MP51.0084.B00 Rom Dump Request

[expede]

Hi !
I´m trying to follow gilles_polysofts tutorial, witch is very detailed by the way, but I got stuck on CRC32 and value "f35a82b5". I do get "a7bc8121" and then there is a djump to this means "B5825AF3" in Big Edian? Okey?? I do not follow. I realise that I nead this number to switch the BDD7C676 in hexeditor but. How do I get from "a7bc8121" to "B5825AF3"?

/Per

 

[LightBulbFun]

so @mikeboss very kindly dumped a Mac Pro 6,1s BootROM for me and extracted and sent over to me 2 files

the FL1100.ffs file

and a XHCI.ffs file

both of these are related to USB 3 (the first one is related to the FL1100 chipset specifically and the XHCI one just handles general class USB 3.0 stuff)

i put these modules into my Mac Pro 5,1s BootROM and sadly it did not work

the FL1100 driver never loads for some reason, but the XHCI driver does load. (I tried just the XHCI driver on its own made no difference, and with the FL1100 driver on its own the Mac Pro acts like it does on stock boot rom ie no USB 3 detected at all)

and when i plug in a USB drive it does light up and stuff but the Mac Pro does not see the USB stick in the boot picker or it hard locks (ie if i reboot with the USB stick connected to the USB 3 card and hold alt it hard locks)

so it looks like the XHCI driver is doing something but its not meshing properly with the Mac Pro 5,1 it would be very interesting to try some other XHCI USB3 chipsets like an ASmedia card? (my USB 3.0 card is one of those very common red coloured Inateck branded KT4004 cards)

 

[mikeboss]

@LightBulbFun

what values are you seeing in the system profiler? MacPro6,1 values are

USB 3.0 Bus:
Host Controller Driver: AppleUSBXHCIFL1100
PCI Device ID: 0x1100
PCI Revision ID: 0x0010
PCI Vendor ID: 0x1b73

 

[MIKX]

Can anyone verify that Ubuntu 10.04 is the correct version for an original 4,1 Mac pro ? (has been flashed to 5,1 )
Ubuntu 10.04 (Lucid Lynx) ?

 

[zozomester]

Hi Muhammet,

Sorry I had lot of work lately and didn't have the time to make a lot of documentation yet..
I'm in the process of making a tutorial on ifixit, maybe I'll have finished in next days but can't promise (I would really love to make this documentation available to all).
If you want all files and archives I made yet I can send you them via personal mail.

I think we have no right to publish any BootRom from Apple, but we can publish any procedure so that anyone can try the upgrade.

First of all, please, make backups of your systems, Roms, etc.
I highly recommend, yet, to do backups with SPI programmer if possible.
Work with a uninterruptible power supply (UPS) if possible.
Any failure while working on the Bootrom can brick your computer...

Note that once your cMP flashed with a NVMe modded BootRom, you will be able to :
- run Sierra (like I did) or High Sierra, booted from a 4K compatible (and 4K formatted) NVMe drive. 4K capable NVMe SSD include any Kingston (A1000, KC1000), Toshiba (XG3-XG4-XG5), some WD / OCZ, some Intel datacenter SSDs.
- otherwise, run High Sierra from any 512b formated NVMe SSD, including any Samsung M.2 NVMe SSD.

In any case, macOS Sierra and High Sierra will both try to update the BootRom at each update, forever.
While we can't stop this process, fortunately the fact is that, while booted from any external or NVMe drive, BootRom update will fail... That will keep our cMP with its modded NVMe Bootrom !
But if you boot any time from an internal AHCI drive and proceed to macOS update, thought, there is a risk that a BootRom update may succed which can revert to a non-NVMe compatible BootRom.. You are warned !


That said, here are the process I made, and sorry for my bad english...

The process is doable either : 1) with hardware SPI programmer, which may be best at present (by safety, because with an SPI programmer it's easy to roll back any change if anything goes wrong), or : 2) with software, by patching the EFIUpdater files.


