MP 1,1-5,1 Healthy NVRAM normal behaviour on 4,1->5,1 machines

w1z · Feb 11, 2023

@Macschrauber Many thanks for the latest release 👍

I tried dumping, testing and flashing my cMP's rom, both live and reconstructed (late 2018/early 2019), and your software reported that the rom's Gaid checksum was not correct on both dump versions including the original reconstructed.

I know @tsialex is very meticulous with his rom reconstruction work so could this be a false positive result/reading from your software?

Cheers

w1z · Feb 11, 2023

I just checked the original rom, pre-reconstruction, and the Gaid warning was not there.

@tsialex, could you have possibly missed this?

Thank you

Note: Forgive me as I haven't been on here for a while.. I just realized I posted under the wrong thread ... meant to post it under your bootrom v144 thread.

Macschrauber · Feb 11, 2023

w1z said:
I just checked the original rom, pre-reconstruction, and the Gaid warning was not there.

View attachment 2156963

@tsialex, could you have possibly missed this?

Thank you

Note: Forgive me as I haven't been on here for a while.. I just realized I posted under the wrong thread ... meant to post it under your bootrom v144 thread.

Check it with UefiTool, also send me a copy to double check.

w1z · Feb 11, 2023

Macschrauber said:
Check it with UefiTool, also send me a copy to double check.

Checked with UEFITool, CRC32 is invalid

Will continue this discussion in the bootrom v144 thread and/or via pm.

Thank you.

Macschrauber · Feb 19, 2023

The Dumper has been updated: (18-2-2023)

The hardware descriptor base_xx is reported.
DirectHW.kext has been updated, Yosemite is finally supported, now fully compatible from Mavericks to Ventura. For Yosemite a NVRAM setting (kext-dev-mode=1) is needed to load the kext. This is something like the pre-stage of s.i.p. and set by the dumper on request. Thanks @joevt and @startergo for rebuilding DirectHW.kext.
In Catalina an incorrect warning was reported: "This Mac is enrolled in a DEP Management", is fixed.
For Syncretic's Boot Rom Mods an incorrect error message was issued by Scanvss and commented accordingly, is fixed.
EnableGop injection in the firmware 144.0.0.0 is detected and _gop is set in the filename after the firmware version to make it easier to distinguish.
In the included ESP tools the physical position is indicated for >tag ESP< as far as possible.

Some examples for ESP tags:

Code:

Internal        OWC Aura SSD
DVD Bay B (Lower)        WDC WD2500JS-41SGB0
External (FireWire)        LaCie
External (USB)        5ASG
SATA Bay 3        ST1000DM003-1ER162
SATA Bay 1        Samsung SSD 850 PRO 256GB

actual screenshot:

Screen Sharing Picture 19. February 2023 at 17.56.14 CET.png

The links:

Healthy NVRAM normal behaviour on 4,1->5,1 machines

Macschrauber's Rom Dump I needed to encrypt the disk image as DropBox has flagged it for containing Flashrom. The password is rom. What's new in the latest versions: Update from 20-2-2024 -> checking Fsys for missing items or wrong order sometimes they get into the wrong order or items...

forums.macrumors.com

Macschrauber · Feb 25, 2023

The Dumper has been updated: (25-2-2023)

It's reporting Enable GOP (including version, if given) and Syncretic's PiquaBoot extensions
It includes UEFIextract, so it also goes thru the whole rom dump and reports if anywhere in the file is a wrong CRC32 checksum.

It takes a little longer to read those roundabout 180 checksums but that's worth it.

The Dumper refuses to flash a rom file with a single broken checksum of course. Not every broken checksum leads to a brick but we better be too careful in case.

those screenshots but the last have the version / date number 18-2, the dumper package has 25-2-2023
the rom file in the last screenshot was never booted so it contains no variables.

the links:

Healthy NVRAM normal behaviour on 4,1->5,1 machines

Macschrauber's Rom Dump I needed to encrypt the disk image as DropBox has flagged it for containing Flashrom. The password is rom. What's new in the latest versions: Update from 20-2-2024 -> checking Fsys for missing items or wrong order sometimes they get into the wrong order or items...

forums.macrumors.com

Macschrauber · Mar 12, 2023

Dumper update: (11-03-2023):

-> old firmware versions like MP51.0089.B00 are displayed as usual, not with the $IBIOSI$ entry

the old versions are displayed correctly in the filename. Example: CKxxxx.EUG_MP51.0089.B00_ ...
Mac Pro 4.1 firmware versions are also shown and named in detail. Before it was MP41*
this concerns dumping as well as saving the previous firmware version when flashing

firmwares with the new naming get their last .0 (144.0.0.0 -> 144.0.0.0.0)
the latter is an embarrassing slip, overlooked for years, you can see how the autocorrection of the Macschrauber's brain works unintentionally

Xserve 2,1 (about Mac Pro 3,1) and
Xserve 3,1 (in about Mac Pro 4,1) firmwares are read. This is still experimental, need dumps and testers.

The test_nvram shell script which goes through the firmware in the background can now analyze 8MB firmwares like the ones from my MacBook Pro Late 2013, again I need more dumps and testers. I can't and don't want to extend the dumper for other Macs at all, but where that doesn't make a lot of effort the dumper may read at least limited.

(who can help with dumps from other Macs would like to send me a conversation, I don't want to blow up the thread unnecessarily)

the link:

Healthy NVRAM normal behaviour on 4,1->5,1 machines

Macschrauber's Rom Dump I needed to encrypt the disk image as DropBox has flagged it for containing Flashrom. The password is rom. What's new in the latest versions: Update from 20-2-2024 -> checking Fsys for missing items or wrong order sometimes they get into the wrong order or items...

forums.macrumors.com

Macschrauber · Mar 19, 2023

Dumper update (19-03-2023)

-> generic reading of other Macs than Mac Pro 4.1/5.1 with Flash ICs supported by Flashrom is added

Mac Pro 1.1 and 2.1 are read out
Xserve 1,1 to 3,1 are read out

Under the hood a lot has been changed in the shell script.
More alarms like problems in the Fsys stream when UefiExtract cannot take it apart are added.

If something is problematic in other firmwares or not I can't judge. I don't have the experience and especially the hardware.

I ask for the dumper logfiles of -non-Mac Pro models-. Successfully read out or not to improve the dumper.

Ihr persönlicher Freigabelink | GMX Cloud

Mit diesem Link erhalten Sie Zugriff auf die mit Ihnen geteilten Daten.

c.gmx.net

Macschrauber · Mar 26, 2023

Macschrauber's Rom Dump

I needed to encrypt the disk image as DropBox has flagged it for containing Flashrom.
The password is rom.

One could have the (false) damaged app warning:

"RomDump Macschrauber.app"
is damaged and can't be opened.
You should eject the disk image.

View attachment 2235498

This is due to some browsers set the quarantine flag for Flashrom.

What is no malware of course but in the wrong hands Flashrom could make serious damage.

Solution 1:

a) Download via github by the github downloader:
https://github.com/Macschrauber/Mac...d/Release/Download.the.Dumper.from.github.zip
also attached to this post

or

b) Download the dmg directly via curl by the dropbox downloader:
https://www.dropbox.com/s/t5k7j4gxj8n9pj2/Download Macschrauber's CMP Rom Dump.zip?dl=1

or

c) Download via a gmx site by the gmx downloader:
https://c.gmx.net/@899644307915413392/4UCGnzAXT4K4_OChzxuBrg

Those downloaders download the dmg, and copy it to "Downloads/Macschrauber's Rom Dump" and set the xprotect flags if needed.

Also they check and adjust the flags for an already downloaded dmg.

Solution 2:

Run the attached repair scripts, one for just the App, one for the folder.
You need to copy the dumper / the tools somewhere as the disk image is write protected.
You will find it on the end of this post.

The repair script also can get protection (is damaged). To solve this you can enter for the default location (userfolder/downloads) xattr -dr com.apple.quarantine $HOME/Downloads/"Is damaged fix"/*

Solution 3:

copy the .app into Utilities (for example)

For Utilities type or copy/paste this line in the Terminal app:

xattr -dr com.apple.quarantine /Applications/Utilities/RomDump\ Macschrauber.app

Now also on Github https://github.com/Macschrauber/Macschrauber-s-Rom-Dump
(there is the most detailed and recent information)

What's new in the latest versions:

Update from 19-10-2024

https://forums.macrumors.com/threads/healthy-nvram-normal-behaviour-on-4-1-5-1-machines.2333460/post-33500100

Update from 1-9-2024

https://forums.macrumors.com/threads/healthy-nvram-normal-behaviour-on-4-1-5-1-machines.2333460/post-33367123

Update from 5-8-2024

https://forums.macrumors.com/threads/healthy-nvram-normal-behaviour-on-4-1-5-1-machines.2333460/post-33300095

Update from 5-5-2024

-> presenting CSR values for s.i.p / rootless flags
like: csr_Allow_Untrusted_Kexts, Unrestricted_FS, Task_For_Pid, Apple_Internal, Unrestricted_Dtrace, Unrestricted_NVRAM (0x77)

-> warn for unusual var headers
like state: 0x00 or 0xff and size: 0xff

-> presenting nvda_drv=1 variable

-> presenting efi-boot-device-data variable

-> the log shows a platform compatibility test for the helper tools

fixed: security mode=none presented an alarm, tho this setting is useless it must not show a warning

Update from 21-4-2024

-> analyzing `.scap`files
Those are proprietary firmware capsules used by Apple to securely package and distribute firmware updates.

-> revisited the display of the NVRAM variables to
example: 1 (5 deleted) MemoryConfigg

-> showing some more NVRAM variables:
recover-boot-mode
sleepwake_diagxx
SleepWakeFailureString
StartupMute and SystemAudioVolume for detecting no audible boot chime

-> wildcards for the test_nvram_shell script. Like [test_nvram *.bin -showallvars]

-> multiple CRC32 errors got all UUIDs displayed

-> added an option for ESP Mount from list and show bootloader to prevent booting of Uefi Windows
If started on a Mac Pro 1,1 to 5,1 unit it allows the user to rename bootx64.efi to bootx64.efioff to
prevent direct booting of Uefi Windows in its ESP by request.

-> a 2nd variant of the LBSN Sector for MP41 is detected

-> -nofreshdump argument for test_nvram and adding this for analysing ch341a dumps
as a readout of a chip in the programmer could not be treated same for live diagnostics.

also a fix for Type_80 firmwares what have more than one Fsys stream in the NRAM Volume, reporting FSys variables order

-> analysing .dump files eficheck creates for sending them without user data (Fsys stream) to Apple
My Mac Mini 7,1 creates a 6 MB file, I would need more examples of other sizes

-> adding a line when OpenCore is running during storing the dump

-> showing MP41 or MP51 backplane type and generation

-> checking Fsys for missing items or wrong order
sometimes they get into the wrong order or items are missing, leading to problems with machine identification
example: Fsys: 0 overrides, 1 override-version, 2 ssn, 3 EOF (son, hwc is missing)

-> one Dialog with up to 4 buttons, scrollable analyze dialog
10.7-10.9 still has the classic look, 10.10 to Catalina horizontal buttons, Big Sur to Sonoma vertical buttons

-> LBSN check for wrong jump points after MP4,1 -> MP5,1 manual conversion and v. v.
If someone tries to inject a Mac Pro 4,1 LBSN/BD sector into a Mac Pro 5,1 firmware the Dumper informs and stops before flashing this gives a brick. Also vice versa, if someone downgrades a Mac Pro 5,1 to Mac Pro 4,1 incorrectly.

-> The ESP / Preboot Tools were polished

-> Additional conditions for missing user privileges

-> more logging / progress bar information

-> technically invalid serial numbers are reported

-> some bugs were fixed, ESP Label works for UEFI Windows,

the Dumper had a bug in V4-2-2024 what prevented starting in 10.9 to 10.7, some ESP Tools were also fixed for working in those earlier OS'.

Also fixed a bug, stopping the script when using the CH341a programmer with a misnamed variable.

In V2-3-2024 a glitch was fixed when the font "Courier New" was missing it prevents displaying the analyse dialog.

In V10-3-2024 fixed checking a file with unsupported file size resulted in a script error, that error come with V2-3-2024.
Also error correction in the Is damaged fix tool due to a typo in a version comment.

