badsh1mmer

Support

If you need any kind of support, please join our discord server for help

If you would like the script to do everything for you:

git clone https://github.com/crosbreaker/badsh1mmer
cd badsh1mmer
bash buildfull_badsh1mmer.sh <board>

If you would like to use a local recovery image:

git clone https://github.com/crosbreaker/badsh1mmer
cd badsh1mmer
bash update_downloader.sh <board>
sudo ./build_badrecovery.sh -i image.bin -t unverified

What is this?

badsh1mmer is a sh1mmer payloads menu injected into badrecovery unverified, allowing for unenrollment on keyrolled kv6 ChromeOS devices.

How do I make a usb?

Download an prebuilt from the prebuilts section, or build an image yourself with the above commands.
On Windows, use Rufus to flash. On Linux, use dd as follows:

sudo dd if=/path/to/badsh1mmer.bin of=/dev/sdX bs=1M status=progress

(remember to replace X with the actual usb's letter identifier)

I have a usb, what now?

If below kv6, complete sh1ttyOOBE, then enter developer mode and recover to your usb
Else, complete sh1ttyexec

Prebuilts

• GitHub Release

Licensing

• LICENSE - main license for all badsh1mmer code
• LICENSE-RELEASES - license for github workflow
• LICENSE-shrink_image - license for shrink_image.sh script

Credits:

• HarryTarryJarry - Badbr0ker, finding the VPD vulnerability
• BinBashBanana - original br0ker, badrecovery
• xz8f - Creating menu, anything new that was added ontop of the original badbr0ker source code
• Lxrd - Sh1ttyOOBE
• codenerd87 - more board support on badbr0ker