where did you get your shim (poll)

[pazza2234]

just asking where you got your shim. not asking for anything, Just wondering what is the most common way people get them. I am not asking for one that works right now, where did you get one for You, even if the site is now down.

[3kh0]

The links in the readme.md are trusted, the other ones could be trojans to brick the chromebook

[pazza2234]

@3kh0 once agean, I know. I was not telling people where to get them, I was asking some active members of the ext-remover descutions a simple question, to see what is the most populear site. I dont want to spred viruses, trojents, or enything that can be damaging to enyone. also I got most of the links from the readme. The one website I did not take from the readme was obelous.dev, witch I used myself and worked fine.

[3kh0]

ik, they could be, just be careful, only get them from trusted sources

[mylesbartlett72]

considering sh1mmer's source has a payload that will try and brick your chromebook (it overwrites the first MMC device, which is the internal storage (eMMC) on most chromebooks (some have nvme storage which it wasnt expecting)) its kinda weird to worry about trojans

[Darcii]

considering sh1mmer's source has a payload that will try and brick your chromebook (it overwrites the first MMC device, which is the internal storage (eMMC) on most chromebooks (some have nvme storage which it wasnt expecting)) its kinda weird to worry about trojans

VERY interesting so does this mean sh1mmer isnt safe?

[mylesbartlett72]

@Darcii id say its safe (in terms of not being malware), the devs were just trolling with that particular payload
probably going after the k12sysadmin guys who would hopefully get curious, run it, and brick their test device.

all the other payloads are safe as far as i can tell, you can look at their source to verify if you want to.

in terms of not bricking the device, apart from that one payload (which you can probably revert the damage from using a standard chromeos recovery image as the firmware would be write-protected by default, and not on the eMMC anyway) there is always some risk, especially with e.g. mrchromebox's fw utility script where you are writing to fw. you can recover from this with relatively inexpensive hardware, some technical knowledge, and the ability to open your chromebook to get at the spi flash chip (you can also directly flash custom fw this way, which could be used to replace even the RO firmware with one that doesnt check Firmware Management Parameters in the event that sh1mmer gets patched)

in terms of not getting caught: that depends on how competent your IT dept is, and what checks they do (some of these can be inferred e.g. if you do not use your chromebook at all (i.e. its powered off or otherwise disconnected from any networks) for a week and bring in your own laptop, do they check why your chromebook reports itself as offline). There is always the risk that someone will look over your shoulder, notice something that seems off, and report you.