Macbook M1 bypass FMM / EFI Unlock

[betonel]

Re: Macbook M1 bypass FMM / EFI Unlock

I have 5pcs MBA 2020 m1 and 1 MBP 13 m1 + t203. if you want i can desoldering and make dump.

It will be great.

I have tried M1.bin and M2.bin, MBP did not start, it entered dfu mode and did restore with appleconfigurator2, which updated iBoot-7429.81.3. Now it starts but nothing has changed (SN/Activation Lock is still the same - can check SN in diagnostics mode). If I put old dump which was working before with iBoot-6723.50.2 will power on then restart, cycle all over again.

Data we need might be in ssd NAND, but I think secureboot bits are set in SOC bios rom. We need an easier way to access NAND sysconfig area.

[mazoot]

Re: Macbook M1 bypass FMM / EFI Unlock

m1 bin is encrypt! when you decrypt you see serial!!! but change serial in this bin is not working for unlock icloud)

how about MDM locked M1 with modified serial situation? Did you test ?

[betonel]

Re: Macbook M1 bypass FMM / EFI Unlock

Haven't found a way (yet) to change the SN for M1 machines. There is no clue SN would be in Winbond SOC rom. Writing content from other machine would stop booting, after dfu restore SN is unchanged. It might be here encrypted, and backed up in ssd nand flash like on iphones/ipads. In the end, can't see the scope of having this SOC chip.. maybe it holds iBoot bootloader code, or act as a backup and SN is encrypted here.

Another lead to be investigated is to intercept spi communication with the chip in various states of machine: boot.. mdm.. activation lock check.. efi password verification.
I'll put my logic analyzer at work and keep you updated. Any suggestion is welcomed.

[mazoot]

Re: Macbook M1 bypass FMM / EFI Unlock

Is your m1 have boot secure locked? can you boot from usb etc ?

[betonel]

Re: Macbook M1 bypass FMM / EFI Unlock

Yes, secureboot is enabled + activation lock. It would be nice to have dump of M1 machine without icloud/mdm one with secureboot disabled and one with secureboot enabled, so we can compare content.

[.::iRizwan::.]

Re: Macbook M1 bypass FMM / EFI Unlock

Secureboot settings are stored in NVRAM
you can disable Secureboot and enable USB boot by commands on T2 jailbroken machines.

[.::iRizwan::.]

Re: Macbook M1 bypass FMM / EFI Unlock

Secureboot settings are stored in NVRAM
you can disable Secureboot and enable USB boot by commands on T2 jailbroken machines.

Two commands actually.
one for Disable secure boot
and one for Enable USB Boot.

[.::iRizwan::.]

Re: Macbook M1 bypass FMM / EFI Unlock

some will argue that can be done in a single command
yes can but actually these are 2 separate commands.

[betonel]

Re: Macbook M1 bypass FMM / EFI Unlock

Apparently after flashing SOC rom I can see external boot device. Who can share working external drive image of BigSur then try to copy it into internal M1 flash and start normally.

[HansTodi01]

Re: Macbook M1 bypass FMM / EFI Unlock

I don't know if this can help. But it is possible to dump every partition mounted in diagnostics mode. There are some Firmware Files (img4) on there. But this probably wouldn't help, right?

[betonel]

Re: Macbook M1 bypass FMM / EFI Unlock

I don't know if this can help. But it is possible to dump every partition mounted in diagnostics mode. There are some Firmware Files (img4) on there. But this probably wouldn't help, right?

How would you do that? Please detail your findings so we can replicate.

[HansTodi01]

Re: Macbook M1 bypass FMM / EFI Unlock

How would you do that?

As it turns out, you can download files to an External Storage Device using the built-in Safari. So I also tried if you could upload files from mounted partitions, and yes this work perfectly fine (on some sites it won't).

So I quickly coded a Webpage with JSZip that combines all selected files to a ZIP and then starts the download. The ZIP is then saved to the Storage Device using Safari.
It would probably work out to just use Google Drive or something, but this was the most local solution (nothing saved on server, basically just download your uploaded files).

I used my web server and domain to do this because it seems to require an actual Domain and also doesn't allow PHP Files.

There are multiple Partitions on there, which you can see if you go to:
Safari --> Settings --> Download Folder --> Select

(At the top, where your current folder is displayed, you can click on the dropdown and then select the MacBook to see even more)

[betonel]

Re: Macbook M1 bypass FMM / EFI Unlock

Download terminal app in place of safari.app overwrite, close safari.. open again then u re in terminal. Too good to be true, but worths trying.

[HansTodi01]

Re: Macbook M1 bypass FMM / EFI Unlock

I think you can't write to the partitions. But I will try this soon

[betonel]

Re: Macbook M1 bypass FMM / EFI Unlock

I think you can't write to the partitions. But I will try this soon

Sure you can, I have downloaded some tests and it worked. But don't know about overwrite.

[ebaymonster]

Re: Macbook M1 bypass FMM / EFI Unlock

tomorrow I will have a MacBook Air without blocking /absolutely normal. what do i need to do ?!
1)....
2)....
3)....

[Stephen]

Re: Macbook M1 bypass FMM / EFI Unlock

Update:

Socrom on MBA 13" M1 does not have SN written whatsoever. If it is written it is coded differently. I should have an unlocked M1 arriving next week

[Nico Latour]

Re: Macbook M1 bypass FMM / EFI Unlock

Update:

Socrom on MBA 13" M1 does not have SN written whatsoever. If it is written it is coded differently. I should have an unlocked M1 arriving next week

I already said this when you said there is no number in it (m1 bin is encrypted)

[ebaymonster]

Re: Macbook M1 bypass FMM / EFI Unlock

has anyone tried to unsolder SSDs and read them? an acquaintance of mine says he can solder them to his phone or tablet and read through ibox.

[qava]

Re: Macbook M1 bypass FMM / EFI Unlock

Hi. I get the 2020 M1 MBP, A2338 chassis 820-02020-11 with UF260 8MBIT-3.0V W25Q80DVUXIE.
Can I do an activation after using T2 T203 programmer?
This model is supported?