2020-10-10T19:49:36Z

Rickmark:

Chimp Cable

2020-10-10T19:49:02Z

Rickmark: Created page with "A Normal Chimp Cable (credit Mr White) The ```Chimp Cable``` is a JTAG/SWD Cable capable of debugging CPFM 00 or 01 devices (EVT and DVT..."

[[File:Chimp_Cable.jpeg|right|thumb|A Normal Chimp Cable (credit Mr White)]]

The ```Chimp Cable``` is a JTAG/SWD Cable capable of debugging CPFM 00 or 01 devices (EVT and DVT devices), or CPFM 03 (production devices) which demoted which have a USB-C port. The Chimp is used with the [[T2]] and [[iPad Pro]]. They can be purchased from obscure markets. There are two known types of the Kanzi cable.

{{stub|hardware}}
[[Category:Cables]]

T8012 checkm8

2020-10-09T05:13:42Z

Rickmark:

{{DISPLAYTITLE:t8012 checkm8}}
The least imaginative team name...

'''t8012 checkm8''' is a team of who have applied the [[checkm8]] vulnerability to the [[t8012]] or "T2" security processor on modern Mac computers.

==Work==
* [[Checkm8]] port to the T2 processor [https://github.com/h0m3us3r/ipwndfu]
* [[T2]] restore using '''libimobiledevice''' [https://gist.github.com/rickmark/9245ed3ef7f36d5a0421557f68c4681b]
* [[USB Target Disk Mode]]
* Apple [[SMC]] Firmware Reverse Engineering
* Analysis of [[FDR]] data in the SysCfg region of Flash, and it's potential for Malware

== Official Members ==
*[[User:h0m3us3r|h0m3us3r]]
*[[User:aunali1|aunali1]]
*[[User:mrarm|mrarm]]
*[[User:rickmark|rickmark]]

== Links ==
* Website - https://t8012.dev
* Blog - https://blog.t8012.dev
* Twitter - https://twitter.com/t8012dev
* GitHub - https://github.com/t8012

[[Category:Hackers]]
[[Category:Teams]]

IPSW File Format

2020-09-16T23:58:50Z

Rickmark: /* Firmwares found in IPSW */

{{redirect|IPSW|the component of XPwn|ipsw}}
{{see also|Disk Image Formats}}
'''IPSW''' ('''iP'''od[[#Notes|[1]<nowiki/>]] '''S'''oft'''w'''are) files have the Magic Number 504B0304 (PK\003\004) and thus are [[wikipedia:ZIP (file format)|ZIP]] archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). IPSWs are used to deliver the [[iDevice|device's]] firmware to the end-user.

== Archive Structure ==
* [[Restore Ramdisk]]
* [[Update Ramdisk]] (some firmwares don't have one due to various reasons)
* [[:/|Filesystem Ramdisk]] (the largest [[Apple Disk Image|.dmg]] file)
* [[Device Tree]] (model specific)
* [[Kernelcache]] (model specific; processor specific on pre-[[S5L8930|A4]])
* BuildManifest.plist (first appeared in [[iOS|iPhone OS]] 3.0 beta 2)
* Restore.plist
* ''Firmware/''
** ''all_flash/''
*** ''all_flash.XXXXX.production/'' (model specific i.e. [[M68AP]], [[N82AP]], etc.)
**** [[S5L File Formats#IMG2|IMG2]]/[[IMG3 File Format|IMG3]] files
**** manifest
** dfu/''
*** [[iBEC]].XXXXX.dfu (model specific i.e. [[M68AP]], [[N82AP]], etc.)
*** [[iBSS]].XXXXX.dfu
*** [[WTF]].XXXXX.dfu (model specific and only for [[M68AP]], [[N82AP]], [[N45AP]], [[N72AP]]; not present in firmwares for the [[N88AP|iPhone 3GS]] and later, because it was used to patch issues with the DFU mode that was burned into the bootrom)
** [[Baseband Device|Baseband]] (may be one or many files depending on the model)

=== Example ===
Here are the contents of the [[Kirkwood 7A341 (iPhone2,1)|iPhone 3GS 3.0 (7A341)]] firmware IPSW:
* <code>[[:/|018-5302-002.dmg]]</code> (281214976 bytes)
* <code>[[Update Ramdisk|018-5304-002.dmg]]</code> (12769604 bytes)
* <code>[[Restore Ramdisk|018-5306-002.dmg]]</code> (12777796 bytes)
* <code>BuildManifest.plist</code> (21097 bytes)
* <code>[[kernelcache]].release.s5l8920x</code> (4695492 bytes)
* <code>Restore.plist</code> (1763 bytes)
* ''<code>Firmware/</code>''
** ''<code>all_flash/</code>''
*** ''<code>all_flash.n88ap.production/</code>''
**** <code>[[AppleLogo|applelogo]].s5l8920x.img3</code> (9604 bytes)
**** <code>[[BatteryCharging0|batterycharging0]].s5l8920x.img3</code> (19716 bytes)
**** <code>[[BatteryCharging1|batterycharging1]].s5l8920x.img3</code> (24900 bytes)
**** <code>[[BatteryFull|batteryfull]].s5l8920x.img3</code> (76100 bytes)
**** <code>[[BatteryLow0|batterylow0]].s5l8920x.img3</code> (56772 bytes)
**** <code>[[BatteryLow1|batterylow1]].s5l8920x.img3</code> (65348 bytes)
**** <code>[[DeviceTree]].n88ap.img3</code> (44996 bytes)
**** <code>[[GlyphCharging|glyphcharging]].s5l8920x.img3</code> (20356 bytes)
**** <code>[[GlyphPlugin|glyphplugin]].s5l8920x.img3</code> (19332 bytes)
**** <code>[[iBoot (Bootloader)|iBoot]].n88ap.RELEASE.img3</code> (178500 bytes)
**** <code>[[LLB]].n88ap.RELEASE.img3</code> (67908 bytes)
**** <code>manifest</code> (341 bytes)
**** <code>[[NeedService|needservice]].s5l8920x.img3</code> (20484 bytes)
**** <code>[[RecoveryMode|recoverymode]].s5l8920x.img3</code> (47876 bytes)
** ''<code>dfu/</code>''
*** <code>[[iBEC]].n88ap.RELEASE.dfu</code> (104772 bytes)
*** <code>[[iBSS]].n88ap.RELEASE.dfu</code> (104772 bytes)

