MP 1,1-5,1 Recovery from bricked 5,1

[MooffooM]

So it finally happened to me...

I was installing Mojave on an alternate SSD to do some OpenCore testing, and when I rebooted the system hung. To revert back to my previous boot disk I tried resetting NVRAM by cmd-opt-P-R and the system chimed once and then nothing...

Pressing the diag switch showed that EFI done was not lit (although it would blip every 20 seconds or so...); I believe my boot rom is toast.

I purchased a MATT card in the hopes of making the system bootable again; however I can find no information on how to use the MATT card.

1) Does it come with an EFI image ready to go?
2) Do I have to program the MATT card prior to use?
3) Can the MATT card accept boot rom updates (e.g. if it is not on 144.0.0.0, can I use the normal update procedure)?
4) Do I need to copy any info from my old boot rom (serial number, etc)?
5) If I need to retrieve anything from my previous boot rom, do I need to buy a different tool (medusa)?

Any information would be greatly appreciated... I want to have everything ready to go once the MATT card arrives so I can get this system back up!

Thank you

 

[Macschrauber]

Do you have a rom dump?

Btw everyone should have one, esp. When playing with dangerous tools like opencore.

 

[MooffooM]

Unfortunately not.. although to be clear I was PREPARING to test with OpenCore, not RUNNING OpenCore, so I would not blame OpenCore for this bricking....

Good advise though... and arguably I would be better off if I had a rom dump. I do have another MacPro 5,1, so I could get a dump from it... Would it help?

 

[tsialex]

Unfortunately not.. although to be clear I was PREPARING to test with OpenCore, not RUNNING OpenCore, so I would not blame OpenCore for this bricking....

Good advise though... and arguably I would be better off if I had a rom dump. I do have another MacPro 5,1, so I could get a dump from it... Would it help?

NO! You will make a clone and Apple will block both.

 

[tsialex]

1) Does it come with an EFI image ready to go?

Cmizapper sends it already flashed with a dump from a mid-2010 Mac, all MATT cards have the exactly same dump from the same Mac Pro.


You can read about it here:

2nd Mac Pro bricked by an Apple update

I just checked your mattorig.bin that you did PM me, 10/28, when you got the MATT card. It's not 140.0.0.0.0, it's MP51.007F.B00 and it's exactly the same one as @Plutonius and @campodoro74. So, cmizapper send the same BootROM to everyone, with exactly same hardwareIDs. :(

forums.macrumors.com

All people that buy a Mac Pro MATT card have the:

1. same System Serial Number - SSN
2. same HWC
3. same SON - Sales Order Number
4. same MLB - Main Logic Board Number
5. same BD - Build Date

So, everything needed to personalise a Mac Pro is exactly the same, the only thing that will differ from another clone is the MAC address, stored inside the Intel Ethernet controller SPI flash that have the controller firmware.

Lot's of unique info are stored inside the BootROM like:

HardwareID:	Location inside the BootROM:
Serial Number (SSN)	NVRAM volume
HWC	NVRAM volume
Sales Order Number (SON)	NVRAM volume
Gaid	NVRAM volume
MLB	Last sector of BootROM
MLB Build Date	Last sector of BootROM

HWC and Gaid are not truly unique, both are linked to the model you bought. Everything else is unique. Read this post:

MP5,1: BootROM thread | 144.0.0.0.0

This is a work in progress These identifiers are used by Apple to fully identify and validate your Mac, without them you can't login with iCloud/iMessage/FaceTime. Identifier:Definition: SSNSystem Serial Number HWCHardware Code SONSystem/Sales Order Number LBSN/MLB SNMain Logic Board Serial...

forums.macrumors.com

Apple will detect the clone when you access iCloud/FaceTime/Messages and will block it.

2) Do I have to program the MATT card prior to use?

You can use install and use it, but like I said before, it's a clone. Apple detect clones when you log in.

3) Can the MATT card accept boot rom updates (e.g. if it is not on 144.0.0.0, can I use the normal update procedure)?

