Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
- Status
It will be good news indeed when we have a thoroughly tested & reliable method & tools ( RomTool ) and also a similarly tested & reliable way to go back to a prior bootROM version.
So far, only zozmester is our single M.2 tester - I admire his courage, a real 'bunjee jumper' !
He quickly turned defeat into victory ! Well done ! let's hope tha tno other problems arise.
I've upgraded a 10.13.4 install to 10.13.5 with the "UPGRADE" ( not the Combo ).
I'll be prudent and wait until High Sierra is final before doing the bootROM flash.
This is not something that one should not rush into.
I also feel like others in this thread that the "MicroCode = 0 " is probably a mistake.
Definitely not going to flash to '87' bootROM ! I'm now at '85 and will stay there for the time being.
So far, only zozmester is our single M.2 tester - I admire his courage, a real 'bunjee jumper' !
He quickly turned defeat into victory ! Well done ! let's hope tha tno other problems arise.
I've upgraded a 10.13.4 install to 10.13.5 with the "UPGRADE" ( not the Combo ).
I'll be prudent and wait until High Sierra is final before doing the bootROM flash.
This is not something that one should not rush into.
I also feel like others in this thread that the "MicroCode = 0 " is probably a mistake.
Definitely not going to flash to '87' bootROM ! I'm now at '85 and will stay there for the time being.
Kind of off topic, but could this method or something similar be able to get Sierra 10.12.6 support for AMD Vega GPU? Would be fantastic for those cMP with one foot still in Sierra and one foot in HS to use the latest AMD gpu for both OSs.
3D acceleration support depends on whether the OS has the correct drivers. If Sierra doesn't have the correct drivers for VEGA then it will not work.
Even in High Sierra, cMP users are struggling to make the Vega card work properly. Don’t expect it’s possible to easily make Vega work in Sierra. Even we can found a way to patch the driver to run in Sierra, I still doubt if that’s stable enough for daily use.
And if this kind of patch exist, I expect quite a few users should do that already (e.g. make a 280X can work in 10.6.8), but I haven’t seen a single case so far.
Is there a way to emulate a virtual pc using a certain EFI? If that was possible we could check to see if the efi works well before flashing it on a Mac Pro.
M
my Mac Pro 5.1 boots fine from pcie nvme 960 it is fast and so far no crash I did fresh install on it by removing firmware folder from installer
I don’t think it matters what carrier card someone uses as long the ssd is detected in the OS, it is bootable by the hacked bootrom.
The confusion started with someone thinking it was caused by the carrier card but actually the bootrom 87 isn’t hackable as of yet. Just use 85 and it’s all fine.
Which folder exactly did you remove? I’m in for the samething. Could you provide us with the location? Was it the combo Installer or the regularisering one?
Best regards
/Per
Best regards
/Per
I would just rather narrow things down, before we go telling everyone that any carrier board will work.
If those that have tried this will kindly report the PCI-E to M.2 card they are using, as well as the drives, Firmware version that was modded, slot used, and any other data they feel like sharing, I think that would be the biggest help to everyone.
So we can start to narrow down any incompatibles, that's what Apple would do if they had enabled this, and I don't think they ever will, so we need our own bug tracking and QC.
My bootrom is 85, did fresh install on Lycom DT-120 with Samsung 960NVME, PCIe card is attached to slot number 3, on slot 2 speed was half. I am now having around 1500mb /sec. I have order another pcie card as x16 and as soon as it arrive I will attach another samsung this time 970 on it, but since I have a USB 3.0 on slot 4, only available slot is 2 or swap usb card and pcie card according to speed result.
\
I think we all know bootrom 85 and earlier is open for modification, not sure for 87, I think zozomester came back from 87 to 85 I dont know how, if this was possible than I should keep may rom in back up somewhere, and dont worry for future roms, if I can revert back to lower firmware anytime no concern. If zozomester explain how he did this would be good.
