T2 Chip Programmer Tool

[unilock01]

@Stephen
You keep contradicting yourself. You say that flashing the T2 ROM is pointless unless you only want to bypass MDM, then you say that flashing the T2 ROM works to get rid of all locks.
Why would you restore the original serial number after replacing it with a new one? That'd just restore the activation lock as soon as you do a factory restore.

@RhetoricalCheese
No way in hell does anybody outside of Apple have access to their servers. Those things are locked down like the Knox.

Also, what's this "mina" thing? Can't you just generate a valid serial using OpenCore's `macserial` or something?

[RethoricalCheese]

Who said I was talking about anybody outside of Apple

[nikey22]

I suppose if someone 2 to 3 months from now reviews their icloud account and says "Oh wait, I sold that macbook a long time ago, I don't need this as part of my devices" and they remove it, then you have cleared the icloud lock!

[Stephen]

Originally Posted by unilock01

@Stephen
You keep contradicting yourself. You say that flashing the T2 ROM is pointless unless you only want to bypass MDM, then you say that flashing the T2 ROM works to get rid of all locks.
Why would you restore the original serial number after replacing it with a new one? That'd just restore the activation lock as soon as you do a factory restore.

@RhetoricalCheese
No way in hell does anybody outside of Apple have access to their servers. Those things are locked down like the Knox.

Also, what's this "mina" thing? Can't you just generate a valid serial using OpenCore's `macserial` or something?

Actually wrong. Once you put In the serial of the original locked device once you get pass the OS install the device cannot be locked again. Only ones that can are MDM locks, Which is why you change the serial. Activation lock does not come back once you’re in the OS. I would know because we do this a lot with no issues.

Haha you think Apple certified techs always follow Apple servers rules…. lol…you have no idea how some permanent unlocks happen then.

Mina is a bypass tool that’s free, unlike checkm8 software where they utilize the checkrain jailbreak and capitalized on just inputting their own code that just remembers the serial in their server and charge you for unlocking your device which in reality is actually free to do with the proper coding knowledge. We o. The other hand are looking at making the bypass free forever.

[Nico Latour]

apple update they rom so this way not many succes anymore

[Nico Latour]

change serial t2 possible but only works with mdm (and mdm never come back) for permanent icloud unlock serial change not works! this only work in 2019 after that apple update the icloud and now icloud is linked on serial, wifi mac adress and bleutooth mac adres

[unilock01]

Originally Posted by Stephen

Actually wrong. Once you put In the serial of the original locked device once you get pass the OS install the device cannot be locked again. Only ones that can are MDM locks, Which is why you change the serial. Activation lock does not come back once you’re in the OS. I would know because we do this a lot with no issues.

And it stays unlocked even after a DFU restore? How??
("DFU restore" is what I meant by "factory restore")

Originally Posted by Stephen

Haha you think Apple certified techs always follow Apple servers rules…. lol…you have no idea how some permanent unlocks happen then.

Why so high-and-mighty? As I understand it, this website is about sharing information, not gatekeeping it...
Besides, I'm pretty sure that anyone certified by Apple outside of Apple themselves has no access to Apple's internal VPN (Apple Connect, I think), much less their activation servers.

Originally Posted by Stephen

Mina is a bypass tool that’s free...

The only Mina tool I can find is "minaT2Activator", which charges $120 to "register" your serial number on their server. Which tool are you talking about?

As for Apple's servers checking Wi-Fi / Bluetooth MAC addresses to determine activation lock status - if older versions of BridgeOS don't know to send that information to Apple (idk if that's the case), how could they check it in the first place?
I'd check what information is actually sent to Apple during macOS activation, but it seems nobody's made an easy-to-digest presentation about it yet XP
In any case... the MAC addresses are stored in the T2 ROM, no? I have no basis for this assumption, but it might make sense due to Apple wanting to keep every form of device identification "secure".

[nikey22]

Originally Posted by Stephen

Until then the only method of removing these locks is Jailbreaking it but that has been recently patched, so for now we wait.

