Macbook M1 bypass FMM / EFI Unlock

[Mmsdma]

Re: Macbook M1 bypass FMM / EFI Unlock

OK, I found a quick way to pull serial info from locked boards. Going to go through and pull more M1 ROM dumps later this week to check for emails; I still haven't found any in the dumps I've checked (over 25 checked now--including 2 more A2442 boards), but going to play with different scenarios (will take time).

hi guys, has anyone managed to find where the sn is recorded?
After reading through the entire thread I only found information that it is somewhere on the first nand and you can not get to it.

[curiositymaster]

Re: Macbook M1 bypass FMM / EFI Unlock

Tsm ill check.

Kindly update us as your research progresses. Cheers!

[curiositymaster]

Re: Macbook M1 bypass FMM / EFI Unlock

i'm not gonna expose it right now, because it is huge hole in macos security and seems like nobody know it. at first i'll post a vidio next week with poc without ditails, next i'll contact apple bug bounty(i know it's weak) , next... anyway i'll get profit and then i'll tell u

If you weren't going to share how you managed to bypass filevault, why talk about it?

[fshadow]

Re: Macbook M1 bypass FMM / EFI Unlock

i'm not gonna expose it right now, because it is huge hole in macos security and seems like nobody know it. at first i'll post a vidio next week with poc without ditails, next i'll contact apple bug bounty(i know it's weak) , next... anyway i'll get profit and then i'll tell u

[kevingill]

Re: Macbook M1 bypass FMM / EFI Unlock

Oh, interesting. Can you update us with how you've managed to boot Linux?

[fshadow]

Re: Macbook M1 bypass FMM / EFI Unlock

I fully agree. Diagnostics do not help the purpose, starting a shell from there wouldn't allow us to do anything.

actually you can get kernel privileges, bypass the FileVault, mount main partition and do whatever you want. I'm on this stage now, and have already booted linux with success. But my goal is to bypass activation lock and install normal macos.

[genhack]

Re: Macbook M1 bypass FMM / EFI Unlock

Couldn't upload the whole libexec folder here as it was too large (42mb after compression). However, I have uploaded the mobileactivationd file from the bypassed mac if that is enough for your research.

Tsm ill check.

[curiositymaster]

Re: Macbook M1 bypass FMM / EFI Unlock

If you have a t2 bypassed make a zip with a password of this folder and upload:

/usr/libexec/

I'm working on T2 latest bridgeOS, can be pwn and i think is possible to bypass!.

Couldn't upload the whole libexec folder here as it was too large (42mb after compression). However, I have uploaded the mobileactivationd file from the bypassed mac if that is enough for your research.

[Mario1241]

Re: Macbook M1 bypass FMM / EFI Unlock

Hello Mario,
In order:

Through DFU I have been able to reverse the firmware of the locked mac I have installed the UniversalMac_11.0.1_20B29_Restore.ipsw even so I have not been able to skip the icloud step.

You can't edit and flash this ipsw, Bootchain will refuse any mod. so this try is usless untill m1 is pwn (*Like t2* with checkm8).

I have tried to start with linux but the operating system does not recognize me or it does not show me the memory or at least I do not know how to boot the operating system that is already combatable.

Ok i think you need to check how boot m1m1 by usb. Just a Ps: M1 will refuse to boot other os in activation, secure state is enbaled but you can try.

The hidden diagnostic system allows me to store all the analysis on a usb stick.

About diagnostic, i check myself and i think there is no way to use external drive for boot something or open app. Diagnostic is designed for just save do that and can't be the skip part of the process, you need to sign binary inside the other volume and make full bypass, this mean if i press activate you go on this flow and do all things you need for boot proper. if mobileactivationd don't make the necessary cert of the devices i think you will never boot inside the real os.

I've got a couple of bypassed T2s and one that won't unlock due to it having Monteray on it.
I also have a water-damaged M1 that won't charge its battery, and it doesn't seem to have sound but other than that, it's running fine and an identical locked M1 that someone could probably make an easy repair of.

the important thing is to find how to unlock it.

