MP51.0084.B00 Rom Dump Request

Discussion in 'Mac Pro' started by HaypurTiryading, May 20, 2018.

  1. expede macrumors regular

    expede

    Joined:
    Jan 15, 2018
    Location:
    Sweden
    #26
    Hi !
    I´m trying to follow gilles_polysofts tutorial, witch is very detailed by the way, but I got stuck on CRC32 and value "f35a82b5". I do get "a7bc8121" and then there is a djump to this means "B5825AF3" in Big Edian? Okey?? I do not follow. I realise that I nead this number to switch the BDD7C676 in hexeditor but. How do I get from "a7bc8121" to "B5825AF3"?

    /Per
     
  2. LightBulbFun macrumors 68000

    LightBulbFun

    Joined:
    Nov 17, 2013
    Location:
    London UK
    #27
    so @mikeboss very kindly dumped a Mac Pro 6,1s BootROM for me and extracted and sent over to me 2 files :)

    the FL1100.ffs file

    and a XHCI.ffs file

    both of these are related to USB 3 (the first one is related to the FL1100 chipset specifically and the XHCI one just handles general class USB 3.0 stuff)

    i put these modules into my Mac Pro 5,1s BootROM and sadly it did not work

    the FL1100 driver never loads for some reason, but the XHCI driver does load. (I tried just the XHCI driver on its own made no difference, and with the FL1100 driver on its own the Mac Pro acts like it does on stock boot rom ie no USB 3 detected at all)

    and when i plug in a USB drive it does light up and stuff but the Mac Pro does not see the USB stick in the boot picker or it hard locks (ie if i reboot with the USB stick connected to the USB 3 card and hold alt it hard locks)

    so it looks like the XHCI driver is doing something but its not meshing properly with the Mac Pro 5,1 it would be very interesting to try some other XHCI USB3 chipsets like an ASmedia card? (my USB 3.0 card is one of those very common red coloured Inateck branded KT4004 cards)
     
  3. mikeboss macrumors 65816

    mikeboss

    Joined:
    Aug 13, 2009
    Location:
    switzerland
    #28
    @LightBulbFun

    what values are you seeing in the system profiler? MacPro6,1 values are

    USB 3.0 Bus:
    Host Controller Driver: AppleUSBXHCIFL1100
    PCI Device ID: 0x1100
    PCI Revision ID: 0x0010
    PCI Vendor ID: 0x1b73
     
  4. MIKX macrumors 6502a

    MIKX

    Joined:
    Dec 16, 2004
    Location:
    Japan
    #29
    Can anyone verify that Ubuntu 10.04 is the correct version for an original 4,1 Mac pro ? (has been flashed to 5,1 )
    Ubuntu 10.04 (Lucid Lynx) ?
     
  5. zozomester macrumors regular

    zozomester

    Joined:
    Apr 26, 2017
    Location:
    Hungary
    #30
    Very nice job! You could not share your modified Firmware?
     
  6. abdyfranco macrumors regular

    abdyfranco

    Joined:
    Dec 4, 2017
    #31
    Can you share the FL1100.ffs file, please? I want to do some testing.
     
  7. mikeboss macrumors 65816

    mikeboss

    Joined:
    Aug 13, 2009
    Location:
    switzerland
    #32
    PM sent...
     
  8. HaypurTiryading thread starter macrumors newbie

    HaypurTiryading

    Joined:
    May 20, 2018
    Location:
    Turkey
    #33
    I wonder if anybody can integrate the gop video driver for non flashed modern cards. I would like them to work at 5GT/s any screen without mods on pre boot, boot, driver selection, other os...
     
  9. LightBulbFun macrumors 68000

    LightBulbFun

    Joined:
    Nov 17, 2013
    Location:
    London UK
    #34
    here you go :) looks to be the same as whats in the Mac Pro 6,1... (this is with my Mac pro 5,1 running its stock BootROM)

    upload_2018-5-23_10-12-55.png

    upload_2018-5-23_10-13-7.png
     
  10. DearthnVader, May 23, 2018
    Last edited: May 23, 2018

    DearthnVader macrumors 6502a

    DearthnVader

    Joined:
    Dec 17, 2015
    Location:
    Red Springs, NC
    #35
    I would try to build the XHCI drivers from EDKII, they should be generic rather than chip specific.

    Test them in a shell, don't use rFIT or rFind, but rather just bless a shell.efi to boot from so you can test against the EFI kernel Apple is using on your system's firmware.

