Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Status
The first post of this thread is a WikiPost and can be edited by anyone with the appropiate permissions. Your edits will be public.

lovely666

macrumors member
Oct 7, 2006
45
14
See your PMs, I've sent my instructions to people that want a reconstruction, you will learn what to do following it.

I think my boot rom may need a reconstruction....

1622264369879.png
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
I think my boot rom may need a reconstruction....

View attachment 1783416
Yep, same case as here:


This is worryingly becoming more common lately. I've sent you instructions by PM.
 
  • Like
Reactions: trifero

trifero

macrumors 68030
May 21, 2009
2,958
2,799
Yep, same case as here:


This is worryingly becoming more common lately. I've sent you instructions by PM.
How many MP do you think you have saved from brick?
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
How many MP do you think you have saved from brick?
This is not a simple question to answer, there are direct and indirect effects, lot's of people started to save dumps and learned to how to do deep NVRAM resets and followed the best practices.

I have a stash of 550 to 600 dumps of different MacPro4,1/MacPro5,1, but not all were reconstructed and for around two years when I was doing everything completely free of charge, lot's of people that sent the dumps never downloaded the reconstructions and I think that some didn't even bothered to go back and read the diagnostic reports.

Now that I charge for reconstructions, diagnostics are always free, things are completely different since when people pay, they want a return for the money spent.
 

Dewdman42

macrumors 6502a
Jul 25, 2008
513
103
Did anyone else have any weird problems with their boot rom after allowing apple’s recent Mojave security update to go through? Mine started acting wonky with my HDD drives for some reason. I tried to reflash by never-booted rom but interestingly after I did that then apple software update suddenly wanted me to do the security update again; which gave me pause. Did the security update mess with the boot rom in some way?
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
Did anyone else have any weird problems with their boot rom after allowing apple’s recent Mojave security update to go through? Mine started acting wonky with my HDD drives for some reason. I tried to reflash by never-booted rom but interestingly after I did that then apple software update suddenly wanted me to do the security update again; which gave me pause. Did the security update mess with the boot rom in some way?
If you don't manually put a MacPro5,1 in firmware programming mode, nothing can interact with the BootROM itself. The problem is indirect, to do updates a series of NVRAM variables are written to the NVRAM volume and files are written to the EFI partition/main disk. This itself can mess with some installs.
 

Dewdman42

macrumors 6502a
Jul 25, 2008
513
103
Thanks for that info. It did appear to mess up mine for sure and yea the EFI volume I boot from was affected. Actually the whole partition map got screwed in some way.

Im still piecing things back together not sure if the coast is clear or not
 

cdf

macrumors 68020
Jul 27, 2012
2,256
2,583
If you don't manually put a MacPro5,1 in firmware programming mode, nothing can interact with the BootROM itself.
I've wondered about this. Would you say, then, that we are being overly cautious when spoofing the firmware version to a high value in OpenCore?
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
I've wondered about this. Would you say, then, that we are being overly cautious when spoofing the firmware version to a high value in OpenCore?
MacPro5,1 tiny NVRAM for today's standards is the Achilles heel of the whole design now and I don't think that we are being overly cautious, let me explain my point.

When spoofing, if Apple sends a firmware update that is newer than the version OC is spoofing, not the case with your current setting of BIOSVersion, the firmware image for the spoofed Mac and some support files are written to the EFI partition and the NVRAM volume get some variables with giant data to get everything set up for the efiflasher to do it's job.

While efiflasher won't flash the wrong/spoofed firmware to the MacPro5,1 SPI flash memory itself, the constant tries/files written to the ESP/etc can make a mess itself inside the NVRAM volume and ESP.

It's not improbable that the MacPro5,1 could have a failed garbage collection, or the SPI flash is on the last legs, and just the flurry of NVRAM variable writes can corrupt the NVRAM volume or even the SPI flash itself fails from NAND cell damage after 8+ years of usage (11+ for an early-2009).

So, setting BIOSVersion to the highest possible value is a best practice when using OC and a MacPro5,1.
 
Last edited:

Dewdman42

macrumors 6502a
Jul 25, 2008
513
103
Yea it definitely did something to my EFI, or actually the partition map, the next day I started getting a thing where the whole SATA HDD disk would self-eject itself during the night.. Notification messages that the disk was turned off without properly ejecting or something to that effect. I think probably due to display sleep after so many hours in the middle of the night, but not entirely sure. I rebooted and everything seemed to be working ok. Then it did it again the next night. DiskUtility showed unfixable problems. The drive started acting very slow and unresponsive...I tried to repair the EFI and unfortunately now none of the volumes on that device will mount at all. The error messages I was getting were about the partition map. SMART showed no errors.

