Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
MP 1,1-5,1 MacPro5,1: BootROM thread | 144.0.0.0.0
- Thread starter tsialex
- WikiPost WikiPost
- Start date
- Sort by reaction score
- Status
Pun unintended, yes.Is that possibel??!! Sorry, had to.
NVRAM volume is composed of, at least, four parts. just one is public.
Before asking something, please just take a look in the thread, most - if not all - questions are already answered.
I know that is a big thread and I'll start to move some things out of here, but taking a look in the last two or three pages before asking something is basic.
I usually answer all questions when I have free time, please don't ask me the same thing three or four times.
I'm trying my best to help people here and I'll be blunt, if you all just keep asking the same things I'll start to ignore and do my research alone.
I know that is a big thread and I'll start to move some things out of here, but taking a look in the last two or three pages before asking something is basic.
I usually answer all questions when I have free time, please don't ask me the same thing three or four times.
I'm trying my best to help people here and I'll be blunt, if you all just keep asking the same things I'll start to ignore and do my research alone.
Please read the thread, I discussed this for the last two pages.
Last edited:
Thank you for helping my friend! All went well. With bootrom 140.0.0.0.0 you can see Bootable DVDs again.
There is no problem at all.
Thank You!
Great to hear, I had to drop my GT 120 back in recently to do a clean install. They are making it so that we need a GPU with Mac EFI less and less.
Out of interest, can you run the Apple Hardware Test now with a PC GPU? Currently that also requires a GPU with Mac EFI.
Hi there,
since @tsialex told us to keep still until the official 10.14.1 installer would be released,
i browsed further in this thread, dumped and checked my fw dump for those nasty x509 certs and boom. Two of them are in my current firmware.
I still have a serial number in AHT, though.
I recently installed two de-lidded X5680s into my MacPro4,1=>MacPro5,1 and had multiple problems with tightening the heatsinks correctly which resulted in a lot of tightening, testing, untightening, testing...
Point is, sometimes i forgot to hold ALT fast enough, so windows booted up and tried to "fix" my computer, because it found problems due to a not correctly tightened CPU cooler. (AHCI-BSOD)
And now i'm afraid to NVME inject my MP51.0089.B00 firmware, or god-forbid get it to 140.0.0.0.0
Would it be possible to remove these certs with @tsialex reconstruction method? If i had those intermediate files, that is...
Thanks in advance.
since @tsialex told us to keep still until the official 10.14.1 installer would be released,
i browsed further in this thread, dumped and checked my fw dump for those nasty x509 certs and boom. Two of them are in my current firmware.
I still have a serial number in AHT, though.
I recently installed two de-lidded X5680s into my MacPro4,1=>MacPro5,1 and had multiple problems with tightening the heatsinks correctly which resulted in a lot of tightening, testing, untightening, testing...
Point is, sometimes i forgot to hold ALT fast enough, so windows booted up and tried to "fix" my computer, because it found problems due to a not correctly tightened CPU cooler. (AHCI-BSOD)
And now i'm afraid to NVME inject my MP51.0089.B00 firmware, or god-forbid get it to 140.0.0.0.0
Would it be possible to remove these certs with @tsialex reconstruction method? If i had those intermediate files, that is...
Thanks in advance.
I can create the intermediate files for you, then you can use this MP5,1: BootROM reconstruction with intermediate files. I'll PM you.Hi there,
since @tsialex told us to keep still until the official 10.14.1 installer would be released,
i browsed further in this thread, dumped and checked my fw dump for those nasty x509 certs and boom. Two of them are in my current firmware.
I still have a serial number in AHT, though.
I recently installed two de-lidded X5680s into my MacPro4,1=>MacPro5,1 and had multiple problems with tightening the heatsinks correctly which resulted in a lot of tightening, testing, untightening, testing...
Point is, sometimes i forgot to hold ALT fast enough, so windows booted up and tried to "fix" my computer, because it found problems due to a not correctly tightened CPU cooler. (AHCI-BSOD)
And now i'm afraid to NVME inject my MP51.0089.B00 firmware, or god-forbid get it to 140.0.0.0.0
Would it be possible to remove these certs with @tsialex reconstruction method? If i had those intermediate files, that is...
Thanks in advance.
Hey thanks.
My Safari wouldn't allow, neither would Chrome, however Firefox allowed.
Cheers
My Safari wouldn't allow, neither would Chrome, however Firefox allowed.
Cheers
I guess if this is my output of binwalk I need to go through reconstruction...