[VHS]

Re: Macbook M1 bypass FMM / EFI Unlock

I've got a couple of bypassed T2s and one that won't unlock due to it having Monteray on it.
I also have a water-damaged M1 that won't charge its battery, and it doesn't seem to have sound but other than that, it's running fine and an identical locked M1 that someone could probably make an easy repair of.

[genhack]

Re: Macbook M1 bypass FMM / EFI Unlock

When you start diagnostics there is dmg image (FieldServiceDiskImagePersonalized) downloded via internet, which contains another dmg image (like 012-94675-003.dmg). That last dmg contains apps, libs, lua scripts and so on, for running diagnostics, but this image is trustcache protected, so if you have control over network it is not possible to change... almost.
assume, you've found a way to change on this image whatever you want, what would you do?

I fully agree. Diagnostics do not help the purpose, starting a shell from there wouldn't allow us to do anything.

[fshadow]

Re: Macbook M1 bypass FMM / EFI Unlock

When you start diagnostics there is dmg image (FieldServiceDiskImagePersonalized) downloded via internet, which contains another dmg image (like 012-94675-003.dmg). That last dmg contains apps, libs, lua scripts and so on, for running diagnostics, but this image is trustcache protected, so if you have control over network it is not possible to change... almost.
assume, you've found a way to change on this image whatever you want, what would you do?

[curiositymaster]

Re: Macbook M1 bypass FMM / EFI Unlock

If you have a t2 bypassed make a zip with a password of this folder and upload:

/usr/libexec/

I'm working on T2 latest bridgeOS, can be pwn and i think is possible to bypass!

I'll see if I can get my hands on one and share it ASAP.

[genhack]

Re: Macbook M1 bypass FMM / EFI Unlock

@genhack, do you have an idea how I can extract mobileactivationd from a mina-jailbroken t2 mac and how to use it to bypass those with upgraded bridgeOS version?

If you have a t2 bypassed make a zip with a password of this folder and upload:

/usr/libexec/

I'm working on T2 latest bridgeOS, can be pwn and i think is possible to bypass!

hello genhack, thank you for your observations.

I was thinking about the UniversalMac_11.0.1_20B29_Restore.ipsw we can edit it and instead of the diagnostic options we change it to the terminal file what would happen?

Considering that I can load by DFU. I do not know how to edit it but it is an option that occurs to me, what do you think?

Cheers!

You can't just edit ipsw like iphone/ipad, devices will refuse the flash. I need an m1 locked and see where we can play around.

[curiositymaster]

Re: Macbook M1 bypass FMM / EFI Unlock

hello genhack, thank you for your observations.

I was thinking about the UniversalMac_11.0.1_20B29_Restore.ipsw we can edit it and instead of the diagnostic options we change it to the terminal file what would happen?

Considering that I can load by DFU. I do not know how to edit it but it is an option that occurs to me, what do you think?

Cheers!

Has anyone tried the hidden diagnostic while booting with a jumpstick?

[curiositymaster]

Re: Macbook M1 bypass FMM / EFI Unlock

@genhack, do you have an idea how I can extract mobileactivationd from a mina-jailbroken t2 mac and how to use it to bypass those with upgraded bridgeOS version?

[Mario1241]

Re: Macbook M1 bypass FMM / EFI Unlock

Hello Mario,
In order:

Through DFU I have been able to reverse the firmware of the locked mac I have installed the UniversalMac_11.0.1_20B29_Restore.ipsw even so I have not been able to skip the icloud step.

You can't edit and flash this ipsw, Bootchain will refuse any mod. so this try is usless untill m1 is pwn (*Like t2* with checkm8).

I have tried to start with linux but the operating system does not recognize me or it does not show me the memory or at least I do not know how to boot the operating system that is already combatable.

Ok i think you need to check how boot m1m1 by usb. Just a Ps: M1 will refuse to boot other os in activation, secure state is enbaled but you can try.

The hidden diagnostic system allows me to store all the analysis on a usb stick.

About diagnostic, i check myself and i think there is no way to use external drive for boot something or open app. Diagnostic is designed for just save do that and can't be the skip part of the process, you need to sign binary inside the other volume and make full bypass, this mean if i press activate you go on this flow and do all things you need for boot proper. if mobileactivationd don't make the necessary cert of the devices i think you will never boot inside the real os.

hello genhack, thank you for your observations.