Update from 23-1-2024

-> Dumps and logfiles get their own folder for every dump
Like ~/Downloads/Macschrauber's Rom Dump 23.01.2024_00-43-43/

silently changed it, as the Dumper could be used to test dumps or to flash, so the previous folder naming was not accurate

-> Revisited most of the ESP Tools and done a new tool: Preboot fixer and renamer
This is for the mess unprotected High Sierra boots does with Catalina and newer.
It can also be used to just rename the icons shown in Boot Picker and OpenCore. Even with multiple lines.
Thanks to @joevt, here for all the the help and with building the icons.
High-sierra-booting-possibly-corrupts-newer-systems-fix-and-description

Update from 23-12-2023

-> showing firmware programming mode [ ] [off] [on]
The Dumper checks for firmware programming mode on compatible units (MacPro 4,1/5,1). It does this during reading/flashing or directly, when the password is stored encrypted by a CLI tool in the Other Tools folder.

(Firmware programming mode is initiated by pressing the power button until a long tone and blinking power LED appear when starting the box.)

I don't want the user to give access to the keychain or to bother him with passwords before the Dumper initiates any visible actions.

-> Wrapped the Dumper into a loop, does not end directly after flashing / dumping.

Fixes:
- if the user's Downloads folder is not available it prompts for another
- The scanvss log filename had the spoofed firmware version in, now it's the real firmware version

Update from 10-12-2023

-> detecting Nvidia Chipsets to report long readout duration
Macs with Nvidia chipsets (MCP79 / MCP89 built around 2009) could take about 5 minutes to read the firmware

-> Multiple flash chip definitions for dumping with the shell script
it prompts for the chip of a Mac whose spi data is not captured (yet) if Flashrom returns more than one type

-> checking Bootblock vectors for rebuilds, showing Fsys header type after base_xx

-> emergency stop if one tries to flash a firmware from another Mac model in a MP 4,1/5,1
exits if the pre-flashing information readout is ignored

-> reading MBP54 and MBP91, updated some chip definitions for other models

-> added a copy ESP script to the ESP tools
Post in thread 'Manually Configured OpenCore on the Mac Pro'

Update from 18-11-2023

-> -vars argument to the shell script
Displays all variables of the nvram stream, including Fsys, Gaid, VSS1, VSS2, SVS1, SVS2. Plain text displaying of the hardware descriptor (base_xx text), IASInstallPhaseList, and the LBSN / BD sector.

But never post such a detailed dump to public sources. The dump, and the big report contains loads of personal and machine data. So again: never, ever post that shell script report!

-> -hexdump argument to the shell script
Displays the most important variables and checks the checksums for post-2012 firmwares.

-> Dynamically finding the lbsn sector, displaying the hexdump of it in the shell script.

-> iCloud lock detection, displaying the stored text shown to the finder in the CLI tool

-> More details for Microsoft Windows certificates

-> MacBook Pro 8,1 dumping. Mac Pro 6.1 got a 2nd spi flash chip type.

-> Scanvss log files for "Scanvss semi-compatible" firmwares
Some firmwares could not be decoded by Scanvss if the whole dump is given, but the extracted NVRAM Volume.

-> rename Preboot
A little script to rename .contentDetails of a Preboot APFS Volume. Sometimes the Names are not updated and the script allows you to rename the name a bootloader shows.

Fixes:
- Battery-health for type 00 firmwares is working.

Hardware-Descriptor (base_xx)

Code:

-------------------------------------------------------------------
4 Fsys store/0 overrides
-------------------------------------------------------------------
Type: Fsys entry
Subtype: Normal
Fixed: Yes
Base: 14800Bh
Header address: FFD4800Bh
Data address: FFD48017h
Offset: Bh
Full size: 67Fh (1663)
Header size: Ch (12)
Body size: 673h (1651)
===================================================================
00000000: 096f 7665 7272 6964 6573 7306            .overridess.
overridess
-------------------------------------------------------------------
ADD_DEVICE    ()    [class="USBPort",type="USB 2.0",location="top-front",speed="480",uhci-id="0x5d100000",ehci-id="0xfd500000"]
ADD_DEVICE    ()    [class="USBPort",type="USB 2.0",location="bottom-front",speed="480",uhci-id="0x3a200000",ehci-id="0xfa400000"]
ADD_DEVICE    ()    [class="USBPort",type="USB 2.0",location="right-rear",speed="480",uhci-id="0x3d100000",ehci-id="0xfd300000"]
ADD_DEVICE    ()    [class="USBPort",type="USB 2.0",location="center-rear",speed="480",uhci-id="0x1a200000",ehci-id="0xfa200000"]
ADD_DEVICE    ()    [class="USBPort",type="USB 2.0",location="left-rear",speed="480",uhci-id="0x1d100000",ehci-id="0xfd100000"]
ADD_DEVICE    ()    [class="FireWirePort",location="rear-right",max-speed="800",port-id="0x01",phy-id="0x00"]
ADD_DEVICE    ()    [class="FireWirePort",location="rear-left",max-speed="800",port-id="0x02",phy-id="0x00"]
ADD_DEVICE    ()    [class="FireWirePort",location="front-top",max-speed="800",port-id="0x01",phy-id="0x01"]
ADD_DEVICE    ()    [class="FireWirePort",location="front-bottom",max-speed="800",port-id="0x02",phy-id="0x01"]
SET_PROPERTY    (class="Processor")    [max-prochots="10000",ptype="iCore7"]
SET_PROPERTY    (class="Sensor"&location="ICAC")    [low-limit="0.1",high-limit="140",type="Current",description="CPU A, Core Low Side (Vcore) Current"]
SET_PROPERTY    (class="Sensor"&location="ICBC")    [low-limit="0.1",high-limit="140",type="Current",description="CPU B, Core Low Side (Vcore) Current"]
SET_PROPERTY    (class="Sensor"&location="Ie1S")    [low-limit="0",high-limit="18",type="Current",description="PCIe Slot 1, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="Ie2S")    [low-limit="0",high-limit="18",type="Current",description="PCIe Slot 2, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="Ie3S")    [low-limit="0",high-limit="18",type="Current",description="PCIe Slot 3, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="Ie4S")    [low-limit="0",high-limit="18",type="Current",description="PCIe Slot 4, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="IeAS")    [low-limit="0",high-limit="18",type="Current",description="PCIe BoostA, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="IeBS")    [low-limit="0",high-limit="18",type="Current",description="PCIe BoostB, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="IH1Z")    [low-limit="0",high-limit="2",type="Current",description="HDD1, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="IH2Z")    [low-limit="0",high-limit="2",type="Current",description="HDD2, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="IH3Z")    [low-limit="0",high-limit="2",type="Current",description="HDD3, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="IH4Z")    [low-limit="0",high-limit="2",type="Current",description="HDD4, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="IO0Z")    [low-limit="0",high-limit="3",type="Current",description="ODD, 12V Current"]
SET_PROPERTY    (class="Sensor"&location="IH5Z")    [low-limit="0",high-limit="12",type="Current",description="HDD+ODD, 5V Current"]
SET_PROPERTY    (class="Sensor"&location="IMAS")    [low-limit="0.1",high-limit="50",type="Current",description="DIMM, PP1V5_S3_MEMA Current"]
SET_PROPERTY    (class="Sensor"&location="IMBS")    [low-limit="0.1",high-limit="50",type="Current",description="DIMM, PP1V5_S3_MEMB Current"]
SET_PROPERTY    (class="Sensor"&location="IN0C")    [low-limit="1",high-limit="40",type="Current",description="IOH Core, PP1V1_S0_IOH Northbridge Current"]
SET_PROPERTY    (class="Sensor"&location="Ip0C")    [low-limit="1",high-limit="80",type="Current",description="PSU, 12V Current (PSMI)"]
SET_PROPERTY    (class="Sensor"&location="ICAB")    [low-limit="0.1",high-limit="40",type="Current",description="PVTT, CPUA Current"]
SET_PROPERTY    (class="Sensor"&location="ICBB")    [low-limit="0.1",high-limit="40",type="Current",description="PVTT, CPUB Current"]
SET_PROPERTY    (class="Sensor"&location="IS1C")    [low-limit="0.25",high-limit="5.0",type="Current",description="PP1V05_S0_SB Current"]
SET_PROPERTY    (class="Sensor"&location="IS2C")    [low-limit="0.25",high-limit="2.3",type="Current",description="PP1V5_S0_SB Current"]
SET_PROPERTY    (class="Sensor"&location="Ip1M")    [low-limit="0.5",high-limit="18",type="Current",description="PP12V_S0 CPUA 240VA Main Current"]
SET_PROPERTY    (class="Sensor"&location="Ip2M")    [low-limit="0",high-limit="18",type="Current",description="PP12V_S0 CPUB 240VA Main Current"]
SET_PROPERTY    (class="Sensor"&location="Ip3M")    [low-limit="0.5",high-limit="18",type="Current",description="PP12V_S0 MEMA 240VA Main Current"]
SET_PROPERTY    (class="Sensor"&location="Ip4M")    [low-limit="0",high-limit="18",type="Current",description="PP12V_S0 MEMB 240VA Main Current"]
SET_PROPERTY    (class="Sensor"&location="Ip5M")    [low-limit="1",high-limit="18",type="Current",description="PP12V_S0 MLB1 240VA Main Current"]
SET_PROPERTY    (class="Sensor"&location="Ip6M")    [low-limit="1",high-limit="18",type="Current",description="PP12V_S0 MLB2 240VA Main Current"]
SET_PROPERTY    (class="Sensor"&location="Ip7M")    [low-limit="0",high-limit="18",type="Current",description="PP12V_S0 PCIE1 240VA Main Current"]
SET_PROPERTY    (class="Sensor"&location="Ip8M")    [low-limit="0",high-limit="18",type="Current",description="PP12V_S0 PCIE2 240VA Main Current"]
SET_PROPERTY    (class="Sensor"&location="TA0P")    [low-limit="5",high-limit="45",type="Temperature",description="System Ambient Temperature"]
SET_PROPERTY    (class="Sensor"&location="TCAC")    [low-limit="1",high-limit="85",type="Temperature",description="CPU A, Core 0 Relative Temperature to ProcHot (PECI)"]
SET_PROPERTY    (class="Sensor"&location="TCAD")    [low-limit="5",high-limit="95",type="Temperature",description="Temperature, CPU A Tdiode"]
SET_PROPERTY    (class="Sensor"&location="TCBC")    [low-limit="1",high-limit="85",type="Temperature",description="CPU B, Core 0 Relative Temperature to ProcHot (PECI)"]
SET_PROPERTY    (class="Sensor"&location="TCBD")    [low-limit="5",high-limit="95",type="Temperature",description="Temperature, CPU B Tdiode"]
SET_PROPERTY    (class="Sensor"&location="TCAH")    [low-limit="5",high-limit="85",type="Temperature",description="CPU A, HeatSink Temperature"]
SET_PROPERTY    (class="Sensor"&location="TCBH")    [low-limit="5",high-limit="85",type="Temperature",description="CPU B, HeatSink Temperature"]
SET_PROPERTY    (class="Sensor"&location="TH1P")    [low-limit="5",high-limit="50",type="Temperature",description="Drive Bay 1, HDD Temperature (On Drive Carrier)"]
SET_PROPERTY    (class="Sensor"&location="TH2P")    [low-limit="5",high-limit="50",type="Temperature",description="Drive Bay 2, HDD Temperature (On Drive Carrier)"]
SET_PROPERTY    (class="Sensor"&location="TH3P")    [low-limit="5",high-limit="50",type="Temperature",description="Drive Bay 3, HDD Temperature (On Drive Carrier)"]
SET_PROPERTY    (class="Sensor"&location="TH4P")    [low-limit="5",high-limit="50",type="Temperature",description="Drive Bay 4, HDD Temperature (On Drive Carrier)"]
SET_PROPERTY    (class="Sensor"&location="TM1P")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM Proximity 1 Temperature (On Riser)"]
SET_PROPERTY    (class="Sensor"&location="TM2P")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM Proximity 2 Temperature (On Riser)"]
SET_PROPERTY    (class="Sensor"&location="TM3P")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM Proximity 3 Temperature (On Riser)"]
SET_PROPERTY    (class="Sensor"&location="TM4P")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM Proximity 4 Temperature (On Riser)"]
SET_PROPERTY    (class="Sensor"&location="TM5P")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM Proximity 5 Temperature (On Riser)"]
SET_PROPERTY    (class="Sensor"&location="TM6P")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM Proximity 6 Temperature (On Riser)"]
SET_PROPERTY    (class="Sensor"&location="TM7P")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM Proximity 7 Temperature (On Riser)"]
SET_PROPERTY    (class="Sensor"&location="TM8P")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM Proximity 8 Temperature (On Riser)"]
SET_PROPERTY    (class="Sensor"&location="TMA1")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM, CPUA, SLOT1, CHA - SPD Temperature"]
SET_PROPERTY    (class="Sensor"&location="TMA2")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM, CPUA, SLOT2, CHB - SPD Temperature"]
SET_PROPERTY    (class="Sensor"&location="TMA3")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM, CPUA, SLOT3, CHC - SPD Temperature"]
SET_PROPERTY    (class="Sensor"&location="TMA4")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM, CPUA, SLOT4, CHC - SPD Temperature"]
SET_PROPERTY    (class="Sensor"&location="TMB1")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM, CPUB, SLOT5, CHA - SPD Temperature"]
SET_PROPERTY    (class="Sensor"&location="TMB2")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM, CPUB, SLOT6, CHB - SPD Temperature"]
SET_PROPERTY    (class="Sensor"&location="TMB3")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM, CPUB, SLOT7, CHC - SPD Temperature"]
SET_PROPERTY    (class="Sensor"&location="TMB4")    [low-limit="5",high-limit="80",type="Temperature",description="DIMM, CPUB, SLOT8, CHC - SPD Temperature"]
SET_PROPERTY    (class="Sensor"&location="TN0D")    [low-limit="5",high-limit="95",type="Temperature",description="Temperature, IOH Tdiode"]
SET_PROPERTY    (class="Sensor"&location="TN0H")    [low-limit="5",high-limit="75",type="Temperature",description="IOH, HeatSink Temperature"]
SET_PROPERTY    (class="Sensor"&location="Tp0C")    [low-limit="5",high-limit="100",type="Temperature",description="PS, AC/DC Supply Temperature 1"]
SET_PROPERTY    (class="Sensor"&location="Tp1C")    [low-limit="5",high-limit="100",type="Temperature",description="PS, AC/DC Supply Temperature 2"]
SET_PROPERTY    (class="Sensor"&location="Te1S")    [low-limit="5",high-limit="95",type="Temperature",description="PCIE slot 1 Temperature"]
SET_PROPERTY    (class="Sensor"&location="Te2S")    [low-limit="5",high-limit="95",type="Temperature",description="PCIE slot 2 Temperature"]
SET_PROPERTY    (class="Sensor"&location="Te3S")    [low-limit="5",high-limit="95",type="Temperature",description="PCIE slot 3 Temperature"]
SET_PROPERTY    (class="Sensor"&location="Te4S")    [low-limit="5",high-limit="95",type="Temperature",description="PCIE slot 4 Temperature"]
SET_PROPERTY    (class="Sensor"&location="Te5S")    [low-limit="5",high-limit="95",type="Temperature",description="PCIE RAID card Temperature"]
SET_PROPERTY    (class="Sensor"&location="VCAC")    [low-limit="0.6",high-limit="1.3",type="Voltage",description="CPU A, Core Voltage"]
SET_PROPERTY    (class="Sensor"&location="VCBC")    [low-limit="0.6",high-limit="1.3",type="Voltage",description="CPU B, Core Voltage"]
SET_PROPERTY    (class="Sensor"&location="Ve1S")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="PCIe Slot 1, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="Ve2S")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="PCIe Slot 2, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="Ve3S")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="PCIe Slot 3, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="Ve4S")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="PCIe Slot 4, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VeAS")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="PCIe BoostA, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VeBS")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="PCIe BoostB, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VH1Z")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="HDD1, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VH2Z")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="HDD2, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VH3Z")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="HDD3, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VH4Z")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="HDD4, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VO0Z")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="ODD, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VH5Z")    [low-limit="4.5",high-limit="5.5",type="Voltage",description="HDD+ODD, 5V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VM1S")    [low-limit="1.43",high-limit="1.57",type="Voltage",description="PP1V5_S3_MEMA Voltage"]
SET_PROPERTY    (class="Sensor"&location="VM2S")    [low-limit="1.43",high-limit="1.57",type="Voltage",description="PP1V5_S3_MEMB Voltage"]
SET_PROPERTY    (class="Sensor"&location="VN0C")    [low-limit="1.07",high-limit="1.13",type="Voltage",description="PP1V1_S0_IOH Northbridge Voltage"]
SET_PROPERTY    (class="Sensor"&location="Vp0C")    [low-limit="11.4",high-limit="12.6",type="Voltage",description="PSU, 12V Voltage"]
SET_PROPERTY    (class="Sensor"&location="VCAB")    [low-limit="1.00",high-limit="1.30",type="Voltage",description="PPVTT_S0_CPUA Voltage"]
SET_PROPERTY    (class="Sensor"&location="VCBB")    [low-limit="1.00",high-limit="1.30",type="Voltage",description="PPVTT_S0_CPUB Voltage"]
SET_PROPERTY    (class="Sensor"&location="VS1C")    [low-limit="1.00",high-limit="1.10",type="Voltage",description="PP1V05_S0_SB Voltage"]
SET_PROPERTY    (class="Sensor"&location="VS2C")    [low-limit="1.43",high-limit="1.58",type="Voltage",description="PP1V5_S0_SB Voltage"]
SET_PROPERTY    (class="Sensor"&location="VS8C")    [low-limit="3.14",high-limit="3.47",type="Voltage",description="PP3V3_S5 Voltage"]
REMOVE_DEVICE    (class="Sensor")    (class="Sensor"&type="?")
REMOVE_DEVICE    !(class="Processor"&location="1")    (class="Sensor"&location="VCBB")
REMOVE_DEVICE    !(class="Processor"&location="1")    (class="Sensor"&location="VCBC")
REMOVE_DEVICE    !(class="Processor"&location="1")    (class="Sensor"&location="ICBB")
REMOVE_DEVICE    !(class="Processor"&location="1")    (class="Sensor"&location="ICBC")
REMOVE_DEVICE    !(class="Processor"&location="1")    (class="Sensor"&location="IMBS")
REMOVE_DEVICE    (class="Memory"&location="DIMM 1"&ecc="FALSE")    (class="Sensor"&location="TMA1")
REMOVE_DEVICE    (class="Memory"&location="DIMM 2"&ecc="FALSE")    (class="Sensor"&location="TMA2")
REMOVE_DEVICE    (class="Memory"&location="DIMM 3"&ecc="FALSE")    (class="Sensor"&location="TMA3")
REMOVE_DEVICE    (class="Memory"&location="DIMM 4"&ecc="FALSE")    (class="Sensor"&location="TMA4")
REMOVE_DEVICE    (class="Memory"&location="DIMM 5"&ecc="FALSE")    (class="Sensor"&location="TMB1")
REMOVE_DEVICE    (class="Memory"&location="DIMM 6"&ecc="FALSE")    (class="Sensor"&location="TMB2")
REMOVE_DEVICE    (class="Memory"&location="DIMM 7"&ecc="FALSE")    (class="Sensor"&location="TMB3")
REMOVE_DEVICE    (class="Memory"&location="DIMM 8"&ecc="FALSE")    (class="Sensor"&location="TMB4")
===================================================================

