MP5,1: BootROM reconstruction with intermediate files

Discussion in 'Mac Pro' started by tsialex, Oct 13, 2018.

  1. tsialex, Oct 13, 2018
    Last edited: Oct 13, 2018

    tsialex macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #1
    Note: I'm starting to move/separate some of the content from the BootROM thread to facilitate search. I'm still editing this article.

    Blank_00.JPG Blank_01.JPG Blank_02.JPG Blank_03.JPG Blank_04.JPG Blank_05.JPG Blank_06.JPG Blank_07.JPG Blank_08.JPG Blank_09.JPG
     
  2. tsialex, Oct 13, 2018
    Last edited: Oct 15, 2018

    tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #2

    This is a DRAFT - Part1:

    This is the detailed process to populate generic MP51.fd from Apple with the hardware identifiers, using the intermediate files that I prepared and sent to some people. If you already have it, this is how you can use UEFITool 0.25.1 to inject the NVRAM volume and LBSN_BD sector into every MP51.fd released by Apple.

    You can inject the NVMe EFI module into MP51.fd before doing this. (No need to inject if using 140.0.0.0.0 BootROM)

    Don't extract the NVRAM volume from your corrupted BootROM and inject into the generic MP51.fd from Apple, you will get the same corrupted BootROM in the end. This works only with the intermediate files I sent.

    Attention:


    Do exactly as I described here, you don't want to brick your Mac Pro. This process is exclusive to MP51 firmwares, do not ever do this to downgrade to a MP41 firmware or use the same process to clean up a MP31 firmware.


    Open UEFITool 0.25.1 (Don't use UEFITool NE):

    UEFITool_00.png


    Menu, Open image file:

    UEFITool_01.png


    Select MP51.fd (you can inject the NVMe EFI module into MP51.fd before doing this if you want to use a BootROM before 140.0.0.0.0) and open it:

    UEFITool_02.png

    MP51.fd opened:

    UEFITool_03.png

    Now select the NVRAM area, it’s the GUID FFF12B8D-7696-4C8B-A985-2747075B4F50:

    UEFITool_04.png

    Click with the right button and select Replace as is:

    UEFITool_05.png

    Open your intermediate files folder, select the NVRAM volume and Open it:

    UEFITool_06.png


    NVRAM is done:

    UEFITool_07.png

    Now open the last volume, GUID 04ADEEAD-61FF-4D31-B6BA-64F8BF901F5A:

    UEFITool_08.png


    Select the last RAW section of GUID 1BA0062E-C779-4582-8566-336AE8F78F09:

    UEFITool_09.png

    Continue on Part2
     
  3. tsialex, Oct 13, 2018
    Last edited: Oct 13, 2018

    tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #3
    This is a DRAFT - Part2:


    Replace as is with your intermediate LBSN_BD sector:

    UEFITool_10.png
    UEFITool_11.png


    LBSN_BD sector is done, now you just have to save it to have a fully reconstructed BootROM.

    UEFITool_12.png


    Menu, Save image file:

    UEFITool_13.png

    Save your file and you are done!.

    Just write it to your logic board SPI flash memory with ROMTool, flashrom etc.

    You can even use EFI2Updater if you know the hidden/force options and how to manually bless it, but it's out of the scope here.

    P.S: There is a tiny easter egg in this document, what is about? :p
     
  4. tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
  5. tsialex, Oct 13, 2018
    Last edited: Oct 13, 2018

    tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
  6. tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
  7. expede, Oct 13, 2018
    Last edited: Oct 15, 2018

    expede macrumors regular

    expede

    Joined:
    Jan 15, 2018
    Location:
    Sweden
    #7
    Is this the egg?

    /Per

    Well it seams I am to stupid to see it. I have been staring at the pictures for some time now. Sorry! To dumb. Wow, I am so dumb.