I'm pretty sure the security update did something to that partition map, including the EFI that I was using as my primary boot device. The OS wasn't there on that device, just the EFI with RefindPlus and OC...Even when I boot to Mojave without OC...I go through RefindPlus on that drive. Or did. Maybe the partiionMap I had was confusing to the Mojave security updater. I had it setup with three partitions, two of which were separate APFS containers and one was HFS in order to use TimeMachine. Then of course EFI partition was there. Given the fact that the last error messages I saw were saying the partition map was FUBAR, I'd say that somehow my partition map was confusing to the security Update....and/or perhaps the NVRAM issue came up, though my NVRAM doesn't normally have that much stuff in it, and it wasn't that long since I had refreshed my never-booted rom either...so I dunno....

But anyway, then I tried to reflash the bootrom hoping that might fix the issue, but when I booted into Mojave again...it said I needed the security update all over again, which is the part that threw me for a loop. Why would it be asking for that again when I had already run it a few days before? All the security updates to OSX should have already been installed. Unless somehow it was never completed properly due to the partition map break down maybe....
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
Why would it be asking for that again when I had already run it a few days before? All the security updates to OSX should have already been installed. Unless somehow it was never completed properly due to the partition map break down maybe....

Even if the SecurityUpdates had been correctly applied, it's possible that Apple released an improved version later with a different build version.

Back in Lion days, Apple released sequentially five new builds in a week or so for the 10.7.3 ComboUpdate, from 11D50 to 11D50d, all of them published in the SUS. While I don't remember any other extreme case like this one, it's fairly common for Apple to quietly improve the builds after problems are reported/detected by Q&A.
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
Another example of an overrun NVRAM/secondary VSS header corrupted, this time is a MP4,1>5,1 from @Muckd:
Screen Shot 2021-06-01 at 23.00.45.png

This is starting to become common place with hybrids (cross-flashed early-2009 Mac Pros). Read more about the problem below:
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
One thing that I've noticed from the start, but I didn't had enough data to investigate, these dumps with secondary VSS header corrupted usually have several PanicInfoLogs:

Screen Shot 2021-06-01 at 23.02.40.png Screen Shot 2021-06-01 at 23.02.34.png

The question now is, the PanicLogs are a cause or a consequence?
 
  • Like
Reactions: trifero

maruengineering

macrumors newbie
Jun 1, 2021
1
2
Hello everybody!

Long time reader, first time poster…

I bought a Dual Processor MacPro5,1 Mid2012 to use in my home studio setup which is centered around some old Echo Audiofire 12 firewire audiocards, so I thought it makes sense to get a MacPro which is nearly not supported anymore; I’m looking for stability and don’t want to be bugged with software updates…

Anyway, long story short, the MacPro had El Capitan installed and the original Firmware; I made incremental updates to High Sierra and then Mojave; I dumped each version of the firmware(s) using RomTool as described in this forum.

Everything is working fine for the moment but by reading this topic I want to be prepared if the worst will happen; I ordered replacement SPI chip 25L3205D, I have a CH341 programmer, tools to solder SMDs…

The video card that was in the MacPro when I received it was a Quadro 5000 (non K); from what I have read here it seems that Nvidia web drivers (which I imagine were used in the past) can mangle the content of the SPI chip, so basically I’m looking for tsialex expertise to have a look at my firmware dumps.

@tsialex, I would have directly PM’d you, but as a newbie I cannot do it before the 5 post rule…

Best regards to everybody!
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
Yea it definitely did something to my EFI, or actually the partition map, the next day I started getting a thing where the whole SATA HDD disk would self-eject itself during the night.. Notification messages that the disk was turned off without properly ejecting or something to that effect. I think probably due to display sleep after so many hours in the middle of the night, but not entirely sure. I rebooted and everything seemed to be working ok. Then it did it again the next night. DiskUtility showed unfixable problems. The drive started acting very slow and unresponsive...I tried to repair the EFI and unfortunately now none of the volumes on that device will mount at all. The error messages I was getting were about the partition map. SMART showed no errors.

I'm pretty sure the security update did something to that partition map, including the EFI that I was using as my primary boot device. The OS wasn't there on that device, just the EFI with RefindPlus and OC...Even when I boot to Mojave without OC...I go through RefindPlus on that drive. Or did. Maybe the partiionMap I had was confusing to the Mojave security updater. I had it setup with three partitions, two of which were separate APFS containers and one was HFS in order to use TimeMachine. Then of course EFI partition was there. Given the fact that the last error messages I saw were saying the partition map was FUBAR, I'd say that somehow my partition map was confusing to the security Update....and/or perhaps the NVRAM issue came up, though my NVRAM doesn't normally have that much stuff in it, and it wasn't that long since I had refreshed my never-booted rom either...so I dunno....