Pre-requirement : extraction of the NVMe DXE driver :
- download and install Pacifist.app : https://www.charlessoft.com
- download and install UEFI Tool : https://github.com/LongSoft/UEFITool/releases
- download "Install macOS High Sierra.app" : https://itunes.apple.com/fr/app/macos-high-sierra/id1246284741
- locate your "Install macOS High Sierra.app", right-click on it and click on "show Package content"
- open "InstallESD.dmg" file in "Contents/SharedSupport"
- you get a mounted "InstallESD" volume. Right-click on the "Firmwareupdate" package and click on "Open with Pacifist"
- in Pacifist, click on the "Resources" tab and open "FirmwareUpdate.pkg"->"Scripts"->"Tools"->"EFIPayloads". Select any firmware payload from a Mac that has native NVMe support, I have used the rMBP 11.4 (MBP114_0182_B00.fd)
- click on "extract as is" and save the MBP114_0182_B00.fd file [edit : corrected thanks to LightBulbFun)
- open that same MBP114_0182_B00.fd file with "UEFI Tool"
- do a text search (not unicode) with "NVMe" : you will find the NVMe DXE driver at an address starting with "51116915-C34B"
- right-click on the DXE driver and click on "extract body", save the file (with an informative name like "NVMe_DXE_apple.ffs" for example )

Here it is, you have the NVMe DXE driver.


Next, solution n°1, with a SPI programmer :
process is very straightforward :
- unsolder the BootRom (chip U8700 on the logic board, a SST 25VF032B on my logic board)
- read the BootRom with an SPI programmer and save the 4M resulting file (for ex. : MP51.007F.xxxxxx_orig.rom
- open the result file with UEFI Tool
- search for a text (non unicode) field "DXE" : that will get you to the DXE driver image portion
- add the previously saved NVMe DXE driver after the last DXE driver (Insert after)
- save the file (ex: MP51.007F.xxxxx_NVMe.rom) and write it back to the Bootrom chip
- solder back the BootRom chip
- et voilà !



Otherwise, solution n°2, With software : (might only work yet on a 4.1 MacPro with BootRom MP51.007F)
the aim is to use the MP51.0085.00B_LOCKED firmware from High Sierra installer app, to patch it to add NVMe DXE driver, then to use the EfiUpdaterApp2.efi programm from MacPro Firmware Update 1.5 which will be patched with help of a script from Netkas MacPro2009-2010 Firmware tool to make accept our modded firmware (with a different CRC32 file)... Sorry if that sounds complicated, I've not managed to patch the EfiUpdaterApp2.efi from High Sierra yet...

Procedure might be changed if starting from a different BootRom version or board...
As always, make backups...

- If running on El Capitan or Sierra and have SIP enabled, start on recovery partition, disable SIP, and reboot.
- download MacPro2009-2010FirmwareTool.zip from Netkas forums
- download MacPro Firmware Update 1.5 : https://support.apple.com/kb/dl1321?locale=en_CA
- download Hexfriend (or any Hexadecimal editor)
- locate your "Install macOS High Sierra" app
- right-click on "Install macOS High Sierra.app", click on "show Package content"
- open "BaseSystem.dmg" file in "Contents/SharedSupport"
- you get an "OS X Base System" mounted volume. Open it, locate the "Install macOS High Sierra.app" at the root of this volume, right-click on it and click on "Show Package Content"
- open the folders "Contents/Resources/Firmware" : you will find in it the last MacPro 5.1 BootRom : MP51.0085.00B_LOCKED.fd
- Make a copy of this file to your desktop
- open this "MP51.0085.00B_LOCKED.fd" file with UEFI Tool
- search for a text (non unicode) field "DXE" : that will get you to the DXE driver image portion
- add the previously saved NVMe DXE driver after the last DXE driver (Insert after)
- save the file (ex: MP51.0085.00B_NVMe.fd)
- with the terminal, calculate the CRC32 of this modded fd file (type : CRC32 and drag your MP51.0085.00B_NVMe.fd file)
- If you used same XDE driver as mine (from rMBP11,4) you should get a value of f35a82b5 which translate to B5825AF3 in big endian
- locate your MacPro2009-2010FirmwareTool and right click on it -> Show Package Content
- open Contents/Resources/ folder, and locate EFIUpdater2010.patch and drag it on your hexadecimal editor
- search and replace for hexadecimal BDD7C676 (big end. crc32 of the 4.1 BootRom) with BE5899C0 (big end. CRC32 of our modded MP51.0085.00B_NVMe.fd file)
- save the obtained file as EFIUpdaterNVMe.patch
- locate your MacPro Firmware Update 1.5 dmg, and mount it on the Desktop
- open with Pacifist the MacProEFIUpdate.pkg
- extract the file "EfiUpdaterApp2.efi" from the resource tab and save it to the same folder as EFIUpdaterNVMe.patch. Note the name of the firmware : MP51_007F_03B_LOCKED.fd
- Patch your "EfiUpdaterApp2.efi" with the previously done "EFIUpdaterNVMe.patch" by typing in the terminal :
patch EfiUpdaterApp2.efi EFIUpdaterNVMe.patch
- If all done well, you now have your patched EfiUpdaterApp2.efi programm and your modded firmware MP51.0085.00B_NVMe.fd
- Place a copy of those both files in /System/Library/CoreServices/Firmware\ Updates/
- rename MP51.0085.00B_NVMe.fd as MP51_007F_03B_LOCKED.fd
- Bless the EfiUpdaterApp2.efi file :
/usr/sbin/bless -mount / -firmware /System/Library/CoreServices/Firmware\ Updates/EfiUpdaterApp2.efi -payload /System/Library/CoreServices/Firmware\ Updates/MP51_007F_03B_LOCKED.fd -options "-x efi-apple-payload0-data" --verbose
- if all done well, you should get "exit 0" as result

You can now shut down your MacPro, then press and hold the power button and let the firmware update be done.

Very nice job! You could not share your modified Firmware?

 

[abdyfranco]

so @mikeboss very kindly dumped a Mac Pro 6,1s BootROM for me and extracted and sent over to me 2 files

the FL1100.ffs file

and a XHCI.ffs file

both of these are related to USB 3 (the first one is related to the FL1100 chipset specifically and the XHCI one just handles general class USB 3.0 stuff)

i put these modules into my Mac Pro 5,1s BootROM and sadly it did not work

the FL1100 driver never loads for some reason, but the XHCI driver does load. (I tried just the XHCI driver on its own made no difference, and with the FL1100 driver on its own the Mac Pro acts like it does on stock boot rom ie no USB 3 detected at all)

and when i plug in a USB drive it does light up and stuff but the Mac Pro does not see the USB stick in the boot picker or it hard locks (ie if i reboot with the USB stick connected to the USB 3 card and hold alt it hard locks)

so it looks like the XHCI driver is doing something but its not meshing properly with the Mac Pro 5,1 it would be very interesting to try some other XHCI USB3 chipsets like an ASmedia card? (my USB 3.0 card is one of those very common red coloured Inateck branded KT4004 cards)

Can you share the FL1100.ffs file, please? I want to do some testing.

 

[mikeboss]

Can you share the FL1100.ffs file, please? I want to do some testing.

PM sent...

 

[HaypurTiryading]

I wonder if anybody can integrate the gop video driver for non flashed modern cards. I would like them to work at 5GT/s any screen without mods on pre boot, boot, driver selection, other os...

 

[LightBulbFun]

@LightBulbFun

what values are you seeing in the system profiler? MacPro6,1 values are

USB 3.0 Bus:
Host Controller Driver: AppleUSBXHCIFL1100
PCI Device ID: 0x1100
PCI Revision ID: 0x0010
PCI Vendor ID: 0x1b73

here you go looks to be the same as whats in the Mac Pro 6,1... (this is with my Mac pro 5,1 running its stock BootROM)

 

[DearthnVader]

so @mikeboss very kindly dumped a Mac Pro 6,1s BootROM for me and extracted and sent over to me 2 files

the FL1100.ffs file

and a XHCI.ffs file

both of these are related to USB 3 (the first one is related to the FL1100 chipset specifically and the XHCI one just handles general class USB 3.0 stuff)

i put these modules into my Mac Pro 5,1s BootROM and sadly it did not work

the FL1100 driver never loads for some reason, but the XHCI driver does load. (I tried just the XHCI driver on its own made no difference, and with the FL1100 driver on its own the Mac Pro acts like it does on stock boot rom ie no USB 3 detected at all)

and when i plug in a USB drive it does light up and stuff but the Mac Pro does not see the USB stick in the boot picker or it hard locks (ie if i reboot with the USB stick connected to the USB 3 card and hold alt it hard locks)

so it looks like the XHCI driver is doing something but its not meshing properly with the Mac Pro 5,1 it would be very interesting to try some other XHCI USB3 chipsets like an ASmedia card? (my USB 3.0 card is one of those very common red coloured Inateck branded KT4004 cards)

I would try to build the XHCI drivers from EDKII, they should be generic rather than chip specific.

Test them in a shell, don't use rFIT or rFind, but rather just bless a shell.efi to boot from so you can test against the EFI kernel Apple is using on your system's firmware.

I forget the exact sequence but it should be something like

load XHCI.efi
reconnect -r

then maybe map fs to map any USB 3 disk you may have plugged in.

If it works then you can generate .ffs files from the .efi driver models.

https://github.com/pbatard/efifs/wiki/Adding-a-driver-to-a-UEFI-firmware

Or you could try a prebuilt version to see if it works:

https://drive.google.com/open?id=1MyiCVdfUXkpIXtFR3JVwfjR3lDx-sMyR

I included the .ffs I extracted, as well as the firmware I extracted it from, and the Xhci.efi driver.

I would test the driver from a shell to see if it links and works for you USB 3 PCI card.

I loaded it from a shell, and it did load, however I'm having trouble passing XHCI to the virtual machine I use to test, so the driver didn't link to anything, because there isn't any XHCI device to link to.

You may want to extract the .ffs yourself, as I'm not 100% sure I did it right, and we don't want to brick your MP.

Sadly I don't own a MP to test with.

 

[Leborgne23]

Hi Gilles, I'm following your instructions carefully as I don't want to turn my MacPro into a brick.
I'm getting worried because late in the process, at the CRC32 checking phase, I don't have the same value as you although I used the exact same NVME-XDE driver and inserted it after the last XDE driver like you advised to to. My CRC32 is 4696ae97 and yours was f35a82b5.Could you take a look at those screenshots and tell me if I did anything wrong ? thanks in advance, fell free to reply in french if faster for you (I used to work for iConcept in Toulouse)

 

[ActionableMango]

I wonder if anybody can integrate the gop video driver for non flashed modern cards. I would like them to work at 5GT/s any screen without mods on pre boot, boot, driver selection, other os...

That would be of enormous benefit.

 

[LightBulbFun]

Hi Gilles, I'm following your instructions carefully as I don't want to turn my MacPro into a brick.
I'm getting worried because late in the process, at the CRC32 checking phase, I don't have the same value as you although I used the exact same NVME-XDE driver and inserted it after the last XDE driver like you advised to to. My CRC32 is 4696ae97 and yours was f35a82b5.Could you take a look at those screenshots and tell me if I did anything wrong ? thanks in advance, fell free to reply in french if faster for you (I used to work for iConcept in Toulouse)
View attachment 762751 View attachment 762750

the CRC f35a82b5 is that of just the NVMe module it self not the entire BootROM (also his CRC value of the patched BootROM in method 2 is of a EFI Update file rather then a complete BootROM, so also keep in mind that everyones full BootROM CRC will be different as everyone has different Motherboard and system serial numbers)

 

[handheldgames]

Considering the fun I’m missing trying to software flash the NVMe upgraded firmware, I’m looking forward to Pomona SIOC8 test clip arriving tomorrow for this upgrade and ressurecting my original 4,1 with what I suspect is a corrupt firmware.

Would someone be willing to share a copy of the NVMe-XDE driver?

 

[mikeboss]

Considering the fun I’m missing trying to software flash the NVMe upgraded firmware, I’m looking forward to Pomona SIOC8 test clip arriving tomorrow for this upgrade and ressurecting my original 4,1 with what I suspect is a corrupt firmware.

Would someone be willing to share a copy of the NVMe-XDE driver?

