Reverse Engineeringchrome osverified bootfirmwaregptkernel signingtpmchromebook

vboot-utils

vboot-utils provides Chrome OS verified boot utilities for manipulating GPT partitions, signing kernels and firmware, and handling Chromebook internals including verified u-boot. It includes tools like cgpt for GPT manipulation, vboot-kernel-utils for kernel signing, and various firmware utilities.

Description

The vboot-utils package contains tools for working with Chrome OS verified boot systems, particularly for Chromebooks. It enables manipulation of GUID Partition Tables (GPT) with Chromium OS extensions via cgpt, kernel signing with vbutil_kernel, and firmware operations through futility and other utilities. These tools are essential for developers modifying Chrome OS devices, signing custom kernels to boot on verified boot systems, and debugging firmware components.

Key components include cgpt for partition management, vboot-kernel-utils providing futility and vbutil_kernel for unified firmware tasks and kernel packing, and vboot-utils offering specialized tools like chromeos-tpm-recovery, crossystem, and dev_debug_vboot. Use cases involve creating keypairs, verifying boot processes, extracting firmware maps, and interfacing with TPM and nvram on Chrome OS hardware.

Most users only need cgpt and vboot-kernel-utils; the full vboot-utils is for advanced Chromebook internals handling. Tools support operations like prioritizing kernel partitions, dumping kernel configs, and modifying Google Binary Blocks (GBB).

How It Works

vboot-utils leverages Chromium OS verified boot protocols, using RSA keys in .vbprivk/.vbpubk/.keyblock formats for signing kernels and firmware. cgpt manipulates GPT headers, entries, and Chromium OS kernel priorities. futility unifies legacy tools, handling FMAP extraction, GBB manipulation, and key operations across vboot v1.0/v2.1 formats. vbutil_kernel packs vmlinuz with keyblocks, configs, and bootloaders into verified blobs, supports repacking, verification against public keys, and extraction. crossystem queries/sets firmware parameters like devmode flags and TPM states via Chrome OS cros_ec interface. dev_debug_vboot validates boot partitions using BIOS keys, logging to /var/log.

Installation

bash
sudo apt install vboot-utils

Flags

cgpt createCreate or reset GPT headers and tables
cgpt addAdd, edit or remove a partition entry
cgpt showShow partition table and entries
cgpt prioritizeReorder the priority of all kernel partitions
futility --vb1Use only vboot v1.0 binary formats
futility --debugBe noisy about what's going on
vbutil_kernel --packPack kernel with required parameters like --keyblock, --signprivate, --version, --vmlinuz
vbutil_kernel --verifyVerify kernel blob with optional --signpubkey
crossystem --allPrint all parameters with descriptions and current values
dev_debug_vboot -b FILESpecify the BIOS image to use

Examples

Show usage and supported commands for GPT manipulation
cgpt -h
Display unified firmware utility help with global options and built-in commands
futility --help
Show vbutil_kernel usage for packing, repacking, verifying, or extracting kernels
vbutil_kernel --help
Display TPM recovery help (requires USB test image in recovery mode)
chromeos-tpm-recovery -h
Show crossystem usage for querying/setting Chrome OS firmware parameters
crossystem -h
Display dev_debug_vboot help for verified boot debugging
dev_debug_vboot -h
Display FMAP contents from a firmware image
futility dump_fmap FLASHIMAGE
Get hardware ID and flags from GBB in bios file
gbb_utility -g bios.bin
Updated 2026-04-16kali.org ↗