you'd need the key from the TPM/secure enclave too, which is much much harder to extract
which is exactly what happens
> unrecoverable without an electron microscope and nation-state level resources (and even then, it would be extremely difficult if not impossible on modern process nodes).
Oh, so you can. It's only a matter of time.
Apple aren't going to allow one phone to attest 5000 new iMessage clients
iCloud Activation Lock, on non-cellular devices (eg, Wi-Fi only iPads), relies on the device's serial number, Wi-Fi MAC, and Bluetooth MAC addresses as the three identifiers required to clear the Activation Lock check. Via special debug cables (eg, a "DCSD cable") there are ways to write in new SysCfg data to the flash to change those variables. This can also be done to Apple Watches (pre-Series 6) with a special dock also sold on the Chinese market.
You can (sort of easily) get your hands on a "clean" serial/MACs set for under $10-15 or so on the market.
