If you've found your way here, it's likely because you updated your firmware and, despite best efforts to minimize the possibility,something went wrong. Thankfully, most Chromebooks can be easily unbricked using cheap, readily available hardware: older Chromebooks using a ch341a USB programmer from Amazon/eBay/Alibaba (and many other sources), and newer (2017+) Chromebooks using a USB-C debug cable (aka Suzy-Q cable).
These 3 components are often bundled together at a lower cost (Amazon link), and if you're unsure if your device uses a 1.8v flash chip or a 3.3v one, it makes sense to have the adapter on hand if needed.
While this is somewhat device-specific, the main points are the same:
Pin 1 of the flash chip will be notated by a dot/depression on the chip; be sure to align this with pin 1 on the chip clip wiring (a red strip on the example linked above).
Googling should locate a disassembly guide for most models. If you can't find one for your exact model, try to find one for another model of the same manufacturer as the bottom cover removal tends to be very similar.
Once you have your device disassembled and flash chip located, time to boot up the flashing environment. Most any Linux setup should do as long as either flashrom is available from the distro's software repositories, or it's 64-bit x86 (in which case you can download a statically compiled build of flashrom from my site). This guide will use a Ubuntu 23.04 live session booted from USB.
So let's get to it:
cd;
sudo apt update
sudo apt install flashrom
sudo flashrom -p ch341a_spi
wget <Full ROM base path><device specific filename>
wget https://mrchromebox.tech/files/firmware/full_rom/coreboot_tiano-edgar-mrchromebox_20180827.rom
wget https://mrchromebox.tech/files/firmware/full_rom/coreboot_tiano-edgar-mrchromebox_20180827.rom.sha1
sha1sum -c coreboot_tiano-edgar-mrchromebox_20180827.rom.sha1
wget <shellball base path>/shellball.<device name>.bin
wget https://mrchromebox.tech/files/firmware/shellball/shellball.edgar.bin
If you're not sure which file to use for your device / don't know your device's board name, you can reference:
https://mrchromebox.tech/#devices and/or http://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices
The firmware in all ChromeOS devices contains a section (RO_VPD) which stores board-specific data, like the serial number, localization settings, and on many devices which have an Ethernet port, the LAN MAC address as well. When flashing via the Firmware Utility Script, the script will automatically extract this from the running firmware and inject it into the firmware to be flashed, so the device serial, LAN MAC address, etc are all maintained. Without this, the device will use a default/generic LAN MAC address set by coreboot. While not ideal, this is only really an issue if two or more of the same device are on the same LAN segment (or you're statically assigning IP addresses based on MAC). But for completeness, if flashing the UEFI firmware or shellball ROM, we'll extract the VPD (either from the board itself or a backup made by the script) and inject it into the firmware to be flashed.
NOTE: you don't need to do this if flashing a stock firmware backup created by the Firmware Utility Script; that image already contains the VPD.
For both the options below, we'll need to use the cbfstool (coreboot filesystem) binary, so let's download/extract that:
wget https://mrchromebox.tech/files/util/cbfstool.tar.gz && tar -zxf cbfstool.tar.gz
Option 1: extract VPD from the firmware on device
sudo flashrom -p ch341a_spi -r badflash.rom
./cbfstool badflash.rom read -r RO_VPD -f vpd.bin
Option 2: extract VPD from stock firmware backup created by Firmware Utility Script (this assumes the file has been copied into working directory)
./cbfstool stock-firmware-<devicename>-<date>.rom read -r RO_VPD -f vpd.bin
Then we inject the VPD into the firmware image to be flashed.
./cbfstool <Shellball ROM/UEFI Full ROM filename> write -r RO_VPD -f vpd.bin
Now the firmware image is ready to be flashed, and will maintain the device's unique serial, LAN MAC address, etc.
