T2 Chip Programmer Tool

[Stephen]

Originally Posted by oxonater

Hey thanks for the reply

Ok I had an MDM LOCKED machine that was repaired (the official way nudge nudge) I went ahead and removed the T2 ROM and changed the serial etc etc. But now I cannot restore/revive just wondering if this has something to do with it was previously on monterey which has somehow patched something so the serial number change reports to the T2 and won't let it boot restore/revive. I have I borked the logic board ��

PS official way meaning sys config which basically updates Apples system with the logic board numbers etc etc using diagnostic tool.

Thanks guys

Did you save the original ROM Data from the T2 Rom Chip? You may have not programmed it correctly which will again result in it not booting correctly. I know it sounds dumb but it does happen, when you desoldered the chip did you have the battery disconnected and the cable to the battery disconnected? and if you did solder it correctly I would assume you corrupted the chip, sometimes you can heat up the chip to much to where you need to purchase a new one. As long as you have the orginal BIN data you will be fine also keep in mind changing the serial is all thats needed so I do not know why you are DFU restoring the device if you are removing an MDM lock? Just my 2 cents.

[oxonater]

Hi Stephen

Most appreciate your responses, seems that I may have corrupted the chip by overheating I have a spare and the original.bin and the modified one.

I also have spares so I will try another one see how it goes, regarding the DFU I tried reviving the device but it won't boot clicking trackpad like it tries to then of and repeats the cycle.

Wont restore either comes up with error but nonetheless reckon your right about the chip being corrupt.

Thanks OXY

[radicalsolutions]

just pick any t2 dump and modify it with your desired sn. After that the laptop will be in recovery mode. Just restore it with AC and that is all

Originally Posted by oxonater

Hi Stephen

Most appreciate your responses, seems that I may have corrupted the chip by overheating I have a spare and the original.bin and the modified one.

I also have spares so I will try another one see how it goes, regarding the DFU I tried reviving the device but it won't boot clicking trackpad like it tries to then of and repeats the cycle.

Wont restore either comes up with error but nonetheless reckon your right about the chip being corrupt.

Thanks OXY

[tobeend]

hi guys, bypass icloud is stalled cause jailbreak is not update, who know did they do something new or that all folks

[asigasm]

Originally Posted by Stephen

https://badcaps.net/forum/showthread.php?t=101283

From now on go here if you want help for unlocking

great, thanks

[genhack]

Originally Posted by asigasm

https://badcaps.net/forum/showthread.php?t=101283

i can't access at link page of new treahd. why?

[kevingill]

The thread was closed after a dispute between members.
It's no longer available, but you may find some of it on waybackmachine or similar

[oxonater]

Originally Posted by Stephen

Did you save the original ROM Data from the T2 Rom Chip? You may have not programmed it correctly which will again result in it not booting correctly. I know it sounds dumb but it does happen, when you desoldered the chip did you have the battery disconnected and the cable to the battery disconnected? and if you did solder it correctly I would assume you corrupted the chip, sometimes you can heat up the chip to much to where you need to purchase a new one. As long as you have the orginal BIN data you will be fine also keep in mind changing the serial is all thats needed so I do not know why you are DFU restoring the device if you are removing an MDM lock? Just my 2 cents.

Hi Stephen and the crew

Ok once again with another device I have hit a brick wall and seeking the knowledge from the elders.

So 15" macbook pro 2019 MDM locked with an MX U3235F SPI ROM having removed and changing the serial I was and still is stuck on blank screen no logo boot up etc etc. The board itself was removed from device an placed on my work area ready for SPI removal so purely so not connected to anything at time of removal and reapplication of said SPI ROM.

I was wondering if anyone else has experienced this issue and wether or not this is curable.

Don't think it has anything to do with programming the SPI ROM just wondered if it is related to other pieces oh attached hardware as the T2 may remember/ store and cause a no boot if these are changed.

I say this because all parts (MOSTLY) are serialised and wondering if this has something to do with the T2 chip.

Once again thanks peops

OXY

[Stephen]

I hate to be the bearer of bad news but considering their is no boot, and the direction the T2 chip is located, have you maybe considered the possiblity that the T2 chip may have been heated as well since the EFI rom chip is close by and you could have hit up the T2 chip by accident and it itself is bad? If not have you considered reading the EFI SPI Rom data and see if it IS even readable at all? If the program cannot even READ the chip chances are that chip is bad and you will need to sadly get a new chip from a donor board or online new. These chips are easily accesible and fairly cheap. I would always advise anyone doing this to have spares on hand just in case. but i am assuming if the board booted before and after removal and reheating it back to the board I am assuming it is one or two things, one, the chip itself is bad and you need a new one, or 2 which DOES happen, the T2 Chip is bad due to overheating in that area. Just food for thought.

[oxonater]

Originally Posted by Stephen

I hate to be the bearer of bad news but considering their is no boot, and the direction the T2 chip is located, have you maybe considered the possiblity that the T2 chip may have been heated as well since the EFI rom chip is close by and you could have hit up the T2 chip by accident and it itself is bad? If not have you considered reading the EFI SPI Rom data and see if it IS even readable at all? If the program cannot even READ the chip chances are that chip is bad and you will need to sadly get a new chip from a donor board or online new. These chips are easily accesible and fairly cheap. I would always advise anyone doing this to have spares on hand just in case. but i am assuming if the board booted before and after removal and reheating it back to the board I am assuming it is one or two things, one, the chip itself is bad and you need a new one, or 2 which DOES happen, the T2 Chip is bad due to overheating in that area. Just food for thought.

