GUIDE: How to get back old EFI after downgrade from Yosemite

[ewbte]

Yosemite also updates your EFI on install, so when you downgrade to previous version of OS X, you still have new "awesome" design in startup manager.

1. You need to download EFI for your mac http://support.apple.com/kb/ht1237 (until they didn't update the page).
2. Be sure you downloaded right EFI, otherwise it could end up bad!
3. Get unpkg http://www.timdoug.com/unpkg/
4. Use unpkg on *.pkg with your EFI, then copy the folder you got to /Applications/Utilities/
5. Open copied folder, find a .scap file.
6. Open terminal, copy there sudo bless -mount / -firmware then press spacebar.
7. Drag .scap file to terminal.
8. Press spacebar and copy --recovery --verbose in terminal.
9. Press enter, type password and press enter again.
10. Shut down your mac from menu, wait until it will turn off.
11. Wait a bit, then turn on your computer but do NOT hold the power button down. The screen will turn black and remain in that state for up to 40 seconds. A gray screen will appear and a status bar indicates the progress of the update.

i.e. for 13-inch rMBP late 2012 I did this:

sudo bless -mount / -firmware /Applications/Utilities/MacBookProRetinaEFIUpdate/System/Library/CoreServices/Firmware\ Updates/MBPRetinaEFIUpdate-1.1/MBP102_0106_B03_LOCKED.scap --recovery --verbose

Notice that terminal dont recognise spacebars in path, add a \ before space between words, like in example I provided.

Do it on your own risk!

Hope you did everything right and enjoy your awesome OS X as nothing happened c:

 

[bravobohan]

No one has mention this before. Thanks. One question is downgrade EFI a must?

 

[ewbte]

No it is not, just in case you don't like black startup manager with newish icons.

 

[knmdk]

Is there anyone who was lucky enough to downgrade EFI Boot ROM firmware on 15-inch MacBook Pro with Retina display (rMBP)?

Here’s my story.

I’m running OS X 10.9.5 (13F1112) (Mavericks) on 15-inch rMBP (Mid 2012, MacBookPro10,1). I never did update to OS X 10.10 or 10.11. However I’ve installed Mac EFI Security Update 2015-001 as it’s description didn’t say about new EFI Boot ROM UI. So now I have that black screen, new icons and fonts in my boot menu (Yosemite or El Capitan style). And since I use boot menu often I feel inconsistency of my laptop. Another issue i my rMBP fans are full speed with the tiny system usage in Windows 7 (a couple of light tabs in Google Chrome and it starts rolling).

I’ve decided to downgrade Boot ROM from MBP101.00EE.B09 (as my System Information and Apple Support article says) to MBP101.00EE.B02 (as this archived Apple Support article says). So I downloaded MacBook Pro Retina EFI Update 1.0 and extracted MBP101_00EE_B02_LOCKED.scap from DMG/PKG using unpkg.

As guides tell (here and here), I did run

sudo bless -mount / -firmware <SCAPFileLocation> --recovery --verbose

Terminal replied everything’s fine (no errors or permission issues). I then shut rMBP down and turned it back on. All it did was 4-5 silent noises and then a normal boot to OS X (however with a bit long loading indicator on the first grey screen). So no EFI Boot ROM firmware being updated indication on grey screen. I did double-check and run

sudo bless -mount / -firmware <SCAPFileLocation> --recovery --setBoot --nextonly --verbose

then

clear ; diskutil mount /dev/disk0s1 ; ls -l /Volumes/EFI/EFI/APPLE/FIRMWARE/ ; diskutil unmount /dev/disk0s1

So in the output I saw the MBP101_00EE_B02_LOCKED.scap file was located on disk0s1 (EFI).

I did a couple of tries more with the same result: 4-5 silent noises and then a normal boot to OS X (takes a while longer than usually).Boot ROM version still same - MBP101.00EE.B09. I then run

sudo diskutil mount /dev/disk0s1 ; sudo rm /Volumes/EFI/EFI/APPLE/FIRMWARE/MBP101_00EE_B02_LOCKED.scap ; sudo diskutil unmount /dev/disk0s1

I did SMC as Apple Support article says and now there’s no delay on first grey screen.

