Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MP51.0084.B00 Rom Dump Request

Status
Not open for further replies.
Hi !
I´m trying to follow gilles_polysofts tutorial, witch is very detailed by the way, but I got stuck on CRC32 and value "f35a82b5". I do get "a7bc8121" and then there is a djump to this means "B5825AF3" in Big Edian? Okey?? I do not follow. I realise that I nead this number to switch the BDD7C676 in hexeditor but. How do I get from "a7bc8121" to "B5825AF3"?

/Per
 
so @mikeboss very kindly dumped a Mac Pro 6,1s BootROM for me and extracted and sent over to me 2 files :)

the FL1100.ffs file

and a XHCI.ffs file

both of these are related to USB 3 (the first one is related to the FL1100 chipset specifically and the XHCI one just handles general class USB 3.0 stuff)

i put these modules into my Mac Pro 5,1s BootROM and sadly it did not work

the FL1100 driver never loads for some reason, but the XHCI driver does load. (I tried just the XHCI driver on its own made no difference, and with the FL1100 driver on its own the Mac Pro acts like it does on stock boot rom ie no USB 3 detected at all)

and when i plug in a USB drive it does light up and stuff but the Mac Pro does not see the USB stick in the boot picker or it hard locks (ie if i reboot with the USB stick connected to the USB 3 card and hold alt it hard locks)

so it looks like the XHCI driver is doing something but its not meshing properly with the Mac Pro 5,1 it would be very interesting to try some other XHCI USB3 chipsets like an ASmedia card? (my USB 3.0 card is one of those very common red coloured Inateck branded KT4004 cards)
 
  • Like
Reactions: mikeboss
@LightBulbFun

what values are you seeing in the system profiler? MacPro6,1 values are

USB 3.0 Bus:
Host Controller Driver: AppleUSBXHCIFL1100
PCI Device ID: 0x1100
PCI Revision ID: 0x0010
PCI Vendor ID: 0x1b73
 
  • Like
Reactions: Squuiid
Can anyone verify that Ubuntu 10.04 is the correct version for an original 4,1 Mac pro ? (has been flashed to 5,1 )
Ubuntu 10.04 (Lucid Lynx) ?
 
gilles_polysoft said:
Hi Muhammet,

Sorry I had lot of work lately and didn't have the time to make a lot of documentation yet..
I'm in the process of making a tutorial on ifixit, maybe I'll have finished in next days but can't promise (I would really love to make this documentation available to all).
If you want all files and archives I made yet I can send you them via personal mail.

I think we have no right to publish any BootRom from Apple, but we can publish any procedure so that anyone can try the upgrade.

First of all, please, make backups of your systems, Roms, etc.
I highly recommend, yet, to do backups with SPI programmer if possible.
Work with a uninterruptible power supply (UPS) if possible.
Any failure while working on the Bootrom can brick your computer...

Note that once your cMP flashed with a NVMe modded BootRom, you will be able to :
- run Sierra (like I did) or High Sierra, booted from a 4K compatible (and 4K formatted) NVMe drive. 4K capable NVMe SSD include any Kingston (A1000, KC1000), Toshiba (XG3-XG4-XG5), some WD / OCZ, some Intel datacenter SSDs.
- otherwise, run High Sierra from any 512b formated NVMe SSD, including any Samsung M.2 NVMe SSD.

In any case, macOS Sierra and High Sierra will both try to update the BootRom at each update, forever.
While we can't stop this process, fortunately the fact is that, while booted from any external or NVMe drive, BootRom update will fail... That will keep our cMP with its modded NVMe Bootrom !
But if you boot any time from an internal AHCI drive and proceed to macOS update, thought, there is a risk that a BootRom update may succed which can revert to a non-NVMe compatible BootRom.. You are warned !


That said, here are the process I made, and sorry for my bad english...

The process is doable either : 1) with hardware SPI programmer, which may be best at present (by safety, because with an SPI programmer it's easy to roll back any change if anything goes wrong), or : 2) with software, by patching the EFIUpdater files.


Pre-requirement : extraction of the NVMe DXE driver :
- download and install Pacifist.app : https://www.charlessoft.com
- download and install UEFI Tool : https://github.com/LongSoft/UEFITool/releases
- download "Install macOS High Sierra.app" : https://itunes.apple.com/fr/app/macos-high-sierra/id1246284741
- locate your "Install macOS High Sierra.app", right-click on it and click on "show Package content"
- open "InstallESD.dmg" file in "Contents/SharedSupport"
- you get a mounted "InstallESD" volume. Right-click on the "Firmwareupdate" package and click on "Open with Pacifist"
- in Pacifist, click on the "Resources" tab and open "FirmwareUpdate.pkg"->"Scripts"->"Tools"->"EFIPayloads". Select any firmware payload from a Mac that has native NVMe support, I have used the rMBP 11.4 (MBP114_0182_B00.fd)
- click on "extract as is" and save the MBP114_0182_B00.fd file [edit : corrected thanks to LightBulbFun)
- open that same MBP114_0182_B00.fd file with "UEFI Tool"
- do a text search (not unicode) with "NVMe" : you will find the NVMe DXE driver at an address starting with "51116915-C34B"
- right-click on the DXE driver and click on "extract body", save the file (with an informative name like "NVMe_DXE_apple.ffs" for example )

Here it is, you have the NVMe DXE driver.


Next, solution n°1, with a SPI programmer :
process is very straightforward :
- unsolder the BootRom (chip U8700 on the logic board, a SST 25VF032B on my logic board)
- read the BootRom with an SPI programmer and save the 4M resulting file (for ex. : MP51.007F.xxxxxx_orig.rom
- open the result file with UEFI Tool
- search for a text (non unicode) field "DXE" : that will get you to the DXE driver image portion
- add the previously saved NVMe DXE driver after the last DXE driver (Insert after)
- save the file (ex: MP51.007F.xxxxx_NVMe.rom) and write it back to the Bootrom chip
- solder back the BootRom chip
- et voilà !



Otherwise, solution n°2, With software : (might only work yet on a 4.1 MacPro with BootRom MP51.007F)
the aim is to use the MP51.0085.00B_LOCKED firmware from High Sierra installer app, to patch it to add NVMe DXE driver, then to use the EfiUpdaterApp2.efi programm from MacPro Firmware Update 1.5 which will be patched with help of a script from Netkas MacPro2009-2010 Firmware tool to make accept our modded firmware (with a different CRC32 file)... Sorry if that sounds complicated, I've not managed to patch the EfiUpdaterApp2.efi from High Sierra yet...

Procedure might be changed if starting from a different BootRom version or board...
As always, make backups...