PM sent...

did you try to resurrect your MacPro4,1 with the firmware restoration CD?

 

[DearthnVader]

I would try to build the XHCI drivers from EDKII, they should be generic rather than chip specific.

Test them in a shell, don't use rFIT or rFind, but rather just bless a shell.efi to boot from so you can test against the EFI kernel Apple is using on your system's firmware.

I forget the exact sequence but it should be something like

load XHCI.efi
reconnect -r

then maybe map fs to map any USB 3 disk you may have plugged in.

If it works then you can generate .ffs files from the .efi driver models.

https://github.com/pbatard/efifs/wiki/Adding-a-driver-to-a-UEFI-firmware

Or you could try a prebuilt version to see if it works:

https://drive.google.com/open?id=1MyiCVdfUXkpIXtFR3JVwfjR3lDx-sMyR

I included the .ffs I extracted, as well as the firmware I extracted it from, and the Xhci.efi driver.

I would test the driver from a shell to see if it links and works for you USB 3 PCI card.

I loaded it from a shell, and it did load, however I'm having trouble passing XHCI to the virtual machine I use to test, so the driver didn't link to anything, because there isn't any XHCI device to link to.

You may want to extract the .ffs yourself, as I'm not 100% sure I did it right, and we don't want to brick your MP.

Sadly I don't own a MP to test with.

I suppose to test one would have to use a rEFInd shell, as I can't seem to bless a shell.efi correctly on my 32bit efi MacBook.

I remember in the early days there was some code from intel that you could build a shell, bless it, and boot from it, but that's likely 32bit efi anyway.

rEFInd should be fine, I think it doesn't replace the EFI kernel in the MP firmware, it's just a boot loader .efi and it has a shell.

 

[HaypurTiryading]

Do you recommend EZP2010 Spi Programmer? I'm thinking to buy from aliexpress. What do you recommend from aliexpress?

 

[Norbert Mikołajczyk]

First thing, great work guys! amazing! Sorry for changing the topic, but maybe we could overclock the cpu using that kind of editing and methods, just wondering?

 

[DearthnVader]

First thing, great work guys! amazing! Sorry for changing the topic, but maybe we could overclock the cpu using that kind of editing and methods, just wondering?

Not really, there just is no support for it in the firmware, and it's not really something that needs to be done on that level. Really that just a matter of going over the logic board with a microscope until you find the PLL Apple used. Then see if you can find the data sheet.

You'd be amazed at the things you can learn with a data sheet. Likely it's an I2C device, and can be programed easily with a tool as simple as Grub2. There is some trial and error to it, and a small chance of killing you logic board, and sometimes the PLL is locked and you have to pull some pin to ground to program it, but it likely doable, just takes some effort.

 

[handheldgames]

It’s the weekend. TIME FOR SOME OLD SCHOOL ROM HACKING.

Following tutorials aimed at flashing a 2009 MacBook Pro, I’ve built a Flash ROM reader compatible with the 4,1/5,1 Mac Pro’s efi flash ram.

The process of attaching the pins from a sparkfun Bus Pirate v 3.6 to the pins of a Pomona SOIC8 clip was relatively easy. Coming in at a cost of about $55.00, including a supply of cables and shipping.

Accessing the ROM requires removal of the CPU tray housing and should take around 20 minutes to complete.

FWIW... there is an easy to access diagnostic port near the PCIe slots that may allow flashing of the Efi rom without having to tear down the cmp. Near the port is a missing jumper that may be necessary to connect.

 

[MIKX]

I wish you well. We certainly have a lot of talented, inquisitive, persistent members involved in this project.

Sometime today I'll be attempting to dump my 4.1>5,1's MP51.0085.B00 bootrom using Flashrom in Linux.

It will be interesting to see if there are major differences between the "84" & "85" bootROM versions.

 

[h9826790]

I wish you well. We certainly have a lot of talented, inquisitive, persistent members involved in this project.

Sometime today I'll be attempting to dump my 4.1>5,1's MP51.0085.B00 bootrom using Flashrom in Linux.

It will be interesting to see if there are major differences between the "84" & "85" bootROM versions.

You mean this file?

I mount the EFI partition, and it's still there. May be no need to dump.

