T2 Chip Programmer Tool

[Reda123456]

Re: T2 Chip Programmer Tool

hello is there a way to remove the entire mdm from MacBook Pro (13-inch, 2017, Four Thunderbolt 3 Ports)
model a1707 emc 3164

[kevingill]

Re: T2 Chip Programmer Tool

Just found something interesting.

If you have an external disk with a MACOS installation (not an installer), you can boot from this if you hold CMD-R for a minute whilst it boots. You can release CMD-R once the loading bar appears. This will boot the recovery from the external disk instead of downloading it. I used Catalina, but others may work.

Once at the language selection, you can press CMD-T to bring up a Terminal.

[kevingill]

Re: T2 Chip Programmer Tool

https://cdn.badcaps-static.com/pdfs/...6bdb9f3b72.pdf

This is a useful read to better understand how the T2 works.

[bb1]

Re: T2 Chip Programmer Tool

Mina did this because you had a special someone in the thread tell them so they had to create a code to stop this since you know…people don't want people to have nice things lol. I'm not worried about it. Our software is half way there.

hey @stephen, just wondering how the completion of the software is going.

[ugamazing]

Re: T2 Chip Programmer Tool

No way to read/program T2 so far.

[gugbobgug]

Re: T2 Chip Programmer Tool

and friend i am interesting
is there any option read and program this big T2 chip ?

[gugbobgug]

Re: T2 Chip Programmer Tool

Also T2 chip has 1 generation and 2 generation：
A1989, A1990, A1932, A2141, A2179, A2251 use 1st generation T2 chip.
A2159 ,A2289 ,MAC MINI A1993 use 2st generation T2 chip.

yes it is right

[gugbobgug]

Re: T2 Chip Programmer Tool

Right if replace T2 can unlock the device but have in mind There are two types of T2 capacity: 1GB and 2GB
T2 chip with 1GB capacity can control 128GB, 256GB, 512GB NAND;
2GB capacity T2 chip can control 1TB, 2TB, 4TB NAND.
So when 128GB, 256GB or 512GB NAND can use 1gb T2 For 1TB, 2TB or 4TB NAND,T2 chip must be 2GB.

i know this

[JOHNLAG7]

Re: T2 Chip Programmer Tool

Also T2 chip has 1 generation and 2 generation：
A1989, A1990, A1932, A2141, A2179, A2251 use 1st generation T2 chip.
A2159 ,A2289 ,MAC MINI A1993 use 2st generation T2 chip.

[JOHNLAG7]

Re: T2 Chip Programmer Tool

hello
yes friend i T2 chip from other not locked macbook air i installed to locked motherboard and it icloud removed and macbook works good, only touch id does not work

and for M1 models you need replace CPU from other macbook

this is 100%

Right if replace T2 can unlock the device but have in mind There are two types of T2 capacity: 1GB and 2GB
T2 chip with 1GB capacity can control 128GB, 256GB, 512GB NAND;
2GB capacity T2 chip can control 1TB, 2TB, 4TB NAND.
So when 128GB, 256GB or 512GB NAND can use 1gb T2 For 1TB, 2TB or 4TB NAND,T2 chip must be 2GB.

[gugbobgug]

Re: T2 Chip Programmer Tool

Hello everyone, not really the same subject, but close enough:

If I replace the T2 chip from a mechanical damaged Macbook (A2179), to a locked one with latest iBridge, will it unlock it?

Thanks

hello
yes friend i T2 chip from other not locked macbook air i installed to locked motherboard and it icloud removed and macbook works good, only touch id does not work

and for M1 models you need replace CPU from other macbook

this is 100%

[Timp74]

Re: T2 Chip Programmer Tool

Hello everyone, not really the same subject, but close enough:

If I replace the T2 chip from a mechanical damaged Macbook (A2179), to a locked one with latest iBridge, will it unlock it?

Thanks

Unlikely. I believe the state of the T2 is linked to the contents of the NAND SSD chips at least...

[tt_the]

Re: T2 Chip Programmer Tool

Hello everyone, not really the same subject, but close enough:

If I replace the T2 chip from a mechanical damaged Macbook (A2179), to a locked one with latest iBridge, will it unlock it?

Thanks

[Timp74]

Re: T2 Chip Programmer Tool

Is it possible to downgrade iBridge/BridgeOS from version 6+ by flashing the T2 EEPROM? Or is there any other way to downgrade using an unsigned ipsw file?

With the intention of using Checkra1n once downgraded.

[willisk]

Re: T2 Chip Programmer Tool

That was it. Thank you!