-------------------------------------------------------------------
4 Fsys store/1 override-version
-------------------------------------------------------------------
Type: Fsys entry
Subtype: Normal
Fixed: Yes
Base: 14868Ah
Header address: FFD4868Ah
Data address: FFD4869Dh
Offset: 68Ah
Full size: 1Bh (27)
Header size: 13h (19)
Body size: 8h (8)
===================================================================
00000000: 106f 7665 7272 6964 652d 7665 7273 696f  .override-versio
00000010: 6e08 00                                  n..
override-version
-------------------------------------------------------------------
00000000: 4261 7365 5f32 3100                      Base_21.
Base_21
===================================================================

IASInstallPhaseList

Code:

-------------------------------------------------------------------
0 VSS store/97 IASInstallPhaseList
-------------------------------------------------------------------
Type: VSS entry
Subtype: Standard
Text: IASInstallPhaseList
Fixed: Yes
Base: 12D8F1h
Header address: FFD2D8F1h
Data address: FFD2D939h
Offset: D8A9h
Variable GUID: 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14
Full size: 280h (640)
Header size: 48h (72)
Body size: 238h (568)
State: 7Fh
Reserved: 00h
Attributes: 00000007h (NonVolatile, BootService, Runtime)
===================================================================
00000000: aa55 7f00 0700 0000 2800 0000 3802 0000  .U......(...8...
00000010: 05de 1e4d c738 6a4a 9cc6 4bcc a8b3 8c14  ...M.8jJ..K.....
00000020: 4900 4100 5300 4900 6e00 7300 7400 6100  I.A.S.I.n.s.t.a.
00000030: 6c00 6c00 5000 6800 6100 7300 6500 4c00  l.l.P.h.a.s.e.L.
00000040: 6900 7300 7400 0000                      i.s.t...
U(8M8jJKIASInstallPhaseList
-------------------------------------------------------------------
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<array>
<dict>
<key>ConclusionDelay</key>
<integer>0</integer>
<key>InstallPhase</key>
<string>Boot 1</string>
<key>InstallPhasePercentageKey</key>
<integer>58</integer>
</dict>
<dict>
<key>ConclusionDelay</key>
<integer>0</integer>
<key>InstallPhase</key>
<string>Language Chooser</string>
<key>InstallPhasePercentageKey</key>
<integer>42</integer>
</dict>
</array>
</plist>
===================================================================

LBSB / BD Sector

Code:

-------------------------------------------------------------------
LBSN sector
-------------------------------------------------------------------
Type: Section
Subtype: Raw
Fixed: No
Base: 3FFEF0h
Header address: FFFFFEF0h
Data address: FFFFFEF4h
Offset: E90h
Type: 19h
Full size: 110h (272)
Header size: 4h (4)
Body size: 10Ch (268)
===================================================================
00000000: 1001 0019                                ....
-------------------------------------------------------------------
00000000: 0000 0000 0000 0000 0000 0000 ea78 ca39  .............x.9
00000010: 2664 848b xxxx xxxx xxxx xxxx xxxx xxxx  &d..J5xxxxxxxxxx
00000020: 4120 2020 2020 ffff ffff ffff ffff ffff  A     ..........
00000030: ffff ffff ffff ffff ffff ffff ffff ffff  ................
*
00000050: ffff ffff ffff ffff ffff ffff xxxx xxxx  ............xxxx
00000060: xxxx xxxx xxxx xxxx xxxx xxxx 0fff ffff  xxxxxxxx........
00000070: ffff ffff ffff ffff ffff ffff 01ff ffff  ................
00000080: ffff ffff ffff ffff ffff ffff 0000 0000  ................
00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
*
000000d0: 0000 0000 0000 0000 0000 0000 bf50 41eb  .............PA.
000000e0: 1d00 0000 0000 0000 0000 0000 ffff ffff  ................
000000f0: ffff ffff ffff ffff e802 ffff 0f09 e9fb  ................
00000100: f200 0000 7856 3412 0000 ffff            ....xV4.....
x9&dJxxxxxxxxBH9A     xxxxxxxxxxxxxPAxV4
===================================================================

Update from 22-10-2023

-> Find my Mac detection
The dumper provides information that Find my Mac is activated. This can be important when buying a used device.
Only the shell script provides the configured text output from a Find my Mac lock. Since these texts often contain private data such as phone numbers or email addresses, there is no output in the dumper.

-> The collection of changing NVRAM states is supported.
You can either add your Shasum encrypted serial number to the shell script or provide an argument
-gathernvram.vol. If that argument is given, or you added the encoded serial number of your Mac to the shell script, the Dumper stores (to spare storage space) just the NVRAM volume of the dump to a pre configured folder "All_Nvrams" in your home folder.

fixes:
- Some newer Macs' firmware (approximately from 2013 onwards) have a variable of the old (up to around 2013) type 00. I have revised the detection logic to avoid incorrect classification.