But anyway, then I tried to reflash the bootrom hoping that might fix the issue, but when I booted into Mojave again...it said I needed the security update all over again, which is the part that threw me for a loop. Why would it be asking for that again when I had already run it a few days before? All the security updates to OSX should have already been installed. Unless somehow it was never completed properly due to the partition map break down maybe....
Apple re-issued stand-alone Security Update 2021-003 for Mojave and Catalina again today:
 

Attachments

  • Screen Shot 2021-06-02 at 12.11.30.png
    Screen Shot 2021-06-02 at 12.11.30.png
    127.1 KB · Views: 96
  • Screen Shot 2021-06-02 at 12.14.02.png
    Screen Shot 2021-06-02 at 12.14.02.png
    119.6 KB · Views: 98
Last edited:

chrfr

macrumors G5
Jul 11, 2009
13,709
7,280
Apple re-issued Security Update 2021-003 for Mojave and Catalina again today:
I'm not sure that this is a reissue as much as it was making them available for separate download. There wasn't a change in the software update catalog for these updates since their initial release on the 24th of May.
Edit: I downloaded the updater and the included package was built on May 20, so it's definitely not a re-release.
 
Last edited:
  • Like
Reactions: MarkC426

Dewdman42

macrumors 6502a
Jul 25, 2008
513
103
Apple re-issued stand-alone Security Update 2021-003 for Mojave and Catalina again today:
Thanks for the heads up. I think the security update was applied correctly the first time or second time, it’s just that the disk where I have OC EFI, got completely messed up, partition map was destroyed and after that I tried to do low level full erase but eventually it would not even detect the drive in drive utility. Something got seriously messed up. I have since put it into a pc and running seatools on it, it’s possible the HDD chose this same moment to fail but it’s mighty coincidental that happened on the same night that I originally ran the security update.

in the future I am going to put my OC/RefindPlus EFI on a USB key and use that to boot, with nothing else on it. That way, hypothetically, if something like that happens again at least it would destroy the partition map of a drive with nothing else in it. I was using that HDD for timemachine and ccc backups and main EFI. When I did the Mojave security update I was not using OC, through RefindPlus it boots Mojave natively. But still it boots through that EFI, so somehow the security update must have gotten confused about non standard setup or else like you said maybe the rom didn’t garbage clean and had some overrun or something but when I looked at it later it looked ok that way, I’m more suspicious of nvram not handling some long scary value or else simply my non standard EFI confused the updater. Hard to say
 

Dewdman42

macrumors 6502a
Jul 25, 2008
513
103
I went to have a look at that Catalina Security update, I used the URL I see in your screen shots, but when I open that link it shows the same page as you see, but when I click on the Download button I am getting directed to something that Safari is flagging impersonating "updates.cdn-apple.com to steal your personal or financial information"

What gives?
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,601
I went to have a look at that Catalina Security update, I used the URL I see in your screen shots, but when I open that link it shows the same page as you see, but when I click on the Download button I am getting directed to something that Safari is flagging impersonating "updates.cdn-apple.com to steal your personal or financial information"

What gives?
Direct link to the support page for Security Update 2021-003 (Catalina):
https://support.apple.com/kb/DL2075?locale=en_US

Screen Shot 2021-06-03 at 21.47.14.png


Link of the update package works fine from Safari and it's an Apple official domain.

Code:
whois cdn-apple.com
% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object

refer:        whois.verisign-grs.com

domain:       COM

organisation: VeriSign Global Registry Services
address:      12061 Bluemont Way
address:      Reston Virginia 20190
address:      United States

contact:      administrative
name:         Registry Customer Service
organisation: VeriSign Global Registry Services
address:      12061 Bluemont Way
address:      Reston Virginia 20190
address:      United States
phone:        +1 703 925-6999
fax-no:       +1 703 948 3978
e-mail:       info@verisign-grs.com

contact:      technical
name:         Registry Customer Service
organisation: VeriSign Global Registry Services
address:      12061 Bluemont Way
address:      Reston Virginia 20190
address:      United States
phone:        +1 703 925-6999
fax-no:       +1 703 948 3978
e-mail:       info@verisign-grs.com