== Firmwares found in IPSW ==
Per http://newosxbook.com/bonus/vol1AppA.html
{| class="wikitable"
|-
! Filename
! Use
|-
| ICE17-1.xx.xx.Release.bbfw
| Intel modem / baseband
|-
| Mav17-1.xx.xx.Release.bbfw
| Maverick modem / baseband
|-
| AOP/aopfw-iphone##aop.im4p
| Always on processor
|-
| Savage/Savage.B[0/2]-[Dev/Prod].[vt.]fw
| FaceID
|-
| Yonkers/Yonkers.EA01_F###_[Dev/Prod]fw
| FaceID
|-
| SE/Stockholm##.RELEASE.sefw
| Secure Element
|-
| Maggie/AppleMaggieFirmwareImage.im4p
| ?
|-
| cpu_Multitouch.im4p
| Multitouch controller
|-
| isp/adc-petra-d3x.im4p
| Image Signal Processor
|-
| ane/h11_ane_fw_quin.im4p
| [[Apple Neural Engine]]
|-
| WirelessPower/WirelessPower.iphone##.im4p
| Wireless charging controller
|-
| SmartIOFirmwareCHIP.im4p
| [[T8020]] and later Smart I/O
|-
| board_CallanFirmware.im4p
| Haptics Firmware
|-
| ave/AppleAVE2FW.im4p
| Audio/Video Encoder
|-
| agx/armfw_g11p.im4p
| GPU Scheduler/Command Stream Processor
|-
| all_flash/sep-firmware.*.im4p
| Secure Enclave Processor
|-
| liquiddetect@2436~iphone-lightning.im4p
| Liquid Damage Detection
|-
| pmp/t8030pmp.im4p
| Power Management Processor
|-
| Rose/r1p0/ftab.bin
| Rose (TouchID) sensor
|-
| vinyl_05.vnlfw
| eSIM
|-
| Veridian
| ? (Some form of signing/device integrity)
|}

== Notes ==
# IPSW files have been used since the very first iPod, though they have [http://www.freemyipod.org/wiki/Firmware a different format] than firmwares for iOS devices.

[[Category:File Formats]]

IPSW File Format

2020-09-16T23:56:53Z

Rickmark: /* Firmwares found in IPSW */

{{redirect|IPSW|the component of XPwn|ipsw}}
{{see also|Disk Image Formats}}
'''IPSW''' ('''iP'''od[[#Notes|[1]<nowiki/>]] '''S'''oft'''w'''are) files have the Magic Number 504B0304 (PK\003\004) and thus are [[wikipedia:ZIP (file format)|ZIP]] archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). IPSWs are used to deliver the [[iDevice|device's]] firmware to the end-user.

== Archive Structure ==
* [[Restore Ramdisk]]
* [[Update Ramdisk]] (some firmwares don't have one due to various reasons)
* [[:/|Filesystem Ramdisk]] (the largest [[Apple Disk Image|.dmg]] file)
* [[Device Tree]] (model specific)
* [[Kernelcache]] (model specific; processor specific on pre-[[S5L8930|A4]])
* BuildManifest.plist (first appeared in [[iOS|iPhone OS]] 3.0 beta 2)
* Restore.plist
* ''Firmware/''
** ''all_flash/''
*** ''all_flash.XXXXX.production/'' (model specific i.e. [[M68AP]], [[N82AP]], etc.)
**** [[S5L File Formats#IMG2|IMG2]]/[[IMG3 File Format|IMG3]] files
**** manifest
** dfu/''
*** [[iBEC]].XXXXX.dfu (model specific i.e. [[M68AP]], [[N82AP]], etc.)
*** [[iBSS]].XXXXX.dfu
*** [[WTF]].XXXXX.dfu (model specific and only for [[M68AP]], [[N82AP]], [[N45AP]], [[N72AP]]; not present in firmwares for the [[N88AP|iPhone 3GS]] and later, because it was used to patch issues with the DFU mode that was burned into the bootrom)
** [[Baseband Device|Baseband]] (may be one or many files depending on the model)

=== Example ===
Here are the contents of the [[Kirkwood 7A341 (iPhone2,1)|iPhone 3GS 3.0 (7A341)]] firmware IPSW:
* <code>[[:/|018-5302-002.dmg]]</code> (281214976 bytes)
* <code>[[Update Ramdisk|018-5304-002.dmg]]</code> (12769604 bytes)
* <code>[[Restore Ramdisk|018-5306-002.dmg]]</code> (12777796 bytes)
* <code>BuildManifest.plist</code> (21097 bytes)
* <code>[[kernelcache]].release.s5l8920x</code> (4695492 bytes)
* <code>Restore.plist</code> (1763 bytes)
* ''<code>Firmware/</code>''
** ''<code>all_flash/</code>''
*** ''<code>all_flash.n88ap.production/</code>''
**** <code>[[AppleLogo|applelogo]].s5l8920x.img3</code> (9604 bytes)
**** <code>[[BatteryCharging0|batterycharging0]].s5l8920x.img3</code> (19716 bytes)
**** <code>[[BatteryCharging1|batterycharging1]].s5l8920x.img3</code> (24900 bytes)
**** <code>[[BatteryFull|batteryfull]].s5l8920x.img3</code> (76100 bytes)
**** <code>[[BatteryLow0|batterylow0]].s5l8920x.img3</code> (56772 bytes)
**** <code>[[BatteryLow1|batterylow1]].s5l8920x.img3</code> (65348 bytes)
**** <code>[[DeviceTree]].n88ap.img3</code> (44996 bytes)
**** <code>[[GlyphCharging|glyphcharging]].s5l8920x.img3</code> (20356 bytes)
**** <code>[[GlyphPlugin|glyphplugin]].s5l8920x.img3</code> (19332 bytes)
**** <code>[[iBoot (Bootloader)|iBoot]].n88ap.RELEASE.img3</code> (178500 bytes)
**** <code>[[LLB]].n88ap.RELEASE.img3</code> (67908 bytes)
**** <code>manifest</code> (341 bytes)
**** <code>[[NeedService|needservice]].s5l8920x.img3</code> (20484 bytes)
**** <code>[[RecoveryMode|recoverymode]].s5l8920x.img3</code> (47876 bytes)
** ''<code>dfu/</code>''
*** <code>[[iBEC]].n88ap.RELEASE.dfu</code> (104772 bytes)
*** <code>[[iBSS]].n88ap.RELEASE.dfu</code> (104772 bytes)

