Announcement

Collapse
No announcement yet.

Macbook M1 bypass FMM / EFI Unlock

Collapse
This topic is closed.
X
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    #21
    Re: Macbook M1 bypass FMM / EFI Unlock

    Originally posted by ebaymonster View Post
    I have 5pcs MBA 2020 m1 and 1 MBP 13 m1 + t203. if you want i can desoldering and make dump.
    It will be great.

    I have tried M1.bin and M2.bin, MBP did not start, it entered dfu mode and did restore with appleconfigurator2, which updated iBoot-7429.81.3. Now it starts but nothing has changed (SN/Activation Lock is still the same - can check SN in diagnostics mode). If I put old dump which was working before with iBoot-6723.50.2 will power on then restart, cycle all over again.

    Data we need might be in ssd NAND, but I think secureboot bits are set in SOC bios rom. We need an easier way to access NAND sysconfig area.
    Attached Files

    Comment


      #22
      Re: Macbook M1 bypass FMM / EFI Unlock

      Originally posted by Nico Latour View Post
      m1 bin is encrypt! when you decrypt you see serial!!! but change serial in this bin is not working for unlock icloud)
      how about MDM locked M1 with modified serial situation? Did you test ?
      Kill the state in yourself and you will be free like a wind...

      Comment


        #23
        Re: Macbook M1 bypass FMM / EFI Unlock

        Haven't found a way (yet) to change the SN for M1 machines. There is no clue SN would be in Winbond SOC rom. Writing content from other machine would stop booting, after dfu restore SN is unchanged. It might be here encrypted, and backed up in ssd nand flash like on iphones/ipads. In the end, can't see the scope of having this SOC chip.. maybe it holds iBoot bootloader code, or act as a backup and SN is encrypted here.

        Another lead to be investigated is to intercept spi communication with the chip in various states of machine: boot.. mdm.. activation lock check.. efi password verification.
        I'll put my logic analyzer at work and keep you updated. Any suggestion is welcomed.

        Comment


          #24
          Re: Macbook M1 bypass FMM / EFI Unlock

          Is your m1 have boot secure locked? can you boot from usb etc ?
          Kill the state in yourself and you will be free like a wind...

          Comment


            #25
            Re: Macbook M1 bypass FMM / EFI Unlock

            Yes, secureboot is enabled + activation lock. It would be nice to have dump of M1 machine without icloud/mdm one with secureboot disabled and one with secureboot enabled, so we can compare content.

            Comment


              #26
              Re: Macbook M1 bypass FMM / EFI Unlock

              Secureboot settings are stored in NVRAM
              you can disable Secureboot and enable USB boot by commands on T2 jailbroken machines.

              Comment


                #27
                Re: Macbook M1 bypass FMM / EFI Unlock

                Originally posted by .::iRizwan::. View Post
                Secureboot settings are stored in NVRAM
                you can disable Secureboot and enable USB boot by commands on T2 jailbroken machines.
                Two commands actually.
                one for Disable secure boot
                and one for Enable USB Boot.

                Comment


                  #28
                  Re: Macbook M1 bypass FMM / EFI Unlock

                  some will argue that can be done in a single command
                  yes can but actually these are 2 separate commands.

                  Comment


                    #29
                    Re: Macbook M1 bypass FMM / EFI Unlock

                    Apparently after flashing SOC rom I can see external boot device. Who can share working external drive image of BigSur then try to copy it into internal M1 flash and start normally.
                    Attached Files

                    Comment


                      #30
                      Re: Macbook M1 bypass FMM / EFI Unlock

                      I don't know if this can help. But it is possible to dump every partition mounted in diagnostics mode. There are some Firmware Files (img4) on there. But this probably wouldn't help, right?

                      Comment


                        #31
                        Re: Macbook M1 bypass FMM / EFI Unlock

                        Originally posted by HansTodi01 View Post
                        I don't know if this can help. But it is possible to dump every partition mounted in diagnostics mode. There are some Firmware Files (img4) on there. But this probably wouldn't help, right?
                        How would you do that? Please detail your findings so we can replicate.

                        Comment


                          #32
                          Re: Macbook M1 bypass FMM / EFI Unlock

                          Originally posted by betonel View Post
                          How would you do that?
                          As it turns out, you can download files to an External Storage Device using the built-in Safari. So I also tried if you could upload files from mounted partitions, and yes this work perfectly fine (on some sites it won't).

                          So I quickly coded a Webpage with JSZip that combines all selected files to a ZIP and then starts the download. The ZIP is then saved to the Storage Device using Safari.
                          It would probably work out to just use Google Drive or something, but this was the most local solution (nothing saved on server, basically just download your uploaded files).

                          I used my web server and domain to do this because it seems to require an actual Domain and also doesn't allow PHP Files.

                          There are multiple Partitions on there, which you can see if you go to:
                          Safari --> Settings --> Download Folder --> Select

                          (At the top, where your current folder is displayed, you can click on the dropdown and then select the MacBook to see even more)

                          Comment


                            #33
                            Re: Macbook M1 bypass FMM / EFI Unlock

                            Download terminal app in place of safari.app overwrite, close safari.. open again then u re in terminal. Too good to be true, but worths trying.

                            Comment


                              #34
                              Re: Macbook M1 bypass FMM / EFI Unlock

                              I think you can't write to the partitions. But I will try this soon

                              Comment


                                #35
                                Re: Macbook M1 bypass FMM / EFI Unlock

                                Originally posted by HansTodi01 View Post
                                I think you can't write to the partitions. But I will try this soon
                                Sure you can, I have downloaded some tests and it worked. But don't know about overwrite.

                                Comment


                                  #36
                                  Re: Macbook M1 bypass FMM / EFI Unlock

                                  tomorrow I will have a MacBook Air without blocking /absolutely normal. what do i need to do ?!
                                  1)....
                                  2)....
                                  3)....
                                  Last edited by ebaymonster; 02-07-2022, 07:04 PM.

                                  Comment


                                    #37
                                    Re: Macbook M1 bypass FMM / EFI Unlock

                                    Update:

                                    Socrom on MBA 13" M1 does not have SN written whatsoever. If it is written it is coded differently. I should have an unlocked M1 arriving next week
                                    sigpic
                                    MEOWING IN THE IMPOSSIBLE UNIVERSE!

                                    Comment


                                      #38
                                      Re: Macbook M1 bypass FMM / EFI Unlock

                                      Originally posted by Stephen View Post
                                      Update:

                                      Socrom on MBA 13" M1 does not have SN written whatsoever. If it is written it is coded differently. I should have an unlocked M1 arriving next week
                                      I already said this when you said there is no number in it (m1 bin is encrypted)

                                      Comment


                                        #39
                                        Re: Macbook M1 bypass FMM / EFI Unlock

                                        has anyone tried to unsolder SSDs and read them? an acquaintance of mine says he can solder them to his phone or tablet and read through ibox.

                                        Comment


                                          #40
                                          Re: Macbook M1 bypass FMM / EFI Unlock

                                          Hi. I get the 2020 M1 MBP, A2338 chassis 820-02020-11 with UF260 8MBIT-3.0V W25Q80DVUXIE.
                                          Can I do an activation after using T2 T203 programmer?
                                          This model is supported?

                                          Comment

                                          Working...
                                          X