Mac EFI Toolkit

[TeslaK]

Thanks for your answer. i fixed it

[MuertoGB]

Apologies for the delay in updates, but development has finally resumed. I've resolved the NVRAM reset issue. In addition to correctly resetting the header, I discovered a bug introduced in version 1.1.4 where the NVRAM store type (VSS, SVS) was not properly assigned. This has now been fixed.

Additionally, I'm introducing a new T2ROM window, where you'll be able to view the iBoot version, serial number, and export/transfer the Scfg serial store (Intel only, image attached).

Looking ahead, after the release of version 1.2, the next update will focus on separating EFI and T2-related tools. A new startup window will be introduced to detect the ROM type via drag-and-drop functionality, etc. However, for the time being, the T2 UI will be open over the main window as a tool window, as I'm working with limited time per release cycle.

More changes are noted in the dev changelog, which will change before release.
https://github.com/MuertoGB/MacEfiTo...v/CHANGELOG.md

[MuertoGB]

Okay, never mind. I suppose a little delay wouldn't hurt to make it proper. New startup window added, multiple ROM windows enabled. More coming.

[Stephen]

Welcome to the forum! Glad you developed something like this. This would come in handy for MDM removals on T2 machines. I do this by hand for most of the MDM locks of old devices. This is truly remarkable.

[MuertoGB]

Welcome to the forum! Glad you developed something like this. This would come in handy for MDM removals on T2 machines. I do this by hand for most of the MDM locks of old devices. This is truly remarkable.

Do you have a reference to how MDM is "bypassed" on T2 devices, it could be worth adding to make life easier. And thanks, I'lm looking forward to geting V1.2 out, but I'm fixing bug after bug cropping up after moving a lot of stuff about.

[MuertoGB]

Version 1.1.5 released, bringing an important bugfix when resetting NVRAM. I've had to pull the dev branch down for now whilst I get everything in order.

https://github.com/MuertoGB/MacEfiTo...leases/tag/115

[curiositymaster]

Do you have a reference to how MDM is "bypassed" on T2 devices, it could be worth adding to make life easier. And thanks, I'lm looking forward to geting V1.2 out, but I'm fixing bug after bug cropping up after moving a lot of stuff about.

We don't bypass MDM on T2 devices, we remove it by simply replacing the serial number with a non-MDM serial.
Well done on your achievements so far, I'll be following with keen interest.

[MuertoGB]

We don't bypass MDM on T2 devices, we remove it by simply replacing the serial number with a non-MDM serial.
Well done on your achievements so far, I'll be following with keen interest.

The version 1.2.0 development branch is back up on github, there's a list of changes in the changelog which is mostly complete, there are also images of the UI redesign. And thanks for the information, I'll add an option to change the serial in the ROM then.

I don't recommend compiling and using anything in dev as it's unfinished and unstable.

https://github.com/MuertoGB/MacEfiToolkit/tree/120-dev

[curiositymaster]

The version 1.2.0 development branch is back up on github, there's a list of changes in the changelog which is mostly complete, there are also images of the UI redesign. And thanks for the information, I'll add an option to change the serial in the ROM then.

I don't recommend compiling and using anything in dev as it's unfinished and unstable.

https://github.com/MuertoGB/MacEfiToolkit/tree/120-dev

This project will do a whole lot of good to the community if we could connect without having to desolder the chip (i.e if we are able to connect via dfu mode) and also if we are able to edit the serial this way.

[PITERPENY]

We don't bypass MDM on T2 devices, we remove it by simply replacing the serial number with a non-MDM serial.
Well done on your achievements so far, I'll be following with keen interest.

Where do you buy serial numbers?

[MuertoGB]

This project will do a whole lot of good to the community if we could connect without having to desolder the chip (i.e if we are able to connect via dfu mode) and also if we are able to edit the serial this way.

Unfortunately access to the T2ROM by any means other than removing it is out of my scope, I don't even think it's possible. However, I put some information here on how to dump the SPIROM very inexpensively:
https://logi.wiki/index.php/T2_Diagn...OM_Programming

[MuertoGB]

Version 2.0.0 BETA 1 released:
https://github.com/MuertoGB/MacEfiTo...ses/tag/200_b1

[MuertoGB]

Version 2.0.0 BETA 2 released:
https://github.com/MuertoGB/MacEfiTo...ses/tag/200_b2

[PITERPENY]

I can't figure out how to change the serial number! Or is this program not able to do this?

[MuertoGB]

I can't figure out how to change the serial number! Or is this program not able to do this?

This is rather vague. What version are you running, are you trying to edit an EFIROM, or SOCROM? Yes, the application does edit serial numbers.

[MuertoGB]

Version 2.0.0 BETA 3 released:
https://github.com/MuertoGB/MacEfiTo...ses/tag/200_b3

[PITERPENY]

This is rather vague. What version are you running, are you trying to edit an EFIROM, or SOCROM? Yes, the application does edit serial numbers.

EFIROM is for macbook without t2, SOCROM is for chips with t2? Am I in the right direction? And the program can only edit socrom?!

[MuertoGB]

EFIROM is for macbook without t2, SOCROM is for chips with t2? Am I in the right direction? And the program can only edit socrom?!

Mostly correct. T2 Macs still have an EFI, but it's in the NAND and inaccessible. The program can edit serial for Intel based T2 SOCROM, and EFIROM => Click "Patch" and select "Change Serial Number", the application will then replace the SSN and allow you to save the patched firmware.

[Stephen]

Do you have a reference to how MDM is "bypassed" on T2 devices, it could be worth adding to make life easier. And thanks, I'lm looking forward to geting V1.2 out, but I'm fixing bug after bug cropping up after moving a lot of stuff about.

In order to bypass an MDM it would be ran with software, however when trying to REMOVE the MDM lock permanently, one would need to change the serial to the device. If you can change the serial number on the device without the need to desolder the chip that retains the information of the board such as EFI lock/FIRMWARE LOCK, Serial number of the board then that would be pretty awesome. But in order to remove the MDM lock on T2 machines one has to desolder the SOCROM chip next to the T2 chip. Reprogram with ASPROGRAMMER, and then change the serial with WinHex. Find the serial, DO NOT change any of the code but the serial so it can still normally boot. That is how its done.

[Stephen]

Where do you buy serial numbers?

Serial numbers cannot be bought unless it is an iPad etc. You can check serials via Mac Serial Lookup, but I would always check serials on Apple Servers via IMEI. As long as the serial pulls up Locked or free and clear on Apple servers the serial can be used.