Making the CR-48 Useful Again by Getting Rid of ChromeOS

Google CR-48Google CR-48

A couple years ago I was fortunate enough to be given a CR-48 by Google when they first launched the ChromeOS platform. It’s a neat little laptop with a lot of potential housing an Intel Atom N455 1.66GHz processor with 2GB of RAM and a 16GB SanDisk SSD. While it was a fun toy to play with, I never really got much use out of it, other than checking email and surfing the web on the free Verizon Wireless 3G connectivity when I was on the road. The lack of real applications and VPN made it difficult to get much done. I tried Ubuntu at one point, installing it on a USB stick, but it was painfully slow and virtually useless for anything other than browsing. Being the collectors item that it is and the electronics packrat that I am, I could never bear to part with it so it sat on a shelf and collected dust… Until I decided to get serious about studying wireless (particularly the CWAP).

Enter Backtrack.

For those that don’t know, Backtrack is a custom linux distribution built for security professionals. It is a suite of tools for vulnerability scanning and exploitation of all kinds with no other bells and whistles. A true hacker’s tool.

Anyway, enough history… Let’s get to the details. On a scale of 1 to 5, the difficulty rating of this install is 1. Seriously. My 7 year old could accomplish this by just following directions (maybe I’ll record that in a video tutorial). The pictorial that goes with this can be found here.

Side note: Once this is complete you will have not only a CR-48 with Backtrack 5 R3 installed on it, but also a Backtrack bootable SD card or USB stick you can carry with you.

Step 1:

Start the laptop in “Developer Mode”
Warning: This will remove all data on the laptop and take a few minutes to reconfigure the system the next time you boot.

  • Unplug the laptop
  • Do not plug it back in until noted in the instructions to avoid electrocution or damage to the laptop

  • Remove the battery
  • Remove the silver tape next to the battery terminals
  • Flip the developer mode switch
  • Done

Step 2:

Remove the pesky “Block writing to the BIOS tab”
This tab prevents data from being written to the BIOS. You can leave it in if you like, but it was a huge pain when I needed to make a boot order change so I completely removed it. If you opt to leave it in place, leave the bottom cover off for the remainder of the tutorial and make sure to place the laptop on a non-conductive surface. Avoid touching any exposed electronic components.

  • Remove 12 screws from the bottom of the CR-48 (including two under the rear rubber feet)
  • Carefully remove the bottom (pull from the VGA side to prevent damaging any ports)
  • Find the silver tab held down by a plastic rivet (near the SIM card slot)
  • Rip it out with extreme prejudice
  • Replace cover and all screws

Step 3:

Boot up and install a new BIOS
Now is the time to plug the laptop back in. After turning on the developer mode, it will take several minutes to wipe the existing configurations and boot up.

  • When presented with the frowning face you will have to press CTRL-D to get the system to boot
  • Follow the steps to get the system connected to a wireless network but do not log in
  • Press CTRL-ALT-→ to open a shell
  • Log in with the username chronos and no password
  • Download the new BIOS by entering the following command
  • wget http://
    – or –

    download it here and put it in your own repository

  • Backup the current BIOS (just in case) by entering the following command
  • sudo flashrom -r backup.bin
  • Copy your backup BIOS to your own drive or server
  • Install the new BIOS by entering the following command
  • sudo flashrom -w cr48bios_0.bin
  • Reboot and hit F2 to enter the new BIOS, F10 to select your boot options, or just let it go to go into ChromeOS

Note: Now is the time to put the cover back on if you have decided not to remove the BIOS protection tab.

Step 4:

Prepare the Backtrack Installation Media
Decide which version you want, I went with the newest at the time (Backtrack 5 R3, Gnome, x64). For this step I will assume you have a Windows machine available and either an SD card or USB stick (>4GB). I found that the most common tool used by the CR-48 community, UNetbootin, doesn’t work very well on OSX and won’t make the drive bootable so I resorted to using Rufus in Windows. If there’s another way that’s easier for you (external DVD drive, dd, etc.), knock yourself out. UNetbootin will automatically download and install certain version of many distributions, unfortunately it doesn’t have BT5R3 yet. Rufus on the other hand simply takes whatever you give it and makes an MS-DOS bootable disk out of it. So either way, I had to download it.

  • Download the Rufus tool here
  • Go to the Backtrack Linux download page and grab your version.
  • Under “Device” choose your installation media (this tool will wipe it out, so be sure it’s the right one)
  • Open Rufus and select “Quick Format” and “Create a bootable disk using:” (This is where you choose your ISO)
  • Click “Start” and wait

I found Rufus to be a bit faster and more effective than UNetbootin after several failed attempts to get anything to boot off the drives.

Step 5:

Install Backtrack
This is where it gets even easier.

  • Insert your SD card or USB stick into the CR-48 destined for greatness
  • Power up and hit F10 (Volume up) to be sure it boots from the correct drive
  • Once the boot menu is displayed, select “Backtrack Text – Default Boot Text Mode”
  • Wait while it loads, as soon as the boot is complete, you are dropped to a command prompt
  • Enter “startx” to go into the GUI
  • Once the system is loaded, you’ll see an icon on the desktop labeled “Install Backtrack” you should double click
  • The installer will pop up and guide you through language selection, time zone, keyboard layout, and disk options (I just used the whole 16GB SSD and blew out ChromeOS)
  • Once you hit “Install” on the last page it’ll take about 30 minutes to complete
  • Remove the installation media and reboot

That’s it. You now have Backtrack running on your CR-48. The Atheros radio allows for all kinds of fun and is recognized by default using the “ath9k” driver. The only thing I have noticed is a bit off is the trackpad… but it was that way even in ChromeOS.

Next up, I’m trying to get my Wildpackets branded Edimax EW-7733UnD working. Initial attempts at midnight last night were fruitless.

Leave a Reply

Your email address will not be published. Required fields are marked *