Solved my 2x 12,2 randomly crashing (post
#22761). It was corrupted EFI ME section. Likely got corrupted by using an older SSD these (at least 2011) iMacs don't like. Unfortunately, don't recall which SSD it was (Likely either Samsung 850 PRO or Sandisk X110)
ME (Intel Management Engine) has basic handshaking code with PCH (Platform Controller Hub. Basically the chip between CPU and peripherals) I've heard of these get corrupted before and vaguely recall seeing some info in this thread (maybe early VBIOS dev days had some EFI corruptions?) Here is an outline of the cleaning procedure in case someone runs into this. Again, these iMacs don't like many older SSDs (particularly Samsungs). I've seen a few macOS problems (boot failure, missing files during installation etc) with incompatible SSDs but never one corrupting EFI ME so even after changing to a compatible SSD (WD Blue), failure continued.
Basic Process in Plain English
- Extract the EFI image from flashrom
- Decode the ME version in image
- Extract the image sections and save its “structure” definition (like a table of contents)
- Find original EFI image with clean ME
- Extract RAW clean ME region
- Extract clean ME section
- Replace ME section of image section saved above with clean ME section
- Build new EFI image (with clean ME) using the structure definition saved above
- Flash new EFI image back into EFI flashrom
Here is the same basic info in wiki (no need to de/resolder flashrom chip). My summary below might be closer matched to these iMacs (eg 12,2) with its specific version of ME and tool versions.
We have Apple MacBook and iPhone Diode readings and general fault finding information compiled by the leaders in this area
logi.wiki
Video Reference
This is the video I followed. It's for a newer Mac so different EFI image and tool versions. Video jumps around a lot fairly quickly. Hopefully the list of steps + pics below should be helpful specific to these earlier iMacs.
Seems there are other tools and process to accomplish this same purpose. I'm just outlining what I tried and work for me.
Extract the EFI image from flashrom
Used my trusty CH341A for VBIOS for this same purpose. I think GRML is possible as well.
Windows PC
For most of the steps, I used a Windows PC to follow the video reference
Made a Folder on Desktop called MEClean to put all the EFI images and extracted results. All the downloaded tools (need to be unzipped) are just in Download folder.
Decode the ME version in image
First need to decode ME version to know what version of tools to fetch. Tool is called MEA (ME Analyzer) its now written in python so install process different than the above video
Intel Engine & Graphics Firmware Analysis Tool. Contribute to platomav/MEAnalyzer development by creating an account on GitHub.
github.com
Follow directions in README Section C to install Python and the the 3 modules (using the pip3 command)
I could only get MEA to find my EFI file with full path
My 12,2 (board number 820-2828) EFI looked like this in MEA
Now we know we have ME version 7.0.0.1193 and PCH chipset is CPT (Cougar Point PCH) Also know as 6-Series chipset (Z68 which we will see later). Now need to fetch version 7.x of the ME tools.
Extract the image sections and save its “structure” definition (like a table of contents)
A guide for disabling Intel Management Engine using FPT on PCH SPI - mostav02/Remove_IntelME_FPT
github.com
I used v7 r2.7z since it was the only version 7 for my 7.0.0.1193 ME
There are 2 version of tools in here v7.1.13.1088 and v7.1.60.1191 AND a BIG WARNING file to explain which to try first (1191) and second (1088). 1191 didn't work for me. Get to find out at the very end of the process so have to rewind and redo most of the steps.
Here is the screen loading my EFI image into the 1088 ME tool. Note it detected 6 Series chip on first screen and Z68 on the 2nd screen (First screen also shows Z68 but just leftover from prior run, you probably won't see Z68 on first run)
The ME tool will do 2 things
- Extract and store all the section in a folder. This is done automatically after you open the EFI. It is extracted even if you say quit and don't save (we are depending on this behavior) It is in this folder we overwrite the corrupted ME section with a clean one from original EFI later.
- Write out the "structure" of EFI (kind of like table of contents). We use the structure to reassemble an EFI with cleaned ME later. This is the step where video shows to save the xml file
Finally, your extracted EFI has your Mac's serial number and I think also board ID. This is why you can't just randomly flash in a compatible EFI (unless you know how to patch these)
Find original EFI image with clean ME
I knew my EFI version from examining System Info and watching the High Sierra macOS update version carefully. It was the most updated version for 12,2 (004F B00)
A checklist of the latest EFI firmware versions which should be running on each recent Mac model.
eclecticlight.co
Apple actually have one last EFI update that set the version 87.0.0.0.0 which marks the last EFI version.
Found my EFI with clean ME here ( IM121_004F_00B.scap )
A repo for all Apple EFI firmware files. Contribute to gdbinit/firmware_vault development by creating an account on GitHub.
github.com
Extract RAW clean ME region
UEFI firmware image viewer and editor. Contribute to LongSoft/UEFITool development by creating an account on GitHub.
github.com
I used UEFITool_NE_A73_win64
Extract clean ME section
Use the ME tool to view the raw clean ME section. Me tool will automatically put the extracted clean ME into a folder.
Replace ME section of image section saved above with clean ME section
Replace the ME section from the mac's EFI with this new clean ME. Now the original folder that has all the EFI parts has a new clean ME. All thats left is to rebuild a new flashable EFI image.
Build new EFI image (with clean ME) using the structure definition saved above
Use the original EFI structure file (xml file) to assemble all the EFI parts (including the new clean ME) into a flashrom image.
Note this is when you get to find out if the 1191 or 1088 ME tool works for you. Probably can find out earlier but this is when I found it as I followed the process.
Working Directories
MEClean Directory
- 820-2828.bin is extracted EFI from 12,2
- 820-2828.xml is this EFI's structure
- IM121_004F_00B.scap is EFI containing the clean ME
- Section_Raw_MeRegionUpdateVolume_body.bin is the extracted raw ME
- outimage.bin is the rebuilt EFI with clean ME
Download Directory
=====
iMac is running Unigine Valley rock solid stable for 2+ hours now. Before it would get progressively worse and crash every 10-20s which couldn't even boot. 12,2 + K2000 + WD Blue SSD + macOS Sonoma (last macOS with good performance system menu UI on Kepler GPUs)
=====
Now that I've learned how to modify EFI. Maybe next project is to insert the Enable_GOP driver into EFI so all non original GPUs have boot picker
🙂 I'll document then.