1. Remove the Winbond chip.
2. Read the data off of the chip, then save the data to your Desktop (windows pc only)
3. Run WinHex, change the serial MANUALLY that is on Mina that is used to unlock it. (IE: In the T203 tool data it will have the Serial plugged in the UNLOCK CODE. Just run WinHex and look for the serial and copy it and paste it. This is the serial activated for Mina.)
4. Then run the jailbreak, then turn on the computer once its jailbroken and activated, reinstall the OS, complete OS setup. Create user and password. Then shut down computer. Remove board if necessary

@Stephen, I'm curious when you say "run the jailbreak", do you mean the minaT2Activator.app found on the golden USB?; You mentioned earlier in the post, this has already been patched.
Also, others have tried this and they are getting an "SSH" connection timout. So yes, it is patched.
Maybe I am confusing "jailbreak" with "bypass".

Also, are you writing back to the T2 your ROM with the mina-serial or are you writing back to the T2 the actual .BIN that came in the golden USB.

Thanks.

[imranromi]

Originally Posted by nikey22

@Stephen, I'm curious when you say "run the jailbreak", do you mean the minaT2Activator.app found on the golden USB?; You mentioned earlier in the post, this has already been patched.
Also, others have tried this and they are getting an "SSH" connection timout. So yes, it is patched.
Maybe I am confusing "jailbreak" with "bypass".

Also, are you writing back to the T2 your ROM with the mina-serial or are you writing back to the T2 the actual .BIN that came in the golden USB.

Thanks.

Actually Usb inside file eeprom read different board Macbook or activate Serial from Mina tool.
Or socket read eeprom t2 chip.Same as bios chip socket.

[nikey22]

Originally Posted by Stephen

This is for those that do not want to restore via DFU if they have not patched with the most recent patch of DFU.

How are you running the "jailbreak", if you aren't in DFU mode? (step 4. of your instructions)

[Stephen]

I will do a picture detail for the forum how to do this. I just want you guys to do this too. But no it is still a hardware method but it’s only viable with the Mina Tool and hardware method. Trust me what I have done works you won’t need to DFU restore if it’s already wiped. There are other methods to getting passed the DFU restore method. Removing the Winbond chip won’t affect anything as long as you follow my methods. I will set this up tomorrow for all of you to follow and hopefully it is pinned.

[curiositymaster]

Originally Posted by Stephen

I will do a picture detail for the forum how to do this. I just want you guys to do this too. But no it is still a hardware method but it’s only viable with the Mina Tool and hardware method. Trust me what I have done works you won’t need to DFU restore if it’s already wiped. There are other methods to getting passed the DFU restore method. Removing the Winbond chip won’t affect anything as long as you follow my methods. I will set this up tomorrow for all of you to follow and hopefully it is pinned.

I find it difficult how people find it difficult to comprehend your instruction or maybe they just find it too much of a read.

I will try your method once I lay my hands on a locked Macbook and possibly let share my experience.

Thanks for sharing your method.

[Stephen]

Yeah it is pretty easy if you follow! I will make that guide today. Standby! Hopefully it gets pinned for now.

[unilock01]

Originally Posted by Stephen

Removing the Winbond chip won’t affect anything as long as you follow my methods.

T2 Macs don't have Winbond chips??? At least, the A1932 / 820-01521 doesn't.

[nikey22]

The chip he is referring to is the U4770 SOC ROM IC located on the A1932 and A2179 boards.

They are Macronix MX25U3235F, but the same kinds are also made by the Winbond company. Just different manufacturer.

[Nico Latour]

Originally Posted by unilock01

T2 Macs don't have Winbond chips??? At least, the A1932 / 820-01521 doesn't.

i think you need glasses they have all winbond chips

[RethoricalCheese]

No, some have winbond, some have macronix.

[Djamalhan]

Hello to all ! I do according to the instructions. After the dfu rig, the error comes out
a2115 Imac 2020 t2

[Nico Latour]

then you update iboot! bypass no possible anymore on this device (only permanent unlock possible)

[Djamalhan]

Originally Posted by Nico Latour

then you update iboot! bypass no possible anymore on this device (only permanent unlock possible)

can you explain in more detail ?