Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Status
The first post of this thread is a WikiPost and can be edited by anyone with the appropiate permissions. Your edits will be public.
Status
Not open for further replies.

w1z

macrumors 6502a
Aug 20, 2013
692
481
Edit: added VMM flag spoofing to differentiate from Catalina supported Mac spoofing, since we don’t know yet if it’s safe. With what I saw up to now, unfortunately I’m inclined to say that it’s not safe, since OpenCore or drivers write binary blobs to the private part of the MP5,1 NVRAM where we can’t erase.

Would love to see examples of these binary blobs and impacted nvram areas under basic use of OpenCore, ie. VMM flag to boot/update Catalina, as I could not find any differences in my binwalk dumps (I know, binwalk isn't the right tool).
 

cdf

macrumors 68020
Jul 27, 2012
2,256
2,583
Let’s not get this misconstrued. If I remember correctly, the edit to post #673 was changing “OpenCore spoofing” to “OpenCore VMM flag spoofing.” Therefore, the concern that has been raised appears to be from OpenCore configurations other than VMM flag spoofing. This is my understanding. Please correct me if I have misunderstood.
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
Would love to see examples of these binary blobs and impacted nvram areas under basic use of OpenCore, ie. VMM flag to boot/update Catalina, as I could not find any differences in my binwalk dumps (I know, binwalk isn't the right tool).
I'm still investigating, it's a complex procedure to track everything. Since the NVRAM areas where the binary blobs are have private/personal data (like iCloud credentials), I can't even post a screenshot. I'll need to create a test iCloud account with bogus data to show this down the road.

Binwalk is a toolkit to facilitate/automate searches, it only shows something if you previously inserted the signature of what you want to research. It will never be useful for this type of primary research.

Let’s not get this misconstrued. If I remember correctly, the edit to post #673 was changing “OpenCore spoofing” to “OpenCore VMM flag spoofing.” Therefore, the concern that has been raised appears to be from OpenCore configurations other than VMM flag spoofing. This is my understanding. Please correct me if I have misunderstood.
Yes, exactly. VMM flag spoofing seems to be safe and nothing is written to the NVRAM, besides the bless changes.

Binary blobs appear inside the private stream/stores of the NVRAM after spoofing iMacPro1,1/MP7,1. We don't know why this is happening or what is doing it.
 
Last edited:

Ludacrisvp

macrumors 6502a
May 14, 2008
797
363
Binary blobs appear inside the private stream/stores of the NVRAM after spoofing iMacPro1,1/MP7,1. We don't know why this is happening or what is doing it.
is this perhaps just macOS doing the writes expecting those areas to be writable for a real 1,1/7,1?
Is there any evidence this is detrimental to the functionality of the machine?
can you emulate NVRAM like in the hack scene and see more clearly who/what/why more safely vs the native NVRAM implementation?
furthermore if we go emulated NVRAM, could that be a solution all on its own to bypass the concerns here?

Also using --nextonly in the bless command is very useful to avoid wasting a lot of time testing things so that only your next boot attempts OC and then it reverts to whatever you did previously (refind in my case)
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
is this perhaps just macOS doing the writes expecting those areas to be writable for a real 1,1/7,1?
I don't think so, a T2 Mac have a totally different way to access the SPI flash.
Is there any evidence this is detrimental to the functionality of the machine?
Clover does the same and bricked various MP5,1, @startergo had one bricked with the same type of binary blobs.
can you emulate NVRAM like in the hack scene and see more clearly who/what/why more safely vs the native NVRAM implementation?
furthermore if we go emulated NVRAM, could that be a solution all on its own to bypass the concerns here?
I don't think this is the way to go, the less we deviate from the standard MP5,1, the better.

VMM spoofing for updates and finding/implementing what is needed to overcome the soft block Apple implemented for hardware encoding is the way to go, not full blown hackintoshfy the MP5,1.

We already know that HEVC, and probably what depends on it like Sidecar, works when spoofing a iMacPro1,1/MP7,1, now we need to find exactly what is needed to activate without the blunt way that is spoofing. We already have a Mac, we need a fine tuned and intelligent way to accomplish this.
 
Last edited:

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
I am testing OC now. I may send you the firmware later on for evaluation.
For now I need controlled dumps, starting from a BootROM image with the NVRAM filled with just the 3rd and 4th streams, then after one boot, after iCloud configuration, after some reboots and then after OpenCore iMacPro1,1/MP7,1 spoofing. @h9826790 and I already did it for our Macs and now I'm tracking and evaluating what is a valid binary blob (like the SPD dumps for each DIMM and some other things) from what OpenCore is doing. I don't have much free time nowadays, but I'm progressing a little everyday.
 