== Firmwares found in IPSW ==
Per http://newosxbook.com/bonus/vol1AppA.html
{| class="wikitable"
|-
! Filename
! Use
|-
| ICE17-1.xx.xx.Release.bbfw
| Intel modem / baseband
|-
| Mav17-1.xx.xx.Release.bbfw
| Maverick modem / baseband
|-
| AOP/aopfw-iphone##aop.im4p
| Always on processor
|-
| Savage/Savage.B[0/2]-[Dev/Prod].[vt.]fw
| FaceID
|-
| Yonkers/Yonkers.EA01_F###_[Dev/Prod]fw
| FaceID
|-
| SE/Stockholm##.RELEASE.sefw
| Secure Element
|-
| Maggie/AppleMaggieFirmwareImage.im4p
| ?
|-
| cpu_Multitouch.im4p
| Multitouch controller
|-
| isp/adc-petra-d3x.im4p
| Image Signal Processor
|-
| ane/h11_ane_fw_quin.im4p
| [[Apple Neural Engine]]
|-
| WirelessPower/WirelessPower.iphone##.im4p
| Wireless charging controller
|-
| SmartIOFirmwareCHIP.im4p
| [[T8020]] and later Smart I/O
|-
| board_CallanFirmware.im4p
| Haptics Firmware
|-
| ave/AppleAVE2FW.im4p
| Audio/Video Encoder
|-
| agx/armfw_g11p.im4p
| GPU Scheduler/Command Stream Processor
|-
| all_flash/sep-firmware.*.im4p
| Secure Enclave Processor
|-
| liquiddetect@2436~iphone-lightning.im4p
| Liquid Damage Detection
|-
| pmp/t8030pmp.im4p
| Power Management Processor
|-
| Rose/r1p0/ftab.bin
| Rose (TouchID) sensor
|}

== Notes ==
# IPSW files have been used since the very first iPod, though they have [http://www.freemyipod.org/wiki/Firmware a different format] than firmwares for iOS devices.

[[Category:File Formats]]

IPSW File Format

2020-09-16T00:34:47Z

Rickmark: /* Firmwares found in IPSW */

{{redirect|IPSW|the component of XPwn|ipsw}}
{{see also|Disk Image Formats}}
'''IPSW''' ('''iP'''od[[#Notes|[1]<nowiki/>]] '''S'''oft'''w'''are) files have the Magic Number 504B0304 (PK\003\004) and thus are [[wikipedia:ZIP (file format)|ZIP]] archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). IPSWs are used to deliver the [[iDevice|device's]] firmware to the end-user.

== Archive Structure ==
* [[Restore Ramdisk]]
* [[Update Ramdisk]] (some firmwares don't have one due to various reasons)
* [[:/|Filesystem Ramdisk]] (the largest [[Apple Disk Image|.dmg]] file)
* [[Device Tree]] (model specific)
* [[Kernelcache]] (model specific; processor specific on pre-[[S5L8930|A4]])
* BuildManifest.plist (first appeared in [[iOS|iPhone OS]] 3.0 beta 2)
* Restore.plist
* ''Firmware/''
** ''all_flash/''
*** ''all_flash.XXXXX.production/'' (model specific i.e. [[M68AP]], [[N82AP]], etc.)
**** [[S5L File Formats#IMG2|IMG2]]/[[IMG3 File Format|IMG3]] files
**** manifest
** dfu/''
*** [[iBEC]].XXXXX.dfu (model specific i.e. [[M68AP]], [[N82AP]], etc.)
*** [[iBSS]].XXXXX.dfu
*** [[WTF]].XXXXX.dfu (model specific and only for [[M68AP]], [[N82AP]], [[N45AP]], [[N72AP]]; not present in firmwares for the [[N88AP|iPhone 3GS]] and later, because it was used to patch issues with the DFU mode that was burned into the bootrom)
** [[Baseband Device|Baseband]] (may be one or many files depending on the model)

=== Example ===
Here are the contents of the [[Kirkwood 7A341 (iPhone2,1)|iPhone 3GS 3.0 (7A341)]] firmware IPSW:
* <code>[[:/|018-5302-002.dmg]]</code> (281214976 bytes)
* <code>[[Update Ramdisk|018-5304-002.dmg]]</code> (12769604 bytes)
* <code>[[Restore Ramdisk|018-5306-002.dmg]]</code> (12777796 bytes)
* <code>BuildManifest.plist</code> (21097 bytes)
* <code>[[kernelcache]].release.s5l8920x</code> (4695492 bytes)
* <code>Restore.plist</code> (1763 bytes)
* ''<code>Firmware/</code>''
** ''<code>all_flash/</code>''
*** ''<code>all_flash.n88ap.production/</code>''
**** <code>[[AppleLogo|applelogo]].s5l8920x.img3</code> (9604 bytes)
**** <code>[[BatteryCharging0|batterycharging0]].s5l8920x.img3</code> (19716 bytes)
**** <code>[[BatteryCharging1|batterycharging1]].s5l8920x.img3</code> (24900 bytes)
**** <code>[[BatteryFull|batteryfull]].s5l8920x.img3</code> (76100 bytes)
**** <code>[[BatteryLow0|batterylow0]].s5l8920x.img3</code> (56772 bytes)
**** <code>[[BatteryLow1|batterylow1]].s5l8920x.img3</code> (65348 bytes)
**** <code>[[DeviceTree]].n88ap.img3</code> (44996 bytes)
**** <code>[[GlyphCharging|glyphcharging]].s5l8920x.img3</code> (20356 bytes)
**** <code>[[GlyphPlugin|glyphplugin]].s5l8920x.img3</code> (19332 bytes)
**** <code>[[iBoot (Bootloader)|iBoot]].n88ap.RELEASE.img3</code> (178500 bytes)
**** <code>[[LLB]].n88ap.RELEASE.img3</code> (67908 bytes)
**** <code>manifest</code> (341 bytes)
**** <code>[[NeedService|needservice]].s5l8920x.img3</code> (20484 bytes)
**** <code>[[RecoveryMode|recoverymode]].s5l8920x.img3</code> (47876 bytes)
** ''<code>dfu/</code>''
*** <code>[[iBEC]].n88ap.RELEASE.dfu</code> (104772 bytes)
*** <code>[[iBSS]].n88ap.RELEASE.dfu</code> (104772 bytes)

== Firmwares found in IPSW ==
Per http://newosxbook.com/bonus/vol1AppA.html
{| class="wikitable"
|-
! Filename
! Use
|-
| ICE17-1.xx.xx.Release.bbfw
| Intel modem / baseband
|-
| Mav17-1.xx.xx.Release.bbfw
| Maverick modem / baseband
|-
| AOP/aopfw-iphone##aop.im4p
| Always on processor
|-
| Savage/Savage.B[0/2]-[Dev/Prod].[vt.]fw
| FaceID
|-
| Yonkers/Yonkers.EA01_F###_[Dev/Prod]fw
| FaceID
|-
| SE/Stockholm##.RELEASE.sefw
| Secure Element
|-
| Maggie/AppleMaggieFirmwareImage.im4p
| ?
|-
| cpu_Multitouch.im4p
| Multitouch controller
|-
| isp/adc-petra-d3x.im4p
| Image Signal Processor
|-
| ane/h11_ane_fw_quin.im4p
| [[Apple Neural Engine]]
|-
| WirelessPower/WirelessPower.iphone##.im4p
| Wireless charging controller
|-
| SmartIOFirmwareCHIP.im4p
| [[T8020]] and later Smart I/O
|-
| board_CallanFirmware.im4p
| Haptics Firmware
|-
| ave/AppleAVE2FW.im4p
| Audio/Video Encoder
|-
| agx/armfw_g11p.im4p
| GPU Scheduler/Command Stream Processor
|}

== Notes ==
# IPSW files have been used since the very first iPod, though they have [http://www.freemyipod.org/wiki/Firmware a different format] than firmwares for iOS devices.

