Being able to unlock via serial number works by having access to what is called GSX. GSX (Global Service Exchange) is part of Apple's Internal Suite of tools and services. Actually it pretty much IS their set of internal tools and services. Think of it this way: when you work for a company and they have their own internal network that can only be accessed by the computers that are at your place of business, accessible only via your personalized login, on computers that you have been assigned to have been allowed to log in under. An admin GSX account login is assigned only once per location, and not all Apple locations or a Genius Bars qualify to have an admin account. There are very limited amounts of admin logins in existence, and in the event you happen to get access to one, it's not like you can just go to gsx.com and login and have unlimited access to iCloud removals.
Apple is on top of their shit. Each login is only allowed access to GSX from very specific and manually pre-authorized IP addresses. If somebody tried logging in from anything other than the allowed IP (and honestly probably other variables like MAC Address, OS type, maybe even time of day) then that account is immediately locked down and terminated until further review has been made. There is absolutely NO hardware method for breaking iCloud like we can with EFI. There is absolutely nothing the same between the two and the similarities between the two stop at the fact that they are both Apple products and that's it. What we are doing with MacBooks is NOT iCloud unlocking, it is BIOS modding. Of course, there are NAND reader/writer hardware that will allow you to modify the contents of a NAND chip (aka flash SSDs, the majority of USBs, a RAM stick, and yes, iPhone internal memory) but that shouldn't be considered as a hardware iCloud method due to the fact that you're not just hooking in some tool that magically removes iCloud, you are physically defacing the logic board of any given device and attaching it into a programmer that would basically just give you unrestricted access to the file system and allow you to change the serial number and other such variables.
If anything these tools are more closely related to Super Jailbreak/Rooting tools than iCloud bypass hardware. There used to be things that worked, but long passed are the days of the iPhone 4 and iOS 6.1 where everything was possible and iPhone was cracked wide open.
Now all the best hardware/software is sold to strictly LE and government authorities for high end dollar amounts only when proper credentials have been provided.To sum it all up!There are no hardware iCloud methods that are publicly available!The only hardware method released publicly is for Cellular IPads. You can retrieve data by yourself. There are programs to do that. For example Ipad ManagerI used it few times.But there is a sad news. I'm not sure but most of these programs work with NTFS and FAT32 files systems. I recently tried to find something that would work with ext4 but I was unsuccessful. So, because OS X is using HFS+ file system there could be problem with software.
Apple Serial Number Product Lookup
Apple Logic Board Serial Number Lookup Model Year
But I can't believe that they don't exist.To sum up try to google 'recovering HFS+ partition' or find program for recovering data that can work with HFS+ file system.Good luck!Please or to join the conversation.