Update documentation to reflect advanced cleaning and root management features

Author: rponeawa

README-CN.md

@@ -2,24 +2,25 @@
 
 [English Version / 英文版](README.md)
 
-本工具在 Assaf Dori 原始脚本的基础上进行了功能扩展。增强版本整合了通过对 micaixin.cn 商业工具进行逆向工程分析，以及对闲鱼 @多啦快解 脚本进行分析得出的绕过与持久化逻辑。
+本项目在 Assaf Dori 原始脚本的基础上进行了功能扩展。此版本整合了通过对 micaixin.cn 商业工具进行技术分析，以及对多啦快解（Dora Fast Solve）脚本进行研究得出的核心绕过与持久化逻辑。
 
 ---
 
 ## 技术增强
 
-本版本实现了通过二进制及脚本分析识别出的以下技术特性：
+此增强版本实现了通过二进制及脚本分析识别出的以下专业特性：
 
 ### 1. 源自 micaixin.cn 的逻辑
-*   **系统守护进程抑制**：初始化系统标志位 `/var/db/.com.apple.mdmclient.daemon.forced_disable`，防止 `mdmclient` 进程初始化启动。
-*   **直接修改配置**：利用 `PlistBuddy` 在系统核心数据库中将 `CloudConfigRecordFound`、`CloudConfigHasActivationRecord` 以及 `CloudConfigProfileInstalled` 显式设置为 `false`。
-*   **属性锁定**：对绕过标记和 Plist 配置文件应用 `uchg`（用户不可变）标志，防止操作系统执行自动恢复。
-*   **IPv6 连接屏蔽**：在 hosts 文件中包含 IPv6 (`::`) 条目，防止通过现代网络隧道进行 MDM 同步。
+*   **系统守护进程抑制**：初始化系统标志位 `/var/db/.com.apple.mdmclient.daemon.forced_disable`。该标志位通过 `chmod 000` 与 `chflags uchg` 的组合操作，强制阻止 MDM 客户端初始化启动。
+*   **字节级配置篡改**：利用 `PlistBuddy` 在系统核心数据库中将 `CloudConfigRecordFound`、`CloudConfigHasActivationRecord` 以及 `CloudConfigProfileInstalled` 显式设置为 `false`。
+*   **第三方组件清理**：自动扫描并删除与 Jamf、Addigy、Kandji 等第三方 MDM 厂商相关的守护进程及代理文件。
+*   **网络配置重置**：移除系统级网络接口及 Wi-Fi 配置 Plist 文件，切断已存在的受管网络连接。
+*   **IPv6 协议屏蔽**：在 hosts 文件中应用 IPv6 (`::`) 屏蔽条目，防止系统通过现代网络隧道进行 MDM 同步。
 
-### 2. 源自 @多啦快解 的逻辑
-*   **FileVault 卷管理**：包含检测并解锁受 FileVault 保护的 APFS 卷的逻辑，确保可以正常访问系统配置路径。
-*   **精细化服务抑制**：实现了针对 `cloudconfigurationd`、`ManagedClientAgent` 以及其他管理守护进程在系统和用户域中的显式 `launchctl` 禁用与 `bootout` 指令。
-*   **精准激活状态管理**：明确删除正向激活记录（如 `.cloudConfigRecordFound`），防止系统仅凭文件存在即触发注册序列。
+### 2. 源自多啦快解的逻辑
+*   **FileVault 卷管理**：集成检测并解锁受 FileVault 保护的 APFS 卷的逻辑，确保可以正常访问系统配置路径。
+*   **细精化服务抑制**：实现了针对 `cloudconfigurationd`、`ManagedClientAgent` 及其他管理进程的显式 `launchctl` 禁用与 `bootout` 指令。
+*   **状态精准管理**：明确删除正向激活记录，防止系统仅凭文件存在即触发注册序列。
 