[[Category:File Formats]]

IPSW File Format

2020-09-16T00:34:26Z

Rickmark:

{{redirect|IPSW|the component of XPwn|ipsw}}
{{see also|Disk Image Formats}}
'''IPSW''' ('''iP'''od[[#Notes|[1]<nowiki/>]] '''S'''oft'''w'''are) files have the Magic Number 504B0304 (PK\003\004) and thus are [[wikipedia:ZIP (file format)|ZIP]] archives. They can be modified with typical zip/unzip tools (i.e. change extension to .zip and double click). IPSWs are used to deliver the [[iDevice|device's]] firmware to the end-user.

== Archive Structure ==
* [[Restore Ramdisk]]
* [[Update Ramdisk]] (some firmwares don't have one due to various reasons)
* [[:/|Filesystem Ramdisk]] (the largest [[Apple Disk Image|.dmg]] file)
* [[Device Tree]] (model specific)
* [[Kernelcache]] (model specific; processor specific on pre-[[S5L8930|A4]])
* BuildManifest.plist (first appeared in [[iOS|iPhone OS]] 3.0 beta 2)
* Restore.plist
* ''Firmware/''
** ''all_flash/''
*** ''all_flash.XXXXX.production/'' (model specific i.e. [[M68AP]], [[N82AP]], etc.)
**** [[S5L File Formats#IMG2|IMG2]]/[[IMG3 File Format|IMG3]] files
**** manifest
** dfu/''
*** [[iBEC]].XXXXX.dfu (model specific i.e. [[M68AP]], [[N82AP]], etc.)
*** [[iBSS]].XXXXX.dfu
*** [[WTF]].XXXXX.dfu (model specific and only for [[M68AP]], [[N82AP]], [[N45AP]], [[N72AP]]; not present in firmwares for the [[N88AP|iPhone 3GS]] and later, because it was used to patch issues with the DFU mode that was burned into the bootrom)
** [[Baseband Device|Baseband]] (may be one or many files depending on the model)

=== Example ===
Here are the contents of the [[Kirkwood 7A341 (iPhone2,1)|iPhone 3GS 3.0 (7A341)]] firmware IPSW:
* <code>[[:/|018-5302-002.dmg]]</code> (281214976 bytes)
* <code>[[Update Ramdisk|018-5304-002.dmg]]</code> (12769604 bytes)
* <code>[[Restore Ramdisk|018-5306-002.dmg]]</code> (12777796 bytes)
* <code>BuildManifest.plist</code> (21097 bytes)
* <code>[[kernelcache]].release.s5l8920x</code> (4695492 bytes)
* <code>Restore.plist</code> (1763 bytes)
* ''<code>Firmware/</code>''
** ''<code>all_flash/</code>''
*** ''<code>all_flash.n88ap.production/</code>''
**** <code>[[AppleLogo|applelogo]].s5l8920x.img3</code> (9604 bytes)
**** <code>[[BatteryCharging0|batterycharging0]].s5l8920x.img3</code> (19716 bytes)
**** <code>[[BatteryCharging1|batterycharging1]].s5l8920x.img3</code> (24900 bytes)
**** <code>[[BatteryFull|batteryfull]].s5l8920x.img3</code> (76100 bytes)
**** <code>[[BatteryLow0|batterylow0]].s5l8920x.img3</code> (56772 bytes)
**** <code>[[BatteryLow1|batterylow1]].s5l8920x.img3</code> (65348 bytes)
**** <code>[[DeviceTree]].n88ap.img3</code> (44996 bytes)
**** <code>[[GlyphCharging|glyphcharging]].s5l8920x.img3</code> (20356 bytes)
**** <code>[[GlyphPlugin|glyphplugin]].s5l8920x.img3</code> (19332 bytes)
**** <code>[[iBoot (Bootloader)|iBoot]].n88ap.RELEASE.img3</code> (178500 bytes)
**** <code>[[LLB]].n88ap.RELEASE.img3</code> (67908 bytes)
**** <code>manifest</code> (341 bytes)
**** <code>[[NeedService|needservice]].s5l8920x.img3</code> (20484 bytes)
**** <code>[[RecoveryMode|recoverymode]].s5l8920x.img3</code> (47876 bytes)
** ''<code>dfu/</code>''
*** <code>[[iBEC]].n88ap.RELEASE.dfu</code> (104772 bytes)
*** <code>[[iBSS]].n88ap.RELEASE.dfu</code> (104772 bytes)

== Firmwares found in IPSW ==
Per http://newosxbook.com/bonus/vol1AppA.html
{| class="wikitable"
|-
! Filename
! Use
|-
| ICE17-1.xx.xx.Release.bbfw
| Intel modem / baseband
| -
| Mav17-1.xx.xx.Release.bbfw
| Maverick modem / baseband
|-
| AOP/aopfw-iphone##aop.im4p
| Always on processor
|-
| Savage/Savage.B[0/2]-[Dev/Prod].[vt.]fw
| FaceID
|-
| Yonkers/Yonkers.EA01_F###_[Dev/Prod]fw
| FaceID
|-
| SE/Stockholm##.RELEASE.sefw
| Secure Element
|-
| Maggie/AppleMaggieFirmwareImage.im4p
| ?
|-
| cpu_Multitouch.im4p
| Multitouch controller
|-
| isp/adc-petra-d3x.im4p
| Image Signal Processor
|-
| ane/h11_ane_fw_quin.im4p
| [[Apple Neural Engine]]
|-
| WirelessPower/WirelessPower.iphone##.im4p
| Wireless charging controller
|-
| SmartIOFirmwareCHIP.im4p
| [[T8020]] and later Smart I/O
|-
| board_CallanFirmware.im4p
| Haptics Firmware
|-
| ave/AppleAVE2FW.im4p
| Audio/Video Encoder
|-
| agx/armfw_g11p.im4p
| GPU Scheduler/Command Stream Processor
|}

== Notes ==
# IPSW files have been used since the very first iPod, though they have [http://www.freemyipod.org/wiki/Firmware a different format] than firmwares for iOS devices.

