T2 Chip Programmer Tool

[kevingill]

Originally Posted by gugbobgug

and it still works ? today ?

Yes, once it’s tied to your Apple ID, all updates go through and it works fine.

[ugamazing]

Hey guys, I just found this thread. I am up for helping in any way I can with regards to pulling any dumps from any boards needed. I have basically every model of T2-based Apple laptop logic board, with as many as 20-30 iCloud locked of some models. I've been setting them aside in hopes an activation lock bypass/removal that's permanent comes about.

I miss the old days of using a headless Raspberry Pi to remove locks. These damn T2 chips are really aggravating us.

Thanks for all the work you guys do and progress you make. I've not checked in too much on the status of a lock removal, but am ever-hopeful.

[tungtuoitinh]

Originally Posted by gugbobgug

and with monterey does it work ?
i think apple patched this

Originally Posted by Pedro147

Stephen's guide https://www.badcaps.net/forum/showpo...1&postcount=53

Old BridgeOS vs New version https://imgur.com/a/Q563GLS

I'm wondering, if in recovery mode "starting internet recovery" is shown under the image of the earth, then surely it can't be bypassed, right? is there any chance for this new bridgeOS case?

In my case,My Macbook air 2018 can't boot into macOS , it's stuck in select wifi to recovery, but i forgot password,it hang on at" activation lock" ,so i can't check version bridgeOS

And the last question, can I use hackintosh device with usb A to use bypass tool?

[Rickkap]

I've had the T203 for some time now and after the update it stopped working, I also noticed that Union stopped selling it so i presumed that there was no way for getting round this anymore. I then came across the Stephen's guide but it was too late for me as i've already config 2 after trying to replace the serial number. So my question is there anyway round this or do i have to wait until a fix? I also tried Check8 but they don't support the A2141 probably since i stupidly used config 2.

[sinaps1]

Never thought would find something lik this support forum so much dettailed in everything! Congrats to all the staff.
I got a A1932 T2 model activation locked that is stuck in only intermet recovery.
I tried even in DFU mode with checkm8 soft to try if it is identified but without success.
The Comand-R combination or any except the DFU doesnt work.
By any chanche is any possibility from DFU to get the OS version or the iBridge OS version?
I want to figure out if has been updated to the latest version, my colleague kept connecting with wifi in recovery mode.. and from researches found out that if it is locked is stuck in internet recovery mode only.

Any suggestion to do any verificarion in this state. I am pretty sure if I programm the T2 ROM will stuck in DFU mode bricked.

[tungtuoitinh]

Originally Posted by sinaps1

Never thought would find something lik this support forum so much dettailed in everything! Congrats to all the staff.
I got a A1932 T2 model activation locked that is stuck in only intermet recovery.
I tried even in DFU mode with checkm8 soft to try if it is identified but without success.
The Comand-R combination or any except the DFU doesnt work.
By any chanche is any possibility from DFU to get the OS version or the iBridge OS version?
I want to figure out if has been updated to the latest version, my colleague kept connecting with wifi in recovery mode.. and from researches found out that if it is locked is stuck in internet recovery mode only.

Any suggestion to do any verificarion in this state. I am pretty sure if I programm the T2 ROM will stuck in DFU mode bricked.

you should check the previous pages, it have image how to check old bridgeOS vs new bridgeOS ( with new bridgeOS have "start internet recovery") after connect wifi

[sinaps1]

Originally Posted by tungtuoitinh

you should check the previous pages, it have image how to check old bridgeOS vs new bridgeOS ( with new bridgeOS have "start internet recovery") after connect wifi

Yes I have a new bridgeos but my previus question was regarding the versions. If this macbook is at latest version or something a bit earlier? So at least I will know when something comes out for the version I have.

[tungtuoitinh]

Originally Posted by sinaps1

Yes I have a new bridgeos but my previus question was regarding the versions. If this macbook is at latest version or something a bit earlier? So at least I will know when something comes out for the version I have.

I think you should dump t2 chip rom and check iboot version, im not sure is that true, so i need comfrim from others

[siddiq]

Originally Posted by tungtuoitinh

I think you should dump t2 chip rom and check iboot version, im not sure is that true, so i need comfrim from others

Yes, checking iBoot in the dump works..

[sinaps1]

Originally Posted by siddiq

Yes, checking iBoot in the dump works..

Found it. is a version iboot-7459 and I guess is updated to the last one.
I am not sure if I re-programm the ROM with an older version will cause the Macbook fail to boot at all.

Did anyone tried to flash the T2 ROM with older Bridge OS after it was updated?

