Explains the sequence of events from Boot ROM to FileVault login, what storage is accessible at different times, and where the code is.
kernel
Security services including TXM, Core Crypto, AMFI, Credential Manager and the SEP Key Store, Gatekeeper and AppleSystemPolicy, tracked during startup.
Making their appearance for the first time in macOS 14.4 are Agatha Christie’s detective Hercule Poirot, branches from nerve cells, and isolated fragments of states. What can they be?
Why do macOS updates keep updating firmware? Is it full of bugs or what? And just what does firmware do?
How to tell whether an app has a memory leak, what to do about it, and the differences from a kernel memory leak.
How the kernel relies on its extensions to make your Mac work, and has highest privilege for stability and security. How this must change for Apple Silicon.
Once the kernel takes over from iBoot, there’s a lot of hardware to get running before the SSV can be properly validation, and kernel extensions loaded.
Sometimes known as iBoot1 and iBoot2, they start work with the LocalPolicy for the intended boot volume, validating its vital components.
Understanding each of the four stages in the Secure Booting of an M1 Mac. These are summarised in diagram available here.
There’s a fundamental difference in the way that Intel and M1 Macs store and load their ‘firmware’, which enables the M1 Mac to load and run difference versions of iBoot.
The Eclectic Light Company 