[[Category:File Formats]]

Savage

2020-09-16T00:22:42Z

Rickmark: Redirected page to FaceID

#REDIRECT [[FaceID]]

Yonkers

2020-09-16T00:22:15Z

Rickmark: Redirected page to FaceID

#REDIRECT [[FaceID]]

ANE

2020-09-16T00:21:38Z

Rickmark: Redirected page to Apple Neural Engine

#REDIRECT [[Apple Neural Engine]]

Provisioning Profiles

2020-09-03T00:51:33Z

Rickmark: Created page with "= Introduction = Provisioning profiles allow for running apps with entitlements or signing certificates outside of the normal configuration of iOS. == File Format == The `m..."

= Introduction =

Provisioning profiles allow for running apps with entitlements or signing certificates outside of the normal configuration of iOS.

== File Format ==

The `mobileprovision` file is a PKCS7 (CMS) signed payload of a plist.

Tristar

2020-09-03T00:48:51Z

Rickmark: /* Introduction */

= Introduction =

Apple ASIC that multiplexes the Lightning port. Superseded by [[Hydra]] in iPhone X and later

http://ramtin-amin.fr/tristar.html

Hydra

2020-09-03T00:48:41Z

Rickmark: Created page with "= Introduction = Successor to the Tristar"

= Introduction =

Successor to the [[Tristar]]

Tristar

2020-09-03T00:48:12Z

Rickmark: Created page with "= Introduction = Apple ASIC that multiplexes the Lightning port. Superseded by Hydra in iPhone X and later"

= Introduction =

Apple ASIC that multiplexes the Lightning port. Superseded by [[Hydra]] in iPhone X and later

SecureBoot

2020-08-29T00:36:34Z

Rickmark: /* = Verified Components */

== Introduction ==

With the advent of the [[T2]] [[macOS]] gained the ability to verify the integrity of the OS as it is booted.

=== Verified Components ===

* The T2 verifies MacEFI via [[img4]] and feeds it to the Intel CPU via eSPI
* MacEFI verifies the `boot.efi` component
** If in Full Security mode it requires a [[im4m]] manifest that is specific to the T2 [[ECID]]
** If in Medium Security mode it requires a [[im4m]] manifest that is specific to the T2 [[CPID]]

SecureBoot

2020-08-29T00:36:26Z

Rickmark: Created page with "== Introduction == With the advent of the T2 macOS gained the ability to verify the integrity of the OS as it is booted. === Verified Components == * The T2 verifi..."

== Introduction ==

With the advent of the [[T2]] [[macOS]] gained the ability to verify the integrity of the OS as it is booted.

=== Verified Components ==

* The T2 verifies MacEFI via [[img4]] and feeds it to the Intel CPU via eSPI
* MacEFI verifies the `boot.efi` component
** If in Full Security mode it requires a [[im4m]] manifest that is specific to the T2 [[ECID]]
** If in Medium Security mode it requires a [[im4m]] manifest that is specific to the T2 [[CPID]]

T8012

2020-08-29T00:32:47Z

Rickmark: /* Bootrom Exploits */

'''T8012''', also just known as the '''T2''' is the CPU introduced in the [[J137AP|second-generation iBridge processor]], the processor found on the iMac Pro, and used on all subsequent T2 enabled Mac products.

== Enabled Mac Products ==

Devices sourced from [https://github.com/libimobiledevice/libirecovery/blob/master/src/libirecovery.c]

{| class="wikitable"
!iBridge Product ID
!Board ID
!Board Minor
!Description (Product ID)
!checkm8/blackbird confirmed
|-
|iBridge2,1
|J137AP
|0x0A
|Apple T2 iMacPro1,1 (j137)
|yes
|-
|iBridge2,3
|J680AP
|0x0B
|Apple T2 MacBookPro15,1 (j680)
|yes
|-
|iBridge2,4
|J132AP
|0x0C
|Apple T2 MacBookPro15,2 (j132)
|yes
|-
|iBridge2,5
|J174AP
|0x0E
|Apple T2 Macmini8,1 (j174)
|yes
|-
|iBridge2,6
|J160AP
|0x0F
|Apple T2 MacPro7,1 (j160)
|yes
|-
|iBridge2,7
|J780AP
|0x07
|Apple T2 MacBookPro15,3 (j780)
|yes
|-
|iBridge2,8
|J140kAP
|0x17
|Apple T2 MacBookAir8,1 (j140k)
|yes
|-
|iBridge2,10
|J213AP
|0x18
|Apple T2 MacBookPro15,4 (j213)
|yes
|-
|iBridge2,11
|J230AP
|0x1F
|?
|?
|-
|iBridge2,12
|J140aAP
|0x37
|Apple T2 MacBookAir8,2 (j140a)
|yes
|-
|iBridge2,13
|J214AP
|0x1E
|?
|?
|-
|iBridge2,14
|J152fAP
|0x3A
|Apple T2 MacBookPro16,1 (j152f)
|yes
|-
|iBridge2,15
|J230kAP
|0x3F
|Apple T2 MacBookAir9,1 (j223k)
|yes
|-
|iBridge2,16
|J214kAP
|0x3E
|?
|?
|-
|iBridge2,19
|J185AP
|0x22
|?
|?
|-
|iBridge2,20
|J185fAP
|0x23
|?
|?
|-
|iBridge2,21
|J223AP
|0x3B
|?
|?
|-
|iBridge2,22
|J215AP
|0x38
|?
|?
|}

==T2 Recovery USB Device ID==
During the restore process, the T2 presents as a [[Restore Mode]] <code>com.apple.recoveryd</code> service, but uses the USB product ID of <code>0x8086</code> instead of the iPhone's <code>0x1290-0x12AF</code>.[https://github.com/libimobiledevice/usbmuxd/blob/master/udev/39-usbmuxd.rules.in]

==Bootrom Exploits==
The T8012 uses Bootrom version [[Bootrom_3401.0.0.1.16]] which is vulnerable to [[checkm8]]. A fork of [[checkm8]] with support for the t2 exists at [https://github.com/h0m3us3r/ipwndfu h0m3us3r]. The adaption of checkm8 was performed by the [[t8012 checkm8]] group by brute forcing the various locations from ROM. The copyright string reads <code>SecureROM for t8012si, Copyright 2007-2016, Apple Inc</code>, for version [[Bootrom_3401.0.0.1.16]].

* [https://twitter.com/axi0mX/status/1182915286858522624 axi0mX T2 support tweet]
* [https://twitter.com/qwertyoruiopz/status/1237400943047704576?s=21 quertyoruiop's early checkra1n previews]

Similar to iPhones, iPads, and iPods, iBridge firmware bundles come in IPSW form. Build train codenames are appended with "HWBridge" to distinguish them from normal firmwares, and the disk image files inside have labels that are appended with "UniversalBridgeOS." They can only be restored to if the Mac is in [[DFU mode]].

=== The T2 Secure Enclave Processor (SEP) ===

The T2 is based on the A10 silicon design and therefore has a A10 SEP. The A10 SEP is a ARM Cortex-A7 32bit CPU. The T2 Secure Enclave is vulnerable to the same exploit Pangu presented at MOSEC named `blackbird`.

The T2 SEP is responsible for acting as a secure store for symmetric secrets (tokens) as well as asymmetric credentials that can be generated and wrapped by the SEP. The SEP plays a key role in disk encryption.

== Entering DFU Mode ==
The T2 models can be restored via a Thunderbolt cable using [https://apps.apple.com/us/app/apple-configurator-2/id1037126344?mt=12 Apple Configurator 2].

=== Desktop Macs ===
For example, iMac Pro and Mac mini models from 2018 or later.<ref>https://support.apple.com/en-us/guide/apple-configurator-2/apdebea5be51/mac</ref>

# Completely power off the Mac; disconnect it from external power.
# Attach one end of a Thunderbolt cable to the correct Thunderbolt port on the Mac.
#* iMac Pro: The Thunderbolt port that is located next to the Ethernet port.
#* Mac mini: The Thunderbolt port that is located next to the HDMI port.
# Connect the other end to any Thunderbolt or USB port on the host Mac (the device which will be used for restoring).
# Hold down the power button on the back of the Mac for 3 seconds, while connecting the power cord.

=== Portable Macs ===
For example, MacBook models from 2018 or later.<ref>https://support.apple.com/en-us/guide/apple-configurator-2/apd0020c3dc2/mac</ref>

# Completely power off the Mac; disconnect it from external power.
# Attach one end of a Thunderbolt cable to the Thunderbolt port that is located on the left side, closest to the front.
# Connect the other end to any Thunderbolt or USB port on the host Mac (the device which will be used for restoring).
# Hold down the power button, right Shift key, and left Control and Option keys, for 3 seconds.

=== Identifying the T2 from DFU ===

Once a device is in DFU enumerating the USB device yields the BoardID. Using either Linux's <code>lsusb -v</code> or macOS's <code>ioreg -p IOUSB</code> the USB serial attribute will contain the same information as any other Apple A core iBoot device. (http://newosxbook.com/bonus/iBoot.pdf). The ChipID will always be 8012. The value for BDID is the BoardID. Full decoding of the version string can be performed using the code at https://github.com/das-iboot/das-iboot/blob/master/das_iboot/device.py. These values for BDID, CPID, CPRV and ECID are in Hex.

=== Identifying the T2 from macOS ===

This will provide many of the same values as DFU but in Decimal instead of Hex like above:

<syntaxhighlight lang="bash">
# ECID in decimal instead of Hex
/usr/libexec/remotectl get-property localbridge UniqueChipID
# Chip ID CPID in decimal (32786 == 0x8012)
/usr/libexec/remotectl get-property localbridge ChipID
# Board Revision CPRV in decimal instead of hex
/usr/libexec/remotectl get-property localbridge BoardRevision
# Board ID (BDID) in decimal instead of hex
/usr/libexec/remotectl get-property localbridge BoardId
# Hardware Model is the name of the Board
/usr/libexec/remotectl get-property localbridge HWModel
</syntaxhighlight>

== Mac Configuration Utility ==
[[Image:MCUIcon.png|thumb|The Mac Configuration Utility icon.]]

In order to restore a firmware to an iBridge device, technicians must use two Apple Internal tools. The first one, '''Apple Service Toolkit (AST)''', is used to initiate a diagnostic session between the host Mac and the Mac in DFU mode. The second tool, which must be installed on the host Mac, is known as the '''Mac Configuration Utility (MCU)'''. It communicates with AST to provide board information and initiate restores and diagnostics over-the-air. MCU supports macOS 10.13.2 or later.

[[Image:MCU.png|thumb|The Mac Configuration Utility startup screen.]]

iBridge devices can still be managed if there is no firmware present by booting a diagnostic image, which is pushed to the device by MCU after a '''Blank Board Serializer''' test is initiated on AST. This test will also assign a serial number to a new board.

During a restore, an Apple logo and progress bar will show on the screen, similar to that of a normal device restore. It is unknown if iBridge firmwares are signed, or if they are verified by the host or by iBridge devices.

== References ==
<references />

[[Category:Application Processors]]

T8012

2020-08-29T00:32:30Z

Rickmark: /* The T2 SEP */

'''T8012''', also just known as the '''T2''' is the CPU introduced in the [[J137AP|second-generation iBridge processor]], the processor found on the iMac Pro, and used on all subsequent T2 enabled Mac products.

== Enabled Mac Products ==

Devices sourced from [https://github.com/libimobiledevice/libirecovery/blob/master/src/libirecovery.c]

{| class="wikitable"
!iBridge Product ID
!Board ID
!Board Minor
!Description (Product ID)
!checkm8/blackbird confirmed
|-
|iBridge2,1
|J137AP
|0x0A
|Apple T2 iMacPro1,1 (j137)
|yes
|-
|iBridge2,3
|J680AP
|0x0B
|Apple T2 MacBookPro15,1 (j680)
|yes
|-
|iBridge2,4
|J132AP
|0x0C
|Apple T2 MacBookPro15,2 (j132)
|yes
|-
|iBridge2,5
|J174AP
|0x0E
|Apple T2 Macmini8,1 (j174)
|yes
|-
|iBridge2,6
|J160AP
|0x0F
|Apple T2 MacPro7,1 (j160)
|yes
|-
|iBridge2,7
|J780AP
|0x07
|Apple T2 MacBookPro15,3 (j780)
|yes
|-
|iBridge2,8
|J140kAP
|0x17
|Apple T2 MacBookAir8,1 (j140k)
|yes
|-
|iBridge2,10
|J213AP
|0x18
|Apple T2 MacBookPro15,4 (j213)
|yes
|-
|iBridge2,11
|J230AP
|0x1F
|?
|?
|-
|iBridge2,12
|J140aAP
|0x37
|Apple T2 MacBookAir8,2 (j140a)
|yes
|-
|iBridge2,13
|J214AP
|0x1E
|?
|?
|-
|iBridge2,14
|J152fAP
|0x3A
|Apple T2 MacBookPro16,1 (j152f)
|yes
|-
|iBridge2,15
|J230kAP
|0x3F
|Apple T2 MacBookAir9,1 (j223k)
|yes
|-
|iBridge2,16
|J214kAP
|0x3E
|?
|?
|-
|iBridge2,19
|J185AP
|0x22
|?
|?
|-
|iBridge2,20
|J185fAP
|0x23
|?
|?
|-
|iBridge2,21
|J223AP
|0x3B
|?
|?
|-
|iBridge2,22
|J215AP
|0x38
|?
|?
|}

==T2 Recovery USB Device ID==
During the restore process, the T2 presents as a [[Restore Mode]] <code>com.apple.recoveryd</code> service, but uses the USB product ID of <code>0x8086</code> instead of the iPhone's <code>0x1290-0x12AF</code>.[https://github.com/libimobiledevice/usbmuxd/blob/master/udev/39-usbmuxd.rules.in]

==Bootrom Exploits==
The T8012 uses Bootrom version [[Bootrom_3401.0.0.1.16]] which is vulnerable to [[checkm8]]. A fork of [[checkm8]] with support for the t2 exists at [https://github.com/h0m3us3r/ipwndfu h0m3us3r]. The adaption of checkm8 was performed by the [[t8012 checkm8]] group by brute forcing the various locations from ROM. The copyright string reads <code>SecureROM for t8012si, Copyright 2007-2016, Apple Inc</code>, for version [[Bootrom_3401.0.0.1.16]].

