Chromebook Samus

First, you need the following binary blobs:

  • descriptor.bin - Intel flash descriptor
  • me.bin - Intel Management Engine
  • mrc.bin - Memory Reference Code, which sets up SDRAM
  • refcode.elf - Additional Reference code
  • vga.bin - video ROM, which sets up the display

If you have a samus you can obtain them from your flash, for example, in developer mode on the Chromebook (use Ctrl-Alt-F2 to obtain a terminal and log in as ‘root’):

cd /tmp
flashrom -w samus.bin
scp samus.bin username@ip_address:/path/to/somewhere

If not see the coreboot tree where you can use:

bash samus

to get the image. There is also an ‘’ scripts that you can use on the ‘coreboot-Google_Samus.*’ file to short-circuit some of the below.

Then ‘ifdtool -x samus.bin’ on your development machine will produce:


Rename flashregion_0_flashdescriptor.bin to descriptor.bin Rename flashregion_2_intel_me.bin to me.bin You can ignore flashregion_1_bios.bin - it is not used.

To get the rest, use ‘cbfstool samus.bin print’:

samus.bin: 8192 kB, bootblocksize 2864, romsize 8388608, offset 0x700000
alignment: 64 bytes, architecture: x86
Name Offset Type Size
cmos_layout.bin 0x700000 cmos_layout 1164
pci8086,0406.rom 0x7004c0 optionrom 65536
spd.bin 0x710500 (unknown) 4096
cpu_microcode_blob.bin 0x711540 microcode 70720
fallback/romstage 0x722a00 stage 54210
fallback/ramstage 0x72fe00 stage 96382
config 0x7476c0 raw 6075
fallback/vboot 0x748ec0 stage 15980
fallback/refcode 0x74cd80 stage 75578
fallback/payload 0x75f500 payload 62878
u-boot.dtb 0x76eb00 (unknown) 5318
(empty) 0x770000 null 196504
mrc.bin 0x79ffc0 (unknown) 222876
(empty) 0x7d66c0 null 167320

You can extract what you need:

cbfstool samus.bin extract -n pci8086,0406.rom -f vga.bin
cbfstool samus.bin extract -n fallback/refcode -f refcode.rmod
cbfstool samus.bin extract -n mrc.bin -f mrc.bin
cbfstool samus.bin extract -n fallback/refcode -f refcode.bin -U

Note that the -U flag is only supported by the latest cbfstool. It unpacks and decompresses the stage to produce a coreboot rmodule. This is a simple representation of an ELF file. You need the patch “Support decoding a stage with compression”.

Put all 5 files into board/google/chromebook_samus.

Now you can build U-Boot and obtain u-boot.rom:

$ make chromebook_samus_defconfig
$ make all

If you are using em100, then this command will flash write -Boot:

em100 -s -d filename.rom -c W25Q64CV -r

Flash map for samus / broadwell:

ffbf8000:CONFIG_ENV_OFFSET (environemnt offset)
ffbe0000:rw-mrc-cache (Memory-reference-code cache)
ff801000:intel-me (address set by descriptor.bin)