Personal Account - OOBESCAPE v2 (Sh1ttyOOBE)
Unenrollment until next powerwash on chromeOS v133-v138

Instructions:
1. Powerwash your Chromebook
2. On the "welcome to your Chromebook" screen, wait until you see the "Quick set up with Android" button (DO NOT PRESS GET STARTED IF IT DOESN'T SHOW IMMEDIATELY).
3. Hit CTRL+ALT+SHIFT+R and click "Cancel".
4. Click "Enter your google account email and password"; it should say to connect to a network.
5. Open Quick Settings from the bottom right and connect to a network.

Persistence method:
- After signing in, you can sign out and you will be back on the welcome screen.
- Progress through OOBE as normal by clicking Get Started and next - you will be greeted with three options to sign in.
- Sign in with the same email and when you sign in, it will hang on the Please Wait screen. 
- Simply restart or alt+volup+x and you will be placed on the lockscreen. 
- After that, you are done and can sign out/reboot and it will be persistent until next powerwash.

Using this to obtain a root shell:
After you have done the persistence method, you can recover to modified recovery images in unverified recovery, because vpd is not blocking developer mode. 
This can be used to obtain a root shell even on keyrolled devices via badrecovery unverified (https://github.com/BinBashBanana/badrecovery#:~:text=unverified,-version), but can not remove fwmp on kv5. 
Currently, this can be used to remove FWMP on keyrolled DEDEDE Chromebooks on kv4 without an android phone. See dededeicarus (https://github.com/HarryJarry1/dededeicarus) for more information.

Important info:
THERE IS A INCOMING PATCH! DO NOT UPDATE TO chromeOS v138 https://chromium-review.googlesource.com/c/chromium/src/+/6652065

Using this to unenroll (remove fwmp) if you already have write protect disabled on a keyrolled Chromebook: (can technically be followed while doing pencil sharpener)
1. Do sh1ttyOOBE with persistence
2. Make a 124 or older [badrecovery](https://github.com/BinBashBanana/badrecovery) unverified image
3. Recover to it in developer mode
4. Run the commands below:  
bash
flashrom --wp-disable
futility gbb -s --flash --flags=0x8090
5.  Reboot, dev mode will now boot successfully

Here is the [web builder](https://binbashbanana.github.io/badrecovery/builder.html), it may be easier as there are no prebuilts.

Credits:
https://github.com/crosbreaker/sh1ttyOOBE
crosbreaker
Titanium Network
