I had to remove a corporate MDM from an iPhone I’d been given and found tazMeah’s excellent project MDMPatcher-Universal. It’s an OS X-based tool, which means that I had to go through a number of hoops to get it working with my setup. There is a lot of rebooting in this process, but I wanted to make sure that there were no problems due to components that couldn’t be properly installed/removed due to pending reboots.
Here’s the environment I was using:
- Mac OS X Big Sur 10.16
- VMWare Workstation 15.5.7
- Dell 7230 laptop with Windows 11 24H2
- iPhone 12 with iOS 18
I started by removing Hyper-V on my latop (which I’d previously used for PoC), as it was going to cause complications with VMWare. In theory, they can co-exist, but I decided to simplify my life by removing the hypervisor I no longer needed. Turn Windows Features On or Off > Uncheck “Hyper-V” Reboot bcdedit /set hypervisorlaunchtype off Reboot
Install VMWare Workstation. I was able to find a license key online for this older product. Reboot. Patch VMWare Workstation to support the Apple VM type using https://github.com/paolo-projects/unlocker Download Download darwin.iso. The tool didn’t download it from me, which I assume is due to the Broadcom/VMWare split. I grabbed it directly from VMWare: https://packages.vmware.com/tools/frozen/darwin/ Run win-install.cmd. This tool also includes the necessary python components, but you could also download/install the latest version of python 3 as a separate application Running win-update-tools.cmd is not necessary. This script simply extracts darwin.iso and stores it in the VMWare Workstation installation directory, which I manually did.
At this point, I made my Mac OS X VM by following this guide: https://github.com/dortania/macOS-VMware-Guide/blob/master/making-the-virtual-machine.md
I had every intention of doing a full writeup, but after going through the whole process - which worked, by the way - it turns out that anytime the iphone is updated (or rebooted?), this process has to be repeated. I don’t want to go through that hassle, since I have other options. So, the rest of this guide is very sparse, but I will list the links that I referenced.
- install MDMPatcher on the OSx VM
- Download the right ipsw file from ipsw.me
- Put the iphone into recovery mode
- Flash the ipsw file using iTunes (the ipsw.me site has instructions). Use the SHIFT key instead of Option if you’re using a Windows device.
- Connect the iphone to the VM using USB passthrough
- Follow the initial setup, but do not connect to any network. If you do, you’ll have to reflash the iphone
- Launch the MDMPatcher in OSX. When your device info shows in MDMPatcher, click “PATCH” to complete the process
- After reboot, follow the remaining setup instructions on the device
References
Some articles I referenced when figuring this out were:
https://github.com/fled-dev/MDMPatcher-Enhanced https://github.com/DavidsonRafaelK/MacOS-Installation https://ipsw.me/download/iPhone13,1/22E240 https://github.com/tazMeah/MDMPatcher-Universal?tab=readme-ov-file