tl;dr you reboot the device with `macvdmtool`, you install m1n1 as the boot object, you talk to the m1n1 proxy over a python shell. I'm documenting the process as I go also (see: the blog posts, also my github repos) both so others can do it and as record of the clean room nature, but this really is just GPT go brrrrr
I'll add an addendum to the blog post at some point with a more detailed method because there is demand, but the tl;dr is:
- boot macos under hypervisor (detailed guide in my part 1) into single user mode
- write your own metal program and run it as early in boot as you can
- trace all relevant graphics regions
- once you see the first kick, intercept that kick, then capture the full uat state
- reboot the device, then copy that whole uat state back into the machine, every bit exactly where it was
- perform the kick, verify the output page changes as expected
- have the LLM build all the objects itself in python
- repeat with different metal programs until we have all the behavior you want
- for a list of all behaviors you want, just look at the m1/m2 kernel driver and make sure everything they do has an analogue in your codebase
- if there's every any problems, there's a very simple debugging loop: 1. MAKE SURE YOU HAVE A REPLAYABLE CAPTURE. if you don't then priority #1 is to get that capture. once you have that capture, it's only a matter of time until it works
https://codyho.dev/blog/hypervisor-macbook-neo/
tl;dr you reboot the device with `macvdmtool`, you install m1n1 as the boot object, you talk to the m1n1 proxy over a python shell. I'm documenting the process as I go also (see: the blog posts, also my github repos) both so others can do it and as record of the clean room nature, but this really is just GPT go brrrrr