[https://twitter.com/axi0mX/status/1182915286858522624 axi0mX T2 support tweet]
[https://twitter.com/qwertyoruiopz/status/1237400943047704576?s=21 quertyoruiop's early checkra1n previews]

Similar to iPhones, iPads, and iPods, iBridge firmware bundles come in IPSW form. Build train codenames are appended with "HWBridge" to distinguish them from normal firmwares, and the disk image files inside have labels that are appended with "UniversalBridgeOS." They can only be restored to if the Mac is in [[DFU mode]].

=== The T2 Secure Enclave Processor (SEP) ===

The T2 is based on the A10 silicon design and therefore has a A10 SEP. The A10 SEP is a ARM Cortex-A7 32bit CPU. The T2 Secure Enclave is vulnerable to the same exploit Pangu presented at MOSEC named `blackbird`.

The T2 SEP is responsible for acting as a secure store for symmetric secrets (tokens) as well as asymmetric credentials that can be generated and wrapped by the SEP. The SEP plays a key role in disk encryption.

== Entering DFU Mode ==
The T2 models can be restored via a Thunderbolt cable using [https://apps.apple.com/us/app/apple-configurator-2/id1037126344?mt=12 Apple Configurator 2].

=== Desktop Macs ===
For example, iMac Pro and Mac mini models from 2018 or later.<ref>https://support.apple.com/en-us/guide/apple-configurator-2/apdebea5be51/mac</ref>

# Completely power off the Mac; disconnect it from external power.
# Attach one end of a Thunderbolt cable to the correct Thunderbolt port on the Mac.
#* iMac Pro: The Thunderbolt port that is located next to the Ethernet port.
#* Mac mini: The Thunderbolt port that is located next to the HDMI port.
# Connect the other end to any Thunderbolt or USB port on the host Mac (the device which will be used for restoring).
# Hold down the power button on the back of the Mac for 3 seconds, while connecting the power cord.

=== Portable Macs ===
For example, MacBook models from 2018 or later.<ref>https://support.apple.com/en-us/guide/apple-configurator-2/apd0020c3dc2/mac</ref>

# Completely power off the Mac; disconnect it from external power.
# Attach one end of a Thunderbolt cable to the Thunderbolt port that is located on the left side, closest to the front.
# Connect the other end to any Thunderbolt or USB port on the host Mac (the device which will be used for restoring).
# Hold down the power button, right Shift key, and left Control and Option keys, for 3 seconds.

=== Identifying the T2 from DFU ===

Once a device is in DFU enumerating the USB device yields the BoardID. Using either Linux's <code>lsusb -v</code> or macOS's <code>ioreg -p IOUSB</code> the USB serial attribute will contain the same information as any other Apple A core iBoot device. (http://newosxbook.com/bonus/iBoot.pdf). The ChipID will always be 8012. The value for BDID is the BoardID. Full decoding of the version string can be performed using the code at https://github.com/das-iboot/das-iboot/blob/master/das_iboot/device.py. These values for BDID, CPID, CPRV and ECID are in Hex.

=== Identifying the T2 from macOS ===

This will provide many of the same values as DFU but in Decimal instead of Hex like above:

<syntaxhighlight lang="bash">
# ECID in decimal instead of Hex
/usr/libexec/remotectl get-property localbridge UniqueChipID
# Chip ID CPID in decimal (32786 == 0x8012)
/usr/libexec/remotectl get-property localbridge ChipID
# Board Revision CPRV in decimal instead of hex
/usr/libexec/remotectl get-property localbridge BoardRevision
# Board ID (BDID) in decimal instead of hex
/usr/libexec/remotectl get-property localbridge BoardId
# Hardware Model is the name of the Board
/usr/libexec/remotectl get-property localbridge HWModel
</syntaxhighlight>

== Mac Configuration Utility ==
[[Image:MCUIcon.png|thumb|The Mac Configuration Utility icon.]]

In order to restore a firmware to an iBridge device, technicians must use two Apple Internal tools. The first one, '''Apple Service Toolkit (AST)''', is used to initiate a diagnostic session between the host Mac and the Mac in DFU mode. The second tool, which must be installed on the host Mac, is known as the '''Mac Configuration Utility (MCU)'''. It communicates with AST to provide board information and initiate restores and diagnostics over-the-air. MCU supports macOS 10.13.2 or later.

[[Image:MCU.png|thumb|The Mac Configuration Utility startup screen.]]

iBridge devices can still be managed if there is no firmware present by booting a diagnostic image, which is pushed to the device by MCU after a '''Blank Board Serializer''' test is initiated on AST. This test will also assign a serial number to a new board.

During a restore, an Apple logo and progress bar will show on the screen, similar to that of a normal device restore. It is unknown if iBridge firmwares are signed, or if they are verified by the host or by iBridge devices.

== References ==
<references />

[[Category:Application Processors]]

T8012

2020-08-29T00:31:21Z

Rickmark: /* The T2 SEP */

'''T8012''', also just known as the '''T2''' is the CPU introduced in the [[J137AP|second-generation iBridge processor]], the processor found on the iMac Pro, and used on all subsequent T2 enabled Mac products.

