MP 1,1-5,1 MP5,1: SPI flash image reconstruction with intermediate files

tsialex

macrumors 604
Original poster
Jun 13, 2016
7,613
8,347
Brazil
Note: I'm starting to move/separate some of the content from the BootROM thread to facilitate search. I'm still editing this article.

EFI Release vs BIOS Version vs BootBlock Version Reference Table:
EFI Release:BIOS Version:BootBlock Version:
MP41.0081.B04MP41.88Z.0081.B04.0903051113AAPLEFI1.88Z.0004.I00.0901121311
MP41.0081.B07MP41.88Z.0081.B07.0910130729AAPLEFI1.88Z.0004.I00.0910130728
MP41.0081.B08MP41.88Z.0081.B08.1001221313AAPLEFI1.88Z.0004.I00.1001221311
MP51.007F.B00MP51.88Z.007F.B00.1008031144AAPLEFI1.88Z.0005.I00.1006041028
MP51.?MP51.88Z.?AAPLEFI1.88Z.0005.I00.1007141219
MP51.007F.B01MP51.88Z.007F.B01.1008231310AAPLEFI1.88Z.0005.I00.?
MP51.007F.B02MP51.88Z.007F.B02.1009221128AAPLEFI1.88Z.0005.I00.?
MP51.007F.B03MP51.88Z.007F.B03.1010071432AAPLEFI1.88Z.0005.I00.1010071430
MP51.0083.B00MP51.88Z.0083.B00.1707271620AAPLEFI1.88Z.0005.I00.1707271617
MP51.0084.B00MP51.88Z.0084.B00.1708080528AAPLEFI1.88Z.0005.I00.1708080525
MP51.0085.B00MP51.88Z.0085.B00.1802021746AAPLEFI1.88Z.0005.I00.1802021742
MP51.0087.B00MP51.88Z.0087.B00.1804181525AAPLEFI1.88Z.0005.I00.1804181521
MP51.0089.B00MP51.88Z.0089.B00.1806081708AAPLEFI1.88Z.0005.I00.1806081704
138.0.0.0.0MP51.88Z.F000.B00.1807300628AAPLEFI1.88Z.0005.I00.1807300627
139.0.0.0.0MP51.88Z.F000.B00.1808171030AAPLEFI1.88Z.0005.I00.1808171029
140.0.0.0.0MP51.88Z.F000.B00.1809191555AAPLEFI1.88Z.0005.I00.1809191554
141.0.0.0.0MP51.88Z.F000.B00.1812191621AAPLEFI1.88Z.0005.I00.1812191620
142.0.0.0.0MP51.88Z.F000.B00.1902142049AAPLEFI1.88Z.0005.I00.1902142048
144.0.0.0.0MP51.88Z.F000.B00.1904121248AAPLEFI1.88Z.0005.I00.1904121247
 
Last edited:

tsialex

macrumors 604
Original poster
Jun 13, 2016
7,613
8,347
Brazil

This is a DRAFT - Part1:

This is the detailed process to populate generic MP51.fd from Apple with the hardware identifiers, using the intermediate files created from BootROM dumps that people sent me.

If you already have the intermediate files, these are created from your Mac Pro BootROM dump and here I show you how to use UEFITool 0.25.1 to inject the NVRAM volume and LBSN_BD sector into every MP51.fd ever released by Apple.

You can inject the NVMe EFI module into MP51.fd before doing this. (No need to inject if using 140.0.0.0.0 BootROM)

Don't extract the NVRAM volume from your corrupted BootROM and inject into the generic MP51.fd from Apple, you will get the same corrupted BootROM in the end. This works only with the intermediate files I sent.

Attention:


Do exactly as I described here, you don't want to brick your Mac Pro. This process is exclusive to MP51 firmwares, do not ever do this to upgrade a MP4,1 or downgrade to a MP41 firmware, or use the same process to clean up a MP31 firmware. A LBSN_BD sector from a MP5,1 firmware is different from the same sector of a MP4,1 firmware and it needs to be modified before injecting into a MP4,1 firmware or you will brick your Mac Pro, reverse too, MP4,1 MLB sector is incompatible with a MP5,1 firmware.


Open UEFITool 0.25.1 (Don't use UEFITool NE):

UEFITool_00.png



Menu, Open image file:

UEFITool_01.png



Select MP51.fd (you can inject the NVMe EFI module into MP51.fd before doing this if you want to use a BootROM before 140.0.0.0.0) and open it:

UEFITool_02.png


MP51.fd opened:

UEFITool_03.png


Now select the NVRAM area, it’s the GUID FFF12B8D-7696-4C8B-A985-2747075B4F50:

UEFITool_04.png


Click with the right button and select Replace as is:

UEFITool_05.png


Open your intermediate files folder, select the NVRAM volume and Open it:

UEFITool_06.png



NVRAM is done:

UEFITool_07.png


Now open the last volume, GUID 04ADEEAD-61FF-4D31-B6BA-64F8BF901F5A:

UEFITool_08.png



Select the last RAW section of GUID 1BA0062E-C779-4582-8566-336AE8F78F09:

UEFITool_09.png


Continue on Part2
 
Last edited:

tsialex

macrumors 604
Original poster
Jun 13, 2016
7,613
8,347
Brazil
This is a DRAFT - Part2:


Replace as is with your intermediate LBSN_BD sector:

UEFITool_10.png

UEFITool_11.png



LBSN_BD sector is done, now you just have to save it to have a fully reconstructed BootROM.

