Payload on MacBook Air(2010-2013). Help Needed

[soni.pc]

Hey everyone, I created payload to find MacBook Air efi 4 digit PIN, but the problem is that after 3 wrong attempts you have to wait 1 minute. After 3 other attempts 5 minutes, and then 15 minutes and so on...
Is there another way to find that dam'n PIN?

My script was like this:

STRING 0000
ENTER

DELAY 1000

STRING 0001

ENTER

DELAY 1000

STRING 0002

ENTER

DELAY 1000

and when I enter the 3-rd PIN wrong I have to wait

[no42]

Sounds like you have a newer Mac.

The straight brute-force attack only works on older models. Though apparently you can trick the counter? apparantly by changing the keyboard language every X attempts?

There is also the following instructions to reset the firmware password on newer Macs:

1. Boot with Option key held to display the boot menu’s firmware password prompt.
2. Press Control-Option-Command-Shift-S to reveal a 33-digit hash (mixed letters and numbers) that contains an identifier for your specific motherboard and the Atmel chip used for your system. In this hash, the first 17 digits are an identifier for the system’s motherboard, and the last 16 digits are a hash for the password.
3. Submit the hash to Apple, where someone will put it through a special utility to create a keyfile that is specific for your machine.
4. Place the file on a special USB boot drive and hold Option to load the boot menu and select this drive.

The system will read the file and properly reset the firmware password stored in the Atmel chip.

Edited November 4, 2013 by midnitesnake