Hey Stephen

Thanks for your response

Guess what it's working LOL
Yes I was scratching my head for hours then went to bed with the hump thinking that I had ruined a decent machine and I was a complete moron.

Woke up this morning and had an epiphany I would try another usb c to usb c lead an APPLE one (the one I was using was a bog standard usb c lead I use for phone) and hey presto with no battery connected it booted to the flashing folder voila. I have since installed an OS and checked serial and such and all's well thank god!

So with that I thank all concerned and can sleep in peace in the knowledge that I am not a dumbass

[genhack]

Originally Posted by kevingill

The thread was closed after a dispute between members.
It's no longer available, but you may find some of it on waybackmachine or similar

Thanks i see what you do in the past.


In order:
The t2 can still be bypassed even on the new BridgeOs, without changing via Hw the serial but the simple way is creating an ad hoc ramdisk for bridgeOs 6+. Mina uses pongo to dynamically patch the boot and eventually go to ramdisk, but this option will have no future development, the developers know it will only be used to bypass the ecloud. Now before buying a t2 locked specifically to create a free bundle for everyone, I would need a little effort from those who still have one that can be bypassed via mina. I ask if some expert soul is can do a wireshark pcap 'usb sniffer' during the activation patch procedure and do a dump via ssh or sshpass of mobileactivationd. Both are necessarily needed to understand what I have to look at in the new binaries. I also reply to those who have written that it is enough to change the dmg and restore. The t2 will not allow you to do this unless you do the signature removal and the all patch you need for flash(like checkrain) ibss ibec kernelcache etc ..
Sorry for my bad english.

[willisk]

Hello guys. Really need your help. I have 2141 macbook that came totally dead. They told me that they did dfu restore (not activated it), then changed u4770 and got 5v and no boot, no dfu. I replaced one shorted cd3217, I couldnt read u4770 (most likely damaged), so I programmed new one with blank serial, got 20V back. Now it starting straight to internet recovery and cant activate. Activation servers not available or something like that. I dont have original u4770 rom and they also dont. Then I tried and edited rom with original serial, but internet recovery ends up with error message -2005F. Do you guys had this before? Im out of ideas how to activate it. Its not icloud or mdm locked.

[kevingill]

Originally Posted by willisk

Hello guys. Really need your help. I have 2141 macbook that came totally dead. They told me that they did dfu restore (not activated it), then changed u4770 and got 5v and no boot, no dfu. I replaced one shorted cd3217, I couldnt read u4770 (most likely damaged), so I programmed new one with blank serial, got 20V back. Now it starting straight to internet recovery and cant activate. Activation servers not available or something like that. I dont have original u4770 rom and they also dont. Then I tried and edited rom with original serial, but internet recovery ends up with error message -2005F. Do you guys had this before? Im out of ideas how to activate it. Its not icloud or mdm locked.

Have you tried a wired connection to the internet rather than WIFI?
That error code is related to internet connectivity.

[RMKyle]

Originally Posted by Stephen

I had this removed because I got tired of all the harassment emails our shop received and phone calls from random people, and also mostly removed more because of the issues it brought from people using it for the wrong reasons.

I personally have continued my work doing this for companies now but for now I am just busy with multiple new projects. currently we are moving our business to a new location since we have grown.

In the mean time I have ceased tutorials on this until further notice. I will eventually come up with a new tutorial one day for the MDM locks for M1 devices which do not require bypassing. So far nothing, but I am hopeful.

I see, thank you for your response anyway. Do you know if that original method from the thread still works however as I have a T203 on the way? I would not be doing anything with M1 macbooks at the moment, only T2 macbooks.

[willisk]

That was it. Thank you!

[Timp74]

Is it possible to downgrade iBridge/BridgeOS from version 6+ by flashing the T2 EEPROM? Or is there any other way to downgrade using an unsigned ipsw file?

With the intention of using Checkra1n once downgraded.

[tt_the]

Hello everyone, not really the same subject, but close enough:

If I replace the T2 chip from a mechanical damaged Macbook (A2179), to a locked one with latest iBridge, will it unlock it?

Thanks

[Timp74]

Originally Posted by tt_the

Hello everyone, not really the same subject, but close enough:

If I replace the T2 chip from a mechanical damaged Macbook (A2179), to a locked one with latest iBridge, will it unlock it?

Thanks

Unlikely. I believe the state of the T2 is linked to the contents of the NAND SSD chips at least...

[gugbobgug]

Originally Posted by tt_the

Hello everyone, not really the same subject, but close enough:

If I replace the T2 chip from a mechanical damaged Macbook (A2179), to a locked one with latest iBridge, will it unlock it?

Thanks

hello
yes friend i T2 chip from other not locked macbook air i installed to locked motherboard and it icloud removed and macbook works good, only touch id does not work

and for M1 models you need replace CPU from other macbook

this is 100%

[JOHNLAG7]

Originally Posted by gugbobgug

hello
yes friend i T2 chip from other not locked macbook air i installed to locked motherboard and it icloud removed and macbook works good, only touch id does not work

and for M1 models you need replace CPU from other macbook

this is 100%

Right if replace T2 can unlock the device but have in mind There are two types of T2 capacity: 1GB and 2GB
T2 chip with 1GB capacity can control 128GB, 256GB, 512GB NAND;
2GB capacity T2 chip can control 1TB, 2TB, 4TB NAND.
So when 128GB, 256GB or 512GB NAND can use 1gb T2 For 1TB, 2TB or 4TB NAND,T2 chip must be 2GB.