MP 1,1-5,1 MacPro5,1: BootROM thread | 144.0.0.0.0

[trifero]

You problem is not BootROM related at all.

Start inspecting the CPU socket pins.

I was thinking just that. I remeber i destroyed a motherboard in a 4.1 for not changing the CPU´s correctly.

 

[tsialex]

I was thinking just that. I remeber i destroyed a motherboard in a 4.1 for not changing the CPU´s correctly.

I bet that everyone does some damage the first time. I probably can say that I'm very experienced with this type of thing and I bent several pins the first time I upgraded an early-2009 dual CPU tray. Took me days to find and unbend all the pins, some were not obvious and I had to check from several angles/different illumination.

 

[trifero]

I bet that everyone does some damage the first time. I probably can say that I'm very experienced with this type of thing and I bent several pins the first time I upgraded an early-2009 dual CPU tray. Took me days to find and unbent all the pins, some were not obvious and I had to check from several angles/different illumination.

I couldn´t fix it. Desperated. For 1 I unbent right, I ****ed 2 mores. Really a ninja task. At the end I bought a new logic board.

 

[tsialex]

I couldn´t fix it. Desperated. For 1 I unbent right, I ****ed 2 mores. Really a ninja task. At the end I bought a new logic board.

There are people here that have the skills and equipment for the socket replacements.

Over the years I slowly bought everything needed to do socket replacements except the trinocular microscope and the x-ray for the alignment, but I have a friend that have one. I've started with the hot air station for some small repairs like SPI replacements, then the hot bed for some more complicated repairs, the IR lamp, now I'm saving for the microscope. I've probably already spent the price of a very nice MP6,1.

 

[SambitSaha141]

@tsialex

Are the boot icons shown on MacOS boot menu screen stored in the Boot ROM? Or do they simple have links to actual file locations on the SSD/HDD/SSHD?

 

[tsialex]

@tsialex

Are the boot icons shown on MacOS boot menu screen stored in the Boot ROM? Or do they simple have links to actual file locations on the SSD/HDD/SSHD?

There are default icons inside the firmware somewhere, but the BootPicker tries to load the .VolumeIcon.icns for each disk.

 

[Borowski]

In uefitool you can search for string "19 89 50 4E 47 0D 0A 1A 0A".
To my knowledge, the icons are .pngs. The string above is in every raw-section of a picture.

 

[Macschrauber]

I would not edit the firmware for Personalization.

if something gets wrong you got a brick.

if one is not able to desolder and reprogram the flash chip (better replace) its unnecessary damage to good hardware.

 

[amishallin]

Ok i've done some searching and tried a few things but cannot get romtool to dump my rom. I keep getting the error "DirectHW.kext could not be loaded. The operation cannot proceed."

SIP is disabled, running Mojave 10.15.6 natively with 144.0.0.0.0 bootrom, removed opencore, reset pram 4x in a row. Do I have to use an old EVGA GTX 680 Mac Edition card? Install High Sierra over Catalina? I have a feeling 1 of these times it's just gonna work and I won't know why.

Tho I am getting some weird behavior with software update in Mojave... sometimes it says I can update to Big Sur and other times (like right now) it says I'm up to date. Also when i'm in the app store there are updates for imovie, pages, numbers, apple developer and geekbench 5 but can't download them because i'm not booted into Catalina (go figure). I think these are just bugs that may never get fixed.

 

[tsialex]

Ok i've done some searching and tried a few things but cannot get romtool to dump my rom. I keep getting the error "DirectHW.kext could not be loaded. The operation cannot proceed."

Search is your friend:

MP5,1: BootROM thread | 144.0.0.0.0

Okay, i had a similar issue and cleared it by removing all instances of RomTool and associated files by using AppCleaner from the MAS. Then I made sure SIP was disabled, then I opened RomTool v2.0 and it worked for me. Not sure if it will solve YOUR issue, but I had to remove RomTool and all...

forums.macrumors.com

AppCleaner

 

[startergo]

Ok i've done some searching and tried a few things but cannot get romtool to dump my rom. I keep getting the error "DirectHW.kext could not be loaded. The operation cannot proceed."

