MP 1,1-5,1 MacPro5,1: BootROM thread | 144.0.0.0.0

[tsialex]

@tsialex did it again!

Now my macpro has a repaired 138 rom with nvme patch and iMessage is working again, after two years of “vacation”.

Thumbs up to Alexandre, he’s then man!

Your SON (System/Sales Order Number) was the most weird I found yet, period.

I'd really like to know how MB871LL/A changed to 000310348281?!?!

Edit: maybe this 12 numerical digit format is related to BTO ones. More data is needed to confirm or disprove that.

 

[LightBulbFun]

Your SON (System/Sales Order Number) was the most weird I found yet, period.

I'd really like to know how MB871LL/A changed to 000310348281?!?!

interesting you mention this

because I have seen a few PowerPC systems where on the sticker where the specs are normally listed there is a long number string starting with SO....

(seen here on one of my own Dual 1.42Ghz MDDs, I got this MDD with another 1.42 MDD which has the specs listed as per normal in this location)

 

[handheldgames]

Yes, you can do that. But if you had any trouble with iCloud/iMessage/FaceTime or strange boot delays, do not do it. Compress your dump and PM me it, I'll check if you have any corruption in the firmware.

I checked 26 BootROM dumps so far, 11 of them had problems.

That would make an interesting post in Apple's bug reporter. How many of the ROMS had 0087 installed along the way?

 

[tsialex]

interesting you mention this

because I have seen a few PowerPC systems where on the sticker where the specs are normally listed there is a long number string starting with SO....

(seen here on one of my own Dual 1.42Ghz MDDs, I got this MDD with another 1.42 MDD which has the specs listed as per normal in this location)

View attachment 779090

Wow, weird one.

With @itadampf dump, the SON was bigger than the usual pre-defined space for the variable.

First one I saw with only numbers in a format different than 123-1234 for System Order Number, can be alphanumerical too when the SO is a Sales Order Number.

Edit: maybe this 12 numerical digit format is related to BTO ones. More data is needed to confirm or disprove that.

 

[itadampf]

My macpro was definitely a bto, and maybe was even replaced with a refurbished one as I had massive problem with apple raid card, could that be the reason?

 

[tsialex]

My macpro was definitely a bto, and maybe was even replaced with a refurbished one as I had massive problem with apple raid card, could that be the reason?

BTO ones has a format like 123-45678 or a alphanumerical with 9 digits. Your weird one had 12 numerical digits, 3 digits bigger than the usual defined space.

Maybe got corrupted when flashed by the repair centre. Did your iMessage stopped before or after repairs? Same time?

Edit: maybe this 12 numerical digit format is related to BTO ones. More data is needed to confirm or disprove that.

[doublepost=1535824990][/doublepost]

That would make an interesting post in Apple's bug reporter. How many of the ROMS had 0087 installed along the way?

Just one MP51.0087.B00 dump, but I bet that some of the 26 Mac Pros had MP51.0087.B00 before.

 

[The Spirit]

everything works fine again.
and my pc gpu 7870 unpatched now runs at 5G GT/s

 

[itadampf]

BTO ones has a format like 123-45678 or a alphanumerical with 9 digits. Your weird one had 12 numerical digits, 3 digits bigger than the defined space.

Maybe got corrupted when flashed by the repair centre. Did your iMessage stopped before or after repairs? Same time?
[doublepost=1535824990][/doublepost]
Just one MP51.0087.B00 dump, but I bet that some of the 26 Mac Pros had MP51.0087.B00 before.

Definitely after: like 2 or 3 years ago. When I was using Yosemite/El Capitan I am sure that iMessage working

 

[tsialex]

Definitely after: like 2 or 3 years ago. When I was using Yosemite I am sure that iMessage working

Maybe it's related with the repair, Apple started checking for more and more things when hackintosh people started to find the identifiers that were used to validate the iMessage logins.

 

[misanthrophy]

You can do this with only a NVMe drive, with some initial trouble. It's the process I use to reconstruct the BootROMs for everyone.

1. Dump your BootROM with ROMTool
2. Extract the NVRAM volume with UEFITool from your BootROM and the Apple new one.
3. Extract the LBSN_BD sector from the old one
4. Open the old and new NVRAM volumes with a hex editor, select the Base_XX/ssn/hwc/son block from the old and overwrite the new NVRAM with that. Save the new. You created a base NVRAM volume to use with every new Apple BootROM.
5. Open the new BootROM with UEFITool, replace the NVRAM volume with your populated one. Replace the LBSN_BD sector too. Save the reconstructed new BootROM.
6. Inject the NVMe DXE to the reconstructed BootROM
7. Use ROMTool to flash the new reconstructed BootROM

With the populated NVRAM volume and the LBSN_BD sector, you can reconstruct every past or future LOCKED.fd file from Apple.

I'm gonna detail this process soon, I already wrote most of it, but some things need to be streamlined. I'll will do a video to help too.

Okay, I am reading what you are writing and know the words, but I literally do not understand everything. Hahaha, sorry.

Should I just wait until you finish a HT article/video or you want to check my rom before? I can paypal you a donation to compensate your work!

 

[tsialex]

Okay, I am reading what you are writing and know the words, but I literally do not understand everything. Hahaha, sorry.

Should I just wait until you finish a HT article/video or you want to check my rom before? I can paypal you a donation to compensate your work!

