It's not a easy task, since the NVRAM space, SSN_HWC_SON block and the LBSN_BD sector are not present in the LOCKED.fd files. You can't just check your DUMP with the LOCKED.fd one.
I'm using HexFiend, binwalk, UEFITool to inspect the dumps.
With HexFiend I check for things like:
- if the SSN_HWC_SON block is correct, in the correct address in the private part of the NVRAM. I saw one totally out of place, before base_20 binary.
- if the LBSN_BD sector is correct and in the correct address, end of the BootROM. I saw one 4 bytes out of place.
- compare sections of the ROMDump with the LOCKED.fd
With binwalk I check for things like:
- strange things on the NVRAM, I've found macOS install logs in plist format (that was weird, seems a botched/interrupted macOS install).
- duplicated NVRAM.
- volumes out of place.
- volumes bigger/smaller than the same ones in the LOCKED.fd files.
- added DXEs
With UEFITool I check for things like:
- valid checksums for the volumes.
- if all the FFS are present.
- sizes.
- signatures.
[doublepost=1534710678][/doublepost]Inspecting BootROMs made me find some interest, to me at least, things.
- BTO/CTO Macs have the full build date, to the second, like ANSI 8601 YYYY-MM-DDThh:mm:ssTZD, but without separators and time zone
- Retail/Refurb Macs have another format for the date YYMMDDYYMMDD7 (7 seems used as delimiter)
- 2010 and 2012 BootROMs are different in the private NVRAM area. Base_20 binary block for 2010 and Base_21 for 2012.
I still don't know what the Base_20 and Base_21 codes do, tried to inspect with IDA-free but got mumbo jumbo. I'm gonna return to it when I have time and a cool head.
Edit: found it, see next posts.
[doublepost=1534710890][/doublepost]Btw, I need more dumps of mid-2012 Mac Pros. I just have two.
[doublepost=1534711600][/doublepost]SSN = System Serial Number
HWC = Hardware Code
SON = System Order Number
LBSN = Logic Board Serial Number
BD = Build Date