- If running on El Capitan or Sierra and have SIP enabled, start on recovery partition, disable SIP, and reboot.
- download MacPro2009-2010FirmwareTool.zip from Netkas forums
- download MacPro Firmware Update 1.5 : https://support.apple.com/kb/dl1321?locale=en_CA
- download Hexfriend (or any Hexadecimal editor)
- locate your "Install macOS High Sierra" app
- right-click on "Install macOS High Sierra.app", click on "show Package content"
- open "BaseSystem.dmg" file in "Contents/SharedSupport"
- you get an "OS X Base System" mounted volume. Open it, locate the "Install macOS High Sierra.app" at the root of this volume, right-click on it and click on "Show Package Content"
- open the folders "Contents/Resources/Firmware" : you will find in it the last MacPro 5.1 BootRom : MP51.0085.00B_LOCKED.fd
- Make a copy of this file to your desktop
- open this "MP51.0085.00B_LOCKED.fd" file with UEFI Tool
- search for a text (non unicode) field "DXE" : that will get you to the DXE driver image portion
- add the previously saved NVMe DXE driver after the last DXE driver (Insert after)
- save the file (ex: MP51.0085.00B_NVMe.fd)
- with the terminal, calculate the CRC32 of this modded fd file (type : CRC32 and drag your MP51.0085.00B_NVMe.fd file)
- If you used same XDE driver as mine (from rMBP11,4) you should get a value of f35a82b5 which translate to B5825AF3 in big endian
- locate your MacPro2009-2010FirmwareTool and right click on it -> Show Package Content
- open Contents/Resources/ folder, and locate EFIUpdater2010.patch and drag it on your hexadecimal editor
- search and replace for hexadecimal BDD7C676 (big end. crc32 of the 4.1 BootRom) with BE5899C0 (big end. CRC32 of our modded MP51.0085.00B_NVMe.fd file)
- save the obtained file as EFIUpdaterNVMe.patch
- locate your MacPro Firmware Update 1.5 dmg, and mount it on the Desktop
- open with Pacifist the MacProEFIUpdate.pkg
- extract the file "EfiUpdaterApp2.efi" from the resource tab and save it to the same folder as EFIUpdaterNVMe.patch. Note the name of the firmware : MP51_007F_03B_LOCKED.fd
- Patch your "EfiUpdaterApp2.efi" with the previously done "EFIUpdaterNVMe.patch" by typing in the terminal :
patch EfiUpdaterApp2.efi EFIUpdaterNVMe.patch
- If all done well, you now have your patched EfiUpdaterApp2.efi programm and your modded firmware MP51.0085.00B_NVMe.fd
- Place a copy of those both files in /System/Library/CoreServices/Firmware\ Updates/
- rename MP51.0085.00B_NVMe.fd as MP51_007F_03B_LOCKED.fd
- Bless the EfiUpdaterApp2.efi file :
/usr/sbin/bless -mount / -firmware /System/Library/CoreServices/Firmware\ Updates/EfiUpdaterApp2.efi -payload /System/Library/CoreServices/Firmware\ Updates/MP51_007F_03B_LOCKED.fd -options "-x efi-apple-payload0-data" --verbose
- if all done well, you should get "exit 0" as result

You can now shut down your MacPro, then press and hold the power button and let the firmware update be done.
Click to expand...
Very nice job! You could not share your modified Firmware?
 
LightBulbFun said:
so @mikeboss very kindly dumped a Mac Pro 6,1s BootROM for me and extracted and sent over to me 2 files :)

the FL1100.ffs file

and a XHCI.ffs file

both of these are related to USB 3 (the first one is related to the FL1100 chipset specifically and the XHCI one just handles general class USB 3.0 stuff)

i put these modules into my Mac Pro 5,1s BootROM and sadly it did not work

the FL1100 driver never loads for some reason, but the XHCI driver does load. (I tried just the XHCI driver on its own made no difference, and with the FL1100 driver on its own the Mac Pro acts like it does on stock boot rom ie no USB 3 detected at all)

and when i plug in a USB drive it does light up and stuff but the Mac Pro does not see the USB stick in the boot picker or it hard locks (ie if i reboot with the USB stick connected to the USB 3 card and hold alt it hard locks)

so it looks like the XHCI driver is doing something but its not meshing properly with the Mac Pro 5,1 it would be very interesting to try some other XHCI USB3 chipsets like an ASmedia card? (my USB 3.0 card is one of those very common red coloured Inateck branded KT4004 cards)
Click to expand...
Can you share the FL1100.ffs file, please? I want to do some testing.
 
mikeboss said:
@LightBulbFun

what values are you seeing in the system profiler? MacPro6,1 values are

USB 3.0 Bus:
Host Controller Driver: AppleUSBXHCIFL1100
PCI Device ID: 0x1100
PCI Revision ID: 0x0010
PCI Vendor ID: 0x1b73
Click to expand...

here you go :) looks to be the same as whats in the Mac Pro 6,1... (this is with my Mac pro 5,1 running its stock BootROM)

upload_2018-5-23_10-12-55.png


upload_2018-5-23_10-13-7.png
 
LightBulbFun said:
so @mikeboss very kindly dumped a Mac Pro 6,1s BootROM for me and extracted and sent over to me 2 files :)

the FL1100.ffs file

and a XHCI.ffs file

both of these are related to USB 3 (the first one is related to the FL1100 chipset specifically and the XHCI one just handles general class USB 3.0 stuff)

i put these modules into my Mac Pro 5,1s BootROM and sadly it did not work

the FL1100 driver never loads for some reason, but the XHCI driver does load. (I tried just the XHCI driver on its own made no difference, and with the FL1100 driver on its own the Mac Pro acts like it does on stock boot rom ie no USB 3 detected at all)

and when i plug in a USB drive it does light up and stuff but the Mac Pro does not see the USB stick in the boot picker or it hard locks (ie if i reboot with the USB stick connected to the USB 3 card and hold alt it hard locks)

so it looks like the XHCI driver is doing something but its not meshing properly with the Mac Pro 5,1 it would be very interesting to try some other XHCI USB3 chipsets like an ASmedia card? (my USB 3.0 card is one of those very common red coloured Inateck branded KT4004 cards)
Click to expand...

