Plug’nPwn – Connect to Jailbreak

Re:Plug’nPwn – Connect to Jailbreak by aunali1 on Tuesday October 13, 2020 @11:42AM (#24766646)

Unfortunately, this is not the complete picture. The T2 simply programs the embedded flash within the PCH over an eSPI interface. Meaning, a successful reprogram from the T2 WILL persist until the following occurs:

- A T2 Restore

- A macOS System Update

[ Parent | on HN ]

Re:Plug’nPwn – Connect to Jailbreak by penwellr on Tuesday October 13, 2020 @12:43PM (#24767251)

rickmark here: Sorry no, that's inaccurate. The T2 provides MacEFI.im4 to the Intel processor by emulating a flash controller over eSPI. So by modifying this file, and removing signature checks you can run any payload you like (see the EFI replacement video)

[ Parent | on HN ]

Re:Plug’nPwn – Connect to Jailbreak by MuffinFlavored on Tuesday October 13, 2020 @01:23PM (#24767651)

So there is some kind of signature defeat involved, correct?

[ Parent | on HN ]

Re:Plug’nPwn – Connect to Jailbreak by h0m3us3r on Wednesday October 14, 2020 @01:17AM (#24773337)

Yes, sigchecks had to be patched out of the kernel. And yes, it does not persist T2 reboot, but T2 only reboots if you hold power button for 5 sec. MacOS "reboot" does _not_ reboot T2.

[ Parent | on HN ]