Yes.

Btw, earlier MATT cards had the first ever public BootROM released, MP51.007F.B00 from early 2010, now cmizapper just updated it to 144.0.0.0.0, this don't change the clone problem.

4) Do I need to copy any info from my old boot rom (serial number, etc)?

You need to. For your Mac Pro correctly work again you need all hardwareIDs correctly saved/hashed/free space indicated.

5) If I need to retrieve anything from my previous boot rom, do I need to buy a different tool (medusa)?

Yes. I have a method to do this without having to desolder the SPI flash memory, but involves risk and I'm not going to explain it here. If you need, I can show it via PM later.

No cmizapper tool works for reading the corrupted SPI flash of a MP5,1, Mac Pro early-2009 to mid-2012 LPC interface design is a lot different than other Macs and Cmizapper developer its tools with a focus on what sells most, MacBooks/MacBook Pros. People here already tested.

 

[MooffooM]

It seems I have multiple paths forward:

• Live with the blocked id... this is a dev/test machine so I don't really care about iMessage/iCloud etc. But I am a perfectionist and would like to fix if possible
• I am not risk adverse. I have ordered a used backplane as a alternate recovery method if required.
• I cannot perform fine soldering - so removal/replacement of the original rom is not feasible

From your referenced post it seems I can determine all the most important info without reading my old rom... SN from label on back, LBSN from the backplane board label, BD from decoded SN, SON from part number on label...

But once I have this data, how can I generate a new boot rom? Hex editing is simple enough, but what about the checksums?

And then: with the new boot rom image: how do you get it on the MATT card?

Sorry for all the questions, but this may help others in the future as more of these machines brick...

tsialex, you really help a lot of people on the forum and provide a lot of info - thank you

 

[tsialex]

It seems I have multiple paths forward:

• Live with the blocked id... this is a dev/test machine so I don't really care about iMessage/iCloud etc. But I am a perfectionist and would like to fix if possible
• I am not risk adverse. I have ordered a used backplane as a alternate recovery method if required.
• I cannot perform fine soldering - so removal/replacement of the original rom is not feasible

From your referenced post it seems I can determine all the most important info without reading my old rom... SN from label on back, LBSN from the backplane board label, BD from decoded SN, SON from part number on label...

But once I have this data, how can I generate a new boot rom? Hex editing is simple enough, but what about the checksums?

And then: with the new boot rom image: how do you get it on the MATT card?

Sorry for all the questions, but this may help others in the future as more of these machines brick...

tsialex, you really help a lot of people on the forum and provide a lot of info - thank you

It's a lot more complex than it appears. First, MLB/BD can't be decoded from the SSN, SSN data only shows the week your Mac Pro was built. MLB/BD is the exact backplane build date, saved by the OEM who made it, not Apple and it not the date that your Mac Pro was assembled. Recreating a valid MLB sector without access to Apple GSX data involves trial and error. SSN date is near, but it's not correct and sometimes backplanes are made months before the Mac Pro final assembly.

Without the sales receipt you don't know the SON, how you know if it's a special order (CTO/BTO), EDU channel purchase, on-line purchase or a standard model that is retail sold? It's very tricky outside standard models pre-made to be sold at retail. It's a lot worse for Mac Pros sold outside the USA.

No one with a sane mind would try to recreate the hardwareIDs if there is a possibility of the SPI flash still have some of it valid.

Checksums are CRC32 little endian.

After you correctly recreated the stores, you inject inside the empty NVRAM volume extracted from the generic MP5,1.fd, then you inject both the NVRAM volume and the MLB sector following the tutorial I made here:

MP5,1: SPI flash image reconstruction with intermediate files

Note: I'm starting to move/separate some of the content from the BootROM thread to facilitate search. I'm still editing this article. EFI Release vs BIOS Version vs BootBlock Version Reference Table: EFI Release:BIOS Version:BootBlock Version...

forums.macrumors.com

Since MATT card is a replacement SPI, while installed all SPI communication is routed to the MATT card SPI flash via LITTLEFRANK and the backplane one is disabled. It will work as the backplane SPI would, so efiflasher, flashrom/ROMTool and the NVRAM access work as nothing was changed and update/dump/write to the MATT card.

