Hello!
First post for me and i think its time for me to contribute to the community.
Maybe this has already been discovered but not posted before so therefore i will post it now.
I have found the location of the software flash protection flags PR0, PR1 and FLOCKDN om the 2010 Imac 11,3 27 inch model
This is the first time i dived into any kind of dissasembling/decompiling. Only done hexedits or premade compiles or patches before so im very proud. Did barely know what program to use hehe
I have not made a easy patch, maybe i will in the future but these adresses are found in the UEFI module: PchSpiRuntime. Change 0x3874, 0x3878 and 0x3804 all to 0x3800.
Sidenote: I also found that in theory you should be able to specify different frequency for DDR3 frequency patch that
@m0bil made. I havent tried it and maybe it doesnt work because the "table" only goes to 1333mhz but i will try in the future.
The patch
# PEI module PlatformStage1Pei
# Force SaPlatformPolicyPpi->MemConfig->DdrFreqLimit = 0 (Disable)
53984C6A-1B4A-4174-9512-A65E5BC8B278 12 P:66C740013505:66C740010000
If 3505 is converted from hex to decimal you get 1333(or 0535 because i dont really understand exactly how it worksi just know they are read reverse sometimes.)
so if you want the sweet spot of 1600mhz with any memory rated 1600 or higher then you can change the patch to 4006.
53984C6A-1B4A-4174-9512-A65E5BC8B278 12 P:66C740013505:66C740014006 for 1600mhz should work.