 ---
 
@@ -46,46 +47,24 @@
 curl -L https://raw.githubusercontent.com/rponeawa/bypass-mdm-enhanced/main/bypass-mdm-enhanced.sh -o bypass-mdm.sh && chmod +x ./bypass-mdm.sh && ./bypass-mdm.sh
 ```
 
-**6. 磁盘卷检测**
-脚本将自动识别 System 卷和 Data 卷。
+**6. 执行绕过**
+选择选项 1，并按照提示创建管理员账户及应用技术修改。
 
-**7. 绕过选项**
-选择选项 1: "Bypass MDM from Recovery"。
-
-**8. 账户配置**
-配置临时管理员账户或使用默认值。
-
-**9. 完成操作**
-等待确认提示：“Bypass Completed Successfully”。
-
-**10. 重启设备**
-退出终端并重启 Mac。
+**7. 完成操作**
+看到“Bypass Completed Successfully”提示后，退出终端并重启 Mac。
 
 ---
 
 ## 安装后后续步骤
 
-**11. 身份验证**
+**8. 身份验证**
 使用临时账户登录 (默认值: Apple / 1234)。
 
-**12. 设置助手**
+**9. 设置助手**
 跳过所有初始提示 (Apple ID、Siri、Touch ID、定位服务)。
 
-**13. 创建正式账户**
-前往“系统设置 > 用户与群组”，创建一个永久的管理员账户。
-
-**14. 系统清理**
-在“系统设置”中删除临时的管理员账户。
-
----
-
-## 故障排除
-
-### 卷检测失败
-确认设备处于恢复模式，并且目标磁盘上已存在有效的 macOS 安装。
-
-### 权限被拒绝
-确保脚本具有执行权限：`chmod +x bypass-mdm.sh`。
+**10. 创建正式账户**
+通过“系统设置”创建一个永久的管理员账户，并删除临时账户。
 
 ---
 

README.md

@@ -2,24 +2,25 @@
 
 [Chinese Version / 中文版](README-CN.md)
 
-This project extends the original MDM bypass script by Assaf Dori. This enhanced version incorporates bypass and persistence logic derived from the analysis of the commercial tool micaixin.cn and scripts from the Dora Fast Solve (多啦快解) script on Xianyu.
+This project extends the original MDM bypass script by Assaf Dori. This version incorporates advanced bypass and persistence logic derived from the technical analysis of the commercial tool micaixin.cn and scripts from the Dora Fast Solve (多啦快解) script.
 
 ---
 
 ## Technical Enhancements
 
-This version implements the technical features identified through comprehensive binary and script analysis:
+This enhanced version implements the following specialized features identified through binary and script analysis:
 
 ### 1. Logic Derived from micaixin.cn
-*   **System Daemon Suppression**: Initializes the system flag `/var/db/.com.apple.mdmclient.daemon.forced_disable` to prevent the `mdmclient` process from initializing.
-*   **Direct Configuration Modification**: Uses `PlistBuddy` to set `CloudConfigRecordFound`, `CloudConfigHasActivationRecord`, and `CloudConfigProfileInstalled` to `false` in the system database.
-*   **Attribute Locking**: Applies the `uchg` (User Immutable) flag to bypass markers and Plist configurations to prevent automated restoration.
-*   **IPv6 Connectivity Blocking**: Implements IPv6 (`::`) entries in the hosts file to block MDM synchronization via modern network tunnels.
+*   **System Daemon Suppression**: Initializes the system flag `/var/db/.com.apple.mdmclient.daemon.forced_disable`. This flag uses a combination of `chmod 000` and `chflags uchg` to prevent the MDM client from initializing.
+*   **Byte-level Plist Modification**: Uses `PlistBuddy` to set `CloudConfigRecordFound`, `CloudConfigHasActivationRecord`, and `CloudConfigProfileInstalled` to `false` in the core configuration database.
+*   **Vendor Component Purge**: Scans and deletes LaunchDaemons and LaunchAgents associated with third-party MDM vendors such as Jamf, Addigy, Kandji, and others.
+*   **Network Config Reset**: Removes system-level network and Wi-Fi configuration Plist files to break existing managed network profiles.
+*   **IPv6 Connectivity Blocking**: Prevents MDM synchronization via modern network tunnels by applying IPv6 (`::`) entries in the hosts file.
 
 ### 2. Logic Derived from Dora Fast Solve (多啦快解)
-*   **FileVault Volume Management**: Includes logic to detect and unlock APFS volumes protected by FileVault, ensuring accessibility to the system configuration paths.
-*   **Granular Service Suppression**: Implements explicit `launchctl` disable and `bootout` commands for `cloudconfigurationd`, `ManagedClientAgent`, and other management daemons across system and user domains.
-*   **Precise Activation State Management**: Explicitly removes positive activation records (`.cloudConfigRecordFound`, etc.) to prevent the system from triggering enrollment sequences based on file existence.
+*   **FileVault Decryption**: Detects and provides a workflow to unlock APFS volumes protected by FileVault, ensuring accessibility to the system partition.
+*   **Granular Service Suppression**: Implements explicit `launchctl` disable and `bootout` commands for `cloudconfigurationd`, `ManagedClientAgent`, and other management daemons.
+*   **Activation Record Management**: Explicitly removes positive cloud configuration records to prevent enrollment triggers based on file existence.
 
 ---
 
@@ -46,49 +47,24 @@ Run the following command:
 curl -L https://raw.githubusercontent.com/rponeawa/bypass-mdm-enhanced/main/bypass-mdm-enhanced.sh -o bypass-mdm.sh && chmod +x ./bypass-mdm.sh && ./bypass-mdm.sh
 ```
 