I would try to build the XHCI drivers from EDKII, they should be generic rather than chip specific.

Test them in a shell, don't use rFIT or rFind, but rather just bless a shell.efi to boot from so you can test against the EFI kernel Apple is using on your system's firmware.

I forget the exact sequence but it should be something like

load XHCI.efi
reconnect -r

then maybe map fs to map any USB 3 disk you may have plugged in.

If it works then you can generate .ffs files from the .efi driver models.

https://github.com/pbatard/efifs/wiki/Adding-a-driver-to-a-UEFI-firmware

Or you could try a prebuilt version to see if it works:

https://drive.google.com/open?id=1MyiCVdfUXkpIXtFR3JVwfjR3lDx-sMyR

I included the .ffs I extracted, as well as the firmware I extracted it from, and the Xhci.efi driver.

I would test the driver from a shell to see if it links and works for you USB 3 PCI card.

I loaded it from a shell, and it did load, however I'm having trouble passing XHCI to the virtual machine I use to test, so the driver didn't link to anything, because there isn't any XHCI device to link to.

You may want to extract the .ffs yourself, as I'm not 100% sure I did it right, and we don't want to brick your MP.

Sadly I don't own a MP to test with.
 
Last edited:
  • Like
Reactions: ActionableMango and LightBulbFun
Hi Gilles, I'm following your instructions carefully as I don't want to turn my MacPro into a brick.
I'm getting worried because late in the process, at the CRC32 checking phase, I don't have the same value as you although I used the exact same NVME-XDE driver and inserted it after the last XDE driver like you advised to to. My CRC32 is 4696ae97 and yours was f35a82b5.Could you take a look at those screenshots and tell me if I did anything wrong ? thanks in advance, fell free to reply in french if faster for you (I used to work for iConcept in Toulouse)
Screen Shot 2018-05-23 at 23.45.51.png Screen Shot 2018-05-23 at 23.47.04.png
 
Leborgne23 said:
Hi Gilles, I'm following your instructions carefully as I don't want to turn my MacPro into a brick.
I'm getting worried because late in the process, at the CRC32 checking phase, I don't have the same value as you although I used the exact same NVME-XDE driver and inserted it after the last XDE driver like you advised to to. My CRC32 is 4696ae97 and yours was f35a82b5.Could you take a look at those screenshots and tell me if I did anything wrong ? thanks in advance, fell free to reply in french if faster for you (I used to work for iConcept in Toulouse)
View attachment 762751 View attachment 762750
Click to expand...

the CRC f35a82b5 is that of just the NVMe module it self not the entire BootROM (also his CRC value of the patched BootROM in method 2 is of a EFI Update file rather then a complete BootROM, so also keep in mind that everyones full BootROM CRC will be different as everyone has different Motherboard and system serial numbers)
 
  • Like
Reactions: expede
Considering the fun I’m missing trying to software flash the NVMe upgraded firmware, I’m looking forward to Pomona SIOC8 test clip arriving tomorrow for this upgrade and ressurecting my original 4,1 with what I suspect is a corrupt firmware.

Would someone be willing to share a copy of the NVMe-XDE driver?
 
handheldgames said:
Considering the fun I’m missing trying to software flash the NVMe upgraded firmware, I’m looking forward to Pomona SIOC8 test clip arriving tomorrow for this upgrade and ressurecting my original 4,1 with what I suspect is a corrupt firmware.

Would someone be willing to share a copy of the NVMe-XDE driver?
Click to expand...

PM sent...

did you try to resurrect your MacPro4,1 with the firmware restoration CD?
 