Since this guide clearly states EFI Boot ROM firmware can be downgraded on 13-inch rMBP may someone point me what am I doing wrong to downgrade on 15-inch rMBP? I did a little research on bless command at Mac Developer Library and it seems my command syntax is all good.

 

[chrfr]

Is there anyone who was lucky enough to downgrade EFI Boot ROM firmware on 15-inch MacBook Pro with Retina display (rMBP)?

You should understand that trying to do this is a terrible idea.
You could leave your computer unusable, and you open up the computer to security vulnerabilities. Is it worthwhile to do this for something you see for at most 30 seconds a day? My computers go weeks between reboots, so I cannot understand why you'd care so much about a boot screen.

 

[grahamperrin]

… Is it worthwhile to do this for something you see for at most 30 seconds a day? …

The downgrade was not for booting alone. If I understand correctly, it was also for:

… fans are full speed with the tiny system usage in Windows 7 …

Cross reference: Did Yosemite Update Boot Firmware?

 

[chrfr]

The downgrade was not for booting alone.

The EFI update isn't causing the fans to run fast in Windows. It's CPU load from something else. (...and no, I'm not digging down the rabbit hole of the other thread you're linking here without context.)

 

[knmdk]

Yes I've been experiencing unusual behavior of fans in my rMBP after that Mac EFI Security Update 2015-001. After further attempts I never succeeded downgrading and finally decided to do a clean installation of OS X El Capitan. I'm quite happy with it and laptop feels solid again. However the fans problem when running Boot Camp didn't go away. So I give up for now.

 

[ramzimehana]

Great guide here, however the file I am extracting isn't giving me the same files as you have mentioned here.

Any help would be great, this issue is driving me mad and I have been experiencing it for a few months now, with no work around.

 

[ewbte]

Great guide here, however the file I am extracting isn't giving me the same files as you have mentioned here.

Any help would be great, this issue is driving me mad and I have been experiencing it for a few months now, with no work around.

Hm, I have no idea what you have there. I've done it a couple of times with my mbpr late2012 and mba mid2012, both worked the same way for me.

 

[ScunnerDarkly]

You should understand that trying to do this is a terrible idea.
You could leave your computer unusable, and you open up the computer to security vulnerabilities. Is it worthwhile to do this for something you see for at most 30 seconds a day? My computers go weeks between reboots, so I cannot understand why you'd care so much about a boot screen.

This thread may be 10+ years old but it is still a relevant question.

Reverting firmware isn't a terrible idea if there is a specific need for performing it. Yes, there are associated risks but chances are someone wanting to go down this route will be technically competent enough to understand the hazards.

 

[sanitariu]

Maybe one of the reason is to be able to flash your EFI via software without the need for J6100 cables and other expensive stuff ?

 

[tsialex]

Maybe one of the reason is to be able to flash your EFI via software without the need for J6100 cables and other expensive stuff ?

No, you can't do firmware mods and use Apple efiflasher to flash the SPI flash memory, it validates the BootROM image before flashing it.

Btw, this is a moot point today. Apple now updates the BootROM frequently and automatically.

 

[sanitariu]

According this post:

Do MacBooks support NVMe SSD drives via the use of a Sintech adapter?

My question: Can anyone confirm or disprove the support of NVMe drives (like the Samsung 960) by the Sintech M.2 PCIe SSD MacBook adapters for macOS Sierra and High Sierra, or would you have any

apple.stackexchange.com

It was possible. Maybe it validates on latest MacOS. Maybe good reason to downgrade .... if it is still possible.

 

[tsialex]

According this post:

Do MacBooks support NVMe SSD drives via the use of a Sintech adapter?

