mercuryworkshop/sh1mmer

source tree, website, and writeup for the sh1mmer chromebook jailbreak

Shady Hardware 1nstrument Makes Machine Enrollment Retreat

Website, source tree, and write-up for a ChromeOS™️ enrollment jailbreak

---

What is SH1MMER?

SH1MMER is an exploit found in the ChromeOS shim kernel that utilitzes modified RMA factory shims to gain code execution at recovery. For more info, check out the blog post/writeup here.

How does it work?

RMA shims are a factory tool allowing certain authorization functions to be signed, but only the KERNEL partitions are checked for signatures by the firmware. We can edit the other partitions to our will as long as we remove the forced readonly bit on them.

How do I use it?

Note

dl.sh1mmer.me has been taken down, so you'll need to find a site rehosting the RMA shims alongside Chromebrew.

Here's how you do that. First, you need to know your Chromebook's board. Go to chrome://version on your Chromebook and copy the word after stable-channel. If chrome://version is blocked, you can search up your Chromebook's model name on chrome100 and see what board it corresponds to. DO NOT DOWNLOAD A RECOVERY IMAGE FROM chrome100, IT WILL NOT WORK.

If your board name is in the list below, great! Find the RAW RMA shim corresponding to your board online. We can no longer provide raw RMA shims due to legal reasons. More information here.

ambassador, brask, brya, clapper, coral, corsola, dedede, enguarde, glimmer, grunt, hana, hatch, jacuzzi, kefka, kukui, lulu, nami, nissa, octopus, orco, pyro, reks, sentry, stout, strongbad, tidus, ultima, volteer, zork

If it's not, good luck. You'll have to try and call up your OEM and demand the files from them, which they are most unlikely to give to you.

---

Building A Beautiful World Shim

Now you can start building. Type out all of these commands in the terminal. You need to be on Linux or WSL2 and have the following packages installed: git, wget. You may need to install additional packages, which the script will prompt you to do.

git clone https://github.com/MercuryWorkshop/sh1mmer
cd sh1mmer/wax
sudo bash wax.sh -i path/to/the/shim/you/downloaded.bin

This will build a beautiful world mini shim. If you want to add chromebrew, do the following:

git clone https://github.com/MercuryWorkshop/sh1mmer
cd sh1mmer/wax
wget https://dl.darkn.bio/api/raw/?path=/Chromebrew/chromebrew.tar.gz
sudo bash wax.sh -i path/to/the/shim/you/downloaded.bin --chromebrew chromebrew.tar.gz -s 4G

Note

If you want to build a devshim, replace chromebrew.tar.gz with chromebrew-dev.tar.gz and replace -s 4G with -s 7G in the wax command. Devshim builds will mount a much larger Chromebrew partition over /usr/local, allowing you to access a desktop environment and even Firefox from within SH1MMER. It's what allowed us to run DOOM on a shim.

When this finishes, the bin file in the path you provided will have been converted into a SH1MMER image. Note that this is a destructive operation, you will need to redownload a fresh shim to try again if it fails.

After injecting, you may continue to the "Booting Into A Shim" section.

---

Building A Legacy Shim

The factory shims for boards such as hana or coral were built before graphics support was added into the tty. This makes it impossible for the Beautiful World GUI to work and thus a legacy CLI-only shim must be built.

Type out all of these commands in the terminal.

git clone https://github.com/MercuryWorkshop/sh1mmer
cd sh1mmer/wax
sudo bash wax.sh -i path/to/the/shim/you/downloaded.bin -p legacy

Note

Building a legacy shim will work on ALL BOARDS. Legacy shims are easier to update and are recommended for advanced users and developers.

When this finishes, the bin file in the path you provided will have been converted into a SH1MMER image. Note that this is a destructive operation, you will need to redownload a fresh shim to try again if it fails.

After injecting, you may continue to the "Booting Into A Shim" section.

---

Booting Into A Shim

Once you have injected your raw shim with SH1MMER, go into the Chromebook Recovery Utility, select the settings icon (⚙️), select Use local image, and then select your injected shim. Alternatively, you can also use other flashers such as BalenaEtcher, Rufus, UNetbootin, and etc. This may take up to 10 minutes, depending on the size of your shim and speed of your USB drive.

