t working in the same directory as the prebuilt.

Replace sudo with your privilege escalation tool of choice.

Windows:

Download Rufus, select your USB, select board-aurora.bin (download from prebuilts, or try to build with WSL).

macOS:

Download Balena Etcher, select your USB, select board-aurora.bin.

ChromeOS (personal/unenrolled device)

Download a prebuilt, get the Chromebook Recovery Utility. Start CRU and click the gear icon in the top right, press “use local image” and navigate to the prebuilt. Select your USB, and let it do its thing. Fun fact, you can also do this for stuff like badbr0ker, meaning you don’t need a pc to unenroll now if you’re willing to use prebuilts, just a chromebook!

Booting

After flashing, do the normal steps to boot sh1mmer, then plug it into your chromebook. It will automatically extend the rootfs to fill the rest of the drive. On future boots if you’re connected to the internet it will automatically update itself. You can then either download recovery images or shims in Aurora itself, or put them on Aurora via mounting the 4th partition of the device on another linux/chromeos machine and copying them into the relevant directory inside /usr/share/aurora/images on the mounted drive (there’s images/recovery, images/shims, and images/gurt [yo]).

Booting Other Shims

Uploading Files via another computer

  1. Use AFT on page 2 (reccomended)
  2. Use a linux computer with ROOT ACCESS

    ChromeOS Files will NOT WORK! Use VT2 or Crostini USB passthrough if you only have a chromebook.

Credits