4.9.2

SpoofVMM v4.9.2

macOS Tahoe Stage 2 Firmware & Root Hash Manifest Fix for dropped T2 Macs (2018–2019)

What's New:

• In-Kernel Stage 2 Firmware Bypass (_cs_validate_page): Intercepts OSInstaller.framework and osinstallersetupd at the kernel memory validation boundary and binary-patches -[OSIUpdateFirmwareElement runReturningError:] with b0 01 c3 (mov al, 1; ret).
• Zero Userland Dylibs Required: Bypasses BridgeOS firmware staging failures directly in kernel space with zero SIP modification and no DYLD_INSERT_LIBRARIES.
• Stage 2 Root Hash Manifest Fix: Preserves opt-in Board-ID swapping (-spoofvmmbid / -spoofvmmstage2) to Albert's Mac-5F9802EFE386AA28 (MacBookPro16,2), allowing MobileSoftwareUpdate to locate root hash and mtree manifests.
• Wi-Fi Antenna Protection: Normal desktop boots leave board-id untouched so native Wi-Fi calibration is preserved.
• Boot Arguments:
  • -spoofvmmbid / -spoofvmmstage2: Enable Board-ID swap for Stage 2.
  • -spoofvmmnocs: Disable in-kernel _cs_validate_page firmware bypass if desired.

4.9.1

This release fixes critical issues that could prevent T2 Macs from reaching the desktop. Thx @zkennedy137 and @Medelcartelinc

SpoofVMM V4.9 Stable-New

This release adds GitHub Actions so it can automatically compile the kext

SpoofVMM V4.9 Stable

This Version is stable and has the updates that get installation of macOS 26 Tahoe to the second stage of the install.

work is being done to get a complete install.

Full Changelog: https://github.com/albert-mueller/Spoof-VMM/commits/V4.9