On the Chromebook, press ESC + Refresh (↻) + Power (⏻) at the same time to enter the recovery screen, then press CTRL + D at the same time and press Enter. This should enable Developer Mode or turn off OS Verification. This may be blocked by system policy, but that doesn't matter.

Press ESC + Refresh (↻) + Power (⏻) at the same time again, then plug in your USB with SH1MMER and you should be booting into the Beautiful World GUI or a CLI screen. From here, you can play around with the options and do what you want.

---

The Fog....

Downgrading and unenrollment has been patched by Google™️. If your Chromebook has never updated to version 112 (or newer) before (check in chrome://version), then you can ignore this and follow the normal instructions. If not, unenrollment will not work as normal.

Fog Bypass Details

If your Chromebook is on version 112 or 113, unenrollment is still possible if you're willing to disable hardware write protection. On most devices, this will require you to take off the back of the Chromebook and unplug the battery, or jump two pins. Further instructions are on the website.

"Unenrolling" with Write Protection

If you aren't willing to take apart your Chromebook to unenroll, you can use an affiliated project, E-Halcyon to boot into an unenrolled environment temporarily. This will bypass both issues of The Fog and The Tsunami, however further caveats are listed on the website.

The Tsunami

Disabling write protection has also been patched by Google™️. If your Chromebook has never updated to version 114 (or newer) before (check in chrome://version), then you can ignore this and follow the Unpatch instructions. If not, disabling write protection will not work as normal.

Tsunami Bypass Details

If your Chromebook is below ChromeOS version 120, unenrollment is still possible by using cryptosmite. Cryptosmite is now included as an extra payload for all shims.

Credits

• CoolElectronics - Pioneering this wild exploit
• ULTRA BLUE - Testing & discovering how to disable RootFS verification
• Unciaur - Found the inital RMA shim
• TheMemeSniper - Testing
• Rafflesia - Hosting files
• generic - Hosting alternative file mirror & crypto miner (troll emoji)
• Bypassi - Helped with the website
• r58Playz - Helped us set parts of the shim & made the initial GUI script
• OlyB - Scraped additional shims & last remaining sh1mmer maintainer
• Sharp_Jack - Created wax & compiled the first shims
• ember - Helped with the website
• Mark - Technical Understanding and Advisory into the ChromeOS ecosystem

sh1mmer's Issues

Getting Enterprise WiFi Passwords

Is it possible to obtain enterprise managed networks WiFi passwords with this tool? Sorry if this is a dumb question.

where to download shim for lenovo chromebook 300e gen 2 ast

i need the shim image to flash to a usb, i am not an authorized lenovo repair so i can't get it, and it's not on the driver site, i need it to remove enrollment

and no i am not underage lol

Support Tool

wax.sh: line 98: syntax error: unexpected end of file

There is no line 98 in wax.sh though as I downloaded it as well, please help.

Shim file doesn't work with Chromebook Recovery Utility

Doesn't appear that the chromebook recovery utility can write the shim file. I've tried multiple USB's, am using the correct shim, ran chrome as administrator, nothing works.

It gets stuck at writing, 0% completed.

Wax says I am using WSL, when I'm most definitely not.

It's not a huge issue as I'd assume it runs fine either way and is just a detection issue, but just wanted to let it be known. My actual kernel is 6.2.10-surface.

scam.html, scam.md et cetera make inaccurate claims about the GPL 3

I saw your increased anxiety about "scams" and felt that I had to weigh in (I have also been inspired by the copyright disclaimer of Team Twiizers with some of my own software, and have made the same legal mistake myself).

Before claiming that distributing the software for a fee is a violation of its copyright, you should seriously read:
https://www.gnu.org/licenses/gpl-faq.en.html#DoesTheGPLAllowMoney

It would only be illegal if they made a profit on the distribution of source code of the project when requested (after a binary copy is obtained)

Should you still wish to prohibit this form of distribution, then you should seek a new, proprietary software license (you will, of course, need unanimous agreement from anyone who wrote a portion of the code, since you can't just relicense copyrighted material where someone else holds the copyright where the license does not allow that - that would be copyright infringement, and the GPL 3 does of course require all derivative works to be redistributed under the same license).

