penwellr

3 ms·

1. 1.▲
   by penwellr 6y ago

   The T2 in a portable stays on even when the Intel CPU and macOS are shutdown, so "persistence" is pretty easy (the T2 can go very very low power). Once you own the T2 you can just disable secure boot and modify macOS anyway (like
2. 2.▲
   by penwellr 6y ago

   Apple has similar "magic DFU commands" for lightning, so for the iPhone X and prior this can be done via a magic cable as well... (look into the Bonobo cable)
3. 3.▲
   by penwellr 6y ago

   rickmark here: Sorry no, that's inaccurate. The T2 provides MacEFI.im4 to the Intel processor by emulating a flash controller over eSPI. So by modifying this file, and removing signature checks you can run any payload you like (see t
4. 4.▲
   by penwellr 6y ago

   The full timeline + previous coverage is here: https://blog.t8012.dev/on-bridgeos-t2-research/