Update from 12-10-2023

-> NVRAM Volume Detection:
The shell script dynamically identifies the NVRAM volume position and offsets. In theory, this means that all Mac Firmwares could be decoded.
-> Dumping Mac Mini 7,1 for the Dumper and shell script
-> ESP Tools: Added a script to automatically label ESPs for the boot picker based on the found bootloader flavor

fixes:
- An error occurred when running Yosemite, and the absence of bootarg: kext-dev-mode=1 prevented the loading of DirectHW.kext, leading to a missing variable.
- An older OS like Yosemite truncated the firmware version, causing the shell script to display a spoofed firmware.
- A glitch related to logging prevented the selection of multiple found flash chips on untested Macs.

Update from 8-10-2023

-> showing the OpenCore spoofed firmware string (only for fresh dumps possible)
-> counting Microsoft Uefi variables
-> dumping: iMac 11,1, iMac 11,2
-> added a tool to rename ESPs (bootloaders like OC) shown in the boot picker

details: https://forums.macrumors.com/thread....2207814/page-520?post=32382081#post-32382081

analyzing MBP61, MBP62, IM112, IM113 to shell script

workaround for deeper analysing units with Scanvss where Scanvss could not scan the dump file directly:
IM112, IM113, IM121, MBP61, MBP62, MBP81, MBP82, MBA41, MBA42, MM51

fixed: infinite loop in the shell script / the Dumper for units with less than 6 NVRAM variables of type (AA.55.7F.00.07)

Update from 17-9-2023

-> detection for refurbished boards (ssnp present), shows a warning if not serialised (ssnp but no ssn)
-> reporting of u(efi) version where possible and adjust the warning for Windows certificates
-> -scanvss and -freespace arguments for the test_nvram shell script

-> fixed: Model code was not shown before serial number in GUI tool

Update from 31-8-2023

-> Fixed a bug where flashing was rejected
-> The ESP tools got a <mount ESP from list v2> tool
what shows the drive model, interface, position and last but not least the type / version (where possible) of the bootloader (OpenCore native, OCLP, OC MartinLo, RefindPlus, rEFInd, Windows, ...)

https://forums.macrumors.com/threads/manually-configured-opencore-on-the-mac-pro.2207814/page-520?post=32382081#post-32382081

Update from 27-8-2023

-> No real new functions, polishing and error corrections.
-> The ESP tools work in old systems what do not work with diskutil to mount / unmount
-> Added a bunch of scripts to add and edit boot-args

Update from 12-8-2023

-> Bootvars show where the System / Bootloader / Recovery / ... is physically stored.

Gives, when possible, the actual path, the product name of the drive and the position.

Like: Boot001: OpenCore |EFI|disk0s1 (PCI External:APPLE SSD SM0256G) /EFI/OC/OpenCore.efi

some more examples:

Code:

BootOrder: 1:Boot0080 Boot0001: OpenCore |EFI|disk3s1 (SATA Bay 3:ST1000DM003-1ER162)|EFI|EFI\OC_OCLP031\OpenCore.efi Boot0080: Mac OS X |Apple_APFS|disk2s2 (SATA Bay 1:Samsung SSD 850 PRO 256GB)|\x-EC79-4675-96B4-786E627FCA06\System\Library\CoreServices\boot.efi Boot0080 is MacOs 10.14.6, label: Mojave Boot0081: Recovery OS \x-98B6-49D7-9BAF-0E6A2928C527\boot.efi Boot0082: |Apple_APFS|disk2s2 (SATA Bay 1:Samsung SSD 850 PRO 256GB)|\x-EC79-4675-96B4-786E627FCA06\System\Library\CoreServices\boot.efi Boot0082 is MacOs 10.14.6, label: Mojave BootFFFF: |EFI|disk3s1 (SATA Bay 3:ST1000DM003-1ER162)|EFI|\EFI\BOOT\BOOTX64.efi OCBtOrder: 1:OCBt0080 OCBt0080: Mac OS X [USB] \x-9D33-4C33-86EE-B3C893C0C765\System\Library\CoreServices\boot.efi OCBt0081: Mac OS X \x-66D5-4532-99D9-7711AAE353F5\System\Library\CoreServices\boot.efi

credits to @joevt for the dumpbootvars scripts, where some code is adapted from.
where DiskUUIDs are stored in the bootvars it is possible to show this details. Not all bootvars contain this.

For us it is very handy to show where the OpenCore bootloader is.

I wrote a little more about what reading the bootvars gives to us in https://forums.macrumors.com/thread...opencore-on-the-mac-pro.2207814/post-32378414

Update from 3-8-2023

-> Reading out battery-health variable on compatible MacBooks plus a history, read from the deleted variables. So we can track the battery-health a little. I could need help to understand more of the values. Not all battery types / machines generate timestamps.

(the battery-health is also displayed in the GUI tool, CLI tool output is better to display)

Code:

$ test_nvram MBA61.88Z.F000.B00.2301131747_N25Q064_10.07.2023_10-00-08.bin -showbathealth
===================================================
test_nvram_shell_script 1-Aug-2023 by Macschrauber
scanning: MBA61.88Z.F000.B00.2301131747_N25Q064_10.07.2023_10-00-08.bin

8MB file detected, analysing in progress
Firmware 478.0.0.0.0 built on Fri Jan 13 17:47:58 PST 2023
Bios Version: MBA61.88Z.F000.B00.2301131747
MBA62, Serial from firmware: xxxxxxxxxxxx85
hwc: G085   son: MD760D/
CRC32 checksums: ok
Battery-Health (VSS1, normal):
"seed1":6758
"seed0":6758
"fccDaySampleAvg":6658
"version":65536
"Battery Service State":0
"waitFc":0
"nccAvg":6668
"fccDaySampleAvgAlt":6658
"nccAvgAlt":6668
"ncc":94
"fccDaySampleCount":2
"Maximum Capacity Percent":97
"seedTs":1682957818
"Battery Service Flags":3
"Battery Serial":"xxxxxxxxxxxxxxxx"
"ts":1688974424
"fccAvgHistoryCount":10
"tsPrev":1688664656
"nccAlt":94
------------------------------------------
battery-health (VSS1, normal):        "Maximum Capacity Percent": 97   ts:  10.07.2023 09:33:44  tsPrev:  06.07.2023 19:30:56  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, normal):        "Maximum Capacity Percent": 97   ts:  30.06.2023 08:15:01  tsPrev:  28.06.2023 10:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, deleted) (1):   "Maximum Capacity Percent": 99   ts:  28.04.2023 20:05:40                                seedTs:  28.04.2023 20:05:40
battery-health (VSS2, deleted) (2):   "Maximum Capacity Percent": 99   ts:  28.04.2023 20:05:40                                seedTs:  28.04.2023 20:05:40
battery-health (VSS2, deleted) (3):   "Maximum Capacity Percent": 99   ts:  28.04.2023 20:05:40                                seedTs:  28.04.2023 20:05:40
battery-health (VSS2, deleted) (4):   "Maximum Capacity Percent": 99   ts:  28.04.2023 20:05:40                                seedTs:  28.04.2023 20:05:40
battery-health (VSS2, deleted) (5):   "Maximum Capacity Percent": 99   ts:  28.04.2023 20:05:40                                seedTs:  28.04.2023 20:05:40
battery-health (VSS2, deleted) (6):   "Maximum Capacity Percent": 98   ts:  01.05.2023 18:16:58  tsPrev:  28.04.2023 20:05:40  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, deleted) (7):   "Maximum Capacity Percent": 98   ts:  24.06.2023 14:18:06  tsPrev:  01.05.2023 18:16:58  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, deleted) (8):   "Maximum Capacity Percent": 98   ts:  24.06.2023 14:18:06  tsPrev:  01.05.2023 18:16:58  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, deleted) (9):   "Maximum Capacity Percent": 98   ts:  24.06.2023 14:18:06  tsPrev:  01.05.2023 18:16:58  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, deleted) (10):  "Maximum Capacity Percent": 98   ts:  26.06.2023 12:15:01  tsPrev:  24.06.2023 14:18:06  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, deleted) (11):  "Maximum Capacity Percent": 98   ts:  26.06.2023 12:15:01  tsPrev:  24.06.2023 14:18:06  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, deleted) (12):  "Maximum Capacity Percent": 97   ts:  28.06.2023 10:15:01  tsPrev:  26.06.2023 12:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS2, deleted) (13):  "Maximum Capacity Percent": 97   ts:  28.06.2023 10:15:01  tsPrev:  26.06.2023 12:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (1):   "Maximum Capacity Percent": 97   ts:  30.06.2023 08:15:01  tsPrev:  28.06.2023 10:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (2):   "Maximum Capacity Percent": 97   ts:  30.06.2023 08:15:01  tsPrev:  28.06.2023 10:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (3):   "Maximum Capacity Percent": 97   ts:  02.07.2023 06:15:01  tsPrev:  30.06.2023 08:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (4):   "Maximum Capacity Percent": 97   ts:  02.07.2023 06:15:01  tsPrev:  30.06.2023 08:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (5):   "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (6):   "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (7):   "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (8):   "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (9):   "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (10):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (11):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (12):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (13):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (14):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (15):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (16):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (17):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (18):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (19):  "Maximum Capacity Percent": 97   ts:  04.07.2023 04:15:01  tsPrev:  02.07.2023 06:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (20):  "Maximum Capacity Percent": 97   ts:  05.07.2023 07:45:54  tsPrev:  04.07.2023 04:15:01  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (21):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (22):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (23):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (24):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (25):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (26):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (27):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (28):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (29):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (30):  "Maximum Capacity Percent": 97   ts:  06.07.2023 19:30:56  tsPrev:  05.07.2023 07:45:54  seedTs:  01.05.2023 18:16:58
battery-health (VSS1, deleted) (31):  "Maximum Capacity Percent": 97   ts:  10.07.2023 09:33:44  tsPrev:  06.07.2023 19:30:56  seedTs:  01.05.2023 18:16:58
Base_18 hardware descriptor
fmm-computer-name: MacBook Air
BootOrder: 1:Boot0080
Boot0080: \pDZ\A20E739E-78F6-3924-A686-272E77E54C35\System\Library\CoreServices\boot.efi
Boot0081: unknown
Boot0082: \pDZ\A20E739E-78F6-3924-A686-272E77E54C35\System\Library\CoreServices\boot.efi
BootFFFF: \System\Library\CoreServices\boot.efi
15 boots since last garbage collection, MTC counter: 29 - 44
VSS1                   VSS2
1 (1 active)           1 (1 active) Memory Configs g
1 (1 active)           1 (1 active) Memory Configs h
1                      0 fmm-mobileme-token-FMM (ok)
0                      0 Microsoft certificates (ok)
29 (1 active)          18 (1 active) Boot PathProperties0000 (ok)
11 (1 active)          12 (1 active) NVRAM PathProperties0000 (ok)
VSS1: found 241 variables (51 valid, 190 deleted)
VSS2: found 337 variables (49 valid, 288 deleted)
1554 bytes free space of 65456 in VSS1
1381 bytes free space of 65456 in VSS2
(Garbage collection should automatically run the next time you reboot.)

-> So added back and forward buttons to the analyse dialog as these get bigger with displaying battery-health.

-> compatible machines dump with eficheck if Flashrom is not working

-> the repair script for cleaning the xattr quarantine flag

CLI tool:
-> the CLI tool can dump with Flashrom. For those machines we know the spi chip versions it assumes the correct type. Not that rich probing as the GUI tool but it works.

(the spi chip type can still be handed over by the -chip:xyz argument)

-> Also the CLI tool dumps with Eficheck (for compatible units, not Mac Pro 4,1/5,1). This will not need S.I.P. disabled (for the DirectHW.kext)

so there is a little installer script for deploying the shell script and the used tools. This is optional, the Dumper works like before. With this shell script things can be automated, like checking the NVRAM free space after every reboot.