Tsialex should people just be PM'ing you directly with these dumps, rather than posting them in this thread?
Tsialex should people just be PM'ing you directly with these dumps, rather than posting them in this thread?
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 UEFI PI firmware volume
16524 0x408C UEFI PI firmware volume
24972 0x618C CRC32 polynomial table, little endian
35787 0x8BCB mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
49948 0xC31C UEFI PI firmware volume
524288 0x80000 UEFI PI firmware volume
540812 0x8408C UEFI PI firmware volume
549260 0x8618C CRC32 polynomial table, little endian
560075 0x88BCB mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
574236 0x8C31C UEFI PI firmware volume
1048576 0x100000 UEFI PI firmware volume
1114112 0x110000 UEFI PI firmware volume
1181518 0x12074E Certificate in DER format (x509 v3), header length: 4, sequence length: 986
1247054 0x13074E Certificate in DER format (x509 v3), header length: 4, sequence length: 986
1343538 0x148032 bzip2 compressed data, block size = 100k
1376256 0x150000 UEFI PI firmware volume
--------------------------------------------------------------------------------
0 0x0 UEFI PI firmware volume
16524 0x408C UEFI PI firmware volume
24972 0x618C CRC32 polynomial table, little endian
35787 0x8BCB mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
49948 0xC31C UEFI PI firmware volume
524288 0x80000 UEFI PI firmware volume
540812 0x8408C UEFI PI firmware volume
549260 0x8618C CRC32 polynomial table, little endian
560075 0x88BCB mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
574236 0x8C31C UEFI PI firmware volume
1048576 0x100000 UEFI PI firmware volume
1114112 0x110000 UEFI PI firmware volume
1181518 0x12074E Certificate in DER format (x509 v3), header length: 4, sequence length: 986
1247054 0x13074E Certificate in DER format (x509 v3), header length: 4, sequence length: 986
1343538 0x148032 bzip2 compressed data, block size = 100k
1376256 0x150000 UEFI PI firmware volume
My output is identical. What does it mean? I read a few pages back in the thread, but I'm not clear on what these "x509" things are. Why are they bad? How did they get into the firmware?
Would extracting them provide us any useful info? https://support.microsoft.com/en-us/help/216830/how-to-view-the-contents-of-a-certificate
Last edited:
I already explained this, but I'm going to detail it know so no more doubts about this.
When you install W8.1 UEFI or W10 UEFI, Microsoft signs your UEFI firmware. It's a security measure, to detect modifications into your BootROM. This is done by a X509 certificate, Microsoft Windows Secure Boot Variable Signer, written into one of the stores of the NVRAM volume. MS shouldn't sign at all a EFI 1.10 Mac like MP5,1.
Code:
0 UUS10U
Washington10URedmond10U
Microsoft Corporation1604U-Microsoft Windows Secure Boot Variable Signer-^g—pG∑EÁ
`˝¡flÜ0
`ÜHe0
*ÜHܘ
Ç4Ö>˘1◊¢$b‰∏{⁄#‹_¿áÑÆ‹œñ…<yí·À≥˜©˜O…HÅd˜)ÛØΩ≥∆„åΩØmÙdA˝ˆ-ÔÚfi;Óˇ{ßj›tµh∞\˙Ï–æZl˝å—÷@£OÕ uñf=¸>ä∫óܪÇ[óç“sî∑;Å3Sms ®xkÉ∆,∆ï•Õπofl≈WSõ
