Installing the firmware script with half a broken screen

I have BLOOGUARD (HP Chromebook x360 14b-ca0061wm) and the left half of the screen is broken. I am looking for a way to limp this thing into the firmware utility script and wiping it to Full ROM firmware.

I could get a usb-C to hdmi cable but I was hoping to avoid that.

I had promising results with the below ai-generated script, but I can’t get the firmware script (or any other command) to output to the right half of the screen. the below script does at least indent the shell to the right half.

ideas I had:

usb-c to hdmi
ssh
tty (output the chromeos terminal to another monitor)
do it blind
tmux / screen / other terminal-in-a-terminal options
braille tty
screen share
narrator / text to speech
zsh / other non-bash terminals
chromebrew
python
fork the script
su / switch user

I have at my disposal:

  • suzyQ debugger
  • several full linux UEFI former chromebooks
  • one samsung ARM chromebook
  • linux /windows x64 pc
  • rasp pi gen 1
  • nanoKVM lite
  • android phones, rootable
cd; curl -LO example.com/r.sh && sudo bash r.sh
#!/bin/bash
echo -e "mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmMrChromebox Firmware Utility Script starting up"

# Number of spaces to indent
SPACES=200
SPACER="$(printf '%*s' "$SPACES" '')"

# 1. Set prompt (PS1) for current session
export PS1="${SPACER}\u@\h:\w\$ "

# 2. Define indent() function for on-demand use
indent() {
    "$@" | sed "s/^/${SPACER}/"
}

# 3. Setup output redirection using FIFO and trap
FIFO="/tmp/ttyshift.$$"
exec 3>&1  # Save original stdout

# Clean up on exit
cleanup() {
    exec 1>&3
    rm -f "$FIFO"
}
trap cleanup EXIT

# Create FIFO and hook stdout through sed
mkfifo "$FIFO"
sed "s/^/${SPACER}/" < "$FIFO" >&3 &
exec 1> "$FIFO"

echo
echo "${SPACER}✅ TTY right shift active (in-memory only)"
echo "${SPACER}Type 'exit' or press Ctrl+D to quit and restore normal output"
echo

# Launch interactive shell with shifted output
bash --norc

I’m pretty sure if the device is in dev mode, you should be able to use the SuzyQ to run the script via ttyUSB1

I’m new to serial devices. What do I do with it?

with screen /dev/ttyUSB0 on my linux box plugged into BLOOGUARD I can get some really low level commands for the CR50 chip. something like help and list help provides command list and info. But I don’t see anything to open a shell or run a script.

Similar story on ttyUSB1 and USB2.

USB0 is the CR50, USB1 should be a dev terminal, USB2 is the EC console

The normal tutorial dev mode (after recovery mode) doesn’t seem to do anything. After a lot of trial and error, I think AP/CPU ttyUSB1 is disabled in software on production devices.

Some basic CCD functionality is accessible by default: read-only access to the EC console, read-write access to the AP console, and a few basic Cr50 console commands. Note that while Cr50 has read-write access to the AP console by default, the AP console itself is disabled for production devices.

ccd testlab enable might do something.

ttyUSB1 is disabled in verified boot mode; in developer mode, it’s a VT console just like CTRL+ALT+F2. I’m using it right now on a stock/dev mode Chromebook

1 Like

What OS and serial client? I’m using Debian and a variety of screen, minicom, picocom, cutecom. On USB0 and USB2 I get text info back from the chromebook. I can send commands.

on USB1 I don’t get text and can’t seem to send anything. what do you get on USB1? is it a normal login prompt?

Maybe I’m not in dev mode. It’s hard to tell with half the screen missing but I can do ctrl-alt-f2 and get a working terminal.

minicom and pop_os! 22.04

I get the same terminal prompt as via VT2:

Developer Console

To return to the browser, press:

  [ Ctrl ] and [ Alt ] and [ <- ]  (F1)                              
                                                                     
To use this console, developer mode must be enabled.                 
Doing so will destroy any saved data on the system.                  
                                                                     
In developer mode, it is possible to
- login and sudo as user 'chronos'
- require a password for sudo and login(*)
- disable power management behavior (screen dimming):
  sudo initctl stop powerd
- install your own operating system image!

