3 ms·

There are a number of videos on YouTube which demonstrate bypassing the EFI PIN code with USB-based brute force tools. Here are two which included purchase link

by miles 10y ago

There are a number of videos on YouTube which demonstrate bypassing the EFI PIN code with USB-based brute force tools. Here are two which included purchase links: Finding your lost EFI PIN code on a locked MacBook Air 2015 https://www.youtube.com/watch?v=r-9VCAUyJlM https://www.youtube.com/watch?v=r-9VCAUyJlM http://www.cmizapper.com/products/brutus.html http://www.cmizapper.com/products/brutus.html Unlock ICloud Locked Macbook Pro, MacBook Air, Imac , Mac Mini https://www.youtube.com/watch?v=iIo3jK-cd_w https://www.youtube.com/watch?v=iIo3jK-cd_w http://pfdinc.wix.com/icloudunlock http://pfdinc.wix.com/icloudunlock I have not had any experience with these, so cannot vouch for their efficacy (or safety). A comment for the CIMzapper claims recovering a 4 digit code can take up to 2 days and a 6 digit code up to 200 days, and that only numeric codes can be recovered. Good luck regaining access to your MacBook!

lisper 10y ago
I actually tried this. It didn't work. The PIN entry is throttled, and after a while it stops accepting guesses altogether. At the moment it says, "Try again in an hour." It has been stuck in that state for a few weeks now.
- miles 10y ago
  Did you try the "CMIzapper Brutus"? It claims to work on models as recent as 2015 and 2016. Might be worth emailing the apparent maker anyway: info@cmizapper.com .
  - lisper 10y ago
    I did not try that exact model, no. I don't see how that (or anything else) could get around the throttling limit.
    - miles 10y ago
      Looks like you might be in luck! Apple EFI firmware passwords and the SCBO myth https://news.ycombinator.com/item?id=11974806 https://news.ycombinator.com/item?id=11974806 https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/ https://reverse.put.as/2016/06/25/apple-efi-firmware-passwor... The site is under heavy load at the moment; here is a cached version: http://webcache.googleusercontent.com/search?q=cache:https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/ http://webcache.googleusercontent.com/search?q=cache:https:/...
      - lisper 10y ago
        Yes, I saw that. Unfortunately, it requires re-flashing the EFI ROM, which is beyond my hacker-fu at the moment. I don't have the right hardware. But this does offer some hope that I can keep the machine out of the landfill.
  - miles 10y ago
    For anyone else coming across this thread in the future, here is a bit more information on this issue, excerpted from "How to Hack Apple EFI" https://ghostlyhaks.com/blog/blog/hacking/18-apple-efi-bypass https://ghostlyhaks.com/blog/blog/hacking/18-apple-efi-bypas... > NOTE: If you have a 2010 model MBP or earlier all you have to do is change the amount of RAM in your MBP and clear the PRAM. This is all you have to do to get past OS lock. But you will still have a firmware lock as far as I know as in many cases this has happened. There have been occasions where the firmware lock has also been removed but I cannot contest to any exact models. Remember to set the Mac up like new and register the Mac with a new iCloud account to avoid any future lock-downs. > Option A: You can assume that a firmware lock was never set and brute force the firmware lock with a HID device such as a Teensy. This operation can take quite a while because it has to go through 10,000 iterations of possible pass-phrases in the worst case scenario. This will ONLY work if it was set by the iCloud! > Option B: You can assume that a firmware lock was indeed implicated when the MBP was set up and that the brute force method will not work. This can save you time but requires you to have a SPI programmer at hand such as the Bus Pirate or in this case a Raspberry Pi.

by miles 10y ago

lisper 10y ago

I actually tried this. It didn't work. The PIN entry is throttled, and after a while it stops accepting guesses altogether. At the moment it says, "Try again in an hour." It has been stuck in that state for a few weeks now.

miles 10y ago
Did you try the "CMIzapper Brutus"? It claims to work on models as recent as 2015 and 2016. Might be worth emailing the apparent maker anyway: info@cmizapper.com .
- lisper 10y ago
  I did not try that exact model, no. I don't see how that (or anything else) could get around the throttling limit.
  - miles 10y ago
    Looks like you might be in luck! Apple EFI firmware passwords and the SCBO myth https://news.ycombinator.com/item?id=11974806 https://news.ycombinator.com/item?id=11974806 https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/ https://reverse.put.as/2016/06/25/apple-efi-firmware-passwor... The site is under heavy load at the moment; here is a cached version: http://webcache.googleusercontent.com/search?q=cache:https://reverse.put.as/2016/06/25/apple-efi-firmware-passwords-and-the-scbo-myth/ http://webcache.googleusercontent.com/search?q=cache:https:/...
    - lisper 10y ago
      Yes, I saw that. Unfortunately, it requires re-flashing the EFI ROM, which is beyond my hacker-fu at the moment. I don't have the right hardware. But this does offer some hope that I can keep the machine out of the landfill.
- miles 10y ago
  For anyone else coming across this thread in the future, here is a bit more information on this issue, excerpted from "How to Hack Apple EFI" https://ghostlyhaks.com/blog/blog/hacking/18-apple-efi-bypass https://ghostlyhaks.com/blog/blog/hacking/18-apple-efi-bypas... > NOTE: If you have a 2010 model MBP or earlier all you have to do is change the amount of RAM in your MBP and clear the PRAM. This is all you have to do to get past OS lock. But you will still have a firmware lock as far as I know as in many cases this has happened. There have been occasions where the firmware lock has also been removed but I cannot contest to any exact models. Remember to set the Mac up like new and register the Mac with a new iCloud account to avoid any future lock-downs. > Option A: You can assume that a firmware lock was never set and brute force the firmware lock with a HID device such as a Teensy. This operation can take quite a while because it has to go through 10,000 iterations of possible pass-phrases in the worst case scenario. This will ONLY work if it was set by the iCloud! > Option B: You can assume that a firmware lock was indeed implicated when the MBP was set up and that the brute force method will not work. This can save you time but requires you to have a SPI programmer at hand such as the Bus Pirate or in this case a Raspberry Pi.