SIP is disabled, running Mojave 10.15.6 natively with 144.0.0.0.0 bootrom, removed opencore, reset pram 4x in a row. Do I have to use an old EVGA GTX 680 Mac Edition card? Install High Sierra over Catalina? I have a feeling 1 of these times it's just gonna work and I won't know why.

Tho I am getting some weird behavior with software update in Mojave... sometimes it says I can update to Big Sur and other times (like right now) it says I'm up to date. Also when i'm in the app store there are updates for imovie, pages, numbers, apple developer and geekbench 5 but can't download them because i'm not booted into Catalina (go figure). I think these are just bugs that may never get fixed.

Search is your friend:

MP5,1: BootROM thread | 144.0.0.0.0

Okay, i had a similar issue and cleared it by removing all instances of RomTool and associated files by using AppCleaner from the MAS. Then I made sure SIP was disabled, then I opened RomTool v2.0 and it worked for me. Not sure if it will solve YOUR issue, but I had to remove RomTool and all...

forums.macrumors.com

AppCleaner

Or you can build the installer:

GitHub - osresearch/rwmem: Read and write physical memory on OS X

Read and write physical memory on OS X. Contribute to osresearch/rwmem development by creating an account on GitHub.

github.com

To install in Catalina you need to mount R/W the system partition:

sudo mount -uw / && killall Finder

 

[amishallin]

With 25 pages of search results I was bound to miss something.

I used the Appcleaner, rebooted, and got a different error. This time it immediately spits out and error "The operation couldn’t be completed. (OSStatus error -67062.)." I looked that up on osstatus.com and it says it's named "errSecCSUnsigned" from security framework cscommon.h.

Figured i'd use Appcleaner again, reboot, reset PRAM (why not?), disable SIP again, downloaded romtool.zip to applications, unzipped it in applications, got the same OSStatus error above, let the dogs out, grabbed a snack, tried 1 more time before bed and it worked twice. The third time gave me the original "DirectHW.kext could not be loaded. The operation cannot proceed" again. In terminal I ran diff -s with both files and they are identical (and roughly 4.2mb) so I burned them to a CD. Why did it work 2X and not 3X? I have no clue.

Don't think there are any more steps after 2 successful ROM dumps with identical files. This sure has been a trip.

 

[Dayo]

$ sudo kextutil /System/Library/Extensions/DirectHW.kext
Password:
Kext rejected due to presence on exclude list: <OSKext 0x7fe153d2ed10 [0x7fff902738f0]> { URL = "file:///System/Library/Extensions/DirectHW.kext/", ID = "com.coresystems.driver.DirectHW" }
Code Signing Failure: not code signed
Diagnostics for /System/Library/Extensions/DirectHW.kext:

Seems some recent update may have added it to some sort of block list

 

[startergo]

$ sudo kextutil /System/Library/Extensions/DirectHW.kext
Password:
Kext rejected due to presence on exclude list: <OSKext 0x7fe153d2ed10 [0x7fff902738f0]> { URL = "file:///System/Library/Extensions/DirectHW.kext/", ID = "com.coresystems.driver.DirectHW" }
Code Signing Failure: not code signed
Diagnostics for /System/Library/Extensions/DirectHW.kext:

Seems some recent update may have added it to some sort of block list

I changed the bundle identifier before compiling the xcode project and it passes through. Maybe it will work if it is changed in the Info.plist to already compiled kext?

 

[Dayo]

I changed the bundle identifier before compiling the xcode project and it passes through. Maybe it will work if it is changed in the Info.plist to already compiled kext?

The issue is actually with Apple's Malware Removal Tool (MRT); the latest version of which, v1.72, blocks DirecHW. You also get a notice that you are downloading a virus if you try to download the installer from the ho.ax site.

We don't get MRT updates on our unsupported units and you basically stay on the version that came with your Mac OS installation.

I had updated mine to v1.72 with SilentKnight from v1.52 (Oct 2019 - when I installed Mojave) just before Xmas and only just clicked.

Grabbing v1.52 from time machine and replacing the file (must be done when booted into another Mac Os instance) allows me to dump my ROM again. You can beat the block if ROMTool is run from an old Mac OS instance.

