the size of the 2nd update is a bit smaller than the first (if you include both uarchs). Maybe a XOR decryption key for the first set? Bootloader, then (Intel

the size of the 2nd update is a bit smaller than the first (if you include both uarchs). Maybe a XOR decryption key for the first set? Bootloader, then (Intel+Apple files) XOR version-key or my-key? I am thinking of the secure mode boot attestation, and extensions that want you to disable that and allow custom kexts, etc. It makes sense that maybe the x86 stuff might be there just in case of rosetta needing to do something. No idea but seems plausible that they want to have the fork there. there definitely is some kind of per-instance registration of which laptop has which version, iphones similarly have a very visible "requesting update" state. Apple has secure boot on all their shit for a long time, they have hardware attestation and the OS will report when it's been updated, and they can monitor attempts for rollback attacks unless the laptop has been Startup Config > Security policy changed to allow insecure mode and older/non-signed/non-apple OSs or custom extensions etc. Apple legitimately did build a very secure default system, you can unlock it but you do have to go out of your way to go into bios etc, by default they will very aggressively assume that apple signing = on and version go forward. Which if any of those files are bit-identical when received by different laptop identifier instances (via wireshark or w/e)? Like "it has to be downloaded from apple" is that because it's custom to your hardware instance? Is there a common file image and then a mask, or is the second thing a giant blob of binaries that's the same for everyone, or what? Or just can't tell because it's encrypted or something?