How I Restored a Macbook Air - Apple M2 2023 14.9
A friend of mine accidentally wiped all partitions on his Macbook Air including the ones that shouldn't be removed (don’t ask me how this was done). As a result, the device became unbootable and was stuck on the Contact Apple Support logo screen. Since there was no Apple Store nearby, he asked me for help.
Although I had never owned a Mac or worked extensively with Apple devices, I decided to take on the challenge. Surprisingly, the solution turned out to be fairly simple. In this blog post, I'll walk you through exactly what I did, so I have a reference for the future and hopefully, it helps others in a similar situation.
First of we need to install the right tools for this job so let's start from here (some claims we need to build all packages from source but I was not forced to so since it worked from an Ubuntu machine via the apt package manager)
apt install -qqy idevicerecovery irecovery usbmuxd
Before we start and connecting the laptop to figure out what mode it is in we must use usbmuxd in another terminal
usbmuxd -f -U root -v
So when I connected the laptop from the usb-c port nearest the power connector I was monitor the dmesg to figure out what mode it was i
dmesg -wx
And when I connected the device the output was showing me that it was in Recovery Mode and I also noticed that it was recognized as a mobile device
dmesg monitor
[367887.261705] usb 1-9: new high-speed USB device number 26 using xhci_hcd
[367887.391060] usb 1-9: New USB device found, idVendor=05ac, idProduct=1281, bcdDevice= 0.00
[367887.391072] usb 1-9: New USB device strings: Mfr=2, Product=3, SerialNumber=4
[367887.391078] usb 1-9: Product: Apple Mobile Device (Recovery Mode)
[367887.391083] usb 1-9: Manufacturer: Apple Inc.
[367887.391087] usb 1-9: SerialNumber: SDOM:01 CPID:6020 CPRV:01 CPFM:03 SCEP:01 BDID:04 ECID:XXXXXXXXXXXXXXXXXXXX IBFL:FD SRNM:[XXXXXXXXXXXX]
And for DFU mode you going to see
It toke a while and then i figured out how to enter the DFU mode and for enter DFU mode and for do so you have to press left option button and command button togheter with right shift and power button and after device is booting release the three keys exempt the power button and wait for it to enter DFU mode. The screen will be blank during this time.
To restore device manually
idevicerestore -e -d UniversalMac_15.3.2_24D81_Restore.ipsw
To restore device by downloading the firmware from apples servers via --latest
e= Erasel= Latest firmware to be downloadedy= Non-interactive mode, do not ask for any input.--ignore-errors= Ignore eventually errors that shows up (not recommended if you doing this first time)
(18:56:08)-[wuseman@elitedesk] ~/downloads $ idevicerestore -eyl --ignore-errors
idevicerestore 1.0.1
Found device in DFU mode
ECID: 3432199344570398
Identified device as j414sap, Mac14,9
Device Product Version: N/A
Device Product Build: N/A
NOTE: Running non-interactively, automatically selecting latest available version
Selected firmware 15.3.2 (build 24D81)
Verifying 'UniversalMac_15.3.2_24D81_Restore.ipsw'...
Checksum matches.
Extracting BuildManifest from IPSW
IPSW Product Version: 15.3.2
IPSW Product Build: 24D81 Major: 24
Device supports Image4: true
Variant: Customer Upgrade Install (IPSW)
This restore will update the device without erasing user data.
Performing macOS restore
Checking IPSW for required components...
All required components found in IPSW
Getting ApNonce in dfu mode... db e3 0e 85 1b 30 b9 09 13 8d ae 2e a1 60 65 19 6c 56 3e 31 45 47 ba 7f 86 02 30 62 7e a8 0c d5
Trying to fetch new SHSH blob
Getting SepNonce in dfu mode... 03 41 00 c9 90 1d e3 ca 39 59 55 0a 1a 2e 89 05 0c 74 ac 98
Received SHSH blobs
Getting SepNonce in dfu mode... 03 41 00 c9 90 1d e3 ca 39 59 55 0a 1a 2e 89 05 0c 74 ac 98
Received SHSH blobs
Getting SepNonce in dfu mode... 03 41 00 c9 90 1d e3 ca 39 59 55 0a 1a 2e 89 05 0c 74 ac 98
Received SHSH blobs
Extracting iBSS.j414s.RELEASE.im4p (Firmware/dfu/iBSS.j414s.RELEASE.im4p)...
Personalizing IMG4 component iBSS...
Sending iBSS (1048988 bytes)...
[==================================================] 100.0%
Nonce: db e3 0e 85 1b 30 b9 09 13 8d ae 2e a1 60 65 19 6c 56 3e 31 45 47 ba 7f 86 02 30 62 7e a8 0c d5
Personalizing IMG4 component Ap,LocalPolicy...
Sending Ap,LocalPolicy (3043 bytes)...
[==================================================] 100.0%
INFO: executing command: lpolrestore
iBoot boot-stage=1
Extracting t6020ciofw.im4p (Firmware/t6020ciofw.im4p)...
Personalizing IMG4 component Ap,RestoreCIO...
Sending Ap,RestoreCIO (184527 bytes)...
[==================================================] 100.0%
INFO: executing command: firmware
Extracting t6020tmufw.im4p (Firmware/t6020tmufw.im4p)...
Personalizing IMG4 component Ap,RestoreTMU...
Sending Ap,RestoreTMU (25012 bytes)...
[==================================================] 100.0%
INFO: executing command: firmware
Extracting rans.t6020.release.im4p (Firmware/rans.t6020.release.im4p)...
Personalizing IMG4 component RestoreANS...
Sending RestoreANS (1099414 bytes)...
[==================================================] 100.0%
INFO: executing command: firmware
Extracting t602xdcp_restore.im4p (Firmware/dcp/t602xdcp_restore.im4p)...
Personalizing IMG4 component RestoreDCP...
Sending RestoreDCP (3594446 bytes)...
[==================================================] 100.0%
INFO: executing command: firmware
Extracting iBootDataStage1.j414s.RELEASE.im4p (Firmware/all_flash/iBootDataStage1.j414s.RELEASE.im4p)...
Personalizing IMG4 component iBootDataStage1...
Sending iBootDataStage1 (63145 bytes)...
[==================================================] 100.0%
INFO: executing command: firmware
INFO: executing command: setenv auto-boot false
INFO: executing command: saveenv
INFO: executing command: setenvnp boot-args rd=md0 nand-enable-reformat=1 -progress -restore
Extracting applelogo@2x~mac-USBc.im4p (Firmware/all_flash/applelogo@2x~mac-USBc.im4p)...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (19510 bytes)...
[==================================================] 100.0%
INFO: executing command: setpicture 4
INFO: executing command: bgcolor 0 0 0
Extracting iBEC.j414s.RELEASE.im4p (Firmware/dfu/iBEC.j414s.RELEASE.im4p)...
Personalizing IMG4 component iBEC...
Sending iBEC (881035 bytes)...
[==================================================] 100.0%
INFO: device serial number is KWGR9Q63HH
Recovery Mode Environment:
iBoot build-version=iBoot-11881.81.4
iBoot build-style=RELEASE
iBoot boot-stage=2
radio-error=2
radio-error-string=2
Sending RestoreLogo...
Extracting applelogo@2x~mac-USBc.im4p (Firmware/all_flash/applelogo@2x~mac-USBc.im4p)...
Personalizing IMG4 component RestoreLogo...
Sending RestoreLogo (19510 bytes)...
Extracting t602x_ane0_fw_selene_rc4x.im4p (Firmware/ane/t602x_ane0_fw_selene_rc4x.im4p)...
Personalizing IMG4 component ANE...
Sending ANE (1682231 bytes)...
Extracting aopfw-mac14jaop.RELEASE.im4p (Firmware/AOP/aopfw-mac14jaop.RELEASE.im4p)...
Personalizing IMG4 component AOP...
Sending AOP (1534775 bytes)...
Extracting AppleAVE2FW_H14S.im4p (Firmware/ave/AppleAVE2FW_H14S.im4p)...
Personalizing IMG4 component AVE...
Sending AVE (1597031 bytes)...
Extracting t602xdcp.im4p (Firmware/dcp/t602xdcp.im4p)...
Personalizing IMG4 component Ap,DCP2...
Sending Ap,DCP2 (3594493 bytes)...
Extracting armfw_g14s.im4p (Firmware/agx/armfw_g14s.im4p)...
Personalizing IMG4 component GFX...
Sending GFX (1510775 bytes)...
Extracting adc-helios-rc4x.im4p (Firmware/isp_bni/adc-helios-rc4x.im4p)...
Personalizing IMG4 component ISP...
Sending ISP (11791159 bytes)...
Extracting J414S_MtpFirmware.im4p (Firmware/J414S_MtpFirmware.im4p)...
Personalizing IMG4 component MtpFirmware...
Sending MtpFirmware (876077 bytes)...
Extracting t6020pmp.im4p (Firmware/pmp/t6020pmp.im4p)...
Personalizing IMG4 component PMP...
Sending PMP (1047351 bytes)...
Extracting 044-60126-077.dmg.trustcache (Firmware/044-60126-077.dmg.trustcache)...
Personalizing IMG4 component RestoreTrustCache...
Sending RestoreTrustCache (21996 bytes)...
Extracting SmartIOFirmware_ASCv5.im4p (Firmware/SmartIOFirmware_ASCv5.im4p)...
Personalizing IMG4 component SIO...
Sending SIO (1180859 bytes)...
Extracting iBootData.j414s.RELEASE.im4p (Firmware/all_flash/iBootData.j414s.RELEASE.im4p)...
Personalizing IMG4 component iBootData...
Sending iBootData (63145 bytes)...
ramdisk-size=0x20000000
Extracting 044-60126-077.dmg (044-60126-077.dmg)...
Personalizing IMG4 component RestoreRamDisk...
Sending RestoreRamDisk (182463290 bytes)...
Extracting DeviceTree.j414sap.im4p (Firmware/all_flash/DeviceTree.j414sap.im4p)...
Personalizing IMG4 component RestoreDeviceTree...
Sending RestoreDeviceTree (64305 bytes)...
...
Fairly simple to be honest to fix a broken macbook. Now it toke a while and after a while it restarted into restore mode (usbmuxd is required for this purpose) was repairing itself and the support apple screen was finally replaced by apple logo and a loading bar
At beginning of this I was told that another mac was required so then I used OSX-KVM to setup MacOS but my computer is to way to slow to run macos actually so that was what I was doing first and I was about to download Apple Configurator 2 that was going to help me to know if the pc was in DFU mode but I thought i was going to help me boot into DFU mode but actually it only will tell you IF the device is in DFU mode but this is was not possible since I needed a version of macos that was above 14 wich was Sequoia and this was the hardest part before i figured out how it worked to get into DFU mode but this will showup in the kernelmsg from /proc/kmsg wich is the kernel message that is simple the dmesg output with more options so when the device is going to boot into DFU mode you will see this in dmesg output similiar that we can see Recovery Mode on the upper picture. After this was figured out it was straight forward to fix this laptop from being totally software bricked to working again.
However, i also tried some hacks blindly for this device in various ways since I love working in shell and and here is some cool tricks that I figured out during the process
irecovery can run an interactive shell that is able to set enviroments and other things and since my deeep insight in the android backend world from terminal there is several boot options with the reboot command so I was also trying all options for being able to boot to the DFU mode from here but it was not possible in anyway I tried but if you know a way to do this feel free to let me know how you did.
Various commands that works in interactive shell from irecovery is the ones below
Commands
Reboot device
reboot
Try reboot the PC to normal mode wich is default` - This will give you a beep sound
irecovery -n
Saves environment variables (not always persistent).
saveenv
Dump enviroments
NOT WORKING - If you know how to do this to figured out all enviroments please let me know how to do so
Controls the auto-boot setting (use setenv auto-boot true to enable it).
auto-boot
Continues execution if halted
go
Send the firmware file over tftp/bootx
bootx
Envorment Variables
Some iBoot versions allow setting and saving environment variables like
Prevents auto-boot
setenv auto-boot false
Enables verbose booting
setenv boot-args "-v"
Enables debug UART
setenv debug-uarts 1
Resource(s)