Firmware autosetup in wax for wings

We should get some of the most common models, get the wifi drivers for all of them and then have wax wget them to /lib/firmware

we're gonna need a bit of help getting the correct drivers but it will make wings work for more than just r58

"Error mounting /dev/sda" and sh1mmer not making any changes on hana (100e 2G MTK)

Hello, I am trying to deprovision an old chromebook (Lenovo 100e 2nd gen MTK) that was decommissioned which had the enrollment left on it. Tried contacting the original district about it and they just told me to send it back so they could recycle it, which is kinda stupid considering they were the ones who let it go. I want to fix this rather than killing it off, so I looked into the sh1mmer exploit. While I was able to get the image to load, I could not get it to actually make changes to the system. Also, when I was building it with wax4web, it says a few things:

ERROR: mounting /dev/sda at /tmp/tmp.O5BV2M failed:
mount: mounting /dev/sda on /tmp/tmp.O5BV2M failed: Invalid argument
ERROR: mounting /dev/sda at /tmp/tmp.LZWGyS failed:
mount: mounting /dev/sda on /tmp/tmp.LZWGyS failed: Invalid argument

I suspect it was not entirely successful with the operation? I couldn't see any errors on the chromebook but I tried doing the following in order:
-De-provision
-disable block_devmode
-enable USB booting

and it still won't let me into devmode, which also leads me to think that it didn't deprovision the device and enable USB booting either. This device clearly has not been updated to 111 considering the bootscreen is the old style one and not the newer one, so it should work in theory. Is there a specific version I need to download and recover to before I can get this working correctly? I'm not sure what version of Chrome OS it is on but I know it was last used in February 2022. Also, I tried building a legacy shim from my own linux VM and that did not work.

Something cool I found in chromeOS settings

Hello!
So if you go to chrome://os-settings/apps, go to google play, then go to manage android preferences you can see the version name at the bottom of the window that pops up, also im pretty sure it's not blocked for people yet.
I hope you can use this info to help with your stuff.
Thank you!

unblock_devmode not working

every time I use unblock_devmode I get an error, and I never am able to fix it. It displays something about line 73, but the error never stays on screen long enough for me to see.

grunt - unofficial image error

i am trying this on a 100e gen 2 ast (grunt board), and have tried two different flash drives, both sandisk and well large enough.

i was able to use the images on chrome100.dev to compile to a sh1mmer image, and flashed it with dd.
but seemingly regardless of the drive or version i use, i get the "trying to install an unofficial Chrome OS recovery image which does not pass verification" error every time.
i have checked multiple times that i am following the procedure exactly, but it doesn't make a difference

i am doubtful that its the drives themselves, as the linux_recovery script from google did flash a working image on the first one i tried just fine.

Challenge QR code does not function.

During setup of shimmer, a challenge window appeared. This has a QR code that is not currently functioning.

Side Note: How to input the authorization code is not defined.

Chromebook not unenrolling

/usr/sbin/sh1mmer_utilities.sh: line 73: read: THERE WAS AN ERROR! The utility likely did not work. Press return to continue. ' : not a valid identifier

I need help with sh1mmer utilities don't work (firmware_management_parameters cannot remove)

When ever i go to unenroll it js says it failed how do i fix it

If you install MrChromebox's UEFI but then go back to the stock chromebook firmware, can you still re-enroll?

If you installed MrChromebox's UEFI on a chromebook that had been un-enrolled with sh1mmer, but then changed your mind, went back to stock firmware, would you still be able to re-enroll the Chromebook or at that point would it be permanently unenrolled?

apologizes if this is a dumb question

Hana - No Sh1mmer Menu

After following the instructions on the site, I am unable to get a Hana machine to get to the Sh1mmer menu.

I have tried the following:

• Windows machine for host, web wax, chrome recovery extension
• Linux host, github instructions, dd to flash usb
• Three separate USB drives
• Three separate Hana devices

The machine starts from the usb, says it copies everything over, and then will just have a blank screen with a line about an image file, but with a missing leading "I" character (mage:file=/usr/share/sh1mmer-assets/Disclaimer.png;scale=1). The only response I get out of it is that it will list more image file names if i hit the down arrow. The enter key will either claim that there is no file or it will reboot the machine entirely.

Chrome Recovery Extension/dd

If you are going to put the speed bump of having to compile yourself so k12sysadmin doesn't get those files, you might as well put the instructions of how to flash the image to a USB using dd on Linux since the extension isn't supported. Of course most Linux users would know, but just saying.

