T2 Chip Programmer Tool

[kevingill]

Originally Posted by xploiter

it is not mdm locked if it is wiped and with activation lock. mdm gets installed during os installation.

If so, what's the purpose of the option in the Recovery Assistant -> Activate with MDM key?

[xploiter]

it has to be there for the use cases that require it

[Stephen]

Originally Posted by xploiter

it is not mdm locked if it is wiped and with activation lock. mdm gets installed during os installation.

Not true. MDM can still have Activation lock to the company email. Changing the serial will solve this issue and remove the lock for good. Even with iBridge 6+

[xploiter]

right activation lock is based on email - be it personal or company
mdm lock is based on user profiles defined by company
therefore you can't be mdm locked on a wiped computer since there is no os with profiles installed on it.
if the activation lock email is the company email it doesn't make it a mdm lock.

[pumemule]

Originally Posted by Stephen

Not true. MDM can still have Activation lock to the company email. Changing the serial will solve this issue and remove the lock for good. Even with iBridge 6+

But when i try to install os on mdm lock after serial change it give activation error.

[curiositymaster]

Originally Posted by pumemule

But when i try to install os on mdm lock after serial change it give activation error.

You need to activate your mac before changing serial. If your T2 mac is unactivated and you edit the serial, it won't go past the activation stage.

[pumemule]

Originally Posted by curiositymaster

You need to activate your mac before changing serial. If your T2 mac is unactivated and you edit the serial, it won't go past the activation stage.

So its one-time solution , in the next reinstall the mac will not be activated...

[.::iRizwan::.]

Originally Posted by pumemule

So its one-time solution , in the next reinstall the mac will not be activated...

don't do it by changing Serial.
do it by bypass method.

[Stephen]

Originally Posted by .::iRizwan::.

don't do it by changing Serial.
do it by bypass method.

Bypass method is not permanent why would anyone want to do that when changing the serial is 100% never coming back even if you DFU restore it?

Also to answer the other guy when he changes the serial it gives activation error, this means it’s iCloud locked and not MDM lock which means the T2 chip is the culprit, MDM locks do not use the T2 to communicate to verify. It goes like this

Apple Server checks in these steps.
1. Apple server checks Serial number , if it kicks back as MDM it follows up with two scenarios, you either get into Os Install or you get the company email lock.
2. Apple server checks T2 chip serial after step 1. So if step one is a serial that is changed and then checks to see if the T2 chip is assigned correctly, which in return will give Activation Server Error messages.

So in theory if you change the serial of an MDM device to new serial then you sign into your device with your iCloud after OS install and say you DFU reset it, that serial is now assigned to your iCloud with the T2 chip until you remove it.

Hope this helps

[Brais]

So,

Changing serial method will work on any T2 chip model, and sets it as a new device( any resets and updates will work as expected)?

And what happened if you register 2 different Iclouds with the same serial number?

[Stephen]

Originally Posted by Brais

So,

Changing serial method will work on any T2 chip model, and sets it as a new device( any resets and updates will work as expected)?

And what happened if you register 2 different Iclouds with the same serial number?

Original first iCloud will always kick back. No matter what you do, the first registered iCloud will always come back first. Meaning it needs to be removed. The second iCloud will not even exist, only when you use the device in of itself.

[Brais]

Many thanks for reply, seems logic, i will try and see what happened.


About T2 chip in a Macmini for exemple, is possible to remove Icloud with the serial method?

Thanks for help

[serkrn]

Hello
I reset the Macbook air 3 2o 2o comes out of the ground (bridge6) and activated icloud.
If I flash the T2 chip with Unlock firmware with soldering, will it help to lower the bridge and bypass icloud activation?

[lamo]

Originally Posted by serkrn

Hello
I reset the Macbook air 3 2o 2o comes out of the ground (bridge6) and activated icloud.
If I flash the T2 chip with Unlock firmware with soldering, will it help to lower the bridge and bypass icloud activation?

no.

[serkrn]

Originally Posted by lamo

no.

what options are there?

[Brais]

Hi, just someone who could ask this question:

Its possible to unlock an Imac or a Macmini with T2 chip and an icloud activation lock with the serial hardware method?

This item will remain as new, no locks , no icloud even with DFU mode resets?

The only condition is the ibridge version as explained?

Many thanks

[kevingill]

This was discussed a while back and I actually bought one to try out.
But sadly, there doesn't appear to be any purple mode software that works with Macs.

[styleangel]

warn someone buying a new mina tool. Apple did something to T2 and it doesn't work anymore

[mich6el]

Hi! my t2 chip transplant experiment failed. I successfully soldered the t2 chip but my board most likely has an underestimated resistance PP1V1_S3. This piece of shit, that I bought on ebay turned on black screen, after 5 times gomg and apple, before replayse t2 chip, after i have cycle dinamic voltage on PP5V_G3S. FUCKING CALCULATOR! I think i have bad cpu on this board to. Who can measure resistanse of PP1V1_S3?

[Timp74]

Originally Posted by ugamazing

Without being too informed on the current status/progress of a T2 bypass or unlock, can I ask a potentially-dumb question?

Would it be possible to somehow identify the contact information (name/email) of the iCloud account owner of a particular board, and then simply attempt to contact them to have the lock removed? Of course many people wouldn't respond, and you'd still be stuck with a locked board, but I was curious if that information would somehow be stored on the board. I'd imagine that info is securely stored/encrypted in the SE, so probably impossible to get to, but was just curious.

On a icloud locked a2179, I found the user's email in plain text using checkra1n and running the "strings" command on the NVRAM file in /var/private/db. I think that was the file and location.. Unsurprisingly the user didn't reply to my email or iMessage about unlocking..