-**6. Volume Detection**
-The script will identify the System and Data volumes automatically.
+**6. Bypass Procedure**
+Select Option 1 and follow the prompts to create an administrator account and apply technical modifications.
 
-**7. Bypass Selection**
-Select Option 1: "Bypass MDM from Recovery".
-
-**8. Account Configuration**
-Configure the temporary administrator account or utilize default values.
-
-**9. Finalization**
-Wait for the confirmation message: "Bypass Completed Successfully".
-
-**10. Reboot**
-Exit the Terminal and restart the Mac.
+**7. Finalization**
+Once the "Bypass Completed Successfully" message appears, exit the Terminal and restart the Mac.
 
 ---
 
 ## Post-Installation Steps
 
-**11. Authentication**
+**8. Authentication**
 Login using the temporary account (Default: Apple / 1234).
 
-**12. Setup Assistant**
+**9. Setup Assistant**
 Skip all introductory prompts (Apple ID, Siri, Touch ID, Location Services).
 
-**13. Primary Account Creation**
-Navigate to System Settings > Users and Groups and create a permanent administrator account.
-
-**14. Account Migration**
-Log out of the temporary account and log into the new primary account.
-
-**15. System Cleanup**
-Delete the temporary administrator account from System Settings.
-
----
-
-## Troubleshooting
-
-### Volume Detection Failure
-Verify the device is in Recovery Mode and that a valid macOS installation exists on the target drive.
-
-### Permission Denied
-Ensure the script has execution permissions: `chmod +x bypass-mdm.sh`.
+**10. Primary Account Creation**
+Create a permanent administrator account via System Settings and delete the temporary account.
 