Take care to keep the serials and IDs very private, it could be a serious security issue publishing them.

commands

Code:

user$ test_nvram -help
test_nvram_shell_script 17-Sep-2023
takes *.bin, *.rom, *.vol, *.fd and one or more of these arguments:
-help               this text
-force              don't check filesize and type
-shortserial        truncate the serial number
-nointro            do not show version and filename
-condense_gfxutil   do not show the full path for Bootvars
-DontCheckVolumes   do not mount or check volumes for bootvar decoding
-showvars           show all NVRAM variables
-mtccounts1         show deleted MTC counts
-mtccounts2         show MTC count of VSS2
-mtccounts12        show all MTC counts
-showall            show MTC (VSS1 deleted, VSS2) and all NVRAM variables
-showlbsn           show LBSN, hwc, son
-showbathealth      show battery-health variables condensed
-showfullbathealth  show battery-health variables (gives a hughe report)
-rename             ask to rename the given file by machine, serial, firmware, additions
-forcerename        same as -rename but don't ask
-simulaterename     same as -forcerename but just write out the new filename
_________________________________________________________________________________________________
 without giving a file:
-dump               dump the firmware with flashrom or eficheck to a file
-SST25VF032B        use this flash chip (MacPro 4,1 2009)
-MX25L3205D         use this flash chip (MacPro 5,1 2010-2011)
-MX25L3206E         use this flash chip (MacPro 5,1 2012)
-chip='yourflash'   use this flash chip, quotate it
-chip=auto          let flashrom detect the chip, if possible
-chip=eficheck      use eficheck if machine is capable

-scanvss            run Syncretic's scanvss to analyse the NVRAM streams, ~2006 to ~2012 Macs only
  for arguments quote like:
   '-scanvss -v'       ...show variable values
   '-scanvss -g'       ...show hex GUIDs
   '-scanvss -D'       ...hide deleted variables
   '-scanvss -d'       ...show header details
   '-scanvss -V1'      ...show only VSS1
   '-scanvss -V2'      ...show only VSS2
   '-scanvss -a'       ...show everything, same as -v -g -d
-freespace          read this machine's NVRAM with scanvss and just print free space of VSS1

just freespace in VSS1

Code:

user$ test_nvram -freespace
Apparent free space in VSS1: 27668 bytes

dumping with Flashrom on a Mac Pro 5,1

Code:

user$ test_nvram -dump
no spi-flash type given, but found MP51. Assuming MX25L3205D from experience
...Requesting load of /users/user/Library/Application Support/Macschrauber/DirectHW.kext.
/users/user/Library/Application Support/Macschrauber/DirectHW.kext loaded successfully (or already loaded).

doing flashrom097r1711 -p internal:laptop=this_is_not_a_laptop -c MX25L3205D/MX25L3208D -r /users/user/Downloads/18.09.2023_21-33-13_MX25L3205D_dump.bin -o /users/user/Downloads/18.09.2023_21-33-13_MX25L3205D_dump.log
...reading /users/user/Downloads/18.09.2023_21-33-13_MX25L3205D_dump.bin with Flashrom
...Flashrom was executed and gave no error

...com.coresystems.DirectHW unloaded and personalities removed.
.../users/user/Downloads/18.09.2023_21-33-13_MX25L3205D_dump.bin was created
.../users/user/Downloads/18.09.2023_21-33-13_MX25L3205D_dump.log was created
===================================================
test_nvram_shell_script 17-Sep-2023 by Macschrauber
scanning: /users/user/Downloads/18.09.2023_21-33-13_MX25L3205D_dump.bin

Firmware 144.0.0.0.0 (latest) built on Fri Apr 12 12:43:00 2019
Bios Version: MP51.88Z.F000.B00.1904121248
(U)efi version: 1.10
MP51, Serial from firmware: CKxxxxxxxxEUG
LBSN: J50xxxxxxxxBH9A   BD: 10xxxx10xxxx
hwc: EUG   son: 000xxxxxxxxx96
EnableGop 1.3 EFI module identified
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
Base_21 hardware descriptor
Boot000x is EFI\OC\OpenCore.efi (LauncherOption: Full)
OCLP: 0.6.9 | -allow_fv | MacPro5,1
fmm-computer-name: MacPro51 (2)
boot-args: keepsyms=1 debug=0x100 -lilubetaall -btlfxallowanyaddr ipc_control_port_options=0 -nokcmismatchpanic -disable_sidecar_mac -lilubetaall
BootOrder: 1:Boot0080
Boot0001: OpenCore |EFI|disk1s1 (SATA DVD Bay B (Lower):SAMSUNG 470 Series SSD)|EFI|PciRoot(0x0)/Pci(0x1F,0x2)/Sata(0x1,0x0,0x0)/HD(1,GPT,53A70A2A-B1A7-4368-A858-870B8D9807CC,0x28,0x64000)/EFI\OC\OpenCore.efi
Boot0080: |Apple_APFS|disk0s2 (PCI-Express Internal:Samsung SSD 970 EVO Plus 500GB)|PciRoot(0x0)/Pci(0x7,0x0)/Pci(0x0,0x0)/Msg(34,010000000025385291504418)/HD(2,GPT,7D2C57B3-FF74-4E5A-83B9-CA26ED30F50F,0x64028,0x3A321FE0)/VenMedia(BE74FCF7-0B7C-49F3-9147-01F4042E6842,A4AEE393BBBE594BB7CF61C455EDEE09)/\31F61C0A-1EAA-4D9B-BDD4-9786D5D5A009\System\Library\CoreServices\boot.efi
Boot0080 is MacOs 10.14.6, label: Mojave
BootFFFF: |Apple_APFS|disk0s2 (PCI-Express Internal:Samsung SSD 970 EVO Plus 500GB)|PciRoot(0x0)/Pci(0x7,0x0)/Pci(0x0,0x0)/Msg(34,010000000025385291504418)/HD(2,GPT,7D2C57B3-FF74-4E5A-83B9-CA26ED30F50F,0x64028,0x3A321FE0)/VenMedia(BE74FCF7-0B7C-49F3-9147-01F4042E6842,A4AEE393BBBE594BB7CF61C455EDEE09)/\31F61C0A-1EAA-4D9B-BDD4-9786D5D5A009\System\Library\CoreServices\boot.efi
BootFFFF is MacOs 10.14.6, label: Mojave
6 boots since last garbage collection, MTC counter: 12 - 18
VSS1                   VSS2
7 (1 active)           1 Memory Configs g (ok)
7 (1 active)           0 Memory Configs h (ok)
1 (1 active)           0 Memory Configs i (ok)
1 (1 active)           0 Memory Configs j (ok)
0                      0 Microsoft certificates (ok)
1 (1 active)           1 BluetoothActiveControllerInfos (ok)
1 (1 active)           1 BluetoothInternalControllerInfos (ok)
1 (1 active)           1 current-network (ok)
1 (1 active)           1 NVRAM PathProperties0000 (ok)
27668 bytes free space of 65464
VSS1 (Formatted) (Healthy), found 67 variables (42 valid, 25 deleted)
VSS2 (Formatted) (Healthy), found 40 variables (40 valid)
...renamed: 18.09.2023_21-33-13_MX25L3205D_dump.bin to MP51_144.0.0.0.0_CKxxxxxxxxEUG_EnableGop_1.3_18.09.2023_21-33-13.bin
...renamed: /users/user/Downloads/18.09.2023_21-33-13_MX25L3205D_dump.log to /users/user/Downloads/MP51_144.0.0.0.0_CKxxxxxxxxEUG_EnableGop_1.3_18.09.2023_21-33-13.log

dumping with eficheck on a MacBook Air 6,2

Code:

~ % test_nvram -dump -chip:eficheck
...reading /users/user/Downloads/23.07.2023_18-22-32_eficheck_dump.bin
Password:
.../users/user/Downloads/23.07.2023_18-22-32_eficheck_dump.bin was created

===================================================
test_nvram_shell_script 23-Jul-2023 by Macschrauber
scanning: /users/user/Downloads/23.07.2023_18-22-32_eficheck_dump.bin

8MB file detected, analysing in progress
Firmware 478.0.0.0.0 built on Fri Jan 13 17:47:58 PST 2023
Bios Version: MBA61.88Z.F000.B00.2301131747
MBA62, Serial from firmware: C17xxxxxxxxxx
hwc: G085   son: MD760D/
CRC32 checksums: ok
Base_18 hardware descriptor
fmm-computer-name: MacBook Air from user
BootOrder: 1:Boot0080
Boot0080: \7AFD3F6D-2719-4CA3-B821-FA9B4D74770B\System\Library\CoreServices\boot.efi
Boot0082: \7AFD3F6D-2719-4CA3-B821-FA9B4D74770B\System\Library\CoreServices\boot.efi
BootFFFF: \pDZ\A20E739E-78F6-3924-A686-272E77E54C35\System\Library\CoreServices\boot.efi
15 boots since last garbage collection, MTC counter: 86 - 101
VSS1                   VSS2
1 (1 active)           1 (1 active) Memory Configs g
1 (1 active)           1 (1 active) Memory Configs h
1 (1 active)           1 (1 active) Kernel Panic dumps type A: Pointer type (ok)
0                      0 Microsoft certificates (ok)
26 (1 active)          42 (1 active) Boot PathProperties0000 (ok)
11 (1 active)          12 (1 active) NVRAM PathProperties0000 (ok)
VSS1: found 177 variables (47 valid, 130 deleted)
VSS2: found 264 variables (50 valid, 214 deleted)
17785 bytes free space of 65456 in VSS1
416 bytes free space of 65456 in VSS2
...renamed: 23.07.2023_18-22-32_eficheck_dump.bin to MBA62_478.0.0.0.0_C17xxxxxxxx_23.07.2023_18-22-32.bin

full check with the cli tool:

Code:

Last login: Sun Jul 23 23:29:33 on ttys000
MacPro51:~ user$ test_nvram /Users/user/Downloads/CKxxxxxCEUG_144.0.0.0.0_gop_1.3_MX25L3205D_23.07.2023_23-34-10.bin -showall
===================================================
test_nvram_shell_script 23-Jul-2023 by Macschrauber
scanning: /Users/user/Downloads/CKxxxxxCEUG_144.0.0.0.0_gop_1.3_MX25L3205D_23.07.2023_23-34-10.bin
Firmware 144.0.0.0.0 (latest) built on Fri Apr 12 12:43:00 2019
Bios Version: MP51.88Z.F000.B00.1904121248
MP51, Serial from firmware: CKxxxxxCEUG
LBSN: J5xxxxxBH9A   BD: 10xxxx10xxxx
hwc: EUG   son: 00031xxxxxxxx
EnableGop 1.3 EFI module identified
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
Base_21 hardware descriptor
Boot000x is EFI\OC\OpenCore.efi (LauncherOption: Full)
OCLP: 0.6.8 | -allow_fv -allow_amfi | MacPro5,1
fmm-computer-name: MacPro51 (2)
MTC count (VSS1, Normal): 111
MTC count (VSS2, Normal): 106
MTC counts VSS1 (DELETED) (1): 106
MTC counts VSS1 (DELETED) (2): 107
MTC counts VSS1 (DELETED) (3): 108
MTC counts VSS1 (DELETED) (4): 109
MTC counts VSS1 (DELETED) (5): 110
boot-args: -no_compat_check keepsyms=1 debug=0x100 -lilubetaall -btlfxallowanyaddr ipc_control_port_options=0 -nokcmismatchpanic -disable_sidecar_mac
BootOrder: 1:Boot0080
Boot0080: \31F61C0A-1EAA-4D9B-BDD4-9786D5D5A009\System\Library\CoreServices\boot.efi
BootFFFF: \31F61C0A-1EAA-4D9B-BDD4-9786D5D5A009\System\Library\CoreServices\boot.efi
OCBtOrder: 1:OCBt0080
OCBt0080: \31F61C0A-1EAA-4D9B-BDD4-9786D5D5A009\System\Library\CoreServices\boot.efi
OCBt0081: Mac OS X \31F61C0A-1EAA-4D9B-BDD4-9786D5D5A009\System\Library\CoreServices\boot.efi
OCBtFFFF: \31F61C0A-1EAA-4D9B-BDD4-9786D5D5A009\System\Library\CoreServices\boot.efi
5 boots since last garbage collection, MTC counter: 106 - 111
VSS1                   VSS2
6 (1 active)           1 Memory Configs g (ok)
6 (1 active)           1 Memory Configs h (ok)
1 (1 active)           1 Memory Configs i (ok)
1 (1 active)           1 Memory Configs j (ok)
6 (1 active)           1 Kernel Panic dumps type A: Pointer type
11 (11 active)         11 Kernel Panic dumps type B: Compressed (caution)
0                      0 Microsoft certificates (ok)
1 (1 active)           1 BluetoothActiveControllerInfos (ok)
6 (1 active)           1 Boot PathProperties0000 (ok)
1 (1 active)           1 NVRAM PathProperties0000 (ok)
2 (2 active)           2 Boot00xx variables
2 (2 active)           2 OCbt00xx variables
16854 bytes free space of 65464
VSS1 (Formatted) (Healthy), found 96 variables (58 valid, 38 deleted)
VSS2 (Formatted) (Healthy), found 58 variables (58 valid)
---------------------
all variables in VSS1:
1 (ACPI Variable):AcpiGlobalVariable (Normal)
1 (Apple Backup Boot Variable):Boot0080 (Normal)
1 (Apple Backup Boot Variable):BootOrder (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0000 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0001 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0002 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0003 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0004 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0005 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0006 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0007 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0008 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0009 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo000K (Normal)
1 (Apple Boot Variable):AAPL,PanicInfoLog (Normal)
1 (Apple Boot Variable):AAPL,PathProperties0000 (Normal)
1 (Apple Boot Variable):EFIBluetoothDelay (Normal)
1 (Apple Boot Variable):IDInstallerDataV2 (Normal)
1 (Apple Boot Variable):LocationServicesEnabled (Normal)
1 (Apple Boot Variable):SystemAudioVolume (Normal)
1 (Apple Boot Variable):SystemAudioVolumeDB (Normal)
1 (Apple Boot Variable):_kdp_ipstr (Normal)
1 (Apple Boot Variable):bluetoothActiveControllerInfo (Normal)
1 (Apple Boot Variable):boot-args (Normal)
1 (Apple Boot Variable):csr-active-config (Normal)
1 (Apple Boot Variable):fmm-computer-name (Normal)
1 (Apple Boot Variable):ignition-failure-boot (Normal)
1 (Apple Boot Variable):ignition-failure-reason (Normal)
1 (Apple Boot Variable):prev-lang-diags:kbd (Normal)
1 (Apple Boot Variable):run-efi-updater (Normal)
1 (Apple NVRAM Variable):AAPL,PathProperties0000 (Normal)
1 (Apple NVRAM Variable):security-key (Normal)
1 (Apple Wireless Network Variable):preferred-count (Normal)
1 (Apple Wireless Network Variable):preferred-networks (Normal)
1 (EFI Global):Boot0001 (Normal)
1 (EFI Global):Boot0080 (Normal)
1 (EFI Global):BootFFFF (Normal)
1 (EFI Global):BootOrder (Normal)
1 (EFI Global):ConOutDev (Normal)
1 (EFI Global):Lang (Normal)
1 (EFI Global):MemoryConfig (Normal)
1 (EFI Global):MemoryConfih (Normal)
1 (EFI Global):MemoryConfii (Normal)
1 (EFI Global):MemoryConfij (Normal)
1 (EFI Global):PlatformLang (Normal)
1 (MTC variable):MTC (Normal)
1 (OpenCore Variable):OCBt0080 (Normal)
1 (OpenCore Variable):OCBt0081 (Normal)
1 (OpenCore Variable):OCBtFFFF (Normal)
1 (OpenCore Variable):OCBtOrder (Normal)
1 (OpenCore Variable):OCLP-Model (Normal)
1 (OpenCore Variable):OCLP-Settings (Normal)
1 (OpenCore Variable):OCLP-Version (Normal)
1 (OpenCore Variable):revblock (Normal)
1 (OpenCore Variable):revpatch (Normal)
1 (Setup Variable):Setup (Normal)
1 4c024000-2802-4a2a-8880-4a4088108c00:@@AB%` (Normal)
1 62bf9b1c-8568-48ee-85dc-dd3057660863:boot-feature-usage (Normal)
---------------------
4 (Apple Boot Variable):SystemAudioVolume (DELETED)
4 (Apple Boot Variable):SystemAudioVolumeDB (DELETED)
5 (Apple Boot Variable):AAPL,PanicInfoLog (DELETED)
5 (Apple Boot Variable):AAPL,PathProperties0000 (DELETED)
5 (EFI Global):MemoryConfig (DELETED)
5 (EFI Global):MemoryConfih (DELETED)
5 (EFI Global):_AGP_DISABLED (DELETED)
5 (MTC variable):MTC (DELETED)
---------------------
all variables in VSS2:
1 (ACPI Variable):AcpiGlobalVariable (Normal)
1 (Apple Backup Boot Variable):Boot0080 (Normal)
1 (Apple Backup Boot Variable):BootOrder (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0000 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0001 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0002 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0003 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0004 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0005 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0006 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0007 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0008 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo0009 (Normal)
1 (Apple Boot Variable):AAPL,PanicInfo000K (Normal)
1 (Apple Boot Variable):AAPL,PanicInfoLog (Normal)
1 (Apple Boot Variable):AAPL,PathProperties0000 (Normal)
1 (Apple Boot Variable):EFIBluetoothDelay (Normal)
1 (Apple Boot Variable):IDInstallerDataV2 (Normal)
1 (Apple Boot Variable):LocationServicesEnabled (Normal)
1 (Apple Boot Variable):SystemAudioVolume (Normal)
1 (Apple Boot Variable):SystemAudioVolumeDB (Normal)
1 (Apple Boot Variable):_kdp_ipstr (Normal)
1 (Apple Boot Variable):bluetoothActiveControllerInfo (Normal)
1 (Apple Boot Variable):boot-args (Normal)
1 (Apple Boot Variable):csr-active-config (Normal)
1 (Apple Boot Variable):fmm-computer-name (Normal)
1 (Apple Boot Variable):ignition-failure-boot (Normal)
1 (Apple Boot Variable):ignition-failure-reason (Normal)
1 (Apple Boot Variable):prev-lang-diags:kbd (Normal)
1 (Apple Boot Variable):run-efi-updater (Normal)
1 (Apple NVRAM Variable):AAPL,PathProperties0000 (Normal)
1 (Apple NVRAM Variable):security-key (Normal)
1 (Apple Wireless Network Variable):preferred-count (Normal)
1 (Apple Wireless Network Variable):preferred-networks (Normal)
1 (EFI Global):Boot0001 (Normal)
1 (EFI Global):Boot0080 (Normal)
1 (EFI Global):BootFFFF (Normal)
1 (EFI Global):BootOrder (Normal)
1 (EFI Global):ConOutDev (Normal)
1 (EFI Global):Lang (Normal)
1 (EFI Global):MemoryConfig (Normal)
1 (EFI Global):MemoryConfih (Normal)
1 (EFI Global):MemoryConfii (Normal)
1 (EFI Global):MemoryConfij (Normal)
1 (EFI Global):PlatformLang (Normal)
1 (MTC variable):MTC (Normal)
1 (OpenCore Variable):OCBt0080 (Normal)
1 (OpenCore Variable):OCBt0081 (Normal)
1 (OpenCore Variable):OCBtFFFF (Normal)
1 (OpenCore Variable):OCBtOrder (Normal)
1 (OpenCore Variable):OCLP-Model (Normal)
1 (OpenCore Variable):OCLP-Settings (Normal)
1 (OpenCore Variable):OCLP-Version (Normal)
1 (OpenCore Variable):revblock (Normal)
1 (OpenCore Variable):revpatch (Normal)
1 (Setup Variable):Setup (Normal)
1 4c024000-2802-4a2a-8880-4a4088108c00:@@AB%` (Normal)
1 62bf9b1c-8568-48ee-85dc-dd3057660863:boot-feature-usage (Normal)

running Syncretic's ScanVSS

Code:

test_nvram bbs.bin '-scanvss -a'
...Requesting load of /users/user/Library/Application Support/Macschrauber/DirectHW.kext.
/users/user/Library/Application Support/Macschrauber/DirectHW.kext loaded successfully (or already loaded).
(Reading the FlashROM may take several seconds...)
ScanVSS v0.17, Copyright 2022 Syncretic.  All Rights Reserved.
This program comes without any warranty of suitability for any purpose.
-- Found 2 VSS structures.
-- Parsing VSS structures from local flash.

----------------
Signature: 53535624 (Valid)
Size:      0000ffb8 (65464)
Format:    5a (Formatted)
State:     fe (Healthy)
Unk16[0]:  fe (Normal)
Unk16[1]:  01
Unk32:     00000000
----------------
--------
Variable: 8be4df61-93ca-11d2-aa0d-00e098032b8c:MemoryConfii (EFI Global)
StartID:  55aa (Valid)
State:    7f (Normal)
Unknown8: 00
Attr:     00000003 (NON_VOLATILE, BOOT_SERVICE_ACCESS)
NameSize: 26
DataSize: 1990
DataType: looks like Binary
Data:
00000000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
...
...
00000100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
000007a0: 01 00 00 00 01 01 11 01 01 00 a4 01 00 00 00 00  ................
000007b0: 00 00 10 01 20 01 01 00 a6 01 00 00 00 00 01 00  .... ...........
000007c0: 00 00 11 01 21 01                                ....!.
--------
--------
Variable: 8be4df61-93ca-11d2-aa0d-00e098032b8c:MemoryConfij (EFI Global)
StartID:  55aa (Valid)
State:    7f (Normal)
Unknown8: 00
Attr:     00000003 (NON_VOLATILE, BOOT_SERVICE_ACCESS)
NameSize: 26
DataSize: 38
DataType: looks like Binary
Data:
00000000: 01 00 a8 01 00 00 00 00 00 00 20 01 ff ff 01 00  .......... .....
00000010: aa 01 00 00 00 00 01 00 34 35 00 00 3a 00 3a 00  ........45..:.:.
00000020: 10 00 20 00 00 00                                .. ...
--------
--------
...
...

-> some more polishing and corrections in the shell script

-> Bootxxxx, OCBtxxxx, BootOrder, OCBtOrder displaying. It shows the bootvars and their order, while also keeping track of their appearances. I recenty had to repair a firmware failure of a backplane where those vars were running wild. As a result, the dialogue box expands and automatically resizes, displaying content in parts if necessary.

If the firmware includes bootvars for UEFI Windows, it will provide a hint to remind the user to take care for protecting the firmware not getting certificates.

-> Dumping with eficheck On certain machines, eficheck is capable of generating proper dumps. Sadly, this functionality is not available on Mac Pros 1.1 to 5.1. If System Integrity Protection (SIP) is enabled for kernel extension (kext) signing, the Dumper utilizes eficheck on Macs that support it.

[/I][/B]

-> The background shell script has more support for non Mac Pros. Under the hood, numerous additional readouts have been incorporated for non-Mac Pros. Utilizing the shell script as a command-line tool provides more detailed information. However, it's important to note that the GUI dialogs hide any private data that may be included.

-> The test_nvram Droplet has been dropped. The dumper takes over this function. One or more files can be dragged into the dumper and evaluated.
This does not work on the .dmg, copy the app to a none write protected folder.

-> One tool version for MacOs 10.5 to 13. Gave up modifier keys (shift, alt, command - so no more extra Mavericks (and earlier) version is needed)

-> Sonoma support

-> warning for exceeding vars limit, colors for test_nvram in terminal mode, displaying normal / deleted vars after VSSx healthy, an ESP tool for mounting ESPs with detailed information of the drive and the physical position.

-> now reading out the Mac Pro 6,1 is added. So Mac Pro 1,1 to 6,1 and the Xserves are supported.

-> After flashing a firmware there is shown an analyzing window of the new readout of the flashed firmware.

-> Multiple EnableGop DXE drivers injections are detected.
-> Displaying a hint for testing GopBurstMode when EnableGop or EnableGopDirect 1.2 is in the file to flash.

-> OpenCore Legacy Patcher NVRAM variables are shown.

-> Added displaying of MTC values. This is a counter what seams not to be used in regular OS' we run on our machines. It increases by 1 on each machine start or wakeup from full "power off" sleep (Hibernatemode 25) and resets to zero with NVRAM reset. Monotonic Counters

-> Filenames the dumper generates now include EnableGop version. If the dump has problems most of the problems are indicated in the filename as well like certificates or crc32 errors.

And several changes under the hood regarding the reading of -non-Mac Pros. For example there is a positive list of Macs that work with Flashrom and the Dumper, there is no warning for those anymore.

Did a lot of rework in the test_nvram shell script under the hood, even for using the shell script without the Dumper. The test_nvram shell script can now rename dump files like MP31.006C.B05_CK___XYL_apfs_nvme.bin. Use -help for an overview.

An encrypted (bound to the boot volume) admin password for the Dumper could be stored, see the tweaks folder.

I still need volunteers who want to read non-Mac Pros with the Dumper and send me the logs.

(The main purpose of the tool is the Mac Pro 4.1/5.1. I just want the tool to be able to read out and back up other machines. As I don't have the ability to test (and to repair bricks) of non-Mac Pros I don't do flashing in this tool for non-Mac Pros.)

Mac Pro 5,1 on Monterey

Mac Mini 2,1 on Tiger

MacBook Air 3,1 on High Sierra

Anaylyse before flashing

Anaylyse after reading back directly after flashing

Warning for multiple EnableGOP injections

Hint for Enable Gop 1.2

all normal / active NVRAM variables are now verified

that's inside the App package (RomDump Macschrauber.app/Contents/Resources/test_nvram) as the tools scanvss and UEFIExtract.
The tools need to be in the same directory or somewhere found by $PATH like /usr/local/bin

Code:

Mac-Pro-3:~ $ test_nvram -help test_nvram_shell_script 17-May-2023 takes *.bin, *.rom, *.vol, *.fd first and one or more of these arguments next: -help this text -force don't check filesize and type -shortserial truncate the serial number -nointro do not show version and filename -showvars show all NVRAM variables -mtccounts1 show deleted MTC counts of VSS1 -mtccounts2 show MTC count of VSS2 -mtccounts12 show all MTC counts -showall show MTC (VSS1 deleted, VSS2) and all NVRAM variables -showlbsn show LBSN -rename rename the given file by machine, serial, firmware, additions and ask -forcerename same as -rename but don't ask -simulaterename same as -forcerename but just write out the new filename Mac-Pro-3:~ $ test_nvram brick.rom -shortserial -showall =================================================== test_nvram_shell_script 17-May-2023 by Macschrauber scanning: brick.rom Firmware 138.0.0.0.0 Serial from firmware: CK__________4PD LBSN C070_______DCVKAL CRC32 checksums: ok Crossflash 4.1->5.1 (bootblock of MP51.007F.B03) base_20 hardware descriptor fmm-computer-name: User’s Mac Pro MTC count (VSS1, Normal): 647 MTC count (VSS2, Normal): 636 MTC counts (DELETED) (1): 636 MTC counts (DELETED) (2): 637 MTC counts (DELETED) (3): 638 MTC counts (DELETED) (4): 639 MTC counts (DELETED) (5): 640 MTC counts (DELETED) (6): 641 MTC counts (DELETED) (7): 642 MTC counts (DELETED) (8): 643 MTC counts (DELETED) (9): 644 MTC counts (DELETED) (10): 645 MTC counts (DELETED) (11): 646 11 boots since last garbage collection, MTC counter: 636 - 647 VSS1 VSS2 12 (1 active) 1 Memory Configs g (ok) 10 (1 active) 1 Memory Configs h (ok) 1 (1 active) 1 Memory Configs i (ok) 1 (1 active) 1 Memory Configs j (ok) 1 (1 active) 1 IASInstallPhaseList / xml (ok) 1 (1 active) 1 Kernel Panic dumps type A: Pointer type 6 (6 active) 6 Kernel Panic dumps type B: Compressed (caution) 0 0 Microsoft certificates (ok) 1 (1 active) 1 BluetoothActiveControllerInfos (ok) 1 (1 active) 1 BluetoothInternalControllerInfos (ok) Length of 2nd VSS Store is wrong (FF FF FF FF) 2869 bytes free space of 65464 VSS1 (Formatted) (Healthy) VSS2 (Formatted) (Healthy) --------------------- all variables in VSS1: 1 (ACPI Variable):AcpiGlobalVariable (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0000 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0001 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0002 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0003 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0004 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0005 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfoLog (Normal) 1 (Apple Boot Variable):EFIBluetoothDelay (Normal) 1 (Apple Boot Variable):IDInstallerDataV2 (Normal) 1 (Apple Boot Variable):LocationServicesEnabled (Normal) 1 (Apple Boot Variable):SystemAudioVolume (Normal) 1 (Apple Boot Variable):SystemAudioVolumeDB (Normal) 1 (Apple Boot Variable):SystemAudioVolumeSaved (Normal) 1 (Apple Boot Variable):bluetoothActiveControllerInfo (Normal) 1 (Apple Boot Variable):bluetoothInternalControllerInfo (Normal) 1 (Apple Boot Variable):efi-apple-payload0 (Normal) 1 (Apple Boot Variable):efi-apple-payload0-data (Normal) 1 (Apple Boot Variable):efi-backup-boot-device (Normal) 1 (Apple Boot Variable):efi-backup-boot-device-data (Normal) 1 (Apple Boot Variable):efi-boot-device (Normal) 1 (Apple Boot Variable):efi-boot-device-data (Normal) 1 (Apple Boot Variable):efi-boot-next (Normal) 1 (Apple Boot Variable):efi-boot-next-data (Normal) 1 (Apple Boot Variable):fmm-computer-name (Normal) 1 (Apple Boot Variable):fmm-mobileme-token-FMM-BridgeHasAccount (Normal) 1 (Apple Boot Variable):install-product-url (Normal) 1 (Apple Boot Variable):prev-lang:kbd (Normal) 1 (Apple Boot Variable):previous-system-uuid (Normal) 1 (Apple NVRAM Variable):AAPL,PathProperties0000 (Normal) 1 (Apple NVRAM Variable):IASCurrentInstallPhase (Normal) 1 (Apple NVRAM Variable):IASInstallPhaseList (Normal) 1 (Apple NVRAM Variable):security-key (Normal) 1 (Apple Wireless Network Variable):current-network (Normal) 1 (Apple Wireless Network Variable):preferred-count (Normal) 1 (EFI Global):Boot0080 (Normal) 1 (EFI Global):Boot0081 (Normal) 1 (EFI Global):BootFFFF (Normal) 1 (EFI Global):BootOrder (Normal) 1 (EFI Global):ConOut (Normal) 1 (EFI Global):ConOutDev (Normal) 1 (EFI Global):GFXVENDOR (Normal) 1 (EFI Global):Lang (Normal) 1 (EFI Global):MemoryConfig (Normal) 1 (EFI Global):MemoryConfih (Normal) 1 (EFI Global):MemoryConfii (Normal) 1 (EFI Global):MemoryConfij (Normal) 1 (EFI Global):_AGP_DISABLED (Normal) 1 (MTC variable):MTC (Normal) 1 (Setup Variable):Setup (Normal) 1 24a6edcb-ebb6-490b-a455-fc9e8fab5366:BluetoothUHEDevices (Normal) 1 8983fd2d-113c-4e2b-8f47-0abfeb20a41a:SmmS3NvsData (Normal) 2 08404100-830a-0192-a800-004098000b80:@ (Normal) ------------------------------------ !!! Multiple normal vars in VSS1, this is totally unexpected and sign of corruption !!! ---------------------- 9 (EFI Global):MemoryConfih (DELETED) 11 (EFI Global):MemoryConfig (DELETED) 11 (MTC variable):MTC (DELETED) --------------------- all variables in VSS2: 1 (ACPI Variable):AcpiGlobalVariable (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0000 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0001 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0002 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0003 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0004 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfo0005 (Normal) 1 (Apple Boot Variable):AAPL,PanicInfoLog (Normal) 1 (Apple Boot Variable):EFIBluetoothDelay (Normal) 1 (Apple Boot Variable):IDInstallerDataV2 (Normal) 1 (Apple Boot Variable):LocationServicesEnabled (Normal) 1 (Apple Boot Variable):SystemAudioVolume (Normal) 1 (Apple Boot Variable):SystemAudioVolumeDB (Normal) 1 (Apple Boot Variable):SystemAudioVolumeSaved (Normal) 1 (Apple Boot Variable):bluetoothActiveControllerInfo (Normal) 1 (Apple Boot Variable):bluetoothInternalControllerInfo (Normal) 1 (Apple Boot Variable):efi-apple-payload0 (Normal) 1 (Apple Boot Variable):efi-apple-payload0-data (Normal) 1 (Apple Boot Variable):efi-backup-boot-device (Normal) 1 (Apple Boot Variable):efi-backup-boot-device-data (Normal) 1 (Apple Boot Variable):efi-boot-device (Normal) 1 (Apple Boot Variable):efi-boot-device-data (Normal) 1 (Apple Boot Variable):efi-boot-next (Normal) 1 (Apple Boot Variable):efi-boot-next-data (Normal) 1 (Apple Boot Variable):fmm-computer-name (Normal) 1 (Apple Boot Variable):fmm-mobileme-token-FMM-BridgeHasAccount (Normal) 1 (Apple Boot Variable):install-product-url (Normal) 1 (Apple Boot Variable):prev-lang:kbd (Normal) 1 (Apple Boot Variable):previous-system-uuid (Normal) 1 (Apple NVRAM Variable):AAPL,PathProperties0000 (Normal) 1 (Apple NVRAM Variable):IASCurrentInstallPhase (Normal) 1 (Apple NVRAM Variable):IASInstallPhaseList (Normal) 1 (Apple NVRAM Variable):security-key (Normal) 1 (Apple Wireless Network Variable):current-network (Normal) 1 (Apple Wireless Network Variable):preferred-count (Normal) 1 (EFI Global):Boot0080 (Normal) 1 (EFI Global):Boot0081 (Normal) 1 (EFI Global):BootFFFF (Normal) 1 (EFI Global):BootOrder (Normal) 1 (EFI Global):ConOut (Normal) 1 (EFI Global):ConOutDev (Normal) 1 (EFI Global):GFXVENDOR (Normal) 1 (EFI Global):Lang (Normal) 1 (EFI Global):MemoryConfig (Normal) 1 (EFI Global):MemoryConfih (Normal) 1 (EFI Global):MemoryConfii (Normal) 1 (EFI Global):MemoryConfij (Normal) 1 (EFI Global):_AGP_DISABLED (Normal) 1 (MTC variable):MTC (Normal) 1 (Setup Variable):Setup (Normal) 1 24a6edcb-ebb6-490b-a455-fc9e8fab5366:BluetoothUHEDevices (Normal) 1 8983fd2d-113c-4e2b-8f47-0abfeb20a41a:SmmS3NvsData (Normal) 2 08404100-830a-0192-a800-004098000b80:@ (Normal) ------------------------------------ !!! Multiple normal vars in VSS2, this is totally unexpected and sign of corruption !!!

the links

password: rom, the downloader should set it, but just in case...

the downloader downloads the dmg, copies it to Downloads/Macschrauber's Rom Dump, if needed, and sets the xprotect flags as flashrom is included.

the gmx downloader (in case dropbox does not work):
https://c.gmx.net/@899644307915413392/4UCGnzAXT4K4_OChzxuBrg

the dropbox downloader (to prefer):
https://www.dropbox.com/s/t5k7j4gxj8n9pj2/Download Macschrauber's CMP Rom Dump.zip?dl=1

is damaged fix:

Mary Andrea · Apr 5, 2023

w1z said:
@Macschrauber Many thanks for the latest release 👍

I tried dumping, testing and flashing my cMP's rom, both live and reconstructed (late 2018/early 2019), and your software reported that the rom's Gaid checksum was not correct on both dump versions including the original reconstructed.

I know @tsialex is very meticulous with his rom reconstruction work so could this be a false positive result/reading from your software?

Cheers

View attachment 2156956

Hi Macschrauber. I tried three times, and unsuccessful result. My cMP 5.1, dual processor, GPU rx580 (without switch), Before Flash I had to choose three options on drop-down menu displays, I chosen one in the middle (two rom numbers) (because I read in a post that this was equivalent to 5.1). However, nothing happened, black screen no brick. I would like to try once choosing another option. - The rom chipset is below. What do you think, could it work?

Macschrauber · Apr 5, 2023

Mary Andrea said:
Hi Macschrauber. I tried three times, and unsuccessful result. My cMP 5.1, dual processor, GPU rx580 (without switch), Before Flash I had to choose three options on drop-down menu displays, I chosen one in the middle (two rom numbers) (because I read in a post that this was equivalent to 5.1). However, nothing happened, black screen no brick. I would like to try once choosing another option. - The rom chipset is below. What do you think, could it work?

