Inside the Apple T2
summary
Reverse engineers extract BridgeOS firmware, map the T2 as an A10‑based controller with a masked ROM root of trust and SEP, and show it becomes the arbiter of UEFI by using slave‑attached flash to present UEFI over a en6 USB network interface. They decode a proprietary XPC wrapper layered over HTTP/2, build a sniffer and a sysdiagnose client, and release tooling; able to pull diagnostic archives and craft messages. Software or physical access can overwrite internal UEFI storage unless additional safeguards intervene, and some mitigations (SEP, ROM) remain intact.
AI-written summary · about
chapters (27)
- 0:00Start
- 11:05eSPI & Slave Attached Flash
- 12:51T2 Early Boot
- 18:25Attacking Secure Boot.
- 20:16T2 Services
- 22:07RemoteXPC
- 22:39Network Interface
- 24:59Layers
- 25:15MBIM (USB)
- 25:54HTTP/2 Crash Course
- 28:04XPC Wrapper
- 29:01Overview of XPC
- 30:21XPC Header
- 30:53XPC Types
- 32:09XPC Fixed-size objects: uint64
- 32:38XPC Variable-length Objects: string
- 33:18XPC Compound Objects: dictionary
- 34:31Other XPC Objects: file_transfer
- 35:04Case Study: Sysdiagnose
- 36:09Sysdiagnose Protocol (simplified)
- 36:49Connecting to Sysdiagnose Server (Before)
- 37:57Connecting to Sysdiagnose Server (After)
- 38:29remotectl relay gated by Entitlements
- 39:29Sysdiagnose Request and Response
- 39:45Sysdiagnose Options
- 40:34Further Exploration
- 41:08Open Source Tooling
related talks
01h 13mIs there an EFI monster inside your apple?
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers
40mReverse Engineering the Customized Pointer Authentication Hardware Implementation on Apple M1
01h 46mTutorial: Introduction to Reverse Engineering
49mThe ARMs race for kernel protection
40mTrust in Apple's Secret Garden: Exploring & Reversing Apple's Continuity Protocol
01h 04mAnalyzing UEFI BIOSes from Attacker & Defender Viewpoints
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox