ROM Download

This page contains a command to download and run a script, which will flash custom firmware with a SeaBIOS payload on approaching 40 models of Intel based Chromebook – allowing you to run an alternative OS such as Linux. The script will work with ChromeOS or pretty much any Linux distro (at least no one has told me otherwise).

There are 3 types of firmware mod – RW_LEGACY, BOOT_STUB, and Full ROM – not all Chromebooks work with each one:

  • RW_LEGACY modifies a 2MB section of the ROM leaving the stock functionality intact, including the scary developer screen, and will not brick your device. Some Chromebooks already come with a working RW_LEGACY slot, although many of them do not (non-functional keyboard on Panther, non-functional display on Auron_Yuna, or just plain missing, etc.). As well as fixing aforementioned bugs, updating the RW_LEGACY slot can enable further functionality such as booting from SD card/eMMC. So, even in the case of a functioning stock RW_LEGACY, it may be fortuitous to update.

  • BOOT_STUB modifies the last 1MB of the ROM, removing the scary developer screen, but also removes the ability to run ChromeOS natively, carrying a chance of bricking your device. This also leaves the “REFRESH + POWER” functionality of the stock ROM intact, meaning, when you press these keys, the device will immediately reboot and attempt to run ChromeOS Recovery (which isn’t there any more), and give you a blank screen. The only way to then stop it from attempting to run ChromeOS Recovery on every boot, is to take the device apart and disconnect the battery.

  • Full ROM, as the name suggests, is a complete ROM containing a coreboot build with a slice of SeaBIOS on top, and is the most risky. Again, this will remove the ability to run ChromeOS natively. Flashing one of these will wipe out your product data. In the case of Sandy/Ivybridge Chromebooks a full ROM enables hardware virtualisation extensions and suspend. Other models full ROM’s also probably contain idiosyncrasies that the stock firmware does not.

You need to be in dev mode and to have disabled write-protect by enabling a jumper/removing a screw (usually the latter, located somewhere on the main board). Disabling write-protect is not necessary when flashing RW_LEGACY unless you want to make the legacy slot default. See each respective supported Chromebook’s developer information¬†page (if available) for info on opening your Chromebook up and disabling write-protect.

Supported Models Matrix

Samsung Series 5 550 Chromebook - Lumpy     YES
HP Pavilion Chromebook - Butterfly     YES
Samsung Series 3 Chromebox - Stumpy     YES *
Acer C710 Chromebook - Parrot     YES
Lenovo X131e Chromebook - Stout     YES
Google Pixel Chromebook - Link YES   YES
Acer C720 Chromebook - Peppy YES   YES
HP Chromebook 14 - Falco YES   YES
ASUS Chromebox - Panther YES   YES
HP Chromebox - Zako YES   YES
Dell Chromebook 11 - Wolf YES   YES
Toshiba Chromebook - Leon YES   YES
LG ChromeBase 22CV241-W - Monroe YES   YES
Acer Chromebox - Mccloud YES    
Dell Chromebox - Tricky YES    
ASUS Chromebooks C200 - Squawks YES    
ASUS Chromebooks C300 - Quawks YES    
Lenovo Chromebook N20 - Clapper YES    
Toshiba Chromebook 2 - Swanky YES    
HP Chromebook 11 G3 - Kip YES YES  
Dell Chromebook 11 (2015) - Candy YES YES  
Acer CB3-111 - Gnawty YES YES  
Lenovo N21/CTL NL6 Education Chromebook/Senkatel Education Chromebook - Enguarde YES YES  
Lenovo Thinkpad 11e Chromebook - Glimmer YES YES  
Samsung Chromebook 2 (Baytrail) - Winky YES YES  
Acer Chromebook 15 (CB3-531) - Banjo YES YES  
Lenovo 100S - Orco YES YES  
Acer C740/Chromebook 11 - Auron_Paine YES    
Acer C910/Chromebook 15 - Auron_Yuna YES    
Chromebook Pixel (2015) - Samus YES    
Asus Chromebox CN62 - Guado YES    
Acer Chromebox CXI2 - Rikku YES    
Dell Chromebook 13 7310 - Lulu YES    
Toshiba Chromebook 2 2015 - Gandof YES    
Lenovo ThinkCentre Chromebox - Tidus YES    
Acer Chromebook R11 - Cyan YES    
Samsung Chromebook 3 - Celes YES    
Acer Chromebook 14 - Edgar YES    
Lenovo N22 Chromebook - Reks YES    

* This has bricked at least 3 Stumpy’s but many more have been okay.

Jenkins is now being used along with some scripts, to automate building, and to reduce chances of a brick from human error. Run the script like so, making sure you are only in Crosh shell *not* the *root* Crosh shell if running from ChromeOS:

cd;bash <(curl

If for some reason you need to run an older build, you will have to flash it manually. See the ROM Archive.

1,063 thoughts on “ROM Download”

  1. After entering cd;bash <(curl
    the process runs and in the end I get:
    Block protection could not be disabled!
    erasing and writing flash chip…SUCCESS

    The laptop reboots (coldboot) to the "OS verification is OFF" screen. I let it give it's two beep and it loads a sign-in.

    At this point, how do I install Ubuntu 14.04 from usb to completely replace the Chrome OS? I am not sure I replaced the Chrome OS with seaBIOS.

    Your assistant is humbly appreciated.

    Thank you and Happy New Year
    Tom G

    1. What do you mean by “loads a sign-in”?

      You just need to make a bootable USB stick as you would for a “normal” laptop. Preferably using dd or Rufus depending on the writing operating system, and preferably not using uNetbootin or similar.

      Depending on the model of Chromebook, it might not be wise to load an old version of Ubuntu like 14.04. Additionally, some models will experience the best hardware support if you instead load GalliumOS.

      Same to you,


      1. Hi jhon,
        I have already executed the script that you left several times

        cd; bash <(curl

        but when executing it I get the following:

        flashrom v0.9.9: 831c609: Nov 30 2017 02:04:47 UTC on Linux 3.18.0-16503-ge33b03ba1f58-dirty (x86_64)
        flashrom v0.9.9: 831c609: Nov 30 2017 02:04:47 UTC on Linux 3.18.0-16503-ge33b03ba1f58-dirty (x86_64)
        Calibrating delay loop … OK.
        Error accessing low megabyte, 0x100000 bytes at 0x0
        / dev / mem mmap failed: Resource temporarily unavailable
        Failed getting access to coreboot low tables.
        Mapping BYT IBASE at 0xfed08000, unaligned size 0x200.
        Mapping BYT SBASE at 0xfed01000, unaligned size 0x200.
        Erasing and writing flash chip … SUCCESS.

        and when restarting the computer and pressing crtl + D on the recovery screen, I get the image of chrome, as if nothing had happened.

        How can i fix this? or is there something that is wrong?

        1. Okay – 3 things I notice.

          1. You haven’t told me what model you’re using.

          2. You seem to be running a custom kernel (one of the kernel opts could be stopping you getting access to the necessary memory).

          3. Have you tried hitting “ctrl + L”?

    1. BOOT_STUB isn’t supported any more, so if you use it, do so even more at your own risk and I won’t fix any problems with it.

      It goes by the codename of the board – if the codename is in the script (the one you see at the dev boot screen), then it’s supported. If not, let me know and I will add it.

    2. hi again jhon
      the model of my chromebook is the Samsung chromebook 3 ‘(celes)

      I researched online and I saw that you have to execute the following script:

      crossystem dev_boot_usb = 1 dev_boot_legacy = 1

      Once you run it and restart the chromebook, press Crtl + L and if it appeared the seabios.

      Anyway, thanks !

  2. I used your script to install your full ROM on my daughter’s C710-2847 a couple of days ago. I read on these pages that your son has a C710 so I figure you might be able to help me. Your script worked perfectly. (Frankly, running your script was much simpler and faster than your WP mining captcha that I had to endure to get in here even.)

    I’m working on a wiki for the MX-Linux forum and community. MX Linux is Debian-based but it uses Sys V init. I’d like to get suspend working with MX-17 GNU/Linux on my daughter’s C710. Suspend is the only thing that is seriously not working. Everything else has worked turn-key. I’ve done a lot of online research and TPM and ehci_pic seems to the at the root of most problems. I’ve tried a number of fixes from your pages here and elsewhere too. Even though your comments indicate it should be fixed, I get one suspend then and the next one causes a black screen hang, requiring a power cycle reset. I see an error 38 in dmesg ([ 206.014679] tpm tpm0: Error (38) sending savestate before suspend). says (under the first paragraph #3, WRT to your ROM):

    It will not be reboot on resume (unlike stock SeaBIOS), presumably since the firmware is not interacting with the TPM. But because an error 38 is returned during the selftest issued on resume, its functioning will degrade over suspend/resume cycles until the machine refuses to enter suspend,

    The 38 error snippet from my dmesg follows. Any ideas?



    [ 115.074460] PM: Preparing system for sleep (mem)
    [ 115.074691] Freezing user space processes … (elapsed 0.001 seconds) done.
    [ 115.076682] OOM killer disabled.
    [ 115.076684] Freezing remaining freezable tasks … (elapsed 0.001 seconds) done.
    [ 115.077953] PM: Suspending system (mem)
    [ 115.077989] Suspending console(s) (use no_console_suspend to debug)
    [ 115.078390] wlan0: deauthenticating from 68:c4:4d:40:31:d8 by local choice (Reason: 3=DEAUTH_LEAVING)
    [ 115.164457] sd 0:0:0:0: [sda] Synchronizing SCSI cache
    [ 115.164822] sd 0:0:0:0: [sda] Stopping disk
    [ 116.008298] PM: suspend of devices complete after 930.559 msecs
    [ 116.020515] PM: late suspend of devices complete after 12.193 msecs
    [ 116.033598] PM: noirq suspend of devices complete after 13.077 msecs
    [ 116.034041] ACPI: Preparing to enter system sleep state S3
    [ 116.034157] ACPI: EC: event blocked
    [ 116.034158] ACPI: EC: EC stopped
    [ 116.034160] PM: Saving platform NVS memory
    [ 116.034161] Disabling non-boot CPUs …
    [ 116.040993] smpboot: CPU 1 is now offline
    [ 116.042945] ACPI: Low-level resume complete
    [ 116.043013] ACPI: EC: EC started
    [ 116.043014] PM: Restoring platform NVS memory
    [ 116.043320] Suspended for 9.976 seconds
    [ 116.044613] Enabling non-boot CPUs …
    [ 116.044737] x86: Booting SMP configuration:
    [ 116.044739] smpboot: Booting Node 0 Processor 1 APIC 0x2
    [ 116.048171] cache: parent cpu1 should not be sleeping
    [ 116.048788] CPU1 is up
    [ 116.050852] ACPI: Waking up from system sleep state S3
    [ 116.066328] mei_me 0000:00:16.0: Refused to change power state, currently in D3
    [ 116.126708] PM: noirq resume of devices complete after 72.421 msecs
    [ 116.129013] PM: early resume of devices complete after 2.257 msecs
    [ 116.129243] ACPI: button: The lid device is not compliant to SW_LID.
    [ 116.129265] ACPI: EC: event unblocked
    [ 116.140038] genirq: Flags mismatch irq 0. 00000080 (mei_me) vs. 00015a00 (timer)
    [ 116.140068] mei_me 0000:00:16.0: request_threaded_irq failed: irq = 0.
    [ 116.140076] dpm_run_callback(): pci_pm_resume+0x0/0x90 returns -16
    [ 116.140079] PM: Device 0000:00:16.0 failed to resume async: error -16
    [ 116.144153] sd 0:0:0:0: [sda] Starting disk
    [ 116.153205] tpm tpm0: A TPM error (38) occurred continue selftest
    [ 116.493192] usb 2-1.2: reset full-speed USB device number 3 using ehci-pci
    [ 116.493228] usb 1-1.1: reset full-speed USB device number 3 using ehci-pci
    [ 116.571379] usb 1-1.1: device firmware changed
    [ 116.636161] usb 1-1.3: reset high-speed USB device number 4 using ehci-pci
    [ 116.888496] PM: resume of devices complete after 759.486 msecs
    [ 116.888793] PM: Finishing wakeup.
    [ 116.888795] OOM killer enabled.
    [ 116.888796] Restarting tasks …
    [ 116.891106] usb 1-1.1: USB disconnect, device number 3
    [ 116.894915] done.
    [ 116.958183] usb 1-1.1: new full-speed USB device number 5 using ehci-pci
    [ 117.038206] usb 1-1.1: string descriptor 0 read error: -22
    [ 117.038223] usb 1-1.1: New USB device found, idVendor=0489, idProduct=e04e
    [ 117.038227] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
    [ 118.696329] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
    [ 118.700949] ata1.00: configured for UDMA/133
    [ 118.757535] usb 1-1.1: firmware: direct-loading firmware ar3k/AthrBT_0x11020000.dfu
    [ 118.806178] usb 1-1.1: firmware: direct-loading firmware ar3k/ramps_0x11020000_40.dfu
    [ 118.957072] usb 1-1.1: USB disconnect, device number 5
    [ 119.032967] systemd-logind[2445]: Operation ‘sleep’ finished.
    [ 119.130177] usb 1-1.1: new full-speed USB device number 6 using ehci-pci
    [ 119.210693] usb 1-1.1: string descriptor 0 read error: -22
    [ 119.210712] usb 1-1.1: New USB device found, idVendor=0489, idProduct=e04e
    [ 119.210716] usb 1-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
    [ 120.804419] wlan0: authenticate with 68:c4:4d:40:31:d8
    [ 120.818692] wlan0: send auth to 68:c4:4d:40:31:d8 (try 1/3)
    [ 120.822593] wlan0: authenticated
    [ 120.823228] wlan0: associate with 68:c4:4d:40:31:d8 (try 1/3)
    [ 120.838867] wlan0: RX AssocResp from 68:c4:4d:40:31:d8 (capab=0x431 status=0 aid=1)
    [ 120.839049] wlan0: associated
    [ 205.771137] PM: Syncing filesystems … done.
    [ 205.889512] PM: Preparing system for sleep (mem)
    [ 205.889732] Freezing user space processes … (elapsed 0.002 seconds) done.
    [ 205.891879] OOM killer disabled.
    [ 205.891880] Freezing remaining freezable tasks … (elapsed 0.001 seconds) done.
    [ 205.893171] PM: Suspending system (mem)
    [ 205.893206] Suspending console(s) (use no_console_suspend to debug)
    [ 205.893661] wlan0: deauthenticating from 68:c4:4d:40:31:d8 by local choice (Reason: 3=DEAUTH_LEAVING)
    [ 205.984009] sd 0:0:0:0: [sda] Synchronizing SCSI cache
    [ 205.984355] sd 0:0:0:0: [sda] Stopping disk
    [ 206.014679] tpm tpm0: Error (38) sending savestate before suspend
    [ 206.014690] dpm_run_callback(): platform_pm_suspend+0x0/0x40 returns 38
    [ 206.014695] PM: Device tpm_tis failed to suspend: error 38
    [ 206.239986] PM: Some devices failed to suspend, or early wake event detected
    [ 206.249418] sd 0:0:0:0: [sda] Starting disk
    [ 206.405105] PM: resume of devices complete after 165.109 msecs
    [ 206.405500] PM: Finishing wakeup.
    [ 206.405502] OOM killer enabled.
    [ 206.405504] Restarting tasks … done.
    [ 206.948747] systemd-logind[2445]: Operation ‘sleep’ finished.

  3. Thanks for the prompt reply, John. lsmod reveals that tpm modules are not loading. I tried blacklisting all of them, but they never load, AFAIK so it’s pointless. If I try to suspend without kernel options I actually don’t get the 38 error but the system hangs on the 2nd suspend attempt. With tpm_tis.force=1, I get the error 38 but at least the computer doesn’t hang and it keep it from needing to recover the filesystem journal after power cycling, though it appears to panic on an ugly shutdown.

    tpm_tis.interrupts=0 only creates a couple of IRQ mismatch errors or something and doesn’t appear to help with suspend at all (despite what my previously linked thread says).

    This thread is also on the right track:

    However, the python3 test command only completes successfully when I boot with tpm_tis.force=1 (though the result doesn’t impart a fix). Without tpm_tis.force=1, I get:

    FileNotFoundError: [Errorno 2] No such file or directory: ‘/dev/tpm0’

    Obviously tpm elements are built into the kernel and not loaded as modules and they are incompatible with your ROM. Unless someone more knowledgeable about Linux TPM handling has some suggestions, I think I’ll need to rebuild a kernel. Sadly, most MX-Linux (or just about any other Linux but Gentoo ;)) users are unlikely to rebuild a kernel for their Chromebook!

    1. Well, this is what I get on mine:

      root@c710:~# dmesg |grep -i tpm
      [ 1.703939] ima: No TPM chip found, activating TPM-bypass!

      Also, if you extract the config file from the ROM, you’ll see there are no TPM options set. If you look at the config options set on the Jenkins server for the SeaBIOS payloads, you’ll also see there’s no TPM support enabled there.

      So, I don’t know what your suspend problem is, but it’s not down to the TPM, as the firmware is not enabling it.

      tpm_tis used to be loaded as a module – I’m not sure when that changed, but it must’ve been at some point in the last 3 or 4 years.

      1. >root@c710:~# dmesg |grep -i tpm
        >[ 1.703939] ima: No TPM chip found, activating TPM-bypass!

        That’s what I get too, John. Thanks for checking.

        During wakeup, I always (kernel option or no kernel option) get:

        [ 178.784354] genirq: Flags mismatch irq 0. 00000080 (mei_me) vs. 00015a00 (timer)
        [ 178.784388] mei_me 0000:00:16.0: request_threaded_irq failed: irq = 0.
        [ 178.784396] dpm_run_callback(): pci_pm_resume+0x0/0x90 returns -16
        [ 178.784399] PM: Device 0000:00:16.0 failed to resume async: error -16

        So maybe the smoking gun lies in those errors.

        However, even though no TPM modules are loaded, I get TPM error messages in dmesg (when I use the force=1 kernel option workaround suggested in the thread). Thus I know the kernel contains some vestiges of TPM code baked-into it (which inspires mistrust, given how many people have reported the same symptoms along with error 38.!

        After 1st suspend attempt:

        [ 197.203607] tpm tpm0: A TPM error (38) occurred continue selftest

        After 2nd suspend attempt (there is no 2nd attempt dmesg without the kernel option, because its hangs):

        [ 420.190800] tpm tpm0: Error (38) sending savestate before suspend
        [ 420.190813] dpm_run_callback(): platform_pm_suspend+0x0/0x40 returns 38
        [ 420.190819] PM: Device tpm_tis failed to suspend: error 38
        [ 420.428599] PM: Some devices failed to suspend, or early wake event detected

        I’ll link this comment page to the MX Linux forum and see what the kernel gurus suggest.

        1. You’re welcome. Okay, well this is happening in Ubuntu 16.04 on kernel 4.4.0-116. I’m pretty sure the C710 was one of the less problematic Chromebooks in terms of power-saving (didn’t have to do things to workaround ehci-pci as you did on Haswell). I would recommend you boot different kernel versions to compare and contrast, and then you might be able to narrow down where this regression was introduced. I would even go back to kernel 3.x just as a test.

          Yeah, I think I’m seeing pretty much the same errors too – that one is related to the Intel Management Engine.

          I’m pretty sure that unless the TPM is initialised in some way by the firmware it will just sit there like a dumb eejit. The Management Engine, with its proprietary version of Minix, really is the one you should worry about. ;)

          Best of luck with it.

  4. Bingo! You were right, John. Woowhoo!! Disabling mei did the trick. I could not do it with modprobe -r, because mei was in use so I used the grub editor and temporarily added the kernel option

    (with no spaces)

    during boot and it worked. Now I’ll put it in grub and do a

    sudo update-grub

    I worked for Intel for over 20 years as a Sr. Hardware Engineer and all I can say is, gee Intel, let’s have some more of your wonderful TPM, AMT, MEI and other features we don’t want and can’t (fully) decline or disable so you and your globalist partners and spooks can own the chips and PCs we pay-for!

    I’ve been a PayPal almost as long as there’s been PayPal and this is the first time I can’t logon, despite two password resets. I keep getting an error on the paypal logon screen (from your “Donate” link or otherwise). I promise that when they get it fixed, I’ll donate 16 EU / ~ 20 bucks U.S. to you and I hope others from the MX community make it over here and donate too. I’ll be linking this page and discussing whether a bug report is in order. I much prefer to donate cash to you than endure bitcoin mining! You’d have my 20 bucks already, if PayPay would have let me logon!

    1. If you remove me_mei first, it will work, since that’s what’s using mei. Of course, you’re going to blacklist anyway, so it doesn’t matter.

      Amen – scary, scary shit they’ve done. They need to cop on.

      You could just donate as guest without an account, although I recognise the link to do it isn’t entirely obvious on the donate page, and thank you!

  5. Donation completed. It turns out that apparently PayPal considered the act of clicking on your “donate” button to be an abnormal transaction for me (maybe because it was Euros?) and locked-down my account. It took 20 mins. on the phone to straighten it out, answering “security” questions from as long as over 20 years ago! Maybe just letting you mine on my machine awhile is actually a better method. :(

    The donation is also on behalf of the MX Linux users group and forum. Except for the mei de-fanging to get suspend working, MX Linux is a turn-key installation using your ROM.


    1. I appreciate the donation, and I understand people have a big psychological problem with mining, but the fact is that the vast majority of users who come here don’t contribute anything, they just take.

      The other added benefit of the mining (in terms of the captcha) is it has zeroed the amount of comment SPAM I’m now getting. I may well decide to disable the auto-miner on the main page in favour of just using captcha, as the amount of money it’s earning is derisory. But I do want to get something from the silent majority who just come to the page, take what they need, and leave. If you have any better ideas on how to achieve that, I’m all ears. Donations have understandably gone down over the last months and years, so there is no way I’m earning enough to buy new models as things stand, and I’m certainly not going to fork out ¬£30 quid a month for a decent unmanaged server on the internet, like I was (hence the C710 serving the website from my own internet connection) …

  6. Yes–of course! modprobe -r mei_me needs to happen first, because lsmod did, in fact, show that it was using mei. Thanks! I guess it was getting late for me but no matter–I just made it persistent right from the start with the kernel blacklist option, as you noted. Blacklisting using an /etc/modprobe.d file would probably work too, I guess.

    Also thanks for your thoughts and considerations regarding donations. I can see the upside to the mining. I inadvertently “triple paid” I think, because I unwittingly kept restarting the mining captcha to comment. That’s okay though, and I don’t mind paying (donating), except when the price is my patience! ;) Philosophically I love crypto currencies. I just wish crypto had realized its inherent benefits as money, instead of mostly realizing the world’s largest casino! Maybe someday, but people obviously love casinos more than they love sound money!

    Here’s a link for anyone who wanders here and decides to “LinuxBook” away their ChromeOS:

    There may be a formal guide in MX Wiki > Hardware someday too.

    1. Believe it or not, I have to do the captcha to login as admin – most times I have to do it at least twice, because I hit enter in a rush! :P

      It’s been a pleasure, and thank you for kinda understanding – wish I could say the same for the guy who contacted my work in regard to the mining …

  7. full rom install which was choice number 5 for me.

    $ inxi -M
    Machine: Device: desktop System: Google product: Parrot v: 1.0 serial: N/A
    Mobo: Google model: Parrot v: 1.0 serial: N/A
    BIOS: coreboot v: 4.0-6588-g4acd8ea-dirty date: 09/04/2014
    $ inxi -S
    System: Host: biker Kernel: 4.15.5-antix.1-amd64-smp x86_64 bits: 64
    Desktop: IceWM 1.4.2 Distro: antiX-17_x64-full Heather Heyer 24 October 2017

    I will donate with paypal

Leave a Reply