My question: Can anyone confirm or disprove the support of NVMe drives (like the Samsung 960) by the Sintech M.2 PCIe SSD MacBook adapters for macOS Sierra and High Sierra, or would you have any

apple.stackexchange.com

It was possible. Maybe it validates on latest MacOS. Maybe good reason to downgrade .... if it is still possible.

Superseded information.

Apple added native NVMe supports for all Macs that are officially supported by High Sierra and can use it, even for Macs that only can boot from Thunderbolt NVMe drives and not internally.

All High Sierra supported Macs that can use NVMe internally or externally via Thunderbolt had BootROM upgrades with High Sierra: all of 2011 line onwards. Mac Pro mid-2010 got NVMe native boot support later, with Mojave firmware upgrades.

Like I posted before, firmware mods to enable hibernation with NVMe blades with MacBooks Air/Pro can't be made with efiflasher.

 

[VinceLx]

Hello,
I am following the procedure from post #1:
- downloaded MBP91.00D3.B0C (2015-002)
- unpacked with unpkg, the folder Mac2015002EFIUpdate is created on the desktop
But when I go in the folder, I see a folder Private, then tmp, then a file called RecoveryUpdatePayload. No file .scap anywhere, even after displaying hidden files (I see the .DS_Store, so should be ok)

How/where can I get this .scap file?

 

[VinceLx]

Hello,
Any help would be helpful. The other option I found is to replace the EFI chip with one containing the old firmware, but I would prefer a clean software solution.

 

[tsialex]

Hello,
Any help would be helpful. The other option I found is to replace the EFI chip with one containing the old firmware, but I would prefer a clean software solution.

Do you know that the moment you boot any macOS release after Sierra the firmware will be updated again automatically?

 

[VinceLx]

Thank you Tsialex.
No, I did not. And this is not important in fact. I just want to run the Blank Board Serializer when booting, so I can insert again the serial number. For some reason it was lost, and for the moment I have no serial number.
This software does not work with the current EFI (229.0.0), it says EFI error.
On the other hand it lauches on the same model (of course it says it works only on machine with no serial, but I least I saw my bootable USB was ok) with EFI MBP91.00D9.B00.
SMS is the same in both machines (2.2f44).
So I wanted to use MBP91.00D3.B0C (2015-002) available from Apple website; but no way to find a .scap file. What do I do wrong?

 

[VinceLx]

By the way I also installed older OS, such as El Capitan and even Mavericks, to run directly the EFI .dmg; but with Mavericks it says I have already the latest firmware. So I am stuck.

 

[tsialex]

Thank you Tsialex.
No, I did not. And this is not important in fact. I just want to run the Blank Board Serializer when booting, so I can insert again the serial number. For some reason it was lost, and for the moment I have no serial number.
This software does not work with the current EFI (229.0.0), it says EFI error.
On the other hand it lauches on the same model (of course it says it works only on machine with no serial, but I least I saw my bootable USB was ok) with EFI MBP91.00D9.B00.
SMS is the same in both machines (2.2f44).
So I wanted to use MBP91.00D3.B0C (2015-002) available from Apple website; but no way to find a .scap file. What do I do wrong?

BBS is totally compatible with current firmwares, your problem is elsewhere, probably a corrupt Fsys store. Fsys store is the third store inside the NVRAM volume and where Apple stores all hardwareIDs except MLB/LBSN and the BuildDate, these two are stored inside the last sector of the SPI flash memory.

Btw, this don't work like you think, .scap is a encapsulated format for Macs that have processors that support IntelME and it's not a binary image of the BootROM like .fd, the NVRAM and MLB sector are not inside it.

After ThunderStrike mitigations were implemented, you can't downgrade at all with Apple's efiflasher. You have to downgrade via external SPI programmer using a previous dump of your whole SPI - BootROM, NVRAM and MLB sector. Even if your Mac used a binary image for firmware upgrades, the .fd firmwares, you can't downgrade via efiflasher, it only accept new firmware releases.

If you are programming it externally, you can modify the NVRAM Fsys store, add the SSN or any other missing hardwareIDs and correct the store checksum hash without the need of BBS at all. You just need to reconstruct the NVRAM volume correctly.

