Skip to content

Instantly share code, notes, and snippets.

@rrolsbe

rrolsbe/gist:195a2551ffdef7540776

Created January 12, 2015 20:22
Show Gist options
  • Save rrolsbe/195a2551ffdef7540776 to your computer and use it in GitHub Desktop.
Save rrolsbe/195a2551ffdef7540776 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.txt
Dennis
If a another script were created to reverse what enable-vmx.sh changed (maybe called unenable-vmx.sh) would a Chromebook boot into Verified mode again?. Seems if the saved kernel bits were restored (bit-for-bit) so that the hash/digital sign matched Googles, it might boot verified mode (unless something else permanently flags the kernel modifications)? From what I have read, booting "Verified Mode" while in Developer mode gives a little more security. Assuming any of the above would work, we could execute the enable-vmx only when we need run a 64Bit VirtualBox VM then execute unenable-vmx.sh reestablish verified boot.
BTW, Thanks for making your enable-vmx.sh script available!!
Regards, Ron
@DennisLfromGA
Copy link

Ron,

If you saved the original kernel file created in Step 2., then I believe you could 'dd' it back and regain a Google signed kernel but I'm not sure - I'd be very careful before I set dev_boot_signed_only to 1 again.

I saw your remarks in Issue 675

I modified the kernel using the enable-vmx.sh script and chromeos still
booted several times just fine with dev_boot_signed_only=1?? With it set
to 1, Virtualbox reported that VT-x was not enabled in the bios (when
trying to launch a 64Bit VM). After setting it to 0 (no other changes),
the 64Bit VM runs fine. I quess I am confused about how this all works?

So it seems like it may not be strictly enforced but I wouldn't want to test it and leave myself out on a limb. :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment