DFU Mode Restore (Macs)

==Supported Macs:==
All MacBooks starting with T2 support this feature. 
*2018+ A1989/A2159 13" MacBook Pro
*2018+ A1990 15" MacBook Pro
*2019 A2141 16" MacBook Pro
*2018+ A1932 13" MacBook Air
*2018+ A1993 Mac mini
*2017 A1862 iMac Pro
*2019 A1991 Mac Pro
*2020 A2338 13" M1 MacBook Pro
*2020 A2337 13" M1 MacBook Air
*2020 A2348 M1 Mac mini
*2021 A2442 14" M1 Pro / M1 Max MacBook Pro
*2021 A2485 16" M1 Pro / M1 Max MacBook Pro
*2022 A2681 13" M2 MacBook Air
*2022 A2338 13" M2 MacBook Pro
*2023 A2779 14" M2 Pro / M2 Max MacBook Pro
*2023 A2780 16" M2 Pro / M2 Max MacBook Pro
==Scenarios for restore:==
DO NOT EVER "REFLOW" T2 or any other chips, even if you seen someone did it it "magically worked". If you found this page, probably you are suspecting T2 issue, so even if DFU won't help you - DON'T REFLOW T2. 
DFU on Beta software might brick the device so keyboard method wont work anymore, however it does not seem to affect anything if you do jumper method DFU. 
DFU mode is needed to restore the T2 firmware when:
*Failed macOS upgrade/reinstall/Security Update
*Failed Combo or Delta update
*Unable to boot into the current OS Internet Recovery using command + option + R
*Unable to successfully create computer account and log in after erasing and reinstalling (M1 computers specifically)
*Looping apple logo with no loading bar after waterdamage on power button (820-00850 confirmed case)
*CPU / PCH replacement: since ME+EFI image is located on BridgeOS partition, to do classical "clean ME" procedure after PCH swap, you need to do full DFU restore. Whis will put uninitialized ME image to BridgeOS partition. Revive is enough to perform CleanME, so if you swapped CPU for data recovery, you can first backup with Target Disk mode, then try revive and full boot.
*waterdamage on TouchID / Power button connector. One of weirdly common reasons for currupt BridgeOS firmware is corroded TouchID connector. It is hard to tell why, but many devices stuck in G3H/T2 state are being repaired after revive.
*5V 0.2a>0.05A loop and no battery charge, unable to DFU from keyboard (SoC Rom corruption)
*some sources claim that PP3V3_S5 power output might be "shorted" to ground(10-50 Ohm) if there is T2 iBoot&BridgeOS corruption. possible explanation is that this output is firmware/configurable pin which is turned to ground per default but it is really questionable claim.
Other reasons to restore: 
Essentially anytime you see something that communicates with T2 not function, a DFU restore may resolve. However, rule out other possibilities first!
A few examples: 
#Battery communication lines being pulled down - but not short causing battery not being recognized and not charging. T2 handles SMC communications now. Battery stats and settings are stored in SoC Rom and will be reset with Revive, so DFU Revive might be considered as SMC configuration reset. 
#Raise/Wake not working properly. I've had two scenarios:
*1: LID_OPEN_LEFT, LID_OPEN_RIGHT, and IPD_LID_OPEN would all function properly when triggered, however the unit would not sleep when lid closed. DFU restore fixed
*2: (820-01958) SMC_LID_RIGHT was low - 1v1 instead of the 1v8 it should be. Causing the unit not to fully wake when raising the lid (did respond when lid was closed) The camera also did not work, which lead me to U4850. I replaced U4580, which fixed the camera, however the SMC_LID_RIGHT line was brought even lower to .110v I isolated the issue to T2. I attempted a restore, this did not work. I tied IPD_LID_OPEN to SMC_LID_RIGHT to put a bandaid on the situation. Obviously this way the unit won't functional properly.
The moral of the story here, is before you attempt a DFU restore, for something that could be T2, attempt to rule out everything else before the restore, as you could brick the unit, and be in a worse condition.
===Beware of the risk!===
Rule out parts or any other board issue that is possible before DFU restoring the unit. There are many things that can cause a DFU restore to fail. The problem is, if you fail a DFU restore, you may end up in a different error state than your original issue. For example: 
If you have a board that comes in, with no power. You plug it into another unit, to check if its in DFU mode. It's not. Let's say PP3v3_G3H is shorted. Let's call this Failure State A. 
Now you're in Failure State A, and you decided to force the unit into DFU, and attempt a restore. At this point, it would fail, and you would be stuck in recovery, let's call this Failure State B. Now you're at Failure State B, it makes it 10x harder to diagnose Failure State A, simply because you can't follow the power structure anymore. At this point, if you find you're short on PP3v3_G3H and remove it, you would have to restore again and PRAY that it works. It does not always. There have been many cases, where the unit came in with liquid damage, clearly a Failure State A type of situation, but the client attempted to restore before sending it, making it into a Failure State B. It seems half the time, after I fix Failure A, that I am able to get out of Failure B after restore. The half that is unsuccessful, is, I'm sure because of a damaged trace or something like that - however, with it being in recovery, or Failure State B, it's much harder to diagnose. 
===Requirements:===
Most boards require touchpad, some boards require Touchpad + Touchbar for full restore. Check trackpad/use known good part on waterdamaged devices before doing DFU Restore. 
You will need:
*a host Mac which has minimum OS of 10.13.5, Apple Configurator 2.6 or newer installed (from App Store), and an internet connection.
*USB-C cable which supports data, USB A to C cable, or Thunderbolt 3 cable. Apple OEM charging cable will work too. 
*Target Mac (one that is being put in DFU) is connected to power. Do not use the left port closest to track pad for power - you will need this for data.
*Target Mac has charged and functional battery/you have power supply plugged in into functioning port. After initial Phase of iBoot restoer (SoCrom) there will be issued a reset signal which resets external power supply but in theory it keeps being powered from DFU port. If PPBUS voltage sinks below threshold, T2 will lose its power and reset into recovery mode. This usually seen as a "usb connection" error roughly after approx 30-40 sec. If something like that happens with your mac, monitor PPBUS / T2 SLP Voltages to confirm and try good known precharged battery.
Make sure Host Mac is powered up, iTunes is not open if applicable (fully quit) and open Apple Configurator 2. 
==How to put Mac into the DFU mode==
=== If the host machine is Apple silicon, you can follow this guide to put targets in DFU through terminal: https://www.bkurtz.io/posts/macvdmtool/ ===
==== Keyboard method for Intel MacBook Pro and MacBook Air ====
Make sure Mac is shut down (hold power button for 5 seconds). Plug in data cable to Host Mac (any port) then into the left port closest to track pad in the Target Mac. Hold right shift + left option + left control + power keys simultaneously for about 3 seconds (according to Apple, other sources say 4-8 seconds). NOTE: We found that if you press the power button for 1 one thousand and then simultaneously hold the right shift + left option + left control, you should be successful each time. We also found that we were able to get in DFU mode around 4 to 6 (one one thousand, etc.) seconds. The Target Mac will remain as a black screen but you should see the DFU box pop up in Apple Configurator window on the Host Mac.
==== Keyboard method For Apple silicon M1 MacBook Pro and MacBook Air ====
Make sure Mac is shut down (hold power button for 5 seconds). Plug in data cable to Host Mac (any port) then into the left-side port closest to the screen in the Target Mac. Press the power button for about half a second, then also press and hold Left Control + Left Option + Right Shift for 10 seconds, then release all keys except power and hold power until the Target Mac shows up in Apple Configurator on the Host Mac.
For Intel Mac mini and iMac Pro - Disconnect power cord fro
m Target Mac. Plug in data cable on Target Mac to port closest to the HDMI port. Hold down power button and plug the power cord back in. Continue holding power button for about 3 seconds. The Target Mac will remain as a black screen but you should see the DFU logo in Apple Configurator window.
For M1 Mac mini - Disconnect Target Mac from power for at least 10 seconds. Plug in data cable on Target Mac to port closest to ethernet and into any port on Host Mac, then press and hold power while reconnecting power, then release power. The status indicator color should be amber. 
For 2019 Mac Pro - Disconnect power cord from Target Mac. Plug in data cable on Target Mac to USB-C port farthest from the power button. While holding the power button, connect the power cord and continue to hold the power button for about 3 seconds. 
====DFU Mode using Jumper method====
logic behind that: T2 signal lines are in many cases not inverted like on intel platform, but they need to be pulled high to trigger. SOC_DFU_RESTORE should be pulled either to 1.8v on T2 or 1.25V on M1 models.
#locate FORCE_DFU jumper. on some Macbook Air boards there is just a testpoint which needs a wire to connect it with 1.8V. This signal needs to be pulled up to 1.8v to activate FORCE_DFU
#power-reset the device (unplug the battery, plug it back).
#Jump FORCE_DFU to 1.8v line, keep it jumped
#connect DFU cable to the device. It will both activate and autostart the macbook which will act as a proper "power button" trigger, switching the device straight into DFU.
#release the jumper (otherwise board would never be able to go past 1st stage of DFU restore)
This results DFU mode in 10/10 cases unless there is something wrong with T2/Jumper/CD321*/Cable
MacBook Air 2018 820-01521 board needs a physical jumper wire from testpoint (there is no debug "button" footprint on board). you can use PP1V8 ouput of T2 PMU as a pullup on the other side of the board
M1(820-02020, 820-02016 and similar) 
Most apple silicon boards will not have populated pullups or jumpers on board, so you need to check the schematics for your particular board and figure how to really pull FORCE_DFU to 1.25V 
Example: 
Opposite on MacBook Pro M1 13" (820-02020) - there will be a missing 1.25V pullup resister RV005 which is unfortunately located on the keyboard side of the board. if you do not want to disassembly the device, so you have to find PP1V25 somewhere else. 
Since it is located quite far away, it would be better to solder a small wire between any exposed line and debug pad. 
If you have trouble using tweezers, just solder a jumper wire and cut it once you see device is in DFU mode. 
Silicon Mac DFU restore also restores operating system partition. You can use a better cable(TBT4) to speed up the process. 
====DFU Mode using external switch====
Apple offers the option to access DFU in manual mode, forcing SOC_FORCE_DFU signal to 1V8_SLPS2R power rail; for T2 machines.
Almost all the boards have the pads available for this purpose.
Be aware, A1932 & A2179 don't have such pads!
For long time wire jumper method has been used.
However, is not easy to reach DFU and you need to resolder new wire each time.
For this reason, I recommend to attach an external switch connected to the corresponding pads:
#A1989		RE032
#A1990		SWK003
#A1932 & A2179	between pin 1/R8010 to pin 1/C7845, or other convenient 1V8_SLPS2R point
#A2141		SWK003
#A2159		SE032
#A2251		RE032
#A2289		SE032
In case of Mx machines, 1V25_S2 (or 1V2_S2) is used instead of 1V8_SLPS2R:
#A2337		SWV011		solder RV020 first, or connect the switch directly to its pad 1
#A2338		SV004/5		solder RV005 first, or connect the switch directly to its pad 2
#A2442		SV100/10	solder RV120 first, or connect the switch directly to its pad 2
How to use the mentioned switch:
#Connect power cable and DFU cable.
#To avoid any weird symptom, force the machine off, pressing power button 5-8 seconds.
#Press FORCE_DFU switch for 3-5 seconds; you should see DFU logo now.
If machine resists to enter DFU, try "playing" with FORCE_DFU and power button.
Sometime, the touch ID may cause problems; doesn't allow to enter DFU, or causing DFU failure.
To avoid such problems, I recommend to use an external switch soldered on the PMU_ONOFF_L pads, similar with FORCE_DFU switch.
==== DFU mode using MacVDMTool ====
You can also use MacVDMTool to put your mac into DFU mode. This tool uses your TBT Controller on Host mac to send VDM message to your M1 and Intel target macs. 
VDM means "Vendor Defined Message" and this is a custom PD signal which is sent directly to CD3217 controller to trigger DFU mode. The host device must be Apple Silicon in order to work! 
Run as SUDO.
== NO DFU Mode Troubleshooting ==
#measure DFU_STATUS voltage. 1.8v indicates T2 is in DFU mode. In some cases pin might be shorted in T2 and needs external Pullup so CD3215/17 would be switched into DFU.
#If DFU Status is high but device is not visible with known good cable - inspect TBT ROM and CD3215/17. To properly allow DFU Connection CD321* should be initialized and TBT rom should be loaded. If you suspect TBT controller, remove SPI straps betweeт TBT SPI ROM and TBT Controller.
#if DFU_status is low, inspect if T2 is fully powered and receivesd signal. The easiest way to get DFU is described above.
#if you have low resistance on DFU_STATUS line and it comes from SoC, try to temporarily force it high state with 100-200Ohm resister to pullup voltage (1.8/1.25 depending on platform)
== T2 SoC ROM Manipulation and Serial Number Restore ==
The SoC ROM is an SPI Flash chip that contains the iBoot bootloader as well as all SMC variables, such as battery statistics and charge logs. It also stores the machine's serial number (SN). While the iBoot bootloader is encrypted, the remaining information is stored in ASCII format. This allows you to determine the machine's serial number without needing access to the chassis or booting the machine.
One alternative method for repairing a "no DFU" device is to erase the SoC ROM, which forces the T2 chip into DFU mode as if a jumper were present. This approach has been promoted by many channels that sell T2 Flash tools, which are typically CH341 chips with soldered WSOP8 adapters, priced between $200 and $300. Due to numerous instructional videos on this subject, there's a non-zero chance of purchasing a board with an incorrect SoC ROM dump, possibly downloaded from random sources like badcaps or vinafix. Let's clarify some misconceptions:
* DFU Restore fully restores the SoC ROM with an "original dump," but AC2 may transfer some information from the old dump, including variables that could potentially be the cause of the problem.
* SoC ROM corruption can lead to issues like no power, no charge, and the inability to enter 4-Finger DFU mode. This might be the primary reason people have started manipulating the SoC ROM rather than simply using a jumper, however there might be cases where moving variables from old dump bricks the machine again.
* The machine's serial number is tied to the T2 chip. If you don't have it or you have SN mismatch, activating the Mac and installing the OS may be impossible.
If you want to attempt flashing the SoC ROM, follow these steps:
# Back up the old dump.
# Completely clean the SPI Flash.
# Perform a DFU Restore.
# Read the fresh dump and restore the serial number block from backup. The T2 SoC ROM SN block offset is: 28A000.
Please note: This is not a method for changing the serial number. Although changing it will reflect the new number in "About This Mac," doing so will disable the Mac's ability to be activated the next time you restore it.
For further information check the T2 repair page, thanks to Muerto 
M1 devices do not need any manipulations, SoC rom will be restored with serial number in it. 
==DFU error codes and troubleshooting==
TO check if device is in DFU state, check voltage on SOC_DFU_STATUS. This goes directly to CD3217 on this port to switch it in DFU mode. If T2 is switched to DFU mode, proper level is 1.8V
DFU_STATUS high but no DFU visible in Apple Configurator might indicate problem with TBT ROM or CD3217
1 - The trackpad is not connected (For successful firmware, the MacBook needs a connected working trackpad).
6 - Probably could not write BridgeOS into service partition. Most likely SSD failure. There might be one hot NAND. Common symptom - T2 does not turn on S5 rails at all. If you have it in revive mode, try restore (All data will be lost!).
Common symptom of Bad SSD volume is T2 tries SSD power resets every few seconds or up to 23 seconds. 
9 - This error can have many causes, so quickly finding the cause of its occurrence is quite difficult. Here are some of the causes of this error: 
*BridgeOS partition not found (Use restore instead of revive, will format SSD), NANDs partition corrupted, NAND chips damaged or some similar.
*Malfunctions on the processor itself or power lines of the processor / RAM. Also if there is no processor on the motherboard.
*Flashing without a part of the cooling system (heat pipe) on macbooks with a large TDP.
*T2 / SEP ROM mismatch (Different T2 and SEP ROM should be restored, not revived) or SEP ROM was damaged and needs to be replaced.
10 - Bad cable / unstable connection.
21 - Resolved with SoC ROM replacement. On macbooks with an M1 processor, this error also means problems with NAND chips such as:
*Failure of one or two NANDs.
*Mismatch between the NAND model and the reference designation on the board (When replacing memory chips, you no longer need to write anything to them using the programmer, just follow the model/place on the board).
*Attempting to restore from recovery after replacing NANDs (After replacing NANDs, it is possible to restore only from DFU).
35 - probably bad trace on one NAND, sysconfig block cofiguration => NAND mismatch.
56 - bad or cracked stockholm chip.
75 - T2 booted in recovery mode (Revive wont work).
3004 - Bad or no internet connection on the MacBook.
3501 - (0xDAD) - target Mac is not connected to power.
4005 - SSD not detected error. 
4013 / 6 - errors indicate bad NAND Sysconfig or wrong position. 
4014 - Unexpected reset. Might be caused by T2 RAM error, power rail failure or even a bad battery.
4045 / 4042 - Timeout error.
Bad SSD will also cause T2 to power cycle its power supply every 20 seconds. this wont give any 100% related to SSD error but it is fully reliable method to confirm bad SSD. 
If you have Lock sign but no power after DFU revive, it is safe to say that both T2 and SSD work fine and problem is on Intel side. inspect S0 rails, no power might be caused by short on something like 5v rail or something what is used for communication pullups. It is always a good idea to check if after T2 boot device goes to S5 /S0 state.
Post-DFU errors on OS Recovery
GUI rendering issue/artifacts on loading screen - sometimes caused by throttling and maybe a bit bugged EFI Loader even on working machines. Happens with low/no battery, also if there is temp.sensor issue. 
-2003F - in most cases caused by internet connection. try using thunderbolt-LAN adapter. 
-1008F error while loading recovery even after DFU is related to icloud Lock device. Speculation is that most likely FMM lock or icloud block forces machine to load other environment which is in some cases not possible. If you have this error and DFU did not help (it helps in most cases because updated EFI probably fixes some bad link/certificate in Recovery loader) - remove device from FMM (Find My Mac) and icloud and try again.
=== DFU Fail Troubleshooting ===
Try known good battery and Trackpad. Disconnect all unnecessary equipment ( Touchbar, Keyboard, Fingerprint sensor).
On some macs disconnecting battery and using external power supply helps to pass through 4014 error (device did unexpectedly reset itself and did not go to restoreOS state).
Try different cable, inspect if device keeps being visible in DFU for long time. If it ocssionally disappears, troubleshoot connectivity (USBC Controller, Cable, usbc connector, etc)
=== iBoot log troubleshooting ===
=== T2 devices ===
One way to get access to iBoot log, is a leaked potassium/banana cable device(this was used on apple factories to test/investigate failures on preproduction stage), this device sends VDM message to CD3215/17 and it starts passing through T2 debug port which yields hmac-sha1 hashes as log messages. Most actual panics are not encoded so you can define problems like NAND, RAM failure with much more precision. Messages are very similar to iPhone iboot logs. You can also use this device to read PCH logs on some machine. PCH logs might be helpful to define GPU failure or some other POST Intel EFI-level problems like bad wlan firmware or issue with thunderbolt. Messages are unencrypted. 
To read RAW iboot log you can use any serial adapter with 1.8 level compatibility, for example " FTDI USB to 1.8V 2.5V 3.3V 5V TTL UART Switch Serial Adapter Module" does have 1.8v support. If you solder direclty to the SOC_DEBUG RX/TX pins, you will see something like that: 
this log might be helpful during DFU, since it will show some panic logs in clear text. 
Unfortunately all other messages are "encrypted" with truncated hmac-sha1 hash which cannot be decrypted. However i am working on making a reference table for some messages. 
Some known, easy to interpret panics might be ANS2 - "Apple Nand Storage 2" panic would be related to one or multiple NAND chips failure. 
=== M1+ ===
On M1 you can use and compile macvdmtool. This software allows you to send force dfu, reset and force serial commands to the cd3217. To get serial log you need to compile/run it on Big Sur since newer versions need you to disable AppleSerialShim kernel extension which is not possible on newest versions due to lack of Kernel Dev packages. This log would be very similar to T2 and will definetely help with troubleshooting if you have issues in DFU. It can also be used to send FORCE_DFU VDM message which works exactly like jumper method but no need to open the device. To use it you need to find proper TBT cable with SBU1/2 lines populated (any charging cable wont work, best way is to check USBC pinout and use MM to confirm.)
=== Sonoma Finder restore ===
since MacOs Sonoma, DFU restore can be performed directly from finder. For some not quite obvious reason, this type of restore provices way more verbosity in Console logs, in some cases it can even pinpoint failed component on board. 
== Experience ==
===(inwerp):===
Case: Macbook Pro 2018 15', 5V shortly 0.3A, than 0.04A-0.08 floating, all G3HOT present. Died with no particular reason, stopped charging and simply did not start up after next reboot.
- Did not work with USBA-USBC adapter (claimed to work by Apple Article), used thunderbolt cable. 
- Apple Configurator shows DFU logo without key combination, but flashing in this mode will end up with a undefined error. 
- Key combination works like 50/50, no particular pattern, best looks like DFU LOGO - SMC RESET Combo 4 Sec till DFU Logo disappears, shows again, now flashing works. 
may end up with the connection timeout, target device will start to boot, then shutdown at some point.
Macbook Pro 13 2019 820-00850
After minor liquid spill on power button / cd3215 chip. After cd3215 repair device freezes on apple logo without progress bar, does not boot into internet recovery. For some reason DFU Restore fixed the device, probably waterdamage on power button connector might somehow damage BridgeOS?
===(Liminalsunset):===
DFU Restore on T2 Mac: MacBook Pro 16" 2019
It's possible to restore the T2 firmware on this machine using a MacBook Air, Mid-2013 13" laptop. It appears that a USB-C mac is not required to initiate the process. 
Both systems were running Catalina 10.15.7. This does erase the SSD. I used Internet Recovery to restore a backup and it worked fine after. Activation Lock and FileVault were enabled prior to procedure and do not appear to affect it. Works with Target MacBook Pro powered off of battery. 
To enter DFU mode I used:
1) Turn off MBP and plug in USB A to USB C cable (third party) from MacBook Air into MacBook Pro, port closest to you facing computer on the left side
2) Locate left Control and Option keys on MacBook Pro, as well as right Shift key. 
3) Press Power button for 1 second, then hold keys above down with power button for 8 (real) seconds. MBP will flash Apple logo, then it will disappear
4) DFU device should show up in Apple Configurator 2. Rest of process is uneventful and works normally. Once restore is complete MBP may need manually powered off and on to start into Internet Recovery
===(Dusten Mahathy)===
Case 1: 
820-01700
Unit not booting without battery present. This board will boot on a 96watt adapter normally. I have seen 3 cases where the board doesn't boot on the adapter alone, and wouldn't charge a stone dead battery normally.
Without battery connected: 20v with a jump to 300-500mA then back to 70mA and kind of sit there. 
With battery connected: It would very slowly raise to charging amperage. (It would take 2 to 3 minutes for it to reach 4 and a half amps, vs the normal 30 seconds to a minute)
After diagnosing the charging circuit, and seemingly everything on the board is physically okay, I decided to DFU restore the unit, thinking something with the SMC, that T2 is now handling. 
This resolved the issue. 
Case 2: 
820-01700
Prohibition Symbol: This seems to be caused by the board being disabled. Flashing the T2 ROM, and restoring via DFU resolved the issue. 
===(Ed Hallman / crumblenaut)===
Exact same deal as Dusten's Case 1 above - 820-01700 board, user reported crashing after liquid exposure and previous board-level work, eventually ending with the system not booting even WITH the battery present. With no battery we saw 20v with a jump to 300-500mA then back to ~70mA and kind of sit there, and with the battery connected we saw a slowly raising charge amperage. 
DFU REVIVE would fail with the error code 6, despite (going off of the table below) the fact that all SSD rail resistances were good and voltages were present. 
After confirming that the user had a backup (thank the dark lord), I performed a proper DFU RESTORE and that got it powering on and booting again. After first boot with Apple logo the system would power off. Second power took some time with fanspin and nothing on the screen, then fans stopped, then fans spun backup and screen initialized. Cmd+Opt+R got it reinstalling right away.
From Experience: (Dusten Mahathy)
820-00958
The unit came in with slight liquid damage on U7650, U6940, and Q7660. Shorted was PP5V_G3S. The shorted component was U8245. After replacing U8245, I found that PP5V_G3S was 10v, instead of the 5v that it was intended for. After only a few seconds of having the board on again after replacing U8245, to check measurements, it was shorted again. At this point, I replaced U7650, Q7660, and repaired several traces and capacitors, resistors. Once again, replacing U8245. This time when powering on the board PP5V_G3S, was at its normal voltage. However, the unit still would not boot. Hovering about 20v 100mA. So after further investigation, I found PPVCCIN_AUX_PCH was not being generated. This was due to PPVCCINAUX_VCC being shorted to ground. This failed component was U7400. Which was powered by PP5V_G3S. So, after replacing U7400, I was making progress. The unit would start the boot process, getting 1v8 on PPVCC_S0_CPU for a second, then 0v, but pulsing. So on/off/on/off scenario. I found the pulsing started all the way back at PP1v8_SLPS2R. I did find, however, that if I removed R7210, R7220, and R7230 the system would be stable again. These are the three resistors that powers PPVCC_S0_CPU. At this point, I am pretty certain that I have some sort of CPU failure. Wether it be the CPU itself or not, I am not sure. I felt that it was, as I have a suspicion the 10v going through the CPU MOSFETs probably killed the CPU. However, as a last desperation, and for research, I decided to attempt to DFU the machine. At his point, it failed, and I got error code 9. This was somewhat expected, as all the power rails are pulsing currently. So what I decided to do, was remove the three resistors mentioned early, to make the system stable again. At this point, the DFU restore went through successfully. This leads me to believe that CPU failure can cause error code 9
== Links / Video ==
DFU on T2 Machines
<youtube>https://www.youtube.com/watch?v=e0jevSCQxGE&</youtube>
Comprehensive guide: https://mrmacintosh.com/how-to-restore-bridgeos-on-a-t2-mac-how-to-put-a-mac-into-dfu-mode/
Error codes Source
Category:Mac