After I changed the serial number on the same .BIN file of the ROM it is not able to contact the APPLE server.. seems like the contact POST method is tied to the Serial number in the ROM.

The serial Number was checked online if it was available and correct.

P.S. Still testing and digging we will find one way!!

[kevingill]

There are a few ROM dumps on this thread.
Can you compare your ROM with another posted here?
I'm not sure what the differences are either.

[sinaps1]

Originally Posted by kevingill

There are a few ROM dumps on this thread.
Can you compare your ROM with another posted here?
I'm not sure what the differences are either.

There are a lot of differences, I tried to compare the A1932 that is the model I have!
The files are very different, and also the Boot sequence is different as it is not declared in the files that are here, instead the original one have some boot sequences inside. Because of this I asked if someone tried with the latest BridgeOS to rewrite the old one. Sincerely I have to unsoldering and soldering again the chip and then retry the bypass/activation.. before going through all the work and risking a board damage thought to ask if someone tried before.

Any suggestion for a software to decompile the .BIN files to something more understandable? I tried some software found online but without success!

[smzlwan223]

[QUOTE=sinaps1;1137421]Found it. is a version iboot-7459 and I guess is updated to the last one.
I am not sure if I re-programm the ROM with an older version will cause the Macbook fail to boot at all.

Did anyone tried to flash the T2 ROM with older Bridge OS after it was updated?

After I changed the serial number on the same .BIN file of the ROM it is not able to contact the APPLE server.. seems like the contact POST method is tied to the Serial number in the ROM.

The serial Number was checked online if it was available and correct.

P.

[smzlwan223]

I have an A1932, did the following experiment, 1, try to read the Rom to the latest version of the ROM im4p.. Illb .. Iboot-7459.101.2... Change it to the old jailbreak version number, M4P. Illb .. Iboot-6723.80. 9, change the inside data, Swipe Rom, power test, found that the computer can not start, feeling ROM IC is not good welding, welding a few times the same effect, 2. Finally, the original backup ROM data brush to write in, the computer can boot, the current test through this experiment, came to the need to verify before boot, t 2, Rom version, so I went on to do the second experiment, or the Rom to jailbreak version number, then connect to the computer to fix T2, wait for the computer to turn on, see if it can jailbreak, the result, or has failed, and then, remove the ROM, see again to fix T2 in the process of T2, the ROM version number has changed back to the latest version number, the result of the experiment, is, the version number of t-2rom data is, the old version number, through the experiment, one point is that the version number of the Rom, is not the basic data of his jailbreak, I do not understand the software very well, I hope you friends, have a good plan, I can do the experiment test, that's all I have so far.

[smzlwan223]

Check to see if the ROM version number was changed back to the latest version number in the process of fixing t 2. The result of the experiment is that the version number of the t 2 Rom data is the old version number. The experiment shows that the ROM version number is not the fundamental data for his jailbreak, my software is not very understand, hope you friends, there is no good program, I can do experimental testing, at present my inspiration only these.

[curiositymaster]

Originally Posted by sinaps1

Found it. is a version iboot-7459 and I guess is updated to the last one.
I am not sure if I re-programm the ROM with an older version will cause the Macbook fail to boot at all.

Did anyone tried to flash the T2 ROM with older Bridge OS after it was updated?

After I changed the serial number on the same .BIN file of the ROM it is not able to contact the APPLE server.. seems like the contact POST method is tied to the Serial number in the ROM.

The serial Number was checked online if it was available and correct.

P.S. Still testing and digging we will find one way!!

If you change the S/N of a T2 device, it will not pass the activation process as it won't be able to march the serial number with the bluetooth and wifi address.

[Stephen]

Originally Posted by curiositymaster

If you change the S/N of a T2 device, it will not pass the activation process as it won't be able to march the serial number with the bluetooth and wifi address.

Incorrect. MDM devices are the only devices you can change the serial number on T2 chips without issue. If it fails to activate on the server, the T2 chip itself was already activated and has the original iCloud and SN tied to the device.

[newmac]

Can i use Mina T2 rom bin file to manually flash the T2 rom? Mine doesnt have a icloud lock it just wont restore using apple configurator. From what i know if i use the Mina bin files my serial number would be changed also would that be a issue?

[heatorious]

Originally Posted by newmac

Can i use Mina T2 rom bin file to manually flash the T2 rom? Mine doesnt have a icloud lock it just wont restore using apple configurator. From what i know if i use the Mina bin files my serial number would be changed also would that be a issue?

Do you get a error when you try to restore?

[newmac]

Error i get is Unexpected device state 'DFU' expected 'Recovery' [com.apple.MobileDevice.Restore - 0xFAE (4014)]

all of T2 standby power is present.