Unenrolling via sh1mmer as well as downgrading are impossible in versions after chromeOS 111

i don't want to spend 20 more hours trying to get chrome 112 to downgrade with various bash commands that don't work if someone else has found a solution

stuck on the device owner has disabled developer mode the system will reboot in verified mode

i'm pretty sure this means it's bricked

No Payloads?

I tried writing my modified shim multiple times to multiple USB's & SD Cards, and rebuild many times. Every single time I have not been able to use any payloads.
Board: grunt & jacuzzi (tested on both)
Version: jacuzzi: 91.0.4472.102, grunt: 101.0.4951.59

Weston Desktop Environment Launch Error

On loading the weston desktop environment launch payload from the payload execution menu in sh1mmer, it will get stuck on a black screen. However, for whatever reason, using the open bash utility and running the payload there using the bash command will load it just fine.

shim mirror down

I apologize as I do think this is included in your whole do not make a issue if the following thing but I am not able to access and download the Shim matching my board I get this message "No webpage was found for the web address: https://mirror.the-repo.org/RMA/Shims/grunt.bin HTTP ERROR 404" regardless the device I use I get the same message and I genuinely don't know where else to go about this or else I would have went there first. Is there just no way to access the files anymore or are they just down or something?

ive downloaded everything

i have installed all packages and have a shim but says cant open wax.sh

Is it possible to use the universal rma shim?

My friend has a barla chromebook and there is no leaked rma shim for it. I did however find a universal shim for all board models could I use that?

Issues sh1mming chromebooks with cr50 on H1 chip after R111

There is currently an issue with sh1mming chromebooks with cr50. I tried disconnecting the battery but that did not work. It was smooth sailing until the final powerwash in which the system still enterprise enrolls even after entering developer mode through the "verification is off" menu on startup. This may be an issue for many board types but these are the most common with the issue:

Models:  HP Chromebook 11 G series EE, Lenovo Chromebook 500e
Version: >R108
Board:   Octopus, Dedede

Sh1mmer was attempted using step from this post due to normal installation not working:
https://www.reddit.com/r/MercuryWorkshop/comments/13dzgak/how_to_use_sh1mmer_after_version_111/

Devshim not showing payloads

I finished building a dev shim, the one I was informed has payloads, and entered the payloads tab after loading it on a computer and found literally nothing. I have rebuilt the shim several times, reflashed it to the usb, but to no avail. Please help.

flashromFullRead() error from vpd command

Cant unenroll, reenroll, or disable block_devmode

Error with making dev files

When trying to make a dev file I get this in the WSL terminal:
The file /dev/loop3p13 does not exist and no size was specified.

All packages are installed properly and up to date as well as Ubuntu

I found another way to find device version.

If chrome://version is blocked, you can search up your chromebook's model name on chrome100.dev and see what board it corresponds to.

You can just go to settings and then, apps then google play store, then Manage Android Preferences, and the version will be right at the bottom.

SH1mmer does not work

Once I finish everything and the jailbreak is injected, I click restart and then it goes to the "OS Verification" screen. Then I click enter and it reboots and still finds the enterprise enrollment. Any help?

another issue

sorry to need help again but on this code sudo sh wax.sh /path/to/the/shim/you/downloaded.bin is says cant open wax.sh

shimmer chromebrew file

Hi, I'm trying to build the iso from the source, but in the instructions it says that I need a file from here. as sh1mmers website is down, is there any other way to get this file?

help

this specific code wget https://dl.sh1mmer.me/build-tools/chromebrew/chromebrew.tar.gz wont work and it will time out

Sh1mmer utilility likely did not work

Everytime I try using an option in the sh1mmer menu, unenrollment, usb unblock, dev mod, etc, it gives me an error saying “Sh1mmer utility likely did not work”. I have tried using the shell to run the commands by themselves, but I have had no luck so far. How can I fix this?

READ THIS BEFORE MAKING AN ISSUE

IF YOUR ISSUE INVOLVES ANY OF THE FOLLOWING

• enrollment
• firmware
• getting wireless access point passwords
• where to download a shim
• the website (or parts of it) being down
• "unofficial image" errors
• WSL issues
• QR codes
• i found XYZ
• sh1mmer utilities don't work (firmware_management_parameters cannot remove)
• Beautiful World GUI not working

DON'T MAKE AN ISSUE!

