Pixelbook Eve - "Access Denied" using wp to disable firmware write protect

Support
1

When I try to disable firmware write protect, I get an Access Denied error.

> wp false
Access Denied
Usage: wp [<BOOLEAN>/follow_batt_pres [atboot]]

Actions I took:

  1. Updated Pixelbook Eve to the latest chromeos/firmware
  2. Turned on Developer Mode
  3. Rebooted the Pixelbook
  4. Connected from linux laptop to Pixelbook using SuzyQable
  5. Opened tty from Linux laptop using “screen /dev/ttyUSB0 9600”
  6. Executed the “wp false” command in the tty and got the access denied error above.

Does anyone have an idea why wp won’t work?

Thanks,
Tim

P.S. Output of ccd in case it helps:

> ccd
State: Locked
Password: none
Flags: 0x000000
Capabilities: 0000000000000000
  UartGscRxAPTx   Y 0=Default (Always)
  UartGscTxAPRx   Y 0=Default (Always)
  UartGscRxECTx   Y 0=Default (Always)
  UartGscTxECRx   - 0=Default (IfOpened)
  FlashAP         - 0=Default (IfOpened)
  FlashEC         - 0=Default (IfOpened)
  OverrideWP      - 0=Default (IfOpened)
  RebootECAP      - 0=Default (IfOpened)
  GscFullConsole  - 0=Default (IfOpened)
  UnlockNoReboot  Y 0=Default (Always)
  UnlockNoShortPP Y 0=Default (Always)
  OpenNoTPMWipe   - 0=Default (IfOpened)
  OpenNoLongPP    - 0=Default (IfOpened)
  BatteryBypassPP Y 0=Default (Always)
  Unused          Y 0=Default (Always)
  I2C             - 0=Default (IfOpened)
  FlashRead       Y 0=Default (Always)
  OpenNoDevMode   - 0=Default (IfOpened)
  OpenFromUSB     - 0=Default (IfOpened)
  OverrideBatt    - 0=Default (IfOpened)
  APROCheckVC     - 0=Default (IfOpened)
read_tpm_nvmem: object at 0x100a not found
[2359.430908 Console unlock allowed]
TPM: dev_mode
Capabilities are default.
Use 'ccd help' to print subcommands

And version:

> version
Chip:    g cr50 B2-C
Board:   0
RO_A:    0.0.12/bf248b9d
RO_B:  * 0.0.13/c7c6eea6
RW_A:    Error
RW_B:  * 0.5.271/cr50_v4.11_mp.81-08ba0d4903
BID A:   00000000:00000000:00000000 Yes
BID B:   00000000:00000000:00000000 Yes
Build:   0.5.271/cr50_v4.11_mp.81-08ba0d4903
         tpm2:v4.11_mp.3-799903d
         pinweaver:v0.0.157-e9f7a8f
         2024-12-13 15:00:51 @chromeos-ci-firmware-us-central1-b-x32-1-
2

run ccd open

3

Thanks for your help @WeirdTreeThing !

This is the output:

> ccd open
read_tpm_nvmem: object at 0x100a not found
[2817.552135 Console unlock allowed]
[2817.553256 ccd_open denied: run from AP in devmode, remove batt, or short chassis_open]
Access Denied
Usage: ccd [help | ...]
4

You forgot the whole ccd unlocking step

5

Still Access Denied:

> ccd unlock
Unlock only allowed after password is set
Access Denied
Usage: ccd [help | ...]
> ccd password thisisatest
Access Denied
Usage: ccd [help | ...]
> ccd unlock thisisatest
Unlock only allowed after password is set
Access Denied
Usage: ccd [help | ...]
>

Note that I also get access denied if I try to clear the password.

6

Please re-read the documentation

7

I forgot to mention that gcstool is missing. I ran a find across / and couldn’t find it. Out of desperation, I downloaded the source code and couldn’t find the tool code. I thought Google must have removed it in the latest update. (Thus why I mentioned I had updated before starting this process.)

And NOW I see that I had transposed the s and c. gSCtool

8

Google Security Chip Tool

9

yep. Even after knowing I had transposed it, I still typed it wrong a couple of times. I can’t claim dyslexia. It must be a muscle memory for something I used to type a lot.

This also explains why I could not find any google help on “pixelbook gcstool missing” :smiley: