yarshure

[000A2DCE:3C50802E] :-) soc --properties
	vendor: Apple
	model: 8030
	fuse-rev: 12 
	primary-cpu: Thunder
	security-epoch: 1 
	security-domain0: 1 
	security-domain1: 0 
	production-mode: 1 
	board-id: 0 

yarshure

[000654DE:3028E526] :-) memory --list
        Type       Start     End      Pages     Attributes
0000: available  800000000-80FFFFFFF  00004000 000000000000000F
0001: available  810008000-879FBFFFF  0001A7EE 000000000000000F
0002: LoaderCode 879FC0000-879FDFFFF  00000008 000000000000000F
0003: available  879FE0000-879FEBFFF  00000003 000000000000000F
0004: BS_data    879FEC000-87A01FFFF  0000000D 000000000000000F
0005: BS_code    87A020000-87A13BFFF  00000047 000000000000000F
0006: BS_data    87A13C000-87A167FFF  0000000B 000000000000000F
0007: BS_code    87A168000-87A197FFF  0000000C 000000000000000F

yarshure

[000A2DCE:3C50802E] :-) memory --list
        Type       Start     End      Pages     Attributes
0000: available  800000000-820FFFFFF  00008400 000000000000000F
0001: available  821E30000-8F2E67FFF  0003440E 000000000000000F
0002: BS_data    8F2E68000-8F2E8BFFF  00000009 000000000000000F
0003: available  8F2E8C000-8F2E97FFF  00000003 000000000000000F
0004: BS_data    8F2E98000-8F2EBFFFF  0000000A 000000000000000F
0005: available  8F2EC0000-8F2EC7FFF  00000002 000000000000000F
0006: MemMapIO   8F2EC8000-8F2ECBFFF  00000001 000000000000000F
0007: BS_data    8F2ECC000-8F2EE7FFF  00000007 000000000000000F

yarshure

BPUTIL(1)		  BSD General Commands Manual		     BPUTIL(1)

NAME
     bputil -- Utility to precisely modify the security settings on Apple Sil-
     icon Macs.

SYNOPSIS
     bputil [-ldfgnmkcas] [-u username] [-p password]
	    [-v APFS Volume Group UUID]

yarshure

iPhone:~ root# nvram bootdelay=10
iPhone:~ root# nvram -p
auto-boot       true
bootdelay       10
backlight-level 1507
restore-step-monitor    {0x11010207:"wifexited"}
restore-step-warnings   {0x11060100:{0:"NVRAM access is not currently available"}}
debug-uarts     3
boot-args       serial=3
boot-command    fsboot

yarshure

[02:28:42.0125-GMT]{3>6} CHECKPOINT NOTICE: Image4 device: AP nonce clearable
entering ramrod_clear_ap_nonce
[02:28:42.0136-GMT]{3>6} CHECKPOINT NOTICE: AP nonce consumed
[02:28:42.0137-GMT]{3>6} CHECKPOINT NOTICE: Pre-existing NVRAM variable: auto-boot=false
[02:28:42.0137-GMT]{3>6} CHECKPOINT NOTICE: Pre-existing NVRAM variable: restore-outcome=initial_monitor_no_return
[02:28:42.0137-GMT]{3>6} CHECKPOINT PROGRESS: START (unknown) -> (initial_engine_no_return)
[02:28:42.0137-GMT]{3>6} CHECKPOINT NOTICE: NVRAM access available on initial check
restore-outcome = initial_engine_no_return
executing /usr/sbin/nvram restore-outcome=initial_engine_no_return
[02:28:42.0145-GMT]{3>6} CHECKPOINT BEGIN: MAIN:[0x0400] umask

yarshure

codesign -vv -d --entitlements -  dd > dd.xml 
dd if=dd.xml of=dd.entitlement skip=8
dd if=taskinfo of=12.bin bs=1 count=12
dd if=dd of=dd.tail skip=12 bs=1
cat 12.bin dd.tail > dd.new
ldid -Sdd.entitlement dd.new

yarshure

iPhone-XS-MAX:~ root# ldid -d /bin/ls
CandidateCDHash sha1=3033686cc8f6dcdccb949f58a8bd65f8a5cb336c
CandidateCDHash sha256=5d9699b539b9629822902144e1968ec698ab58a6
Hash choices=sha1,sha256
CDHash=5d9699b539b9629822902144e1968ec698ab58a6

yarshure

apple@apples-MBP bin % nanokdp -h
Serial device (1) : /dev/cu.Bluetooth-Incoming-Port
Serial device (2) : /dev/cu.usbserial-DT03V19V
Select a device by its number (^D to abort): q
usage: nanokdp [-d device [-Z]] [-c config] [-f none|sw|hw] [-k usecs] [-K [-p port]] [-w usecs] [-y[<format>]] [-e] [-b] [-n] [-l] [-L filename] [-s] [-x dir] [-I][-P plugin] 

where options are:

    -d open a serial port of the given device
        (example: -d /dev/tty.USA19QW213P1.1)

yarshure

apple@apples-MBP ~ % astris -h
astris v2.7.2 [Astris-1760.40.28~128 (AzulB tools)]
usage:  astris [options] [<host> | <host>:<probe> | <probe>]

Options:
     --help                   Display this usage message then exits.
     --version                Displays version banner then exits
     --swd                    Debug target in Serial Wire Debug mode
     --jtag                   Debug target in JTAG mode
     --script <script>        Execute <script> instead of entering interactive mode.