Pwndfu Mac [updated]

PwndFU for Mac: Exploiting BootROM Vulnerabilities in Apple’s T2 and Intel-Based Systems

(proof-of-concept, mostly private/research): Pwndfu Mac

brew install libusb usbmuxd

PongoOS Documentation - Explains the pre-boot environment used after entering Pwndfu. Because the exploit is bootrom-based, this jailbreak works

Tools like use Pwndfu internally. After putting the device in Pwndfu mode, checkra1n uploads a custom kernel (a "ramdisk") that disables code-signing enforcement. Because the exploit is bootrom-based, this jailbreak works on any iOS version (from iOS 12 to the latest iOS 16/17, as long as the device is A11 or older). However, newer tools like iPwnder32 have been developed

: These newer Macs have significantly different boot architectures. While they still have a DFU mode for restoration, the original checkm8 exploit does not apply to them. However, newer tools like iPwnder32 have been developed to handle the specific USB communication requirements of M1/M2 chips when they act as the "master" to pwn an older iPhone.