Hacker News new | ask | show | jobs
by Wowfunhappy 1767 days ago
No it can't. You'd have to disable SIP temporarily in the first place, and a rootkit can't boot a recovery environment while SIP is engaged.

And then on Apple Silicon Macs, entering 1TR is tied to the physical action of holding down the power button.