== Enabled Mac Products ==

Devices sourced from [https://github.com/libimobiledevice/libirecovery/blob/master/src/libirecovery.c]

{| class="wikitable"
!iBridge Product ID
!Board ID
!Board Minor
!Description (Product ID)
!checkm8/blackbird confirmed
|-
|iBridge2,1
|J137AP
|0x0A
|Apple T2 iMacPro1,1 (j137)
|yes
|-
|iBridge2,3
|J680AP
|0x0B
|Apple T2 MacBookPro15,1 (j680)
|yes
|-
|iBridge2,4
|J132AP
|0x0C
|Apple T2 MacBookPro15,2 (j132)
|yes
|-
|iBridge2,5
|J174AP
|0x0E
|Apple T2 Macmini8,1 (j174)
|yes
|-
|iBridge2,6
|J160AP
|0x0F
|Apple T2 MacPro7,1 (j160)
|yes
|-
|iBridge2,7
|J780AP
|0x07
|Apple T2 MacBookPro15,3 (j780)
|yes
|-
|iBridge2,8
|J140kAP
|0x17
|Apple T2 MacBookAir8,1 (j140k)
|yes
|-
|iBridge2,10
|J213AP
|0x18
|Apple T2 MacBookPro15,4 (j213)
|yes
|-
|iBridge2,11
|J230AP
|0x1F
|?
|?
|-
|iBridge2,12
|J140aAP
|0x37
|Apple T2 MacBookAir8,2 (j140a)
|yes
|-
|iBridge2,13
|J214AP
|0x1E
|?
|?
|-
|iBridge2,14
|J152fAP
|0x3A
|Apple T2 MacBookPro16,1 (j152f)
|yes
|-
|iBridge2,15
|J230kAP
|0x3F
|Apple T2 MacBookAir9,1 (j223k)
|yes
|-
|iBridge2,16
|J214kAP
|0x3E
|?
|?
|-
|iBridge2,19
|J185AP
|0x22
|?
|?
|-
|iBridge2,20
|J185fAP
|0x23
|?
|?
|-
|iBridge2,21
|J223AP
|0x3B
|?
|?
|-
|iBridge2,22
|J215AP
|0x38
|?
|?
|}

==T2 Recovery USB Device ID==
During the restore process, the T2 presents as a [[Restore Mode]] <code>com.apple.recoveryd</code> service, but uses the USB product ID of <code>0x8086</code> instead of the iPhone's <code>0x1290-0x12AF</code>.[https://github.com/libimobiledevice/usbmuxd/blob/master/udev/39-usbmuxd.rules.in]

==Bootrom Exploits==
The T8012 uses Bootrom version [[Bootrom_3401.0.0.1.16]] which is vulnerable to [[checkm8]]. A fork of [[checkm8]] with support for the t2 exists at [https://github.com/h0m3us3r/ipwndfu h0m3us3r]. The adaption of checkm8 was performed by the [[t8012 checkm8]] group by brute forcing the various locations from ROM. The copyright string reads <code>SecureROM for t8012si, Copyright 2007-2016, Apple Inc</code>, for version [[Bootrom_3401.0.0.1.16]].

[https://twitter.com/axi0mX/status/1182915286858522624 axi0mX T2 support tweet]
[https://twitter.com/qwertyoruiopz/status/1237400943047704576?s=21 quertyoruiop's early checkra1n previews]

Similar to iPhones, iPads, and iPods, iBridge firmware bundles come in IPSW form. Build train codenames are appended with "HWBridge" to distinguish them from normal firmwares, and the disk image files inside have labels that are appended with "UniversalBridgeOS." They can only be restored to if the Mac is in [[DFU mode]].

=== The T2 SEP ===

The T2 is based on the A10 silicon design and therefore has a A10 SEP. The A10 SEP is a ARM Cortex-A7 32bit CPU. The T2 Secure Enclave is vulnerable to the same exploit Pangu presented at MOSEC named `blackbird`.

== Entering DFU Mode ==
The T2 models can be restored via a Thunderbolt cable using [https://apps.apple.com/us/app/apple-configurator-2/id1037126344?mt=12 Apple Configurator 2].

=== Desktop Macs ===
For example, iMac Pro and Mac mini models from 2018 or later.<ref>https://support.apple.com/en-us/guide/apple-configurator-2/apdebea5be51/mac</ref>

# Completely power off the Mac; disconnect it from external power.
# Attach one end of a Thunderbolt cable to the correct Thunderbolt port on the Mac.
#* iMac Pro: The Thunderbolt port that is located next to the Ethernet port.
#* Mac mini: The Thunderbolt port that is located next to the HDMI port.
# Connect the other end to any Thunderbolt or USB port on the host Mac (the device which will be used for restoring).
# Hold down the power button on the back of the Mac for 3 seconds, while connecting the power cord.

=== Portable Macs ===
For example, MacBook models from 2018 or later.<ref>https://support.apple.com/en-us/guide/apple-configurator-2/apd0020c3dc2/mac</ref>

# Completely power off the Mac; disconnect it from external power.
# Attach one end of a Thunderbolt cable to the Thunderbolt port that is located on the left side, closest to the front.
# Connect the other end to any Thunderbolt or USB port on the host Mac (the device which will be used for restoring).
# Hold down the power button, right Shift key, and left Control and Option keys, for 3 seconds.

=== Identifying the T2 from DFU ===

Once a device is in DFU enumerating the USB device yields the BoardID. Using either Linux's <code>lsusb -v</code> or macOS's <code>ioreg -p IOUSB</code> the USB serial attribute will contain the same information as any other Apple A core iBoot device. (http://newosxbook.com/bonus/iBoot.pdf). The ChipID will always be 8012. The value for BDID is the BoardID. Full decoding of the version string can be performed using the code at https://github.com/das-iboot/das-iboot/blob/master/das_iboot/device.py. These values for BDID, CPID, CPRV and ECID are in Hex.

=== Identifying the T2 from macOS ===

This will provide many of the same values as DFU but in Decimal instead of Hex like above:

<syntaxhighlight lang="bash">
# ECID in decimal instead of Hex
/usr/libexec/remotectl get-property localbridge UniqueChipID
# Chip ID CPID in decimal (32786 == 0x8012)
/usr/libexec/remotectl get-property localbridge ChipID
# Board Revision CPRV in decimal instead of hex
/usr/libexec/remotectl get-property localbridge BoardRevision
# Board ID (BDID) in decimal instead of hex
/usr/libexec/remotectl get-property localbridge BoardId
# Hardware Model is the name of the Board
/usr/libexec/remotectl get-property localbridge HWModel
</syntaxhighlight>

== Mac Configuration Utility ==
[[Image:MCUIcon.png|thumb|The Mac Configuration Utility icon.]]

In order to restore a firmware to an iBridge device, technicians must use two Apple Internal tools. The first one, '''Apple Service Toolkit (AST)''', is used to initiate a diagnostic session between the host Mac and the Mac in DFU mode. The second tool, which must be installed on the host Mac, is known as the '''Mac Configuration Utility (MCU)'''. It communicates with AST to provide board information and initiate restores and diagnostics over-the-air. MCU supports macOS 10.13.2 or later.

[[Image:MCU.png|thumb|The Mac Configuration Utility startup screen.]]

iBridge devices can still be managed if there is no firmware present by booting a diagnostic image, which is pushed to the device by MCU after a '''Blank Board Serializer''' test is initiated on AST. This test will also assign a serial number to a new board.

During a restore, an Apple logo and progress bar will show on the screen, similar to that of a normal device restore. It is unknown if iBridge firmwares are signed, or if they are verified by the host or by iBridge devices.

== References ==
<references />

[[Category:Application Processors]]