Sh1mmer

https://github.com/MercuryWorkshop/Sh1mmer

Sh1mmer is an exploit capable of completely unenrolling enterprise-managed Chromebooks.
By MercuryWorkshop

What are the features?

Unenrollment for Kernvers 1 through 6
Re-Enrollment
A modified version of MrChromebox’s firmware utility script
Set kernver to 1 (if already unenrolled)

Prebuilts

Currently unavailable.

Building

You must first obtain an unmodified (“raw”) RMA shim. You can find these at cros.download. You must unzip the file if it’s in a zip file.

Option 1: Use the web builder

Simply go to https://sh1mmer.me/builder, click Start, and select your raw shim .bin file. Wait a minute or two, and your Sh1mmer shim will automatically download.

Option 2: Build locally (requires Linux or WSL2)

git clone https://github.com/MercuryWorkshop/sh1mmer.git
cd sh1mmer/wax

Run this command with a raw or stripped shim:

sudo bash wax.sh -i path/to/shim.bin

To build Sh1mmer with the update payload for br0ker, replace the second command with

sudo bash update_downloader.sh <board>
sudo bash wax.sh -i /path/to/shim.bin -s 2.5G

Replace the 2.5G with 3.0G for Nissa boards

Flashing

Linux: (Replace /dev/sdX with your flash drive/sd card)

sudo dd if=/path/to/sh1mmer_shim.bin of=/dev/sdX bs=4M status=progress

Windows: Download Rufus, select your USB, select your sh1mmer image

macOS: Download BalenaEtcher, select your USB, select your sh1mmer image

ChromeOS: Download Chromebook Recovery Utility, select “Use local image” in the settings menu of it, select your USB, select your sh1mmer image

Booting

Press [Esc+Ref+Pwr], then [Ctrl+D] to enter developer mode.
Plug in your flash drive that you flashed Sh1mmer to.
Press [Esc+Ref+Pwr] again and allow the shim to boot up.