T2 Chip Programmer Tool

[PACh]

Hi, im having problems writing back the bin file to the chip, it might be the drivers, which drivers did you install on a windows 10 machine? I installed the CH341SER file located on the T203 files and the computer doesnt recognize the device, I tried to install the latest version of this driver and the computer doesnt recognize de device either. If I force to use the driver, it gets installed as USB-SERIAL CH341A (COM3) but the asprogrammer doesnt see the device.... If I use the CH341PAR it works but I get an error writing the chip back: "Verification error on address: 00000000:FFH | 30H" if i read the chip again it is empty.
How does the T203 appears in your device manager? I would really appreciate any help.

Regards

[grabship]

hi, are you found a solution for this problem?

[grabship]

Originally Posted by PACh

Hi, im having problems writing back the bin file to the chip, it might be the drivers, which drivers did you install on a windows 10 machine? I installed the CH341SER file located on the T203 files and the computer doesnt recognize the device, I tried to install the latest version of this driver and the computer doesnt recognize de device either. If I force to use the driver, it gets installed as USB-SERIAL CH341A (COM3) but the asprogrammer doesnt see the device.... If I use the CH341PAR it works but I get an error writing the chip back: "Verification error on address: 00000000:FFH | 30H" if i read the chip again it is empty.
How does the T203 appears in your device manager? I would really appreciate any help.

Regards

hello

i'm sorry, i'm french and i dont speack very well english,

i shell this programmer to a macbook air a2179, locked efi,

so i have a same problem, i have test with several computer (windows 7, 10, 11 mac os...). i can read the original program in the chip, but when write the new program: Verification error on address: 00000000:FFH | 30H

i testing the voltage on my t203 programmer, i have 3v3 and my chip (U4770) work with 1v8.

is it normal??

[Stephen]

Sorry guys I been afk. I know you been probably waiting for my updates. So far there seems to be progress with Checkrain for another hardware bypass for iBridge 6.0+. I anticipate it to be out very soon and we can be back to unlocking our locked boards again.

[Stephen]

Originally Posted by PACh

Hi, im having problems writing back the bin file to the chip, it might be the drivers, which drivers did you install on a windows 10 machine? I installed the CH341SER file located on the T203 files and the computer doesnt recognize the device, I tried to install the latest version of this driver and the computer doesnt recognize de device either. If I force to use the driver, it gets installed as USB-SERIAL CH341A (COM3) but the asprogrammer doesnt see the device.... If I use the CH341PAR it works but I get an error writing the chip back: "Verification error on address: 00000000:FFH | 30H" if i read the chip again it is empty.
How does the T203 appears in your device manager? I would really appreciate any help.

Regards

The drivers come in a folder on the T203 you must install them.

[ugamazing]

Originally Posted by Stephen

Sorry guys I been afk. I know you been probably waiting for my updates. So far there seems to be progress with Checkrain for another hardware bypass for iBridge 6.0+. I anticipate it to be out very soon and we can be back to unlocking our locked boards again.

We've got to stop calling 'bypassed' boards 'unlocked'--they are not unlocked. Can't be updated/wiped, can't be sold as unlocked/working, etc. Gotta keep those phrases separate. Hardware unlock = board unlocked. Bypass = board bypassed with a bunch of limitations.

We've had customers send in boards/units that "locked themselves after installing an update" and turns out they bought a unit with a bypass in place and now they're stuck with a locked board/unit. Some sketchy eBay listings claiming to be selling "T2 unlock services" are just doing the quick bypass that is not a real unlock, but they're calling it an unlock. It's not.

[piernov]

Thanks for insisting on this @ugamazing, I'm with you on this one.

[ugamazing]

Originally Posted by piernov

Thanks for insisting on this @ugamazing, I'm with you on this one.

Thanks, Piernov.

[dam1inc]

I have a T2 device that is EFI and IC locked, Is there a way to jb and ssh and bypass EFI without updating iBridgeOS. Or a hardware method to bypass EFI without updating iBridgeOS?

[dam1inc]

Originally Posted by Stephen

The drivers come in a folder on the T203 you must install them.

Can you clear the EFI from this .bin if possible., I already paid for Mina T2 removal but didnt know the device was also EFI locked too. Thanks

[.::iRizwan::.]

Originally Posted by ugamazing

We've got to stop calling 'bypassed' boards 'unlocked'--they are not unlocked. Can't be updated/wiped, can't be sold as unlocked/working, etc. Gotta keep those phrases separate. Hardware unlock = board unlocked. Bypass = board bypassed with a bunch of limitations.

We've had customers send in boards/units that "locked themselves after installing an update" and turns out they bought a unit with a bypass in place and now they're stuck with a locked board/unit. Some sketchy eBay listings claiming to be selling "T2 unlock services" are just doing the quick bypass that is not a real unlock, but they're calling it an unlock. It's not.

Stephen, you aren't based out of Atlanta, are you?

Agreed
The only true unlock is "FMM off" from Apple servers.
everything else is just .....
and most people don't know but there is bypass for New BridgeOS from a long time.
as well as EFI Lock remove without updating BridgeOS.