I was thinking about the UniversalMac_11.0.1_20B29_Restore.ipsw we can edit it and instead of the diagnostic options we change it to the terminal file what would happen?

Considering that I can load by DFU. I do not know how to edit it but it is an option that occurs to me, what do you think?

Cheers!

[genhack]

Re: Macbook M1 bypass FMM / EFI Unlock

Hello genhack , I share with you.

I currently have two m1(A2338) macs, they don't have the T2 chip.
Through DFU I have been able to reverse the firmware of the locked mac I have installed the UniversalMac_11.0.1_20B29_Restore.ipsw even so I have not been able to skip the icloud step.

I have tried to start with linux but the operating system does not recognize me or it does not show me the memory or at least I do not know how to boot the operating system that is already combatable.

I have also experimented opening the hidden menu in the diagnostics but still I can't open the terminal because it doesn't recognize it.

The hidden diagnostic menu lets me store all the scans on a usb stick.

I have also tried to use an external disk with the operating system installed to be able to use it and it does not allow it.

The hidden diagnostic system allows me to store all the analysis on a usb stick.

Tell me how I can experiment with the locked computer, or can you think of any other option.

best regards

Hello Mario,
In order:

Through DFU I have been able to reverse the firmware of the locked mac I have installed the UniversalMac_11.0.1_20B29_Restore.ipsw even so I have not been able to skip the icloud step.

You can't edit and flash this ipsw, Bootchain will refuse any mod. so this try is usless untill m1 is pwn (*Like t2* with checkm8).

I have tried to start with linux but the operating system does not recognize me or it does not show me the memory or at least I do not know how to boot the operating system that is already combatable.

Ok i think you need to check how boot m1m1 by usb. Just a Ps: M1 will refuse to boot other os in activation, secure state is enbaled but you can try.

The hidden diagnostic system allows me to store all the analysis on a usb stick.

About diagnostic, i check myself and i think there is no way to use external drive for boot something or open app. Diagnostic is designed for just save do that and can't be the skip part of the process, you need to sign binary inside the other volume and make full bypass, this mean if i press activate you go on this flow and do all things you need for boot proper. if mobileactivationd don't make the necessary cert of the devices i think you will never boot inside the real os.

[Mario1241]

Re: Macbook M1 bypass FMM / EFI Unlock

hey @Mario1241 pongoOs can be booted on m1 but is useless. if you can't pwn m1 processor (like t2). On m1 we need to understand if 1TR or recovery, when locked can boot other os, and if yes what we can mount without aes engine. if you have another mac i can send you a ways for boot linux and check what we can do. Just a remember we need a full patch or mobileactivationd and a dump of t2 macbook bypassed with minacriss can be the key.

Hello genhack , I share with you.

I currently have two m1(A2338) macs, they don't have the T2 chip.
Through DFU I have been able to reverse the firmware of the locked mac I have installed the UniversalMac_11.0.1_20B29_Restore.ipsw even so I have not been able to skip the icloud step.

I have tried to start with linux but the operating system does not recognize me or it does not show me the memory or at least I do not know how to boot the operating system that is already combatable.

I have also experimented opening the hidden menu in the diagnostics but still I can't open the terminal because it doesn't recognize it.

The hidden diagnostic menu lets me store all the scans on a usb stick.

I have also tried to use an external disk with the operating system installed to be able to use it and it does not allow it.

The hidden diagnostic system allows me to store all the analysis on a usb stick.

Tell me how I can experiment with the locked computer, or can you think of any other option.

best regards

[genhack]

Re: Macbook M1 bypass FMM / EFI Unlock

hey @Mario1241 pongoOs can be booted on m1 but is useless. if you can't pwn m1 processor (like t2). On m1 we need to understand if 1TR or recovery, when locked can boot other os, and if yes what we can mount without aes engine. if you have another mac i can send you a ways for boot linux and check what we can do. Just a remember we need a full patch or mobileactivationd and a dump of t2 macbook bypassed with minacriss can be the key.