 

[zozomester]

Hi Muhammet,

Sorry I had lot of work lately and didn't have the time to make a lot of documentation yet..
I'm in the process of making a tutorial on ifixit, maybe I'll have finished in next days but can't promise (I would really love to make this documentation available to all).
If you want all files and archives I made yet I can send you them via personal mail.

I think we have no right to publish any BootRom from Apple, but we can publish any procedure so that anyone can try the upgrade.

First of all, please, make backups of your systems, Roms, etc.
I highly recommend, yet, to do backups with SPI programmer if possible.
Work with a uninterruptible power supply (UPS) if possible.
Any failure while working on the Bootrom can brick your computer...

Note that once your cMP flashed with a NVMe modded BootRom, you will be able to :
- run Sierra (like I did) or High Sierra, booted from a 4K compatible (and 4K formatted) NVMe drive. 4K capable NVMe SSD include any Kingston (A1000, KC1000), Toshiba (XG3-XG4-XG5), some WD / OCZ, some Intel datacenter SSDs.
- otherwise, run High Sierra from any 512b formated NVMe SSD, including any Samsung M.2 NVMe SSD.

In any case, macOS Sierra and High Sierra will both try to update the BootRom at each update, forever.
While we can't stop this process, fortunately the fact is that, while booted from any external or NVMe drive, BootRom update will fail... That will keep our cMP with its modded NVMe Bootrom !
But if you boot any time from an internal AHCI drive and proceed to macOS update, thought, there is a risk that a BootRom update may succed which can revert to a non-NVMe compatible BootRom.. You are warned !


That said, here are the process I made, and sorry for my bad english...

The process is doable either : 1) with hardware SPI programmer, which may be best at present (by safety, because with an SPI programmer it's easy to roll back any change if anything goes wrong), or : 2) with software, by patching the EFIUpdater files.


Pre-requirement : extraction of the NVMe DXE driver :
- download and install Pacifist.app : https://www.charlessoft.com
- download and install UEFI Tool : https://github.com/LongSoft/UEFITool/releases
- download "Install macOS High Sierra.app" : https://itunes.apple.com/fr/app/macos-high-sierra/id1246284741
- locate your "Install macOS High Sierra.app", right-click on it and click on "show Package content"
- open "InstallESD.dmg" file in "Contents/SharedSupport"
- you get a mounted "InstallESD" volume. Right-click on the "Firmwareupdate" package and click on "Open with Pacifist"
- in Pacifist, click on the "Resources" tab and open "FirmwareUpdate.pkg"->"Scripts"->"Tools"->"EFIPayloads". Select any firmware payload from a Mac that has native NVMe support, I have used the rMBP 11.4 (MBP114_0182_B00.fd)
- click on "extract as is" and save the MBP114_0182_B00.fd file [edit : corrected thanks to LightBulbFun)
- open that same MBP114_0182_B00.fd file with "UEFI Tool"
- do a text search (not unicode) with "NVMe" : you will find the NVMe DXE driver at an address starting with "51116915-C34B"
- right-click on the DXE driver and click on "extract body", save the file (with an informative name like "NVMe_DXE_apple.ffs" for example )

Here it is, you have the NVMe DXE driver.


Next, solution n°1, with a SPI programmer :
process is very straightforward :
- unsolder the BootRom (chip U8700 on the logic board, a SST 25VF032B on my logic board)
- read the BootRom with an SPI programmer and save the 4M resulting file (for ex. : MP51.007F.xxxxxx_orig.rom
- open the result file with UEFI Tool
- search for a text (non unicode) field "DXE" : that will get you to the DXE driver image portion
- add the previously saved NVMe DXE driver after the last DXE driver (Insert after)
- save the file (ex: MP51.007F.xxxxx_NVMe.rom) and write it back to the Bootrom chip
- solder back the BootRom chip
- et voilà !