Yes, it's much better to dump your own ROM and keep it safe. That's with your Mac's unique serial, will make your life much easier if you really need those ROM in future.
The downgrade method sounds much easier than expected. Just rename the .fd file in the firmware folder to a high version number, than the installer will believe there is a firmware "upgrade" and flash that firmware into the Mac.
Also, someone reported that it's possible to use ROMTool to flash an older firmware back in, but will need more info to confirm this.
Did someone checked what has been changed in the new firmware ? is there a tool to make a qucik comparison to understand changed portion I heard the microcode version is zero on 87 seems like a mistake.
If we can make that kind of comparison can we find out why NVME hack is not working ?
I am sorry but I dont have any knowledge about firmware or hardware just trying to gather information as much as possible. to keep my mac as much as possible..
IMO, without the help from Apple's documents, it will be extremely hard to "decode" the changes by just comparing the old / new ROM.
We already know why the NVME hack doesn't work, Apple patched the FW so malicious code can't inject itself into the boot rom. You have to understand the EFI/UEFI is really just a basic and extendable OS that runs at boot time.
The same thing that makes it extendable, also makes it vulnerable, really anyone can add any functionality they want to EFI/UEFI, good or bad.
I once booted a HP ICH8 based laptop from both firewire and Wifi into the macOS, even tho the legacy bios didn't support booting from either. If I wanted to turn that knowledge into blackhat misdoings, it would be easy.
I am a Darth after all.
The same thing that prevents bad actors for injecting code into .87, also prevents us. I'm sure we could circumvent it if we really wanted to, but we have the old FW's that work just fine for what we want to do, so at this point there is no need.
Let's burn that bridge when Apple adds something to the FW we can't live without.
We already know why the NVME hack doesn't work, Apple patched the FW so malicious code can't inject itself into the boot rom. You have to understand the EFI/UEFI is really just a basic and extendable OS that runs at boot time.
The same thing that makes it extendable, also makes it vulnerable, really anyone can add any functionality they want to EFI/UEFI, good or bad.
I once booted a HP ICH8 based laptop from both firewire and Wifi into the macOS, even tho the legacy bios didn't support booting from either. If I wanted to turn that knowledge into blackhat misdoings, it would be easy.
I am a Darth after all.
The same thing that prevents bad actors for injecting code into .87, also prevents us. I'm sure we could circumvent it if we really wanted to, but we have the old FW's that work just fine for what we want to do, so at this point there is no need.
Let's burn that bridge when Apple adds something to the FW we can't live without.
I don't think we know that at all. Just because the NVMe hack doesn't appear to work on 0087 (and as far as I know was only reported by one person) doesn't mean it's related to the vulnerability Apple patched. I'm not saying that you're wrong, but I don't think there is near enough evidence for anyone to know yet one way or another.
I'm using this M.2 carrier in slot 4. I put a cute green LED on it - nostalgic from my Amiga 4000T days.
My 960 EVO gets about 1360mb write & 1,400mb read on 4Gb test with this carrier.
It is sold by a Japanese company that produces cheap PC accessories.
http://www.kuroutoshikou.com/product/interface/converter_board/m_2-pcie/
My 960 EVO gets about 1360mb write & 1,400mb read on 4Gb test with this carrier.
It is sold by a Japanese company that produces cheap PC accessories.
http://www.kuroutoshikou.com/product/interface/converter_board/m_2-pcie/
I Already had High Sierra 10.13.4 up and running. I updated to 10.13.5 using the "UPDATE" . .NOT the Combo and NOT the full installer. This avoids the bootROM flash altogether.
I haven't flashed my MP51.0085.B00 bootROM yet. I'm running my 960 EVO M.2 in a Fusion setup in Sierra 10.12.6.
I prefer to wait for High Sierra's last & final upgrade before flashing the BootROM in case Apple has any more unpleasant surprises for us.
In the meantime I am setting up a High Sierra 10.13.5 install in a HFS SSD with all the apps & files I need for day to day use and will keep that updated . . then when 10.13.6 ( final ? ) is released I will be able to do a CCC to the 960 EVO M.2and then do the bootROM flash ( with fingers crossed ).
Who knows. . dosdude1 & LightBulbFun may come up with new toys for us to play with by then.
At this stage I'm not interested at all in 10.14.x Mojave.
I haven't flashed my MP51.0085.B00 bootROM yet. I'm running my 960 EVO M.2 in a Fusion setup in Sierra 10.12.6.
I prefer to wait for High Sierra's last & final upgrade before flashing the BootROM in case Apple has any more unpleasant surprises for us.
In the meantime I am setting up a High Sierra 10.13.5 install in a HFS SSD with all the apps & files I need for day to day use and will keep that updated . . then when 10.13.6 ( final ? ) is released I will be able to do a CCC to the 960 EVO M.2and then do the bootROM flash ( with fingers crossed ).
Who knows. . dosdude1 & LightBulbFun may come up with new toys for us to play with by then.
At this stage I'm not interested at all in 10.14.x Mojave.
Last edited:
I opened installer as show contents/resources/firmware
I have deleted that firmware folder
And installed
Hi,
Sorry I definitely had no time last days... I am terribly busy with work and won't have any free time before at least 1 week...
As some told they couldn't boot on NVMe with Bootrom MP_0087, I tried to found a little time to test and patch the MP51_0087 BootRom on a second Mac Pro I have.
And it did worked like a charm...
I can't see where things go wrong so I put my result files as an attachment.
here is what I did :
- first, save the full BootRom with dosdude1 ROMTool (just in case... I didn't used it)
- as before, I work with the EfiUpdater2.efi file from the MacProEFIUpdate15
- extract the MP51_0087 update file (MP51_0087_00B_LOCKED.fd) from the 10.13.5 High Sierra installer app
- extract the NVMe DXE driver from the MBP114_0183 Bootrom and saved it as a .ffs file (named "51116915-MBP114_0183_NVMe_DXE.ffs")
- insert this .ffs file in the MP51_0087_BootRom update file, and save the NVMe patched result BootRom as MP51_0087_00B_LOCKED_NVMe.rom
- calculate the CRC32 value of this MP51_0087_00B_LOCKED_NVMe.rom file : that gave me a value of 0f439227 which is 2792430F in big endian
- patch the EfiUpdater2.efi file from the MacPro Firmware Update 1.5 with the new CRC32 value : search for BDD7C676 (big end. crc32 of the 4.1 BootRom) and replace with 2792430F (big end. crc32 of the 5.1 0087 BootRom patched for NVMe)
- save this new patch file as EFIUpdater2010_modded_to_2792430F.patch
- patch the EfiUpdater2.efi
- put both the patched EfiUpdater2.efi file and MP51_0087_00B_LOCKED_NVMe.rom in the /System/Library/CoreServices/Firmware\ Update folder
- rename MP51_0087_00B_LOCKED_NVMe.rom to MP51_007F_03B_LOCKED.rom
then ran the bless command, shut down and pressed a long time the power button.
A simplier methor could be with dosdude1 BootRom ROMTool :
- upgrade while running on an AHCI drive your Mac Pro 5.1 to High Sierra 10.13.5, so that the Bootrom MP51_0087 will be natively applied
- dump your BootRom with ROMTool
- patch it with the DXE NVMe driver
- flash your Bootrom with the resulted file with ROMTool
As always, please do have a backup and be careful while playing with Bootrom upgrades.
PS : here is a photo of the basic M.2 PCIe card I used on my two Mac Pros.
Both MacPros recognised at boot the XG5 drive (set to 4K blocs) with Sierra, one with a patched MP51_0084 BootRom the other one with the MP51_0087 BootRom.
- Status