T2 Chip Programmer Tool

[tiVmE]

Hi guys, something happened to my last effort and I want to ask if anybody has ecountered.
The device is A2159, appears to be activation lock. I tried with checkm8 to check if it was possible to JB, it did, then I proceeded to unlock with Mina tools.
Then I got to Recovery normally, no erase mac option available so I just erase the hard drive and reinstall big sur.
Afterwards, I check then it was a 11.6.2 BS and the bridge is already been updated to 19.16.14243. This is the part I couldn't understand how it got there.
Therefore, it is not possible to access recover with Command R anymore (EFI locked).

So anybody could kindly explain how it got update to the latest BridgeOS? And I can no longer access to jailbreak anymore...

[tiVmE]

I kinda get it, I was unable to JB it the 2nd time so I got to revive, then it boot to OS perfectly but the Recovery might be blocked forever.

[.::iRizwan::.]

Recovery is not blocked but the jailbreak is not possible anymore for now at least publicly

[tiVmE]

Originally Posted by .::iRizwan::.

Recovery is not blocked but the jailbreak is not possible anymore for now at least publicly

Sorry but are you saying that for new BridgeOS or even old ones could not be done anymore?

[TrumanHW]

Originally Posted by Bb68

Hi
Ch340 programmer , like by-t200

You a MacOS user ... ? Able to read CH341x (ROMs) via MacOS ..?
If not, I finally figured out how (after 7 years) and can help (free obviously)


As far as dealing with T2 (Intel + M1) ... I have:
•*T203
•*Medusa 2.6 / 2.7 / 3.1
•*DS809
•*RT809F + Level Shifter

I'm determined to figure iC locked + MDM issue (intel + M1) asap.

Back to reading the remainder of this thread)

[TrumanHW]

Originally Posted by stevie

You can run the mina activation tool by putting the MBP in DFU Mode, but unless you pay the unreasonable $90 - $120, mina resellers want for allowing you to "submit the SN you want to use," it'll come up with the message: "serial no authorised"

You can use the tool with the bin files with the tool, & though
successful, it'll give inaccurate summary details in about this mac.
ie: displays that it is a 13" when its actually 16in, etc.

Fascinating!, thank you.
Have T203 – just haven't gotten that far yet.

Do you know how to read ROM (bin) off programmers using MacOS ..?
I figured it out finally, so if that'd help anyone LMK and I'll post instructions.

[TrumanHW]

Originally Posted by piernov

Changing T2 SN

Fixing [ONLY] the MDM management issue can be done via T2's ROM (SN):

•*Desolder ROM
•*Dump ROM BIN
•*Find SN: after string mNrS

THE QUESTION:
Does ONLY eliminating MDM from T2 (Intel obviously) require steps beyond modifying the SN?
Exemplars of my preferred character-revision:
- C02 --> CO2 ...or... C02 --> C0Z ... 6 --> G ... G --> Q
- Retain the letter-qty
- Validate: Fsys @ 0x590000 ... via Medusa v2.7 (SO convenient!!!)

IS a valid SN FORMAT (naming convention) now required? If so, can we:
- Could we not change the WEEK of mfr to 53..?
- Reuse a SN that was made in one country-code (Czech?) for China?
- Reuse a SN from a unit which is no longer reparable?
- Is there something analogous to the 0x590000 ..?

Thanks!!!

[/SIZE][/B]IE, following Stephen's STICKIED: T2 Unlocking Method (Hardware)


(Obviously all other info posted stands + I already have the T203)
•*Pkg kind: 25-series SPI ROM
•*Pkg size: 3x4mm (smaller than ≤ 2017 ROM)
•*ROM volt: 1.8v (Requires a 'level shifter' to use a CH341a)
•*Simple: T203 = CH341a with integral 1.8v level shifter + 3x4mm fixture.

[.::iRizwan::.]

Originally Posted by tiVmE

Sorry but are you saying that for new BridgeOS or even old ones could not be done anymore?

Old one you can do no issue.

[TrumanHW]

Originally Posted by Bb68

Hi

CH340 programmer , like by-t200

Cool, would you be willing to provide a copy of the SW which came with the T200 ..? I'm thinking the only difference between the T200 and T203 is the software, no ...?

PS, You can read a CH341x on MacOS (as can the T203, - also a CH341a)

[Pedro147]

So I see that Stephen's new thread got shut down mainly because of the childish antics of one new member. Why do people have to destroy things to satisfy their own fragile egos?

Originally Posted by TrumanHW

Do you know how to read ROM (bin) off programmers using MacOS ..?
I figured it out finally, so if that'd help anyone LMK and I'll post instructions.

Cool, well I am interested for sure thanks.

Originally Posted by TrumanHW

I'm determined to figure iC locked + MDM issue (intel + M1) asap.

Fantastic

Originally Posted by .::iRizwan::.

The simple method to check for old or new BridgeOS is put device in internet recovery, connect WiFi and compare it with the following image.

Just to clarify if I may @.::iRizwan::. so in relation to the two BridgeOS images, the old one has no text under the progress bar but the new one does? I am not missing anything here am I Thanks

[vampirekiller]

hi! t203 with standart serial number is not work anymore? i tried mina chk8m devteam all this services have one data base. database used serial number but now t2 chip id.(((

[TrumanHW]

Originally Posted by Pedro147

Cool, well I am interested for sure thanks.

I'm not sure if it's old news or not, but I had looked for a USB driver for MacOS so I didn't have to use a damned PC to Read / Write ROM .bin files ...


