Translate to Thunderbolt DFU to support T2 security chips

[rickmark]

The T2 processor is almost identical in DFU protocol to USB DFU, but instead uses Thunderbolt as the transport. Because of this sending the same payloads over Thunderbolt DFU will likely allow it to be used with the T2 chip as well.

[rickmark]

Sorry to top-post, but I did a bit of digging myself.

Turns out a T2 based MacBook will indeed work with only a USB controller to enter DFU mode (it seems the thunderbolt protocol is used at a later stage of restore).

For those interested, the reported DFU string states CPID:8012 - iBoot-3401.0.0.1.16

I think this is about enough to show that Checkm8 MAY work, but this is newer SecureROM; so that is assuming the USB heap issue wasn't patched in a later release. But at the same time the chip used is about an A10, which means it will not have ARM pointer authentication codes, making it more likely to be quick work then the XS and future...

[baconwaifu]

Try adding a config entry with some preexisting offsets, it should at the very least crash the target, which should confirm vulnerability to the exploit. It's a bit more work after that to twist it into actual code execution though.

[MCMrARM]

When booting my T2-powered MBP2018 to DFU: SerialNumber: CPID:8012 CPRV:10 CPFM:03 SCEP:01 BDID:0C ECID:#removed# IBFL:3C SRTG:[iBoot-3401.0.0.1.16]
I tried adding a configuration identical to the 8011 or 8015 CPU, both quite obviously failed, but the chip rebooted from from DFU and showed as a rather weird device:

[ 7535.287769] usb 1-3: New USB device found, idVendor=05ac, idProduct=8600, bcdDevice= 2.01
[ 7535.287775] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 7535.287778] usb 1-3: Product: Apple T2 Controller
[ 7535.287781] usb 1-3: Manufacturer: Apple Inc.
[ 7535.287784] usb 1-3: SerialNumber: 000000000000

The computer itself did not reboot, but it seems that the T2 chip did.

I presume this means it's vulnerable, but I have no idea how to progress from there as it seems the offsets required are not easily obtainable.

[rickmark]

Curious @MCMrARM -

While the T2 isn't generally required for operation after boot, it does still handle in band encryption of the NVMe memory. If you have a file operation occurring as you trip the reboot, does your system indicate a pause in the block storage?? This may indicate that Apple has factored in some either resiliency for the T2 or that reboots for things like T2 upgrades are a occurrence which has been accounted for....

[MCMrARM]

If you panic the T2, the NVMe drive becomes immediately non-operational and the laptop reboots 10 seconds later.

[rickmark]

Damn watchdog X-D

[h0m3us3r]

Any new progress on T2 in the past 3 months?

[rickmark]

Has been working successfully from linux on the USB transport (thunderbolt may therefore unneeded). This is generally how to do a T2 restore...

Maybe we ought add the following to the wiki for the T2?

Building the world: https://gist.githubusercontent.com/rickmark/9245ed3ef7f36d5a0421557f68c4681b/raw/5d0d4846ba98cf72f810cdf07b895131ef386075/gistfile1.txt

Cleaning the world:
https://gist.githubusercontent.com/rickmark/9245ed3ef7f36d5a0421557f68c4681b/raw/5d0d4846ba98cf72f810cdf07b895131ef386075/clean_t2_restore.sh

Doing a Restore:

Follow these instructions

1. https://support.apple.com/guide/apple-configurator-2/revive-firmware-in-mac-computers-apdebea5be51/mac
2. https://gist.githubusercontent.com/rickmark/9245ed3ef7f36d5a0421557f68c4681b/raw/5d0d4846ba98cf72f810cdf07b895131ef386075/perform_t2_restore.sh

Locking down a Pi before hand (yes validated on x86_64 and arm)
https://gist.githubusercontent.com/rickmark/9245ed3ef7f36d5a0421557f68c4681b/raw/5d0d4846ba98cf72f810cdf07b895131ef386075/lockdown_pi.sh

In addition, it's related but not that I have reverse engineered Apple's USB Target Disk Mode and am currently working on pushing a driver to support to linux staging. Will update here when it's stable:

https://github.com/rickmark/apple_utdm

[h0m3us3r]

I apologize if I am misunderstanding something, but isn't that just a standard dfu restore procedure? I was mainly asking about pwndfu with checkm8, as both t8002 and the t8012 under question were confirmed to be doable by @axi0mX (in this tweet: https://twitter.com/axi0mX/status/1182915286858522624?s=20), but the payload seems to only exist for the t8002 unless I'm missing something...

[rickmark]

Oh shoot, I had *supposed* they were but hadn’t seen confirmation: given that his code is public I should be able to adapt it, but need an older T2 mac since it’s based on the iBoot secure rom version. I think this is why original iMac Pro’s are so expensive second hand... Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: h0m3us3r <notifications@github.com> Sent: Sunday, February 23, 2020 11:45:02 PM To: axi0mX/ipwndfu <ipwndfu@noreply.github.com> Cc: Rick Mark <rickmark@outlook.com>; Author <author@noreply.github.com> Subject: Re: [axi0mX/ipwndfu] Translate to Thunderbolt DFU to support T2 security chips (#141) I apologize if I am misunderstanding something, but isn't that just a standard dfu restore procedure? I was mainly asking about pwndfu with checkm8, as both t8002 and the t8012 under question were confirmed to be doable by @axi0mX<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Faxi0mX&data=02%7C01%7C%7Cca05e024368e43a392ec08d7b8fd7565%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181271035130147&sdata=e9I1IvLBLAdBjXISACsifnqJnsEPyyHjDAGw7173fqE%3D&reserved=0> (in this tweet: https://twitter.com/axi0mX/status/1182915286858522624?s=20<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Faxi0mX%2Fstatus%2F1182915286858522624%3Fs%3D20&data=02%7C01%7C%7Cca05e024368e43a392ec08d7b8fd7565%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181271035140141&sdata=%2BauKWiEORA1DUwcezIvReM7CkcbkSCrcIPDZS%2FYA0ys%3D&reserved=0>), but the payload seems to only exist for the t8002 unless I'm missing something... — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Faxi0mX%2Fipwndfu%2Fissues%2F141%3Femail_source%3Dnotifications%26email_token%3DAAA6TWZXMC74D7AP7G7ZHB3REN3H5A5CNFSM4I57JPEKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEMW3VYY%23issuecomment-590199523&data=02%7C01%7C%7Cca05e024368e43a392ec08d7b8fd7565%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181271035140141&sdata=4FHdRNg%2FTIhz0WqUQhTGbV%2FOT6qxyGmaBzzqc1yrJSc%3D&reserved=0>, or unsubscribe<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAA6TW5EENLG3YYJ7HLIXOTREN3H5ANCNFSM4I57JPEA&data=02%7C01%7C%7Cca05e024368e43a392ec08d7b8fd7565%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181271035150137&sdata=MywGNFEsX10V4cntUavVE1bT%2BcM9U1V4IJSir1qsmdE%3D&reserved=0>.

[rickmark]

Also this means that the T2 has become a GID Oracle for all T8012 (even with newer SecureROM). Since they share a group key and some are pwn-able Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: Rick Mark <rickmark@outlook.com> Sent: Sunday, February 23, 2020 11:47:43 PM To: axi0mX/ipwndfu <reply@reply.github.com>; axi0mX/ipwndfu <ipwndfu@noreply.github.com> Cc: Author <author@noreply.github.com> Subject: Re: [axi0mX/ipwndfu] Translate to Thunderbolt DFU to support T2 security chips (#141) Oh shoot, I had *supposed* they were but hadn’t seen confirmation: given that his code is public I should be able to adapt it, but need an older T2 mac since it’s based on the iBoot secure rom version. I think this is why original iMac Pro’s are so expensive second hand... Get Outlook for iOS<https://aka.ms/o0ukef>

________________________________ From: h0m3us3r <notifications@github.com> Sent: Sunday, February 23, 2020 11:45:02 PM To: axi0mX/ipwndfu <ipwndfu@noreply.github.com> Cc: Rick Mark <rickmark@outlook.com>; Author <author@noreply.github.com> Subject: Re: [axi0mX/ipwndfu] Translate to Thunderbolt DFU to support T2 security chips (#141) I apologize if I am misunderstanding something, but isn't that just a standard dfu restore procedure? I was mainly asking about pwndfu with checkm8, as both t8002 and the t8012 under question were confirmed to be doable by @axi0mX<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Faxi0mX&data=02%7C01%7C%7Cca05e024368e43a392ec08d7b8fd7565%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181271035130147&sdata=e9I1IvLBLAdBjXISACsifnqJnsEPyyHjDAGw7173fqE%3D&reserved=0> (in this tweet: https://twitter.com/axi0mX/status/1182915286858522624?s=20<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Faxi0mX%2Fstatus%2F1182915286858522624%3Fs%3D20&data=02%7C01%7C%7Cca05e024368e43a392ec08d7b8fd7565%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181271035140141&sdata=%2BauKWiEORA1DUwcezIvReM7CkcbkSCrcIPDZS%2FYA0ys%3D&reserved=0>), but the payload seems to only exist for the t8002 unless I'm missing something... — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Faxi0mX%2Fipwndfu%2Fissues%2F141%3Femail_source%3Dnotifications%26email_token%3DAAA6TWZXMC74D7AP7G7ZHB3REN3H5A5CNFSM4I57JPEKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEMW3VYY%23issuecomment-590199523&data=02%7C01%7C%7Cca05e024368e43a392ec08d7b8fd7565%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181271035140141&sdata=4FHdRNg%2FTIhz0WqUQhTGbV%2FOT6qxyGmaBzzqc1yrJSc%3D&reserved=0>, or unsubscribe<https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAA6TW5EENLG3YYJ7HLIXOTREN3H5ANCNFSM4I57JPEA&data=02%7C01%7C%7Cca05e024368e43a392ec08d7b8fd7565%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181271035150137&sdata=MywGNFEsX10V4cntUavVE1bT%2BcM9U1V4IJSir1qsmdE%3D&reserved=0>.

[h0m3us3r]

I thought all t8012s have 3401.0.0.1.16 bootrom. Are there ones with a newer version?

My understanding was that nobody had dumped 3401.0.0.1.16 to extract the offsets for the payload (or got the offsets by some other means), not that the payload did not work/only worked on some t8012s.

[rickmark]

Will confirm if this is true after BSides ... Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: h0m3us3r <notifications@github.com> Sent: Monday, February 24, 2020 12:12:44 AM To: axi0mX/ipwndfu <ipwndfu@noreply.github.com> Cc: Rick Mark <rickmark@outlook.com>; Author <author@noreply.github.com> Subject: Re: [axi0mX/ipwndfu] Translate to Thunderbolt DFU to support T2 security chips (#141) I thought all t8012s have 3401.0.0.1.16 bootrom. Are there ones with a newer version? My understanding was that nobody had dumped 3401.0.0.1.16 to extract the offsets for the payload (or got the offsets by some other means), not that the payload did not work/only worked on some t8012s. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Faxi0mX%2Fipwndfu%2Fissues%2F141%3Femail_source%3Dnotifications%26email_token%3DAAA6TW2SOPZRKKANH6T3GATREN6PZA5CNFSM4I57JPEKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEMW5OQA%23issuecomment-590206784&data=02%7C01%7C%7C8ab39c0b7362428a87cb08d7b9015407%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181287656391227&sdata=UFZ5TJaU47ucbklr14k1XkwKP289hcqON7do2e6w%2Bk8%3D&reserved=0>, or unsubscribe<https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAA6TW32W27TF2EVGMR3UOLREN6PZANCNFSM4I57JPEA&data=02%7C01%7C%7C8ab39c0b7362428a87cb08d7b9015407%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637181287656391227&sdata=AjKMnCE8YIZgUtUv2hB8vwhJCWujDdyBXkv7GrR%2FJsM%3D&reserved=0>.

[h0m3us3r]

Let me know if I can be of any use, as I have a 2019 macbook, but I need to figure out how to boot the damned thing into dfu first. The apple-provided key-combo boots mine into internet recovery for some absurd reason...

[MCMrARM]

pretty sure the iMac Pro also has 3401.0.0.1.16: https://twitter.com/axi0mx/status/958054470537043968