If you dump with my tool there is no menu to choose what chip. In the background it assumes a chip we know from experience and probes with it.

Anyway, if the dumper is asking for a chip on a Mac Pro 4.1 or 5.1 something is odd. I send you a conversation to give me some log files what are not for the public.

Edit:
Mary Andrea has been using a package he found on Youtube where the Dumper and DosDude's RomTool is both included.
He is asking about DosDude's tool.
The Dumper does not need selection of the flash type. At least not on a Mac Pro.

stupots · Apr 6, 2023

@Macschrauber "Warning for multiple EnableGOP injections"

So to avoid this warning (assuming this is undesirable?) in a case where someone wants to upgrade from EnableGOP 1.1 to 1.2, the best practice would be to flash back originalrom.bin (no enableGOP), then do the EnableGOP procedure again from original ROM?

Thanks, Stu.

startergo · Apr 6, 2023

Macschrauber said:
Syncretic's PiquaBoot extensions

What is this?

Macschrauber · Apr 6, 2023

stupots said:
@Macschrauber "Warning for multiple EnableGOP injections"

So to avoid this warning (assuming this is undesirable?) in a case where someone wants to upgrade from EnableGOP 1.1 to 1.2, the best practice would be to flash back originalrom.bin (no enableGOP), then do the EnableGOP procedure again from original ROM?

Thanks, Stu.

Yes, exactly.
One can see this also in UefiTool but as my tool is the one recommended in the EnableGop documentation I found it useful to monitor this situation.

Maybe someone does even not know that EnableGop is in the firmware or has several machines, a used one, etc it is also useful.

Macschrauber · Apr 6, 2023

startergo said:
What is this?

https://forums.macrumors.com/threads/mp4-1-5-1-looking-for-bootrom-beta-testers.2375345/post-31839819

Macschrauber · Apr 15, 2023

Redone the scan of the dumps of #27 from the year 2021 with the 15-4-2023 version of the test_nvram shell script.

This was a full set of NVRAM dumps after forced garbage collection from empty to full NVRAM.

Found an interesting variable: MTC count. This is a counter what rises with every unit firmware start and is set to zero with a NVRAM reset. So thru the back door it could be a counter for unit starts.

I have found dumps with MTC counts in the 1000s. This is a 4 bytes variable, long enough for quite some firmware (re)starts.

It raises on the pure unit start, the firmware itself raises it, not the OS. So a wakeup from Hibernatemode 25 (what is power down and suspend from disk) with no system boot as well as “normal“ power up and reboot.

Code:

test_nvram_shell_script 15-Apr-2023 by Macschrauber
===================================================
scanning: 1.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
MTC count: 2
Assumed 1 boots since last garbage collection
2 (1 active) Memory Configs g (ok)
2 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
52839 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 2.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 3
Assumed 2 boots since last garbage collection
3 (1 active) Memory Configs g (ok)
3 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
1 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
47465 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 3.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 4
Assumed 3 boots since last garbage collection
4 (1 active) Memory Configs g (ok)
4 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
2 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
42790 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 4.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 5
Assumed 4 boots since last garbage collection
5 (1 active) Memory Configs g (ok)
5 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
3 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
38115 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 5.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 6
Assumed 5 boots since last garbage collection
6 (1 active) Memory Configs g (ok)
6 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
4 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
33440 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 6.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 7
Assumed 6 boots since last garbage collection
7 (1 active) Memory Configs g (ok)
7 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
5 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
28765 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 7.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 8
Assumed 7 boots since last garbage collection
8 (1 active) Memory Configs g (ok)
8 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
6 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
24090 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 8.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 9
Assumed 8 boots since last garbage collection
9 (1 active) Memory Configs g (ok)
9 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
7 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
19415 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 9.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 10
Assumed 9 boots since last garbage collection
10 (1 active) Memory Configs g (ok)
10 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
8 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
14740 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 10.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 11
Assumed 10 boots since last garbage collection
11 (1 active) Memory Configs g (ok)
11 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
9 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
10065 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 11.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 12
Assumed 11 boots since last garbage collection
12 (1 active) Memory Configs g (ok)
12 (1 active) Memory Configs h (ok)
1 (1 active) Memory Configs i (ok)
1 (1 active) Memory Configs j (ok)
0 Microsoft certificates (ok)
10 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
5390 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 12.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 13
Assumed 12 boots since last garbage collection
13 (1 active) Memory Configs g (caution)
13 (1 active) Memory Configs h (caution)
1 (1 active) Memory Configs i (caution)
1 (1 active) Memory Configs j (caution)
0 Microsoft certificates (ok)
11 (0 active) AAPL Path Properties (ok)
VSS2 is empty (ok after recent full nvram reset or after flashing a rebuilt firmware)
715 bytes free space of 65464 (caution)
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)
===================================================
scanning: 13.bin

Firmware 144.0.0.0.0 (latest)
Serial from firmware: CKxxxxxxx8PZ
CRC32 checksums: ok
Bootblock of 144.0.0.0.0 (rebuilt firmware)
base_21 hardware descriptor
fmm-computer-name: berlins Mac Pro
MTC count: 14
Assumed 1 boots since last garbage collection
VSS1                   VSS2
2 (1 active)           1 Memory Configs g (ok)
2 (1 active)           1 Memory Configs h (ok)
1 (1 active)           1 Memory Configs i (ok)
1 (1 active)           1 Memory Configs j (ok)
0                      0 Microsoft certificates (ok)
1 (0 active)           1 AAPL Path Properties (ok)
51718 bytes free space of 65464
VSS1 (Formatted) (Healthy)
VSS2 (Formatted) (Healthy)

tsialex · Apr 15, 2023

Macschrauber said:
Found an interesting variable: MTC count. This counts the boots since the last time the NVRAM was reset.

MTC, MonoTonic Counter, is not an entry that counts the last time the NVRAM was reset. It's a security feature that Intel implemented for applications to detect offline storage attacks. Apps can increment it up to 100 counters in a epoch (= day/reboot) and its usage is to validate if someone cloned the system or booted the disk with another computer, etc.

Monotonic Counters

Intel® Dynamic Application Loader (Intel® DAL) is a specific TEE with the Intel® Converged Security Engine (Intel® CSE) which is a general TEE.

www.intel.com

edk/Sample/Universal/MonotonicCounter/RuntimeDxe/MonotonicCounter.c at master · tianocore/edk

Git mirror of EDK. Contribute to tianocore/edk development by creating an account on GitHub.

github.com

Macschrauber · Apr 15, 2023

Ok, thanks for the details

But it seems that it is not used, so you seem to be able to elicit this information from this variable through the back door.

Corrected last post, of course.

tsialex · Apr 15, 2023

Macschrauber said:
Ok, thanks for the details

But it seems that it is not used, so you seem to be able to elicit this information from this variable through the back door.

When I first looked at MTC some years ago I had dumps with high thirty thousands, you would have to reboot the Mac Pro 10x per day for the last 10 years to increment the counter to that value - this does not make sense to count the NVRAM reset.

MTC is an entry that auto-increments itself each day and each reboot and every time a TXE app requests it (up to 100 per epoch), you can't infer NVRAM resets from that.

Macschrauber · Apr 15, 2023

Ok, I stand corrected with such a high amount of the MTC var content, my highest amount I found was 6152, quite high but not weird for 10 + years.

In my observation MTC gets deleted once with every boot, don't had one dump with more amount of MTC vars than boots since garbage collection.

Of course I checked a lot of dumps and all what I looked into looked like this example:

Code:

Variable: eb704011-1402-11d3-8e77-00a0c969723b:MTC (MTC variable)
State:    7c (DELETED)
00000000: 11 07 00 00
State:    7c (DELETED)
00000000: 12 07 00 00
State:    7c (DELETED)
00000000: 13 07 00 00
State:    7c (DELETED)
00000000: 14 07 00 00
State:    7c (DELETED)
00000000: 15 07 00 00
State:    7c (DELETED)
00000000: 16 07 00 00                                  
State:    7f (Normal)
00000000: 17 07 00 00

Macschrauber · Apr 15, 2023

this is the dump with a MTC content of 6152:

Code:

Variable: eb704011-1402-11d3-8e77-00a0c969723b:MTC (MTC variable)
State:    7c (DELETED)
00000000: ff 17 00 00                                      
State:    7c (DELETED)
00000000: 00 18 00 00                                     
State:    7c (DELETED)
00000000: 01 18 00 00                                      
State:    7c (DELETED)
00000000: 02 18 00 00                                      
State:    7c (DELETED)
00000000: 03 18 00 00                                     
State:    7c (DELETED)
00000000: 04 18 00 00                                      
State:    7c (DELETED)
00000000: 05 18 00 00                                    
State:    7c (DELETED)
00000000: 06 18 00 00                                      
State:    7c (DELETED)
00000000: 07 18 00 00                                    
State:    7f (Normal)
00000000: 08 18 00 00                                      

9 boots since last garbage collection, MTC counter: 6152
VSS1                   VSS2
10 (1 active)          1 Memory Configs g (ok)
10 (1 active)          1 Memory Configs h (ok)
1 (1 active)           1 Memory Configs i (ok)
1 (1 active)           1 Memory Configs j (ok)
1 (0 active)           0 IASInstallPhaseList / xml (ok)
1 (1 active)           1 Kernel Panic dumps type A: Pointer type
0                      0 Microsoft certificates (ok)
4 (1 active)           1 BluetoothActiveControllerInfos (ok)
1 (1 active)           1 BluetoothInternalControllerInfos (ok)
4 (0 active)           0 AAPL Path Properties (ok)
5380 bytes free space of 65464

sfalatko · Apr 16, 2023

stupots said:
@Macschrauber "Warning for multiple EnableGOP injections"

So to avoid this warning (assuming this is undesirable?) in a case where someone wants to upgrade from EnableGOP 1.1 to 1.2, the best practice would be to flash back originalrom.bin (no enableGOP), then do the EnableGOP procedure again from original ROM?

Thanks, Stu.

To be clear - you don't have to flash your cMP with an unmodified version of your original ROM to "clear out" the modified version before flashing with an updated version of EnableGop.

You only need to redo the EnableGop procedure with a copy of your original Rom and the newer version of EnableGop then flash that to replace the intalled ROM patched with the older version of EnableGop

Macschrauber · Apr 16, 2023

sfalatko said:
To be clear - you don't have to flash your cMP with an unmodified version of your original ROM to "clear out" the modified version before flashing with an updated version of EnableGop.

You only need to redo the EnableGop procedure with a copy of your original Rom and the newer version of EnableGop then flash that to replace the intalled ROM patched with the older version of EnableGop

yes, if you use dxeinject with a firmware dump what has EnableGop already injected it injets EnableGop a second time.

It does not overwrite it.

So be sure to use a dump without EnableGop

You can check it easily with the dumper by the <test a rom dump> button after clicking <more>

Also latest version of the dumper warns the user if it finds more instances of the same EnableGop GUID before flashing.

w1z · Apr 20, 2023

@Macschrauber It would be great if you'd start a dedicated thread for your valuable rom dumper/flasher/tester app. Who knows, it might get pinned at some point. I also propose you give it a name so it's easier to find as its coverage is fragmented between youtube, macrumors and the other forums you're active on.

Thank you for your efforts and work!

Macschrauber · Jun 7, 2023

The Dumper and the background tools (Flashrom, Scanvss, UefiExtract, Macserial) all works in Mac Os 14 Sonoma:

MP 1,1-5,1 Healthy NVRAM normal behaviour on 4,1->5,1 machines

macrumors 6502a

macrumors 6502a

macrumors 68040

macrumors 6502a

macrumors 68040

macrumors 68040

macrumors 68040

macrumors 68040

macrumors 68040

Macschrauber's Rom Dump​

Solution 1:​

Solution 2:​

Solution 3:​

Update from 12-8-2023​

Update from 3-8-2023​

Attachments

macrumors newbie

Attachments

macrumors 68040

macrumors newbie

macrumors 603

macrumors 68040

macrumors 68040

macrumors 68040

Contributor

macrumors 68040

Contributor

macrumors 68040

macrumors 68040

macrumors 6502a

macrumors 68040

macrumors 6502a

macrumors 68040

Our Staff

Macschrauber's Rom Dump

Solution 1:

Solution 2:

Solution 3:

Update from 12-8-2023

Update from 3-8-2023