[RMKyle]

Re: T2 Chip Programmer Tool

I had this removed because I got tired of all the harassment emails our shop received and phone calls from random people, and also mostly removed more because of the issues it brought from people using it for the wrong reasons.

I personally have continued my work doing this for companies now but for now I am just busy with multiple new projects. currently we are moving our business to a new location since we have grown.

In the mean time I have ceased tutorials on this until further notice. I will eventually come up with a new tutorial one day for the MDM locks for M1 devices which do not require bypassing. So far nothing, but I am hopeful.

I see, thank you for your response anyway. Do you know if that original method from the thread still works however as I have a T203 on the way? I would not be doing anything with M1 macbooks at the moment, only T2 macbooks.

[kevingill]

Re: T2 Chip Programmer Tool

Hello guys. Really need your help. I have 2141 macbook that came totally dead. They told me that they did dfu restore (not activated it), then changed u4770 and got 5v and no boot, no dfu. I replaced one shorted cd3217, I couldnt read u4770 (most likely damaged), so I programmed new one with blank serial, got 20V back. Now it starting straight to internet recovery and cant activate. Activation servers not available or something like that. I dont have original u4770 rom and they also dont. Then I tried and edited rom with original serial, but internet recovery ends up with error message -2005F. Do you guys had this before? Im out of ideas how to activate it. Its not icloud or mdm locked.

Have you tried a wired connection to the internet rather than WIFI?
That error code is related to internet connectivity.

[willisk]

Re: T2 Chip Programmer Tool

Hello guys. Really need your help. I have 2141 macbook that came totally dead. They told me that they did dfu restore (not activated it), then changed u4770 and got 5v and no boot, no dfu. I replaced one shorted cd3217, I couldnt read u4770 (most likely damaged), so I programmed new one with blank serial, got 20V back. Now it starting straight to internet recovery and cant activate. Activation servers not available or something like that. I dont have original u4770 rom and they also dont. Then I tried and edited rom with original serial, but internet recovery ends up with error message -2005F. Do you guys had this before? Im out of ideas how to activate it. Its not icloud or mdm locked.

[genhack]

Re: T2 Chip Programmer Tool

The thread was closed after a dispute between members.
It's no longer available, but you may find some of it on waybackmachine or similar

Thanks i see what you do in the past.


In order:
The t2 can still be bypassed even on the new BridgeOs, without changing via Hw the serial but the simple way is creating an ad hoc ramdisk for bridgeOs 6+. Mina uses pongo to dynamically patch the boot and eventually go to ramdisk, but this option will have no future development, the developers know it will only be used to bypass the ecloud. Now before buying a t2 locked specifically to create a free bundle for everyone, I would need a little effort from those who still have one that can be bypassed via mina. I ask if some expert soul is can do a wireshark pcap 'usb sniffer' during the activation patch procedure and do a dump via ssh or sshpass of mobileactivationd. Both are necessarily needed to understand what I have to look at in the new binaries. I also reply to those who have written that it is enough to change the dmg and restore. The t2 will not allow you to do this unless you do the signature removal and the all patch you need for flash(like checkrain) ibss ibec kernelcache etc ..
Sorry for my bad english.

[oxonater]

Re: T2 Chip Programmer Tool

I hate to be the bearer of bad news but considering their is no boot, and the direction the T2 chip is located, have you maybe considered the possiblity that the T2 chip may have been heated as well since the EFI rom chip is close by and you could have hit up the T2 chip by accident and it itself is bad? If not have you considered reading the EFI SPI Rom data and see if it IS even readable at all? If the program cannot even READ the chip chances are that chip is bad and you will need to sadly get a new chip from a donor board or online new. These chips are easily accesible and fairly cheap. I would always advise anyone doing this to have spares on hand just in case. but i am assuming if the board booted before and after removal and reheating it back to the board I am assuming it is one or two things, one, the chip itself is bad and you need a new one, or 2 which DOES happen, the T2 Chip is bad due to overheating in that area. Just food for thought.

Hey Stephen

Thanks for your response

Guess what it's working LOL
Yes I was scratching my head for hours then went to bed with the hump thinking that I had ruined a decent machine and I was a complete moron.

Woke up this morning and had an epiphany I would try another usb c to usb c lead an APPLE one (the one I was using was a bog standard usb c lead I use for phone) and hey presto with no battery connected it booted to the flashing folder voila. I have since installed an OS and checked serial and such and all's well thank god!

So with that I thank all concerned and can sleep in peace in the knowledge that I am not a dumbass