Otherwise, solution n°2, With software : (might only work yet on a 4.1 MacPro with BootRom MP51.007F)
the aim is to use the MP51.0085.00B_LOCKED firmware from High Sierra installer app, to patch it to add NVMe DXE driver, then to use the EfiUpdaterApp2.efi programm from MacPro Firmware Update 1.5 which will be patched with help of a script from Netkas MacPro2009-2010 Firmware tool to make accept our modded firmware (with a different CRC32 file)... Sorry if that sounds complicated, I've not managed to patch the EfiUpdaterApp2.efi from High Sierra yet...

Procedure might be changed if starting from a different BootRom version or board...
As always, make backups...

- If running on El Capitan or Sierra and have SIP enabled, start on recovery partition, disable SIP, and reboot.
- download MacPro2009-2010FirmwareTool.zip from Netkas forums
- download MacPro Firmware Update 1.5 : https://support.apple.com/kb/dl1321?locale=en_CA
- download Hexfriend (or any Hexadecimal editor)
- locate your "Install macOS High Sierra" app
- right-click on "Install macOS High Sierra.app", click on "show Package content"
- open "BaseSystem.dmg" file in "Contents/SharedSupport"
- you get an "OS X Base System" mounted volume. Open it, locate the "Install macOS High Sierra.app" at the root of this volume, right-click on it and click on "Show Package Content"
- open the folders "Contents/Resources/Firmware" : you will find in it the last MacPro 5.1 BootRom : MP51.0085.00B_LOCKED.fd
- Make a copy of this file to your desktop
- open this "MP51.0085.00B_LOCKED.fd" file with UEFI Tool
- search for a text (non unicode) field "DXE" : that will get you to the DXE driver image portion
- add the previously saved NVMe DXE driver after the last DXE driver (Insert after)
- save the file (ex: MP51.0085.00B_NVMe.fd)
- with the terminal, calculate the CRC32 of this modded fd file (type : CRC32 and drag your MP51.0085.00B_NVMe.fd file)
- If you used same XDE driver as mine (from rMBP11,4) you should get a value of f35a82b5 which translate to B5825AF3 in big endian
- locate your MacPro2009-2010FirmwareTool and right click on it -> Show Package Content
- open Contents/Resources/ folder, and locate EFIUpdater2010.patch and drag it on your hexadecimal editor
- search and replace for hexadecimal BDD7C676 (big end. crc32 of the 4.1 BootRom) with BE5899C0 (big end. CRC32 of our modded MP51.0085.00B_NVMe.fd file)
- save the obtained file as EFIUpdaterNVMe.patch
- locate your MacPro Firmware Update 1.5 dmg, and mount it on the Desktop
- open with Pacifist the MacProEFIUpdate.pkg
- extract the file "EfiUpdaterApp2.efi" from the resource tab and save it to the same folder as EFIUpdaterNVMe.patch. Note the name of the firmware : MP51_007F_03B_LOCKED.fd
- Patch your "EfiUpdaterApp2.efi" with the previously done "EFIUpdaterNVMe.patch" by typing in the terminal :
patch EfiUpdaterApp2.efi EFIUpdaterNVMe.patch
- If all done well, you now have your patched EfiUpdaterApp2.efi programm and your modded firmware MP51.0085.00B_NVMe.fd
- Place a copy of those both files in /System/Library/CoreServices/Firmware\ Updates/
- rename MP51.0085.00B_NVMe.fd as MP51_007F_03B_LOCKED.fd
- Bless the EfiUpdaterApp2.efi file :
/usr/sbin/bless -mount / -firmware /System/Library/CoreServices/Firmware\ Updates/EfiUpdaterApp2.efi -payload /System/Library/CoreServices/Firmware\ Updates/MP51_007F_03B_LOCKED.fd -options "-x efi-apple-payload0-data" --verbose
- if all done well, you should get "exit 0" as result

You can now shut down your MacPro, then press and hold the power button and let the firmware update be done.

Hi Gilles,
Has someone succeeded the second solution? You might not be able to make a video (Youtube)?

 

[expede]

@h9826790 I do not?!! I have a Firmware.scap file. But I do have firmware 84 not 85.

/Per

 

[handheldgames]

Attempting to backup the cmp efi rom using a 2018 and 2010 MacBook Pro with the bus pirate, Pomona clip combo using flashrom, the ST flash ram is not recognized while surface mounted. Mirroring the same results originally reported.