I'll PM you.

 

[tamarro]

Your SON (System/Sales Order Number) was the most weird I found yet, period.

I'd really like to know how MB871LL/A changed to 000310348281?!?!

I guess this SON was not corrupted.

2010 I got me a brand new MP BTO 6-core, not refurbished.
My SON is of the same format: 12 numerical digits starting with 000310......

I have had three FW updates by Apple Installers since then:
-> 0084 -> 0089 -> 138. I do not believe that these updates corrupt my firmware. SON did not change between them.
BTW, I have never had any trouble with iCloud/iMessage/FaceTime ever.

Eventually, this is just another SON format for BTO Macs ...

 

[tsialex]

I guess this SON was not corrupted.

2010 I got me a brand new MP BTO 6-core, not refurbished.
My SON is of the same format: 12 numerical digits starting with 000310......

I have had three FW updates by Apple Installers since then:
-> 0084 -> 0089 -> 138. I do not believe that these updates corrupt my firmware. SON did not change between them.
BTW, I have never had any trouble with iCloud/iMessage/FaceTime ever.

Eventually, this is just another SON format for BTO Macs ...

It’s definitely possible. I’ve checked 31 unique Mac Pros 4,1 and 5,1 so far - Of this 31 unique ones, various were BTOs and with 3 of those the owners provided the Apple Store sales receipt email with all the data, @itadampf BTO Mac Pro was the first 12 digit one I've found.

I know it’s a small dataset to take any conclusions. I need to found more 12 digit ones with working iMessage to have any confirmation.

With @itadampf case, when I restored his SON (as System Order Number), iMessage returned from the dead after two years. So, a year before MP51.0083.B00.

Btw, if possible, I'd like to take a look on your BootROM.

 

[Catzjes]

Hello, I am trying to dump system ROM to include NVME and to post here for research by tsialex (thanks for all the hard work!!!) but I get a Kext Error: DirectHW.kext could not be loaded. The operation cannot proceed.
See screenshots, I disabled SIP in Recovery and switched the computer on with the power button pressed long enough to have the LED flash and hear the beep. What do I do wrong?

 

[tsialex]

Hello, I am trying to dump system ROM to include NVME and to post here for research by tsialex (thanks for all the hard work!!!) but I get a Kext Error: DirectHW.kext could not be loaded. The operation cannot proceed.
See screenshots, I disabled SIP in Recovery and switched the computer on with the power button pressed long enough to have the LED flash and hear the beep. What do I do wrong?

Do you have any antivirus installed? AV usually blocks DirectHW.kext access.

Btw, thx! =)

 

[Catzjes]

Do you have any antivirus installed? AV usually blocks DirectHW.kext access.

Btw, thx! =)

No AV software on cMP, only HS firewall enabled. AV was enabled on my MBP which I used to download the files but I downloaded the ROMTool direct on the cMP. Should I try to download all needed files directly on the cMP?

 

[tsialex]

No AV software on cMP, only HS firewall enabled. AV was enabled on my MBP which I used to download the files but I downloaded the ROMTool direct on the cMP. Should I try to download all needed files directly on the cMP?

Try downloading ROMTool.zip with this link.

 

[Catzjes]

Try downloading ROMTool.zip with this link.

I downloaded the file from the link directly on the cMP, Still same problem

 

[tsialex]

I downloaded the file from the link directly on the cMP, Still same problem

Weird, what could be blocking DirectHW?!?
[doublepost=1535907719][/doublepost]

I downloaded the file from the link directly on the cMP, Still same problem

What's your GateKeeper setting (System Preferences > Security & Privacy > Allow apps downloaded from)? It's the only other thing that I can remember now.

 

[Catzjes]

Weird, what could be blocking DirectHW?!?
[doublepost=1535907719][/doublepost]
What's your GateKeeper setting (System Preferences > Security & Privacy > Allow apps downloaded from)? It's the only other thing that I can remember now.

 

[tsialex]

View attachment 779273

Should work with your settings. Strange.

I've found another similar case #592

 

[crjackson2134]

I downloaded the file from the link directly on the cMP, Still same problem

Okay, i had a similar issue and cleared it by removing all instances of RomTool and associated files by using AppCleaner from the MAS.

Then I made sure SIP was disabled, then I opened RomTool v2.0 and it worked for me. Not sure if it will solve YOUR issue, but I had to remove RomTool and all associated files, then redo everything.

It's worth a shot...

 

[Catzjes]

Okay, i had a similar issue and cleared it by removing all instances of RomTool and associated files by using AppCleaner for the MAS.

Then I made sure SIP was disabled, then I opened RomTool v2.0 and it worked for me. Not sure if it will solve YOUR issue, but I had to remove RomTool and all associated files, then redo everything.

It's worth a shot...

It seems to work what you propose , I now get a warning, see screenshot. What to do next?

 

[crjackson2134]

It seems to work what you propose , I now get a warning, see screenshot. What to do next?

View attachment 779279

Read the warning...

I just trusted it and clicked continue. Since you are dumping the ROM it should be fine, but you SHOULD double check the chip before FLASHING the Rom...

 

[Catzjes]

Read the warning...

I just trusted it and clicked continue. Since you are dumping the ROM it should be fine, but you SHOULD double check the chip before FLASHING the Rom...

Thanks, I will check before flashing, and thanks for putting me "back on track"