ü1_˙ô÷Ûƒ∞=«å?˜^Ö¢F=¨-Ü[{‚lùYSØ∫@:ójJE"93ŸâÄ@ á“R¥ôÜΩÙó˜Ü¸ö9Ô÷ºå»Œùƒ±/º$Ó±≈MÅô öG≤Q∑”SUŸÕ·»Ôü6™U.Ωö˙wY2MΩ`(ÙÁèxKBootDebugPolicyApplied*™U Ωö˙wY2MΩ`(ÙÁèxKKernel_SiStatus™U&Ωö˙wY2MΩ`(ÙÁèxKKernel_RvkSiStatus™U&Ωö˙wY2MΩ`(ÙÁèxKKernel_SkuSiStatus™U&Ωö˙wY2MΩ`(ÙÁèxKKernel_WinSiStatus™U&Ωö˙wY2MΩ`(ÙÁèxKKernel_ATPSiStatus™U2Ωö˙wY2MΩ`(ÙÁèxKKernel_EntRevokeSiStatus™U(Ωö˙wY2MΩ`(ÙÁèxKWindowsBootChainSvn™U o"ÏÍ£…zG®&›«Õ¿„UnlockID¬å÷°õqÏœ!PÕ°Q\¸R=˛îûiÖ≤Ø ~™U o"ÏÍ£…zG®&›«Õ¿„UnlockIDCopy¬å÷°õqÏœ!PÕ°Q\¸R=˛îûiÖ≤Ø ~™U,afl‰ã ì“™
‡ò+åBoot0000tWindows Boot Manager*(@Ä-u>ÚÌB≥√HáëuHœF\EFI\Microsoft\Boot\bootmgfw.efiˇWINDOWSàxBCDOBJECT={9dea862c-5cdd-4e70-acc1-f32b344d4795}ˇ™U4 o"ÏÍ£…zG®&›«Õ¿„OfflineUniqueIDRandomSeedPèÜXåü:fiX¡ˆA«ªòBflCû⁄ìÛå¥∂S∞%1™U:o"ÏÍ£…zG®&›«Õ¿„OfflineUniqueIDRandomSeedCRC~¸|-™U afl‰ã ì“™
‡ò+åBoot0080Mac OS X–A
*(@`ÏcG<mÜ`+DÆ!∫î\ÈŒ$˜¸tæ|ÛIëGÙ.hB(µ∞¥DÑËÈZwÂ⁄ö\5F9FFDCF-A953-3065-83D7-5680871467D1\System\Library\CoreServices\boot.efiˇ™Uafl‰ã ì“™
‡ò+åBootOrderÄ™U*aC|*´ªK®Ä˛Aô\üÇefi-boot-device-data–A
*(@`ÏcG<mÜ`+DÆ!∫î\ÈŒ$˜¸tæ|ÛIëGÙ.hB(µ∞¥DÑËÈZwÂ⁄ö\5F9FFDCF-A953-3065-83D7-5680871467D1\System\Library\CoreServices\boot.efiˇ™U ºaC|*´ªK®Ä˛Aô\üÇefi-boot-device<array><dict><key>IOMatch</key><dict><key>IOProviderClass</key><string>IOMedia</string><key>IOPropertyMatch</key><dict><key>UUID</key><string>7FB57F28-B4B0-4408-84E8-E95A7F77E5DA</string></dict></dict><key>BLLastBSDName</key><string>disk2s2</string></dict><dict><key>IOEFIDevicePathType</key><string>MediaFilePath</string><key>Path</key><string>\5F9FFDCF-A953-3065-83D7-5680871467D1\System\Library\CoreServices\boot.efi</string></dict></array>™UaC|*´ªK®Ä˛Aô\üÇprev-lang:kbden:0™U$aC|*´ªK®Ä˛Aô\üÇcsr-active-configw™UÇafl‰ã ì“™
‡ò+åBootFFFFz–A
*(@Ä-u>ÚÌB≥√HáëuHœ0\EFI\BOOT\BOOTX64.efiˇ™U“¯µ©mÀ¬Bºµˇ™‰3^PBRDevicePathPCIROOT(0)#PCI(1F02)#ATA(C02T00L00)The problem is, Microsoft is signing multiple times the BootROM. Most people have one signing certificate, some have two. I found three of those certificates into hardware dumps of two backplanes that couldn't boot anymore, read by SPI flash programmers after the SPI flash was removed from the board for repair.
I found two decent support article about the Secure Boot process, Diving into Secure Boot and Windows Secure Boot Key Creation and Management Guidance, but I still don't know when the signing is done and why is happening multiple times with Mac Pro 5,1.
So, if you have two of those, don't wait to Microsoft sign it again and cause havoc. Post here that you found two, I'll PM you with instructions.
Last edited:
If this “sign the BootROM” thing may happen when we switch to Windows from MacOS. Then it will perfectly explain why my last logicboard is bricked.
That happened right at the moment I tried to reboot my cMP into Windows.
I found two decent support article about the Secure Boot process, Diving into Secure Boot and Windows Secure Boot Key Creation and Management Guidance, but I still don't know when the signing is done and why is happening multiple times.
I think the only feasible way of not messing up your BootROM is installing via the DVD in legacy mode, amirite?
With CSM mode, Microsoft don't sign the BootROM.
Why most people don't have multiple certificates and some had three?
One thing that I know, the two bricks that I have hardware dumps of the SPI flash memory had been upgraded to MP51.0087.B00 before, so maybe this is triggered by the missing microcodes?
This problem needs more investigation and reports to Apple and Microsoft.