 

[MooffooM]

Fantastic! Thank you...

 

[freddycat]

Cmizapper sends it already flashed with a dump from a mid-2010 Mac, all MATT cards have the exactly same dump from the same Mac Pro.


You can read about it here:

2nd Mac Pro bricked by an Apple update

I just checked your mattorig.bin that you did PM me, 10/28, when you got the MATT card. It's not 140.0.0.0.0, it's MP51.007F.B00 and it's exactly the same one as @Plutonius and @campodoro74. So, cmizapper send the same BootROM to everyone, with exactly same hardwareIDs. :(

forums.macrumors.com

All people that buy a Mac Pro MATT card have the:

1. same System Serial Number - SSN
2. same HWC
3. same SON - Sales Order Number
4. same MLB - Main Logic Board Number
5. same BD - Build Date

So, everything needed to personalise a Mac Pro is exactly the same, the only thing that will differ from another clone is the MAC address, stored inside the Intel Ethernet controller SPI flash that have the controller firmware.

Lot's of unique info are stored inside the BootROM like:

HardwareID:	Location inside the BootROM:
Serial Number (SSN)	NVRAM volume
HWC	NVRAM volume
Sales Order Number (SON)	NVRAM volume
Gaid	NVRAM volume
MLB	Last sector of BootROM
MLB Build Date	Last sector of BootROM

HWC and Gaid are not truly unique, both are linked to the model you bought. Everything else is unique. Read this post:

MP5,1: BootROM thread | 144.0.0.0.0

This is a work in progress These identifiers are used by Apple to fully identify and validate your Mac, without them you can't login with iCloud/iMessage/FaceTime. Identifier:Definition: SSNSystem Serial Number HWCHardware Code SONSystem/Sales Order Number LBSN/MLB SNMain Logic Board Serial...

forums.macrumors.com

Apple will detect the clone when you access iCloud/FaceTime/Messages and will block it.


You can use install and use it, but like I said before, it's a clone. Apple detect clones when you log in.


Yes.

Btw, earlier MATT cards had the first ever public BootROM released, MP51.007F.B00 from early 2010, now cmizapper just updated it to 144.0.0.0.0, this don't change the clone problem.


You need to. For your Mac Pro correctly work again you need all hardwareIDs correctly saved/hashed/free space indicated.


Yes. I have a method to do this without having to desolder the SPI flash memory, but involves risk and I'm not going to explain it here. If you need, I can show it via PM later.

No cmizapper tool works for reading the corrupted SPI flash of a MP5,1, Mac Pro early-2009 to mid-2012 LPC interface design is a lot different than other Macs and Cmizapper developer its tools with a focus on what sells most, MacBooks/MacBook Pros. People here already tested.

Hello Alex. I assume that you are Portuguese or Portuguese based language. I bought a 2009 macpro that became bricked upon reset. What do you think is better? Reflash or new EFI chip? I don't know how to send MP to talk about my issue with you.
Thanks

 

[tsialex]

Hello Alex. I assume that you are Portuguese or Portuguese based language. I bought a 2009 macpro that became bricked upon reset. What do you think is better? Reflash or new EFI chip? I don't know how to send MP to talk about my issue with you.
Thanks

I'm already helping two people with similar problems, please go to the thread below and read everything, including the link I posted.

Please ask any doubts there, it will help others.

Mac Pro 4.1 > 5.1 bricked by High Sierra security update?

Hi all, need some advice please for a semi-literate/just enough to be dangerous cMP user. It’s a 12 core 3.33GHz with 96GB RAM and GT120 running, or was running, High Sierra. I bought the 4.1>5.1 cMP in Feb 2016 already flashed and can’t remember the OS it came with (possibly may have...

forums.macrumors.com