• it is not our fault if you can't re-enroll
• it is not our fault if your chromebook is bricked or can't be enrolled because you're using CFW
• it is not our fault if you can't connect to your school's wifi
• it is not our job to direct you to where to find shims
• it is not a sh1mmer issue if the website is down
• you are using a recovery image if you get an unofficial image error
• WSL is not supported
• we did not add QR codes, you are using a raw shim
• make a pull request
• downgrade to v110 or below
• your board doesn't have frecon and needs a legacy shim

IF YOUR QUESTION SOUNDS SIMILAR TO ANY OF THESE, DON'T POST IT OR I WILL SMITE YOU

WE ARE NOT TECH SUPPORT

firmware_management_parameters cannot remove

Wipe flags and unblock dev_mode fail.

removal of troll() functions

let's not mess up peoples computers on purpose

wax script doesn't seem to work in WSL (version 1)

I can't get it to function properly under WSL 1, due to an error about something with loop devices (bottom line)
cgpt also doesn't seem to be in the WSL repos, but even installing it manually doesn't fix this.

Log:

bridget@DESKTOP-02C0T7M:~/sh1mmer/wax$ sudo ./wax.sh ~/chromeos_14695.142.0_snappy_recovery_stable-channel_mp.bin --dev
-------------------------------------------------------------------------------------------------------------
Welcome to wax, a shim modifying automation tool made by CoolElectronics and Sharp_Jack, greatly improved by r58playz and Rafflesia
Prerequisites: cgpt must be installed, program must be ran as root, chromebrew.tar.gz needs to exist inside the wax folder
-------------------------------------------------------------------------------------------------------------
Launch flags you should know about: --dev will install a much larger chromebrew partition used for testing, --antiskid will relock the rootfs
Expanding bin for 'arch' partition. this will take a while
7516192768 bytes (7.5 GB, 7.0 GiB) copied, 48 s, 157 MB/s
7+0 records in
7+0 records out
7516192768 bytes (7.5 GB, 7.0 GiB) copied, 47.7404 s, 157 MB/s

Welcome to fdisk (util-linux 2.37.2).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

GPT PMBR size mismatch (21308975 != 40183343) will be corrected by write.
The backup GPT table is not on the end of the device. This problem will be corrected by write.

Command (m for help):
The partition table has been altered.
Syncing disks.

Partitioning

Welcome to fdisk (util-linux 2.37.2).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.


Command (m for help): Partition number (14-128, default 14): First sector (16452-40183310, default 21309440): Last sector, +/-sectors or +/-size{K,M,G,T,P} (21309440-40183310, default 40183310):
Created a new partition 14 of type 'Linux filesystem' and of size 9 GiB.

Command (m for help): The partition table has been altered.
Syncing disks.

Creating loop device
losetup: cannot find an unused loop device: No such device

fdisk error

I went into the code after several errors claimng 'fdisk not found'. I am not a fully advanced shell developer, but I do know that fdisk is deprecated and needs replacement.

Various parts of sh1mmer assume hardware configurations that are not always consistent

I would personally guess that these issues occur due to the hardware you developed the exploit on being different from mine.

I have found both the below issues to occur on volteer chromebooks (collis customisation id)

1)Assuming the internal disk is eMMC. This is not always the case, on some devices it is an NVMe SSD (e.g. /dev/nvme0n1 for whole device, /dev/nvme0n1p1 for individual partition)
This can cause these payloads and utilites to fail. Examples which will fail are:
troll.sh (the payload)
disable_verity() in sh1mmer_utilities.sh

2)Display resolution is not always consistent across chromebooks
Some chromebooks have high-resolution displays, the various images sh1mmer displays in its UI will display as if some heavy overscan compensation has been enabled (i.e. centred, with a massive black border around them). However, text from the console will display in the correct position, becoming inconsistent (this is very visible in e.g. the payloads menu, where the text is outside of the console border). All functionality (where not affected by issue 1) still works.

Some suggested workarounds:
For issue 1)

• In the script ran at startup, try and run lsblk, then grep for nvme (if this fails, let the user select manually as below, do not search for mmc since this might be e.g. a sd card). Based on the result, set an environment variable or something specifying which device type to use, and then read this from scripts.
• If autodetection is impossible, let the user select if they have a NVMe ssd, eMMC, or something else (perhaps standard linux /dev/sd(x)[i] block devices), maybe with the output of lsblk above the prompt to help them decide.
• If autodetection is impossible, let the user specify when running the relevant commands

For issue 2)

• When building, provide an option to use high-res UI images (could just be upscaled in krita tbh, they don't have to be redone if this is obnoxious)
• Have a fallback, text-only UI that can be manually invoked, or set to run by default when building

It should be noted that the "core" functionality of sh1mmer (i.e. unenroll and unblock devmode) is unaffected by these issues, at least on the hardware I used.

difference between devshim and normal shim?