DearthnVader said:
I would try to build the XHCI drivers from EDKII, they should be generic rather than chip specific.

Test them in a shell, don't use rFIT or rFind, but rather just bless a shell.efi to boot from so you can test against the EFI kernel Apple is using on your system's firmware.

I forget the exact sequence but it should be something like

load XHCI.efi
reconnect -r

then maybe map fs to map any USB 3 disk you may have plugged in.

If it works then you can generate .ffs files from the .efi driver models.

https://github.com/pbatard/efifs/wiki/Adding-a-driver-to-a-UEFI-firmware

Or you could try a prebuilt version to see if it works:

https://drive.google.com/open?id=1MyiCVdfUXkpIXtFR3JVwfjR3lDx-sMyR

I included the .ffs I extracted, as well as the firmware I extracted it from, and the Xhci.efi driver.

I would test the driver from a shell to see if it links and works for you USB 3 PCI card.

I loaded it from a shell, and it did load, however I'm having trouble passing XHCI to the virtual machine I use to test, so the driver didn't link to anything, because there isn't any XHCI device to link to.

You may want to extract the .ffs yourself, as I'm not 100% sure I did it right, and we don't want to brick your MP.

Sadly I don't own a MP to test with.
Click to expand...

I suppose to test one would have to use a rEFInd shell, as I can't seem to bless a shell.efi correctly on my 32bit efi MacBook.

I remember in the early days there was some code from intel that you could build a shell, bless it, and boot from it, but that's likely 32bit efi anyway.

rEFInd should be fine, I think it doesn't replace the EFI kernel in the MP firmware, it's just a boot loader .efi and it has a shell.
 
Norbert Mikołajczyk said:
First thing, great work guys! amazing! Sorry for changing the topic, but maybe we could overclock the cpu using that kind of editing and methods, just wondering? :)
Click to expand...

Not really, there just is no support for it in the firmware, and it's not really something that needs to be done on that level. Really that just a matter of going over the logic board with a microscope until you find the PLL Apple used. Then see if you can find the data sheet.

You'd be amazed at the things you can learn with a data sheet. Likely it's an I2C device, and can be programed easily with a tool as simple as Grub2. There is some trial and error to it, and a small chance of killing you logic board, and sometimes the PLL is locked and you have to pull some pin to ground to program it, but it likely doable, just takes some effort.
 
  • Like
Reactions: Norbert Mikołajczyk
BBD09BF7-69E3-4885-894E-C49773D58FCE.jpeg
It’s the weekend. TIME FOR SOME OLD SCHOOL ROM HACKING.

Following tutorials aimed at flashing a 2009 MacBook Pro, I’ve built a Flash ROM reader compatible with the 4,1/5,1 Mac Pro’s efi flash ram.

The process of attaching the pins from a sparkfun Bus Pirate v 3.6 to the pins of a Pomona SOIC8 clip was relatively easy. Coming in at a cost of about $55.00, including a supply of cables and shipping.

Accessing the ROM requires removal of the CPU tray housing and should take around 20 minutes to complete.

FWIW... there is an easy to access diagnostic port near the PCIe slots that may allow flashing of the Efi rom without having to tear down the cmp. Near the port is a missing jumper that may be necessary to connect.
 
Last edited:
  • Like
Reactions: lilins, zoltm, ActionableMango and 5 others
I wish you well. We certainly have a lot of talented, inquisitive, persistent members involved in this project.

Sometime today I'll be attempting to dump my 4.1>5,1's MP51.0085.B00 bootrom using Flashrom in Linux.

It will be interesting to see if there are major differences between the "84" & "85" bootROM versions.
 
  • Like
Reactions: Squuiid
MIKX said:
I wish you well. We certainly have a lot of talented, inquisitive, persistent members involved in this project.

Sometime today I'll be attempting to dump my 4.1>5,1's MP51.0085.B00 bootrom using Flashrom in Linux.

It will be interesting to see if there are major differences between the "84" & "85" bootROM versions.
Click to expand...

You mean this file?
Screen Shot 2018-05-27 at 12.28.20.png

I mount the EFI partition, and it's still there. May be no need to dump.
 
  • Like
Reactions: zoltm and MisterAndrew
gilles_polysoft said:
Hi Muhammet,

Sorry I had lot of work lately and didn't have the time to make a lot of documentation yet..
I'm in the process of making a tutorial on ifixit, maybe I'll have finished in next days but can't promise (I would really love to make this documentation available to all).
If you want all files and archives I made yet I can send you them via personal mail.

I think we have no right to publish any BootRom from Apple, but we can publish any procedure so that anyone can try the upgrade.

First of all, please, make backups of your systems, Roms, etc.
I highly recommend, yet, to do backups with SPI programmer if possible.
Work with a uninterruptible power supply (UPS) if possible.
Any failure while working on the Bootrom can brick your computer...

Note that once your cMP flashed with a NVMe modded BootRom, you will be able to :
- run Sierra (like I did) or High Sierra, booted from a 4K compatible (and 4K formatted) NVMe drive. 4K capable NVMe SSD include any Kingston (A1000, KC1000), Toshiba (XG3-XG4-XG5), some WD / OCZ, some Intel datacenter SSDs.
- otherwise, run High Sierra from any 512b formated NVMe SSD, including any Samsung M.2 NVMe SSD.

In any case, macOS Sierra and High Sierra will both try to update the BootRom at each update, forever.
While we can't stop this process, fortunately the fact is that, while booted from any external or NVMe drive, BootRom update will fail... That will keep our cMP with its modded NVMe Bootrom !
But if you boot any time from an internal AHCI drive and proceed to macOS update, thought, there is a risk that a BootRom update may succed which can revert to a non-NVMe compatible BootRom.. You are warned !


That said, here are the process I made, and sorry for my bad english...

The process is doable either : 1) with hardware SPI programmer, which may be best at present (by safety, because with an SPI programmer it's easy to roll back any change if anything goes wrong), or : 2) with software, by patching the EFIUpdater files.


Pre-requirement : extraction of the NVMe DXE driver :
- download and install Pacifist.app : https://www.charlessoft.com
- download and install UEFI Tool : https://github.com/LongSoft/UEFITool/releases
- download "Install macOS High Sierra.app" : https://itunes.apple.com/fr/app/macos-high-sierra/id1246284741
- locate your "Install macOS High Sierra.app", right-click on it and click on "show Package content"
- open "InstallESD.dmg" file in "Contents/SharedSupport"
- you get a mounted "InstallESD" volume. Right-click on the "Firmwareupdate" package and click on "Open with Pacifist"
- in Pacifist, click on the "Resources" tab and open "FirmwareUpdate.pkg"->"Scripts"->"Tools"->"EFIPayloads". Select any firmware payload from a Mac that has native NVMe support, I have used the rMBP 11.4 (MBP114_0182_B00.fd)
- click on "extract as is" and save the MBP114_0182_B00.fd file [edit : corrected thanks to LightBulbFun)
- open that same MBP114_0182_B00.fd file with "UEFI Tool"
- do a text search (not unicode) with "NVMe" : you will find the NVMe DXE driver at an address starting with "51116915-C34B"
- right-click on the DXE driver and click on "extract body", save the file (with an informative name like "NVMe_DXE_apple.ffs" for example )

Here it is, you have the NVMe DXE driver.


Next, solution n°1, with a SPI programmer :
process is very straightforward :
- unsolder the BootRom (chip U8700 on the logic board, a SST 25VF032B on my logic board)
- read the BootRom with an SPI programmer and save the 4M resulting file (for ex. : MP51.007F.xxxxxx_orig.rom
- open the result file with UEFI Tool
- search for a text (non unicode) field "DXE" : that will get you to the DXE driver image portion
- add the previously saved NVMe DXE driver after the last DXE driver (Insert after)
- save the file (ex: MP51.007F.xxxxx_NVMe.rom) and write it back to the Bootrom chip
- solder back the BootRom chip
- et voilà !



