Apple’s T2 security chip jailbreak
Hi guys, I am part of the team working on all things T2. [1]<p>The checkra1n support is just in a PoC state, it will successfully exploit and boot the T2. The payload support is partially broken, but being worked on.<p>Additionally, we have SSH working over usbmuxd from a tethered device [2] and SSH working from macOS on device, with an SDK in the works [3].<p>Some key takeaways from the T2 being jailbroken:<p>- Custom Bootloaders (OpenCore, Coreboot, etc) are now possible as the T2 validates/sends the UEFI payload to PCH using a bridgeOS binary called MacEFIUtil, which can trivially have its signature checks patched.<p>- Filevault and by extension Touch ID are more or less crippled, especially in light of the recent SEP exploits. Amusingly, Apple uses a hardcoded "passcode", analogous to an iDevice's unlock pin in plain text within the UEFI firmware.<p>- Support for In-System Debugging of the PCH/Intel processor over USB. This works in a similar fashion to those Bonobo cable used for debugging iDevices [4]. We are working on building an accessory that you can purchase and plug into your Mac with a USB male endpoint exposing Intel's DCI debugging protocol.<p>- Lightweight AppleSilicon Tinkering environment. With SSH support from macOS on device, and the T2's modest specs, its a nice sandbox for messing with arm64 stuff. It's a pretty peppy chip, at times coming close to my 8th gen i7...yikes.<p>1. <a href="https://www.theiphonewiki.com/wiki/T8012_checkm8" rel="nofollow">https://www.theiphonewiki.com/wiki/T8012_checkm8</a><p>2. <a href="https://twitter.com/qwertyoruiopz/status/1237904335184564224" rel="nofollow">https://twitter.com/qwertyoruiopz/status/1237904335184564224</a><p>3. <a href="https://twitter.com/su_rickmark/status/1286886010681462784" rel="nofollow">https://twitter.com/su_rickmark/status/1286886010681462784</a><p>4. <a href="http://bonoboswd.com/" rel="nofollow">http://bonoboswd.com/</a>