Readme does not explain so can anyone clarify?

Developer Mode is disabled on this device by system policy

Is it possible to disable or bypass this?

It fails to boot to the drive when you plug it in because of this

thanks :)

Permission Denied

Hello! I created a legacy shim on a Dedede shim, and when I opened it up, it gave me

sh: 1: factory_install.sh: Permission denied

Any solutions?! I used the GitHub repository to build the shim.

RMA Shim base code

Hello, this isn't an issue, I just have a question. I was just wondering how I could access the root files of the Shim to remove the code listed in the Breaking Chrome OS article on coolelectronics.me. Thank you.

weston

got a —dev shim, im downgraded and its a black screen on the environment script for sh1mmer. is any support available

Used this guide to sh1mmer after v111, it still fails to disable dev mode

https://www.reddit.com/r/MercuryWorkshop/comments/11ohd7m/how_to_use_sh1mmer_after_chrome_111/
Used this guide, it still fails to disable dev mode (I used an v91 image from chrome100.dev but that shouldn't matter)
#42

Someone is eventually going to have to add arrow key support and selection boxes for Beautiful World.

Utilities image needs to be updated.

sh1mmer won't open when USB drive plugged in

I downloaded the octopus shim from here and flashed it to a USB stick. when I go to the Esc+Refresh+Power screen and plug it in it shows this

(I just found that Image online I did not take it.)
Did I do this right or am I dumb?

Chromebook specs just in case:
Dell Chromebook 3100
Chrome OS Version 80.0.3987.137
Platform 12739.94.0-20.03.05

I downgraded to v80 from v109 using a recovery USB

rma shim download page not working

`

<title>Worker threw exception | dl.sh1mmer.me | Cloudflare</title></title> <style>body{margin:0;padding:0}</style> <script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementById('cookie-alert'); cookieEl.style.display = 'block'; }) } </script>

Please enable cookies.

Error 1101 Ray ID: 7c9f660d4d2f86aa • 2023-05-19 21:23:01 UTC

Worker threw exception

  <section></section><!-- spacer -->

  <div class="cf-section cf-wrapper">
    <div class="cf-columns two">
      <div class="cf-column">
        <h2 data-translate="what_happened">What happened?</h2>
        <p>You've requested a page on a website (dl.sh1mmer.me) that is on the <a href="[https://www.cloudflare.com/5xx-error-landing/](view-source:https://www.cloudflare.com/5xx-error-landing/)" target="_blank">Cloudflare</a> network. An unknown error occurred while rendering the page.</p>
      </div>

      
      <div class="cf-column">
        <h2 data-translate="what_can_i_do">What can I do?</h2>
        <p><strong>If you are the owner of this website:</strong><br />you should <a href="[https://www.cloudflare.com/login?utm_source=error_100x](view-source:https://www.cloudflare.com/login?utm_source=error_100x)" target="_blank">login to Cloudflare</a> and check the error logs for dl.sh1mmer.me.</p>
      </div>
      
    </div>
  </div><!-- /.section -->

  <div class="cf-error-footer cf-wrapper w-240 lg:w-full py-10 sm:py-4 sm:px-8 mx-auto text-center sm:text-left border-solid border-0 border-t border-gray-300">

Cloudflare Ray ID: 7c9f660d4d2f86aa • Your IP: Click to reveal censored • Performance & security by Cloudflare

<script>(function(){function d(){var b=a.getElementById("cf-footer-item-ip"),c=a.getElementById("cf-footer-ip-reveal");b&&"classList"in b&&(b.classList.remove("hidden"),c.addEventListener("click",function(){c.classList.add("hidden");a.getElementById("cf-footer-ip").classList.remove("hidden")}))}var a=document;document.addEventListener&&a.addEventListener("DOMContentLoaded",d)})();</script>

</div><!-- /#cf-error-details -->

<script> window._cf_translation = {}; </script> `