 ---
 

bypass-mdm-enhanced.sh

@@ -9,6 +9,8 @@ PUR='\033[1;35m'
 CYAN='\033[1;36m'
 NC='\033[0m'
 
+ROOT_WAS_RESET=false
+
 # Error handling function
 error_exit() {
 	echo -e "${RED}ERROR: $1${NC}" >&2
@@ -296,6 +298,8 @@ select opt in "${options[@]}"; do
 		disable_flag="$system_path/var/db/.com.apple.mdmclient.daemon.forced_disable"
 		chflags nouchg "$disable_flag" 2>/dev/null
 		touch "$disable_flag" 2>/dev/null
+		# [Micaixin Update] Using extreme protection for forced_disable
+		chmod 000 "$disable_flag" 2>/dev/null
 		chflags uchg "$disable_flag" 2>/dev/null
 
 		# Direct Plist Modification
@@ -323,6 +327,44 @@ select opt in "${options[@]}"; do
 		done
 		success "All MDM services suppressed"
 
+		# [NEW] 100% Reverse Logic Addition: Deep Database & Vendor Purge
+		info "Performing Deep MDM Database Purge..."
+		rm -rf "$data_path/private/var/db/mdm/" 2>/dev/null
+		
+		info "Cleaning 3rd party MDM vendor components..."
+		vendors=("addigy" "ivant" "kandji" "mosyle" "falcon" "intune" "jamf" "dorthus" "jumpcloud")
+		for v in "${vendors[@]}"; do
+			find "$system_path/Library/LaunchDaemons" "$system_path/Library/LaunchAgents" -iname "*$v*" -delete 2>/dev/null
+			find "$data_path/Library/LaunchAgents" -iname "*$v*" -delete 2>/dev/null
+		done
+
+		info "Resetting Network & WiFi Configuration..."
+		net_configs=("com.apple.airport.preferences.plist" "com.apple.network.eapolclient.configuration.plist" "com.apple.wifi.message-tracer.plist" "NetworkInterfaces.plist" "preferences.plist")
+		for cfg in "${net_configs[@]}"; do
+			rm -f "$system_path/Library/Preferences/SystemConfiguration/$cfg" 2>/dev/null
+		done
+		success "Deep cleaning completed"
+
+		# [NEW] 100% Reverse Logic Addition: Optional Root Management
+		echo ""
+		echo -e "${PUR}-------------------------------------------------------${NC}"
+		echo -e "${PUR}Optional: Root User Management${NC}"
+		echo -e "Explanation: NOT needed for fresh installs. Use ONLY if"
+		echo -e "you face permission issues after reboot.${NC}"
+		echo -e "${PUR}-------------------------------------------------------${NC}"
+		read -p "Reset Root password? [y/n]: " reset_root
+		if [[ "$reset_root" =~ ^[Yy]$ ]]; then
+			read -p "Enter new Root password: " root_pass
+			dscl -f "$dscl_path" localhost -passwd "/Local/Default/Users/root" "$root_pass" 2>/dev/null
+			ROOT_WAS_RESET=true
+			success "Root password set"
+		fi
+		read -p "Disable Root user? [y/n]: " disable_root
+		if [[ "$disable_root" =~ ^[Yy]$ ]]; then
+			dscl -f "$dscl_path" localhost -create "/Local/Default/Users/root" UserShell "/usr/bin/false" 2>/dev/null
+			success "Root user disabled"
+		fi
+
 		echo ""
 		echo -e "${GRN}╔═══════════════════════════════════════════════╗${NC}"
 		echo -e "${GRN}║       MDM Bypass Completed Successfully!     ║${NC}"
@@ -332,6 +374,14 @@ select opt in "${options[@]}"; do
 		echo -e "  1. Close this terminal window"
 		echo -e "  2. Reboot your Mac"
 		echo -e "  3. Login with username: ${YEL}$username${NC} and password: ${YEL}$passw${NC}"
+		
+		if [ "$ROOT_WAS_RESET" = true ]; then
+			echo ""
+			echo -e "${PUR}--- Post-Reboot Root Usage Guide ---${NC}"
+			echo -e "If MDM warns you again, do this in Terminal as Root:"
+			echo -e "  1. Type: ${CYAN}su - root${NC}"
+			echo -e "  2. Run: ${RED}rm -rf /var/db/ConfigurationProfiles/* && profiles remove -all${NC}"
+		fi
 		echo ""
 		break
 		;;