Now that everything is prepped, time to flash the device. To be thorough, we'll perform a 2nd verification after flashing to ensure the integrity of the flashed firmware.
sudo flashrom -p ch341a_spi --ifd -i bios -w <filename>
sudo flashrom -p ch341a_spi -w <filename>
sudo flashrom -p ch341a_spi --ifd -i bios -v <filename>
sudo flashrom -p ch341a_spi -v <filename>
Reassembly is the reverse of disassembly. Reconnect the internal battery and replace the bottom cover. Flip over the device, connect external power, press the power button, and cross your fingers :)
As above, this is only needed if you failed to factory reset the CCD flags as part of disabling the device's firmware write-protection. While this is somewhat device-specific, the main points are the same:
Most any 64-bit Debian/Ubuntu based distro should work here, but this guide will use a Ubuntu 2304 live session booted from USB (since its version of flashrom supports Suzy-Q flashing).
Let's get to it:
cd;
sudo apt update
sudo apt install flashrom
ls /dev/ttyUSB*
echo "ccd open" | sudo tee -a /dev/ttyUSB0 > /dev/null
wget <Full ROM base path><device specific filename>
wget https://mrchromebox.tech/files/firmware/full_rom/coreboot_tiano-edgar-mrchromebox_20180827.rom
wget https://mrchromebox.tech/files/firmware/full_rom/coreboot_tiano-edgar-mrchromebox_20180827.rom.sha1
sha1sum -c coreboot_tiano-edgar-mrchromebox_20180827.rom.sha1
wget <shellball base path>/shellball.<device name>.bin
wget https://mrchromebox.tech/files/firmware/shellball/shellball.edgar.bin
If you're not sure which file to use for your device / don't know your device's board name, you can reference:
https://mrchromebox.tech/#devices and/or http://www.chromium.org/chromium-os/developer-information-for-chrome-os-devices
The firmware in all ChromeOS devices contains a section (RO_VPD) which stores board-specific data, like the serial number, localization settings, and on many devices which have an Ethernet port, the LAN MAC address as well. When flashing via the Firmware Utility Script, the script will automatically extract this from the running firmware and inject it into the firmware to be flashed, so the device serial, LAN MAC address, etc are all maintained. Without this, the device will use a default/generic LAN MAC address set by coreboot. While not ideal, this is only really an issue if two or more of the same device are on the same LAN segment (or you're statically assigning IP addresses based on MAC). But for completeness, if flashing the UEFI firmware or shellball ROM, we'll extract the VPD (either from the board itself or a backup made by the script) and inject it into the firmware to be flashed.
NOTE: you don't need to do this if flashing a stock firmware backup created by the Firmware Utility Script; that image already contains the VPD.
For both the options below, we'll need to use the cbfstool (coreboot filesystem) binary, so let's download/extract that:
wget https://mrchromebox.tech/files/util/cbfstool.tar.gz && tar -zxf cbfstool.tar.gz
Option 1: extract VPD from the firmware on device
sudo flashrom -p raiden_debug_spi:target=AP -r badflash.rom
./cbfstool badflash.rom read -r RO_VPD -f vpd.bin
Option 2: extract VPD from stock firmware backup created by Firmware Utility Script (this assumes the file has been copied into working directory)
./cbfstool stock-firmware-<devicename>-<date>.rom read -r RO_VPD -f vpd.bin
Then we inject the VPD into the firmware image to be flashed.
./cbfstool <Shellball ROM/UEFI Full ROM filename> write -r RO_VPD -f vpd.bin
Now the firmware image is ready to be flashed, and will maintain the device's unique serial, LAN MAC address, etc.
Now that everything is prepped, time to flash the device.
sudo flashrom -p raiden_debug_spi:target=AP -i SI_BIOS -w <filename>
sudo flashrom -p raiden_debug_spi:target=AP -w <filename>
Once flashing is complete, disconnect the Suzy-Q cable. If the internal battery was not disconnected, the device will likely reboot as soon as flashing has completed. If the internal battery was disconnected, reconnect it and replace the bottom cover. Flip over the device, connect external power, press the power button, and cross your fingers :)