UEFITool_12.png



Menu, Save image file:

UEFITool_13.png


Save your file and you are done!.

Just write it to your logic board SPI flash memory with ROMTool, flashrom etc.

You can even use EFI2Updater if you know the hidden/force options and how to manually bless it, but it's out of the scope here.

P.S: There is a tiny easter egg in this document, what is about? :p
 
Last edited:

expede

macrumors regular
Jan 15, 2018
203
54
Sweden
Is this the egg?

/Per

Well it seams I am to stupid to see it. I have been staring at the pictures for some time now. Sorry! To dumb. Wow, I am so dumb.

(No need to inject if using 140.0.0.0.0 BootROM)
 
Last edited:

abdyfranco

macrumors regular
Dec 4, 2017
126
114
Is this the egg?

/Per

Well it seams I am to stupid to see it. I have been staring at the pictures for some time now. Sorry! To dumb.
I saw the images for almost half an hour and I couldn't find anything. :confused:
 

h9826790

macrumors G5
Apr 3, 2014
14,108
6,734
Hong Kong
I followed this exact procedure to reconstruct my BootROM, it’s easy to follow, and have great success. The resultant file is identical to the one that tsialex sent me.

And when I follow the procedure, the image looks interesting to me is this one.
DC79CFCF-C0EA-471E-8A98-CE431C74301D.png
 

tsialex

macrumors 604
Original poster
Jun 13, 2016
7,613
8,347
Brazil
I followed this exact procedure to reconstruct my BootROM, it’s easy to follow, and have great success. The result file is identical to the one that tsialex sent me.

And when I follow the procedure, the image looks interesting to me is this one.
View attachment 795144
But why? ;)

People are near, but no one found it yet :p
 

h9826790

macrumors G5
Apr 3, 2014
14,108
6,734
Hong Kong
The numbers looks wrong to me is the G89090004PC. Because that’s not a normal cMP serial number.

So, I assume it’s about how to decode this numbers.

if the last 3 digit means “for PC”, then it’s not too hard to understand. But if that means something else, it will be much harder to decoded.

Also, now we know if we remove the 000 between G8909 and 4PC, then the result is wrong (or wrongly decoded).

Then the next few questions will be if the G is attached to the 8909000? And if 8909 has it’s own special meaning?

1989 Sep? Or 8th Sep 2009? Both doesn’t looks like has special meaning on computer or Mac Pro.

So far, I can only find a company call itself 8909.

8909000 can be a phone number, but I don’t think tsialex will post that on a forum.

And what “G” means? G890? 9000?

If the direction is right, may be the others can help to decode.
 
Last edited:

tsialex

macrumors 604
Original poster
Jun 13, 2016
7,613
8,347
Brazil
The numbers looks wrong to me is the G89090004PC. Because that’s not a cMP serial number.
It's a totally valid serial number for early-2009.

So, I assume it’s about how to decode this numbers.

if the last 3 digit means “for PC”, then it’s not too hard to understand. But if that means something else, it will be much harder to decoded.

Also, now we know if we remove the 000 between G8909 and 4PC, then the result is wrong (or wrongly decoded).

Then the next few questions will be if the G is attached to the 8909000? And if 8909 has it’s own special meaning?

1989 Sep? Or 8th Sep 2009? Both doesn’t looks like has special meaning on computer or Mac Pro.

So far, I can only find a company call itself 8909.

8909000 can be a phone number, but I don’t think tsialex will post that on a forum.

And what “G” means? G890? 9000?

If the direction is right, may be the others can help to decode.
4PC is one of the models of 2009 Mac Pros, the basic single processor one, MB871LL/A.

No phone numbers, no hidden info. It's about the serial. Why?
 
Last edited:

tsialex

macrumors 604
Original poster
Jun 13, 2016
7,613
8,347
Brazil
G8 - USA
9 - 2009
09 - week 9
000 - production line 0
4PC - Mac Pro 4,1

Production line 0?
Yep. It's the first production Mac Pro, since Apple starts all serials with zero.
[doublepost=1539601851][/doublepost]
Which would make it the very first one produced, or perhaps the one used during the keynote for the Mac Pro reveal on March 3rd 2009!?
Yes, the first one production Mac Pro made.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.