Last edited:

T0mLewis

macrumors newbie
Oct 15, 2019
4
0
Holy crap 28 pages, I just firmware upgraded a 4,1 to 5,1 and I have it running High sierra, ordering a metal compatible GPU (MSI Gaming Radeon RX 560 128-bit 4GB GDRR5) via https://support.apple.com/en-us/HT208898 to get it updated to mojave. Without reading through 28 pages, do you think mojave+ will be possible on the MacPro 5,1? Or will it be a complete faff
 

trifero

macrumors 68030
May 21, 2009
2,960
2,802
Holy crap 28 pages, I just firmware upgraded a 4,1 to 5,1 and I have it running High sierra, ordering a metal compatible GPU (MSI Gaming Radeon RX 560 128-bit 4GB GDRR5) via https://support.apple.com/en-us/HT208898 to get it updated to mojave. Without reading through 28 pages, do you think mojave+ will be possible on the MacPro 5,1? Or will it be a complete faff
Mojave is native in Mac Pro 5.1 .If you mean Catalina, runs like a charm in 5.1, with the help of @dosdude1 and more others.
 
  • Like
Reactions: T0mLewis

trifero

macrumors 68030
May 21, 2009
2,960
2,802
Oh yeah sorry Catalina! tongue tied!
Is there a how-to buried somewhere in these 28 pages?

Just a few more pages.

Don´t get mad . Just follow instructions on page 1
[automerge]1573137272[/automerge]
How do you apply an update?
For Catalina, you mean?
 
  • Like
Reactions: T0mLewis

Coyote2006

macrumors 6502a
Apr 16, 2006
512
233

Just a few more pages.

Don´t get mad . Just follow instructions on page 1
[automerge]1573137272[/automerge]

For Catalina, you mean?

Yes, for Catalina (of course :) )
 
  • Like
Reactions: T0mLewis

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
Yes, for Catalina (of course :) )
Apple requires a supported Mac to do point updates (10.15.0 to 10.15.1, for example). The only workaround Apple provided is to use a VM, since when Apple tests if your Mac is supported, the code checks if it's running inside a VM and then permit the update. OpenCore VMM flag spoofing makes Catalina think that is running inside a VM.

You can't update a Catalina install with MP5,1 without a VM or VMM flag spoofing, dosdude1 way is to install over every time an update is released.

These are the four ways to update Catalina with a MP5,1:

  1. connect your Catalina disk to a supported Mac,
  2. use a raw disk VM to update
  3. spoof the VMM flag with OpenCore
  4. install dosdude1 new version over
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
10.15.2 build 19C32e released this afternoon, for now only updates and without the full installer. 4,69 GB.
 
  • Like
Reactions: trifero

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
If you have the file from Mojave I am currently on Catalina and it would be awesome if you could send it my way! The only relevant kexts I can find using Google seems to be this one from this GitHub repo: https://github.com/LukaJankovic/10.12-zenbook-ux303u/tree/master/IO80211Family.kext/Contents/PlugIns
Sorry, I can't send you Apple proprietary files. Extract it from the Mojave installer, if you need BCM94322MC support or from Sierra if you need BCM94321MC.

/System/Library/Extensions/IO80211Family.kext/Contents/PlugIns/AirPortBrcm4331.kext
 

caarsonrr

macrumors newbie
Nov 7, 2019
5
0
Sorry, I can't send you Apple proprietary files. Extract it from the Mojave installer, if you need BCM94322MC support or from Sierra if you need BCM94321MC.

/System/Library/Extensions/IO80211Family.kext/Contents/PlugIns/AirPortBrcm4331.kext


Thank you so much for your reply!

Do you know where or have an idea of where this file could be on the Mojave installer?
I just went and scoured the installer.
 

tsialex

Contributor
Original poster
Jun 13, 2016
13,455
13,602
There is really no issue with asking!
He can say that he doesn't want to reply or just not reply at all!
Please don't ask more. There's all info you ever need with this screenshot.

BCM94321MC you will get from the most recent Sierra Security Update.
BCM94322MC you will get from High Sierra or Mojave current Security Update.

Screen Shot 2019-11-07 at 22.50.21.png
 
Status
Not open for further replies.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.