* To set a password for 'chronos', run the following as root:

chromeos-setdevpasswd

If you are having trouble booting a self-signed kernel, you may need to                                   
enable USB booting.  To do so, run the following as root:                                                 
                                                                                                          
enable_dev_usb_boot                                                                                       
                                                                                                          
Have fun and send patches!                                                                                
                                                                                                          
localhost login:                                                                                          
localhost login: chronos                                                                                  
chronos@frostflow-rev2 ~ $

Would you mind sharing your minicom config? Are you running the client terminal as root (sudo su) or a normal user?

Does it matter when I plug in the SuzyQ? I usually leave it in from boot on the host Chromebook. When should I see the login info - after getting to the welcome screen in ChromeOS?

Do I need to log in to ChromeOS at all? I started from scratch and re-locked everything, plugged the battery back in, enabled recovery mode, enabled developer mode, did not enable dev tools within chromeOS.


I also bought a USB-C → Displayport as well as USB-C → HDMI adapter, but it doesn’t look like VT2 terminals are shared over USB-C. The normal ChromeOS is compatible with external displays.

default. minicom requires sudo/root yes

I leave it plugged in. console comes up right before the welcome screen

no, just need a network connection

Well I got it working, but never got the tty working. minicom complained about its default /dev/ modem not being available, and I monkeyed with that and the picocom app but never got USB1 tty working.

Same principle as the OP: write a bunch of filler text to move the output to the right half of the screen. if you have a KVM device you can send exact keyboard sequences over USB to avoid typos.

semi-Blind chromebook UEFI setup guide:

  1. recovery mode
  2. developer mode (ctrl-D)
  3. firmware WP disable (battery disconnect etc)
  4. connect wifi (accessibility options that help: narrator / chronovox (press space on fresh boot, listen to the narrator who explains it, docked magnifier)
    1. note that the ‘accept’ bar on fresh boot gets a scroll bar (hidden) if you have the magnifier docked to the top. you need to scroll down to accept if you want to pass this first screen for some reason.
  5. VT2 (ctrl-alt-f2)
  6. external keyboards are allowed and may type more reliably than the crap on a chromebook
  7. chronos and enter to log in.
  8. test that you’re in a terminal: hold down m and get a bunch of ms until you see the ms. then hold a little more. press enter. you should get an error about how a bunch of Ms isn’t a valid command.

where it gets fun: in most shells including the VT2 shell, you can add a bunch of spaces to the start of your command. no problem.

so instead of “echo asdf” you can say echo asdf. with enough spaces you can see you command as you type. when you press enter the output will unfortunately be behind the broken part of the screen if your left side is broke.

I tried “smarter” versions of the next command and they weren’t reliable. no idea why.

mystr=“wwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwwww ”

adjust the number of w as needed. (I use w and m because they are wide in variable width fonts). Note if you put a couple spaces at the end of mystr it’s a bit more readable (creates a gap between mystr and the script output).

cd; curl -LO mrchromebox.tech/firmware-util.sh

sudo bash firmware-util.sh | sed “s/^/${mystr}/”

tab-completion works on the first part, you can say

sudo bash fir and press tab to complete to

sudo bash firmware-util.sh

The sed command appends mystr to the start of every line of output of the setup script. with enough w it moves the output to the part that you can read.

The questions from the script are still left-aligned, so you have to do those blind. you can try following along in the source code. if you have a fragment of a string you can search for it in the code.

the sequence for me was basically

2 → install uefi firmware

y → brick warning

I ACCEPT → ccd flashAP warning

1? copy a firmware backup to USB

1 → select the available device

remove USB and press enter → continue

wait 90+ seconds and press enter

P → poweroff

(reinsert the battery cable now)

sudo minicom -D /dev/ttyUSB1

is all I used

From my testing, it seems like the serial console on stock only works on AMD/ARM.

1 Like

The chromebook host needs to be AMD or ARM, or the serial client needs to be on AMD or ARM?

The chromebook

In your case I would skip the firmware script and manually flash with the SuzyQ.

1 Like