nserver:      A.GTLD-SERVERS.NET 192.5.6.30 2001:503:a83e:0:0:0:2:30
nserver:      B.GTLD-SERVERS.NET 192.33.14.30 2001:503:231d:0:0:0:2:30
nserver:      C.GTLD-SERVERS.NET 192.26.92.30 2001:503:83eb:0:0:0:0:30
nserver:      D.GTLD-SERVERS.NET 192.31.80.30 2001:500:856e:0:0:0:0:30
nserver:      E.GTLD-SERVERS.NET 192.12.94.30 2001:502:1ca1:0:0:0:0:30
nserver:      F.GTLD-SERVERS.NET 192.35.51.30 2001:503:d414:0:0:0:0:30
nserver:      G.GTLD-SERVERS.NET 192.42.93.30 2001:503:eea3:0:0:0:0:30
nserver:      H.GTLD-SERVERS.NET 192.54.112.30 2001:502:8cc:0:0:0:0:30
nserver:      I.GTLD-SERVERS.NET 192.43.172.30 2001:503:39c1:0:0:0:0:30
nserver:      J.GTLD-SERVERS.NET 192.48.79.30 2001:502:7094:0:0:0:0:30
nserver:      K.GTLD-SERVERS.NET 192.52.178.30 2001:503:d2d:0:0:0:0:30
nserver:      L.GTLD-SERVERS.NET 192.41.162.30 2001:500:d937:0:0:0:0:30
nserver:      M.GTLD-SERVERS.NET 192.55.83.30 2001:501:b1f9:0:0:0:0:30
ds-rdata:     30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CFC41A5766

whois:        whois.verisign-grs.com

status:       ACTIVE
remarks:      Registration information: http://www.verisigninc.com

created:      1985-01-01
changed:      2017-10-05
source:       IANA

   Domain Name: CDN-APPLE.COM
   Registry Domain ID: 1623820299_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.corporatedomains.com
   Registrar URL: http://cscdbs.com
   Updated Date: 2020-10-31T05:57:56Z
   Creation Date: 2010-11-04T14:41:19Z
   Registry Expiry Date: 2021-11-04T15:41:19Z
   Registrar: CSC Corporate Domains, Inc.
   Registrar IANA ID: 299
   Registrar Abuse Contact Email: domainabuse@cscglobal.com
   Registrar Abuse Contact Phone: 8887802723
   Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
   Name Server: A.NS.APPLE.COM
   Name Server: B.NS.APPLE.COM
   Name Server: C.NS.APPLE.COM
   Name Server: D.NS.APPLE.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2021-06-04T00:48:16Z <<<


Domain Name: cdn-apple.com
Registry Domain ID: 1623820299_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.corporatedomains.com
Registrar URL: www.cscprotectsbrands.com
Updated Date: 2020-10-31T01:57:56Z
Creation Date: 2010-11-04T10:41:19Z
Registrar Registration Expiration Date: 2021-11-04T15:41:19Z
Registrar: CSC CORPORATE DOMAINS, INC.
Sponsoring Registrar IANA ID: 299
Registrar Abuse Contact Email: domainabuse@cscglobal.com
Registrar Abuse Contact Phone: +1.8887802723
Domain Status: clientTransferProhibited http://www.icann.org/epp#clientTransferProhibited
Registry Registrant ID: 
Registrant Name: Domain Administrator
Registrant Organization: Apple Inc.
Registrant Street: One Apple Park Way
Registrant City: Cupertino
Registrant State/Province: CA
Registrant Postal Code: 95014
Registrant Country: US
Registrant Phone: +1.4089961010
Registrant Phone Ext: 
Registrant Fax: +1.4089741560
Registrant Fax Ext: 
Registrant Email: domains@apple.com
Registry Admin ID: 
Admin Name: Domain Administrator
Admin Organization: Apple Inc.
Admin Street: One Apple Park Way
Admin City: Cupertino
Admin State/Province: CA
Admin Postal Code: 95014
Admin Country: US
Admin Phone: +1.4089961010
Admin Phone Ext: 
Admin Fax: +1.4089741560
Admin Fax Ext: 
Admin Email: domains@apple.com
Registry Tech ID: 
Tech Name: Domain Administrator
Tech Organization: Apple Inc.
Tech Street: One Apple Park Way
Tech City: Cupertino
Tech State/Province: CA
Tech Postal Code: 95014
Tech Country: US
Tech Phone: +1.4089961010
Tech Phone Ext: 
Tech Fax: +1.4089741560
Tech Fax Ext: 
Tech Email: apple-noc@apple.com
Name Server: d.ns.apple.com
Name Server: b.ns.apple.com
Name Server: c.ns.apple.com
Name Server: a.ns.apple.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2020-10-31T01:57:56Z <<<
 
Last edited:

Dewdman42

macrumors 6502a
Jul 25, 2008
513
103
the domain does look legit I agree. I'm a little nervous when I try to allow it through anyway, it prompts for my system password with no other explanation...
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.