I bet @amishallin is running one newer than 1.52. Can be checked by selecting MRT.app in S/L/CoreServices and the version number will show up in Finder.

 

[Macschrauber]

On Mac Pro 5.1 and 3.1 I managed to dump the rom With DarwinDumper 3.1.1 3.1.1

Bios-System is the line to check. Dont play around with this tool cause many of those other Tools inside hard crashes the machine. Dumping the rom was ok.

The Mac Pro 3.1 refused to load DirectHW.kext with RomTool and RomDump. Dumping with Darwin Dumper was ok.


strange thing: MRT is V1.5.2 on this DosDude Mojave Mac Pro 3.1



(replaced directhw.kext of RomTool with that different version of DarwinDumper. No success. System still refuses to load the kext with RomTool)


------------


tho I could Dump the rom on a natively booting 5.1 with MRT V1.7.2

also DarwinDumper 3.1.1 did a successful dump on this 5.1

------------------------------





also did the security update 2020-007 on this 5.1, RomTool and DarwinDumper still work.

should be something else...

was able to flash the rom with Mojave 18G7016 2020-007 as well, did a verify reading after it of course

 

[tsialex]

It's not MRT related, at least not with clean installs of 10.13.6+2020-006 or 10.14.6+2020-007 - did several in the last 10 days, no problem at all.

This DirectHW.kext blocking is know since the start of flashrom with macOS. It's usually happens when you had some AV/Malware installed.

 

[tsialex]

The issue is actually with Apple's Malware Removal Tool (MRT); the latest version of which, v1.72, blocks DirecHW. You also get a notice that you are downloading a virus if you try to download the installer from the ho.ax site.

We don't get MRT updates on our unsupported units and you basically stay on the version that came with your Mac OS installation.

I had updated mine to v1.72 with SilentKnight from v1.52 (Oct 2019 - when I installed Mojave) just before Xmas and only just clicked.

Grabbing v1.52 from time machine and replacing the file (must be done when booted into another Mac Os instance) allows me to dump my ROM again. You can beat the block if ROMTool is run from an old Mac OS instance.

I bet @amishallin is running one newer than 1.52. Can be checked by selecting MRT.app in S/L/CoreServices and the version number will show up in Finder.

Nope, 1.72 here and I can use it fine.

 

[amishallin]

It's not MRT related, at least not with clean installs of 10.13.6+2020-006 or 10.14.6+2020-007 - did several in the last 10 days, no problem at all.

This DirectHW.kext blocking is know since the start of flashrom with macOS. It's usually happens when you had some AV/Malware installed.

I just checked and my MRT is 1.52 (native Mojave install). Checked the patched Catalina install (via Mojave) and didn't see MRT.app in either "Catalina" or "Catalind - Data."

About having AV installed. I do have Panda Dome installed and that may have caused it... and thought I closed the app and all related "things" in activity monitor.

 

[startergo]

I had the blocking due to the presence on the excluded list with osresearch/rwmem
Then I downloaded and Modified the identifier in the Xcode from here directhw-master.zip https://review.coreboot.org/cgit/directhw.git/commit/.
Also in Catalina removed i386 option. Basically Xcode offers automatic fix for obsolete options:
After modification and compiling no more blocking.

sudo kextload /Library/Extensions/DirectHW.kext
Password:
g5@G5s-Mac-Pro ~ % kextstat | grep -v com.apple
Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>
  161    0 0xffffff7f856a3000 0x4000     0x4000     mybundle.com (1.3) 58B28CB3-3D4B-3ACB-929C-06F34F412FE4 <8 6 5 3>

Excluded list:

Blocked kernel extensions

Detailed listing of the kernel extensions which are blocked automatically by El Capitan’s XProtect system.

eclecticlight.co

com.coresystems.driver.DirectHW – LE 9999 – old open source tools to provide hardware functions on x86 systems

LE 9999 Means versions less or equal than 9999. That is forever.
ROM Tool's internal DIrectHW.kext:

code sign -dv --verbose=4 /Applications/ROMTool.app/Contents/Resources/DirectHW.kext
1.52.1
ea3859d4ba2f3e577a159bc91e3074c5d85c0523
x64
kextstat | grep -v com.apple
Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>
  162    0 0xffffff7f856f7000 0x4000     0x4000     com.doresystems.driver.DirectHW (1.3) no UUID <8 6 5 3>

That is why ROM Tool's DIrectHW.kext passes the validation so long the SIP is disabled and no Antivirus is loaded.