I'm using an application? I think it's an app, anyway, a CLI app (via HomeBrew):
FlashROM (.org if you want to read about it) ...

SERIAL -to- USB - CH341 ROM (MacOS):


Install xcode:				xcode-select --install
Relocate xcode:				sudo xcode-select --switch /Library/Developer/CommandLineTools
Install HomeBrew:			/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
Install cask:				brew install cask
Install Ruby:				brew install ruby
Install FlashRom:**			brew install flashrom
List Programmers:			sudo flashrom --help
Verify reader:				sudo flashrom -p ch341a_spi
ROM Read:				sudo flashrom -p ch341a_spi -r   <name.bin>  (defaults location ~ )
ROM Write:				sudo flashrom -p ch341a_spi -w   <name.bin>  (defaults location ~ )

IF you had a TL866* [eg: TL866II+, etc] instead of the listed USB Programmers in the attached image for CH341a (as I used, but, as also the T203 and T200 programmers are, which is why I think FlashROM is a wise installation irrespective which programmer you own if reading this thread)...

In ADDITION to FlashROM ... perhaps you'd also:

Install MiniPro				brew install minipro

Whereas the FlashROM application's supported programmers are manied and being added (you can look at the changelog on flashrom org to see their revision history) ... MiniPro does JUST the TL866x and appears to have no plans of adding anything to that "list."


Obviously if you already have HomeBrew, XCode Tools, Ruby, etc., installed, you'll just be reminded of that if you attempt to re-install them.

I can PM you a link to my Paste Bin of the commands if preferred.


FlashROM work with 11 different USB Programmers (listed below):
- dummy
- ft2232_spi
- serprog
- buspirate_spi
- dediprog
- developerbox
- pony_spi
- usbblaster_spi
- pickit2_spi
- ch341a_spi
- digilent_spi
- stlinkv3_spi

Attached image shows the command used to Read via my CH341a
Pending which $PROGRAMMER you're using, just sub the above 'term' for the corresponding model you have.

Hope that's what you thought I meant; I feel stupid now, learning about two different USB to Serial Programmers which have CLI (Bash) applications that obviate the use of a fcuking MISERALBE ass Windows-PC for a Mac ... and worse..? The only damned application that controls the CH341 R&W on a PC has a HORRIBLE HEX / ASCII editor. I'm literally ELATED to have found a solution ... for 8 fcuking YEARS I had repeatedly tried the "DRIVER" that FTDI put out for the CH341 ... with every version of MacOS possible, none-of-which worked! But this !?? In 2-seconds ... and it's been VERY reliable.

Part of why I love MacOS is for things like, 'Scroll to Zoom'
System Preferences --> Accessibility --> Zoom
Check Mark "Use scroll gesture with modifier key to zoom: ^Control"

This way, whatever I'm working on I can zoom in on in a fraction of a sec.
INSTANTLY optimizing my display's working-area for exactly what I'm doing.
When COMPARING CODE !?? Of COURSE it's preferable.

Hell, even when using PC-3000..? I STILL prefer using TeamViewer over LAN bc... I can zoom in. There's nothing on a PC that's even close to the "scroll to zoom" feature ... and even though with glasses my vision's fine, close up I just make fewer mistakes of every sort.

[TrumanHW]

Originally Posted by Stephen

Side note: If the serial was MDM locked before you will have to try to find another serial of the same model and year to change it to. I always suggest just changing the last digit or last two digits or letters at the end of the Serial

MDM process:

IE: C02*******89 (original)
Change too C02*******87 or 88 or try others. Check the serials online.

I feel CERTAIN you know this already ...
But those 4 digits ARE what define the model-specs.

First 2 (C0) = mfr location...
Last 4 (Right to Left) = Model...

Example:
C02SJ0R2G8WN
C02 - made in china
SJ0R2 - Date-Code + [Unique-Identifier]
G8WN - MODEL

I would've thought changing
SJ0R2 to
2JOR2 or
SJORS or
2J0RS ...etc ... would at least preserve the machine identity.

If you insist on changing the last digits ... there is still a file in the OS you install which lists the machine identities ... and you could change that (at least on older OS).

[Stephen]

I usually just change the last digit. In most cases

[Pedro147]

Originally Posted by TrumanHW

I'm not sure if it's old news or not, but I had looked for a USB driver for MacOS so I didn't have to use a damned PC to Read / Write ROM .bin files ...

Thanks for the comprehensive reply and I'll have a look and see if I can get a handle on it sometime. Appreciate the effort TrumanHW

[curiositymaster]

Originally Posted by Pedro147

So I see that Stephen's new thread got shut down mainly because of the childish antics of one new member. Why do people have to destroy things to satisfy their own fragile egos?


Cool, well I am interested for sure thanks.


Fantastic



Just to clarify if I may @.::iRizwan::. so in relation to the two BridgeOS images, the old one has no text under the progress bar but the new one does? I am not missing anything here am I Thanks

You're spot on mate

[Pedro147]

Originally Posted by curiositymaster

You're spot on mate

About the new vs old BridgeOS images? Thanks

[phunghau]

please help me icloud can't open �� macbook air A1932 EMC 3184

[phunghau]

i think the same as you

[Pedro147]

Originally Posted by phunghau

what is your selling price ?

.
Please do not encourage this guy as he is trying to sell files that are available from others here for free. We don't want this thread shut down like the last one was because of stuff like this.