[SerGre]

Hi,
Can anyone read/provide all T2 ROMs from this tool:
€ 383,48 12%OFF | Ufix U-BOS2 For Remove EFI Lock Firmware Lock PIN Code Lock of 2008-2017 Macbook with M1 or T2 ROM Chips BIOS Repairing Tools
https://a.aliexpress.com/_EuVvu2T

The dumps are saved in device, can anyone extract this?

[sinaps1]

Originally Posted by .::iRizwan::.

Agreed
The only true unlock is "FMM off" from Apple servers.
everything else is just .....
and most people don't know but there is bypass for New BridgeOS from a long time.
as well as EFI Lock remove without updating BridgeOS.

Can you guide us which don't know that this bypass exist?
Can you share the information so at least we can bypass at least. I know that the bypass is not definitive, but with the update of the bridgeOS I am stuck and can't bypass the activation lock.

[SMDFlea]

Have a productive argument by all means, but if this thread starts getting petty it will be closed

[ajbernasko]

So the T2 chip is a two layered chip ?

[ugamazing]

Originally Posted by ajbernasko

So the T2 chip is a two layered chip ?

Yes, top RAM layer, bottom CPU layer. Also has over 1,400 balls...very aggravating to work with/reball/etc.

[ajbernasko]

bcos I am working on an A2159 with liquid damage, prepped to turn on but keyboard, trackpad, touchbar was not working, changed chasis and got to know it is from the board(SPI_TPAD_CLK_R) was low resistance when motherboard turns on. would I have to change T2 chip or reprogram the EEPROM chip again ?

[ugamazing]

Originally Posted by ajbernasko

bcos I am working on an A2159 with liquid damage, prepped to turn on but keyboard, trackpad, touchbar was not working, changed chasis and got to know it is from the board(SPI_TPAD_CLK_R) was low resistance when motherboard turns on. would I have to change T2 chip or reprogram the EEPROM chip again ?

May be worth starting a new thread in the repair forum, as you're dealing with a liquid-damaged device. It could be a lot of things in your case. You mention checking resistance with board on (you should not do that); the touchbar circuitry is quite isolated from the trackpad circuitry as well, so the two are unlikely related (but check for STG across all rails to be sure), and if you've reprogrammed the T2 ROM already, then who knows what else could be going on. You may be dealing with several issues, but I'd not even bother looking at the T2 yet.

[Stephen]

T2 Chip not fun to replace best to just ignore it. Matter of time we will have a new jailbreak and maybe one day we could have a solution to program the T2 chip or get access to it to retrieve information like email tied to it or whatever. Here is hoping for the future. I believe like all devices we always find work arounds that work. EFI locks were difficult but eventually we got past them with programmer tools (which required soldering of course) etc. Some didnt require soldering but I personally never liked those tools but they do work to an extent.

Earlier today we received a T2 Locked Mac mini where the customer stated it was MDM, and they said Apple told them this. It appears it was not MDM locked because once the serial was changed it would not communicate with the Apple Activation server, so that confirmed it was definitely icloud locked and it had the newest iBridge patch . Usually even if it has the patch and it is MDM it never matters because I could easily just change the serial and voila activated, but I am starting to wonder if we may come close to MDM removal on M1 devices. I now have a 14" MDM on hand we just got and it makes me want to start digging into the board and seeing about forcing the serial to come up. WISH me luck lol

[ugamazing]

Originally Posted by Stephen

T2 Chip not fun to replace best to just ignore it. Matter of time we will have a new jailbreak and maybe one day we could have a solution to program the T2 chip or get access to it to retrieve information like email tied to it or whatever. Here is hoping for the future. I believe like all devices we always find work arounds that work. EFI locks were difficult but eventually we got past them with programmer tools (which required soldering of course) etc. Some didnt require soldering but I personally never liked those tools but they do work to an extent.

Earlier today we received a T2 Locked Mac mini where the customer stated it was MDM, and they said Apple told them this. It appears it was not MDM locked because once the serial was changed it would not communicate with the Apple Activation server, so that confirmed it was definitely icloud locked and it had the newest iBridge patch . Usually even if it has the patch and it is MDM it never matters because I could easily just change the serial and voila activated, but I am starting to wonder if we may come close to MDM removal on M1 devices. I now have a 14" MDM on hand we just got and it makes me want to start digging into the board and seeing about forcing the serial to come up. WISH me luck lol

Yeah I sure hope we find a software-based unlock, but I feel these M1 boards are a whole different animal. Having the "T2" (sic) inside the CPU is a huge bummer (especially from a hardware standpoint--dead CPU = goodnight). But I wonder if the consolidated RAM or the nands may hold some secrets.

I've looked through a few M1 ROMs and it seems to be a lot of nothing. No serial info or anything from what I can tell. Did find some user-related data like on old SPI ROM dumps (wifi network info, device names, etc) but no user names or emails or anything. Couldn't find serial info to change. Let us know what you find and good luck! If you need any files for comparison, let me know.