 

[Dayo]

That is why ROM Tool's DIrectHW.kext passes the validation so long the SIP is disabled and no Antivirus is loaded.

Noticed that the version in ROMTool is 47kb while the one I use with lnkspd is 106kb.
All versions are loading again. Not sure what exactly changed apart from MRT. Maybe it was XProtect that was doing the dirty.

Need to find the lnkspd/PCIe Boost thread again as I noticed that the script's kextunload command at the end fails when i run it manually and that the kext stays loaded.

 

[macsforme]

Is this the correct compatible chip to replace the boot ROM chip on a Mac Pro 4,1 -> 5,1?

MX25L3206EM2I-12G | Digi-Key Electronics

Order today, ships today. MX25L3206EM2I-12G – FLASH - NOR Memory IC 32Mbit SPI 86 MHz 8-SOP from Macronix. Pricing and Availability on millions of electronic components from Digi-Key Electronics.

www.digikey.com

Also, is it a recommended method to pull the backplane board and hire a reputable electronics repair shop to desolder the old chip and solder on the new one? My tools are limited and so are my skills, so I'd prefer that to trying to do it myself. I already have a ch341a programmer, and a rebuilt clean ROM from @tsialex from a while back, so I should be able to flash the chip and have it ready for them to solder on.

 

[trifero]

Is this the correct compatible chip to replace the boot ROM chip on a Mac Pro 4,1 -> 5,1?

MX25L3206EM2I-12G | Digi-Key Electronics

Order today, ships today. MX25L3206EM2I-12G – FLASH - NOR Memory IC 32Mbit SPI 86 MHz 8-SOP from Macronix. Pricing and Availability on millions of electronic components from Digi-Key Electronics.

www.digikey.com

Also, is it a recommended method to pull the backplane board and hire a reputable electronics repair shop to desolder the old chip and solder on the new one? My tools are limited and so are my skills, so I'd prefer that to trying to do it myself. I already have a ch341a programmer, and a rebuilt clean ROM from @tsialex from a while back, so I should be able to flash the chip and have it ready for them to solder on.

You can find them already flashed in ebay. Even with your serial number. I bought one some months ago for an Imac. I dismantled the logic board and went to a profesional solder.

 

[tsialex]

Is this the correct compatible chip to replace the boot ROM chip on a Mac Pro 4,1 -> 5,1?

MX25L3206EM2I-12G | Digi-Key Electronics

Order today, ships today. MX25L3206EM2I-12G – FLASH - NOR Memory IC 32Mbit SPI 86 MHz 8-SOP from Macronix. Pricing and Availability on millions of electronic components from Digi-Key Electronics.

www.digikey.com

Yes, you can use any of these SPI flash memories below:

• SST25VF032B
• MX25L3205A
• MX25L3206E

The first two are not produced anymore, but NOS stock sometimes appear, the last one is still produced.

Also, is it a recommended method to pull the backplane board and hire a reputable electronics repair shop to desolder the old chip and solder on the new one? My tools are limited and so are my skills, so I'd prefer that to trying to do it myself. I already have a ch341a programmer, and a rebuilt clean ROM from @tsialex from a while back, so I should be able to flash the chip and have it ready for them to solder on.

You have to remove the backplane from the case, it's not possible to desolder it inside the case.

While it's easy to desolder it, see the SMD removal with ChipQuick low-point solder desolder method for example, if you can't do yourself and can find someone to do it cheap, go for it. Backplanes are becoming expensive lately.

 

[tsialex]

You can find them already flashed in ebay. Even with your serial number. I bought one some months ago for an Imac. I dismantled the logic board and went to a profesional solder.

This will make it boot, but just the SSN solves nothing if you use iCloud/FaceTime/Messages. There are 7 different hardwareIDs that differentiate one Mac Pro from another.