Otherwise, solution n°2, With software : (might only work yet on a 4.1 MacPro with BootRom MP51.007F)
the aim is to use the MP51.0085.00B_LOCKED firmware from High Sierra installer app, to patch it to add NVMe DXE driver, then to use the EfiUpdaterApp2.efi programm from MacPro Firmware Update 1.5 which will be patched with help of a script from Netkas MacPro2009-2010 Firmware tool to make accept our modded firmware (with a different CRC32 file)... Sorry if that sounds complicated, I've not managed to patch the EfiUpdaterApp2.efi from High Sierra yet...

Procedure might be changed if starting from a different BootRom version or board...
As always, make backups...

- If running on El Capitan or Sierra and have SIP enabled, start on recovery partition, disable SIP, and reboot.
- download MacPro2009-2010FirmwareTool.zip from Netkas forums
- download MacPro Firmware Update 1.5 : https://support.apple.com/kb/dl1321?locale=en_CA
- download Hexfriend (or any Hexadecimal editor)
- locate your "Install macOS High Sierra" app
- right-click on "Install macOS High Sierra.app", click on "show Package content"
- open "BaseSystem.dmg" file in "Contents/SharedSupport"
- you get an "OS X Base System" mounted volume. Open it, locate the "Install macOS High Sierra.app" at the root of this volume, right-click on it and click on "Show Package Content"
- open the folders "Contents/Resources/Firmware" : you will find in it the last MacPro 5.1 BootRom : MP51.0085.00B_LOCKED.fd
- Make a copy of this file to your desktop
- open this "MP51.0085.00B_LOCKED.fd" file with UEFI Tool
- search for a text (non unicode) field "DXE" : that will get you to the DXE driver image portion
- add the previously saved NVMe DXE driver after the last DXE driver (Insert after)
- save the file (ex: MP51.0085.00B_NVMe.fd)
- with the terminal, calculate the CRC32 of this modded fd file (type : CRC32 and drag your MP51.0085.00B_NVMe.fd file)
- If you used same XDE driver as mine (from rMBP11,4) you should get a value of f35a82b5 which translate to B5825AF3 in big endian
- locate your MacPro2009-2010FirmwareTool and right click on it -> Show Package Content
- open Contents/Resources/ folder, and locate EFIUpdater2010.patch and drag it on your hexadecimal editor
- search and replace for hexadecimal BDD7C676 (big end. crc32 of the 4.1 BootRom) with BE5899C0 (big end. CRC32 of our modded MP51.0085.00B_NVMe.fd file)
- save the obtained file as EFIUpdaterNVMe.patch
- locate your MacPro Firmware Update 1.5 dmg, and mount it on the Desktop
- open with Pacifist the MacProEFIUpdate.pkg
- extract the file "EfiUpdaterApp2.efi" from the resource tab and save it to the same folder as EFIUpdaterNVMe.patch. Note the name of the firmware : MP51_007F_03B_LOCKED.fd
- Patch your "EfiUpdaterApp2.efi" with the previously done "EFIUpdaterNVMe.patch" by typing in the terminal :
patch EfiUpdaterApp2.efi EFIUpdaterNVMe.patch
- If all done well, you now have your patched EfiUpdaterApp2.efi programm and your modded firmware MP51.0085.00B_NVMe.fd
- Place a copy of those both files in /System/Library/CoreServices/Firmware\ Updates/
- rename MP51.0085.00B_NVMe.fd as MP51_007F_03B_LOCKED.fd
- Bless the EfiUpdaterApp2.efi file :
/usr/sbin/bless -mount / -firmware /System/Library/CoreServices/Firmware\ Updates/EfiUpdaterApp2.efi -payload /System/Library/CoreServices/Firmware\ Updates/MP51_007F_03B_LOCKED.fd -options "-x efi-apple-payload0-data" --verbose
- if all done well, you should get "exit 0" as result

You can now shut down your MacPro, then press and hold the power button and let the firmware update be done.
Click to expand...
Hi Gilles,
Has someone succeeded the second solution? You might not be able to make a video (Youtube)?
 
Attempting to backup the cmp efi rom using a 2018 and 2010 MacBook Pro with the bus pirate, Pomona clip combo using flashrom, the ST flash ram is not recognized while surface mounted. Mirroring the same results originally reported.
 
Status
Not open for further replies.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back