Anyway, I shared everything you need to do. Good luck.

 

[VinceLx]

Wow.
It will take me a while to go through all this, but it seems an interesting digging challenge.
Thanks, now let's see what I can do

 

[Glisseman]

Hello everyone, sorry for my bad English, I am French-speaking and I use google translation.

I came across the forum looking for how to downgrade the EFI firmware to access the Apple Hardware Test or the Apple Diagnostic.

My main problem is similar to that of @VinceLx ; my serial number is missing after the update to Mojave and this, I do not know why. The update to Catalina did not correct the problem.

-I tried to use BBS but without success.
-I tried to boot on an Apple Diag USB key, without success
-I tried to clean install my mac to the original version 10.8, without success.

I am a little lost.
I mainly use my mac at work and on the go and a lot of functions become missing or unusable without Apple recognizing the serial number. (Imessage / FaceTime / Handoff / etc)

I read the post from @tsialex which suggests going external to rebuild NVRAM properly, but I don't know how to do it.

Can you help me with this?

Thank you for your attention

Current config:
MacBook Air 5.2 (mid2012)
MacOS 10.15.4

 

[tsialex]

Hello everyone, sorry for my bad English, I am French-speaking and I use google translation.

I came across the forum looking for how to downgrade the EFI firmware to access the Apple Hardware Test or the Apple Diagnostic.

My main problem is similar to that of @VinceLx ; my serial number is missing after the update to Mojave and this, I do not know why. The update to Catalina did not correct the problem.

-I tried to use BBS but without success.
-I tried to boot on an Apple Diag USB key, without success
-I tried to clean install my mac to the original version 10.8, without success.

I am a little lost.
I mainly use my mac at work and on the go and a lot of functions become missing or unusable without Apple recognizing the serial number. (Imessage / FaceTime / Handoff / etc)

I read the post from @tsialex which suggests going external to rebuild NVRAM properly, but I don't know how to do it.

Can you help me with this?

Thank you for your attention

Current config:
MacBook Air 5.2 (mid2012)
MacOS 10.15.4

Downgrade won't help you at all. You problem is not the EFI Firmware, but the private part of the NVRAM volume where the hardwareIDs are stored and firmware upgrades don't touch. You can downgrade and upgrade forever and it won't repair that area.

The problem is, for successfully repair the Fsys store it involves a lot of firmware deep knowledge that only people that work in the field have. There are lots of hashes to make the volume valid, it's not just an hex edit. To make matters several worse, MBA5,1/5,2 firmware is an encapsulated firmware.

I'm not trying to discourage you, just point to the problem that this is not a simple repair that advanced users can do.

I already showed the road with my posts here, I can't help more than that. Good luck.

 

[Weaselboy]

Moderator Note:

Thread closed as it is no longer relevant. See the information below provided by member @tsialex.

---

The downgrade thread is now useless because when Apple did the ThunderStrike mitigation firmware upgrades, they did two things:

1. Removed the write access to the SPI flash after the kernel is loaded, so only Apple EFIflasher booted from a firmware upgrade temporary image (it's a teardown of the Recovery partition that has the proper handshakes with the SPI) can access it. This makes flashrom/ROMTool useless for writing to the SPI flash memory that contains the EFI Firmware, the NVRAM volume and the BootBlock. Now you can only write to the SPI flash with the Apple firmware updater or an external SPI flash programmer.
2. Apple EFIFlasher now checks the SPI flash if the EFI firmware that you are trying to flash to the SPI flash memory is newer than the version already installed, this removed the serious security failure were you could downgrade the firmware to a version without the mitigation and continue to implant permanent exploits.

So, since the ThunderStrike mitigation firmwares, you can't downgrade an EFI firmware with any Mac with iX processors: most of 2010, all 2011 Macs (except mid-2010/mid-2012 Mac Pro, both are just refreshes of the 2009 Mac Pro platform). If the Mac has native Thunderbolt ports, you can't downgrade the firmware without an external SPI flash programmer.