Entering 1TR with Virtualization.framework?

Hey:

I've grepped through Apple Documentations and found no hint about how to boot my macOS VM into 1TR to disable SIP and whatnot in a Virtualized macOS with Apple Silicon's Virtualization.framework.

Any hint on how to implement this feature?

Up vote post of NZhang Down vote post of NZhang
419 views
Posted by
NZhang
Reply
Add a Comment

Replies

What is “1TR” in this context?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Posted by
eskimo
Up vote reply of eskimo Down vote reply of eskimo

  • The "One True Recovery" mode on Apple Silicon Macs, which is the only place where security features like SIP could be disabled

    —
    NZhang

  • See below since format is broken here in comments

    —
    NZhang
Add a Comment

Basically, I'm hoping to disable EVERY SINGLE security feature in my Apple Silicon macOS VM, the most important ones are as following:

  • Loading unsigned kernel extension
  • Ability to read and write (Optionally, create new executable memory region) in kernel space.
  • Read-Write to root filesystem

.....

Posted by
NZhang
Up vote reply of NZhang Down vote reply of NZhang
Add a Comment

I've tried to boot into recovery using private APIs in Apple Silicon's Virtualization.framework and executed the following:

csrutil disable
bputil -p -k -c -a -s
spctl --master-disable
spctl kext-consent disable

However when I switched back to macOS in the VM:

  • Changes done by spctl is not preserved
  • Changes done by bpctl is preserved, but KIP status is shown as Customized (sip0): 7f
  • csrutil status says disabled but I still can't write to /
  • Loading unsigned kext results infinite Must reboot to use new extension in User-Approved Kernel-Extension Loading
Posted by
NZhang
Up vote reply of NZhang Down vote reply of NZhang
Add a Comment