     
  8. tsialex, Oct 13, 2018
    Last edited: Oct 13, 2018

    tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #8
    No :p (it's in one of the images, btw)
     
  9. abdyfranco macrumors regular

    abdyfranco

    Joined:
    Dec 4, 2017
    #9
    I saw the images for almost half an hour and I couldn't find anything. :confused:
     
  10. h9826790 macrumors G4

    h9826790

    Joined:
    Apr 3, 2014
    Location:
    Hong Kong
    #10
    I followed this exact procedure to reconstruct my BootROM, it’s easy to follow, and have great success. The resultant file is identical to the one that tsialex sent me.

    And when I follow the procedure, the image looks interesting to me is this one.
    DC79CFCF-C0EA-471E-8A98-CE431C74301D.png
     
  11. tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #11
    But why? ;)

    People are near, but no one found it yet :p
     
  12. h9826790 macrumors G4

    h9826790

    Joined:
    Apr 3, 2014
    Location:
    Hong Kong
    #12
    The numbers
     
  13. tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #13
    Ok, you are near. What the numbers represent?
     
  14. h9826790 macrumors G4

    h9826790

    Joined:
    Apr 3, 2014
    Location:
    Hong Kong
    #14
    G8909, a photodiode array, for PC
     
  15. tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #15
    Nope. Cold again.
     
  16. h9826790, Oct 15, 2018
    Last edited: Oct 15, 2018

    h9826790 macrumors G4

    h9826790

    Joined:
    Apr 3, 2014
    Location:
    Hong Kong
    #16
    The numbers looks wrong to me is the G89090004PC. Because that’s not a normal cMP serial number.

    So, I assume it’s about how to decode this numbers.

    if the last 3 digit means “for PC”, then it’s not too hard to understand. But if that means something else, it will be much harder to decoded.

    Also, now we know if we remove the 000 between G8909 and 4PC, then the result is wrong (or wrongly decoded).

    Then the next few questions will be if the G is attached to the 8909000? And if 8909 has it’s own special meaning?

    1989 Sep? Or 8th Sep 2009? Both doesn’t looks like has special meaning on computer or Mac Pro.

    So far, I can only find a company call itself 8909.

    8909000 can be a phone number, but I don’t think tsialex will post that on a forum.

    And what “G” means? G890? 9000?

    If the direction is right, may be the others can help to decode.
     
  17. tsialex, Oct 15, 2018
    Last edited: Oct 15, 2018

    tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #17
    It's a totally valid serial number for early-2009.

    4PC is one of the models of 2009 Mac Pros, the basic single processor one, MB871LL/A.

    No phone numbers, no hidden info. It's about the serial. Why?
     
  18. h9826790 macrumors G4

    h9826790

    Joined:
    Apr 3, 2014
    Location:
    Hong Kong
  19. tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #19
    No, but you are near. Decode the serial number and you know why. :p
     
  20. h9826790 macrumors G4

    h9826790

    Joined:
    Apr 3, 2014
    Location:
    Hong Kong
    #20
    The cMP usually made in China, but this once made in USA
     
  21. tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #21
    China, USA, Ireland… But it's not where.
     
  22. BillyBobBongo macrumors 68020

    BillyBobBongo

    Joined:
    Jun 21, 2007
    Location:
    On The Interweb Thingy!
  23. h9826790 macrumors G4

    h9826790

    Joined:
    Apr 3, 2014
    Location:
    Hong Kong
    #23
    G8 - USA
    9 - 2009
    09 - week 9
    000 - production line 0
    4PC - Mac Pro 4,1

    Production line 0?
     
  24. BillyBobBongo macrumors 68020

    BillyBobBongo

    Joined:
    Jun 21, 2007
    Location:
    On The Interweb Thingy!
    #24
    Which would make it the very first one produced, or perhaps the one used during the keynote for the Mac Pro reveal on March 3rd 2009!?
     
  25. tsialex thread starter macrumors 68040

    tsialex

    Joined:
    Jun 13, 2016
    Location:
    Brazil
    #25
    Yep. It's the first production Mac Pro, since Apple starts all serials with zero.
    --- Post Merged, Oct 15, 2018 ---
    Yes, the first one production Mac Pro made.
     

Share This Page