    I forget the exact sequence but it should be something like

    load XHCI.efi
    reconnect -r

    then maybe map fs to map any USB 3 disk you may have plugged in.

    If it works then you can generate .ffs files from the .efi driver models.

    https://github.com/pbatard/efifs/wiki/Adding-a-driver-to-a-UEFI-firmware

    Or you could try a prebuilt version to see if it works:

    https://drive.google.com/open?id=1MyiCVdfUXkpIXtFR3JVwfjR3lDx-sMyR

    I included the .ffs I extracted, as well as the firmware I extracted it from, and the Xhci.efi driver.

    I would test the driver from a shell to see if it links and works for you USB 3 PCI card.

    I loaded it from a shell, and it did load, however I'm having trouble passing XHCI to the virtual machine I use to test, so the driver didn't link to anything, because there isn't any XHCI device to link to.

    You may want to extract the .ffs yourself, as I'm not 100% sure I did it right, and we don't want to brick your MP.

    Sadly I don't own a MP to test with.
     
  11. Leborgne23 macrumors newbie

    Joined:
    May 23, 2018
    #36
    Hi Gilles, I'm following your instructions carefully as I don't want to turn my MacPro into a brick.
    I'm getting worried because late in the process, at the CRC32 checking phase, I don't have the same value as you although I used the exact same NVME-XDE driver and inserted it after the last XDE driver like you advised to to. My CRC32 is 4696ae97 and yours was f35a82b5.Could you take a look at those screenshots and tell me if I did anything wrong ? thanks in advance, fell free to reply in french if faster for you (I used to work for iConcept in Toulouse)
    Screen Shot 2018-05-23 at 23.45.51.png Screen Shot 2018-05-23 at 23.47.04.png
     
  12. ActionableMango macrumors G3

    ActionableMango

    Joined:
    Sep 21, 2010
    #37
    That would be of enormous benefit.
     
  13. LightBulbFun macrumors 68000

    LightBulbFun

    Joined:
    Nov 17, 2013
    Location:
    London UK
    #38
    the CRC f35a82b5 is that of just the NVMe module it self not the entire BootROM (also his CRC value of the patched BootROM in method 2 is of a EFI Update file rather then a complete BootROM, so also keep in mind that everyones full BootROM CRC will be different as everyone has different Motherboard and system serial numbers)
     
  14. handheldgames macrumors 65816

    handheldgames

    Joined:
    Apr 4, 2009
    Location:
    Pacific NW, USA
    #39
    Considering the fun I’m missing trying to software flash the NVMe upgraded firmware, I’m looking forward to Pomona SIOC8 test clip arriving tomorrow for this upgrade and ressurecting my original 4,1 with what I suspect is a corrupt firmware.

    Would someone be willing to share a copy of the NVMe-XDE driver?
     
  15. mikeboss macrumors 65816

    mikeboss

    Joined:
    Aug 13, 2009
    Location:
    switzerland
    #40
    PM sent...

    did you try to resurrect your MacPro4,1 with the firmware restoration CD?
     
  16. DearthnVader macrumors 6502a

    DearthnVader

    Joined:
    Dec 17, 2015
    Location:
    Red Springs, NC
    #41
    I suppose to test one would have to use a rEFInd shell, as I can't seem to bless a shell.efi correctly on my 32bit efi MacBook.

    I remember in the early days there was some code from intel that you could build a shell, bless it, and boot from it, but that's likely 32bit efi anyway.

    rEFInd should be fine, I think it doesn't replace the EFI kernel in the MP firmware, it's just a boot loader .efi and it has a shell.
     
  17. HaypurTiryading thread starter macrumors newbie

    HaypurTiryading

    Joined:
    May 20, 2018
    Location:
    Turkey
    #42
    Do you recommend EZP2010 Spi Programmer? I'm thinking to buy from aliexpress. What do you recommend from aliexpress?
     
  18. Norbert Mikołajczyk macrumors member

    Norbert Mikołajczyk

    Joined:
    May 26, 2016
    #43
    First thing, great work guys! amazing! Sorry for changing the topic, but maybe we could overclock the cpu using that kind of editing and methods, just wondering? :)
     
  19. DearthnVader macrumors 6502a

    DearthnVader

    Joined:
    Dec 17, 2015
    Location:
    Red Springs, NC
    #44
    Not really, there just is no support for it in the firmware, and it's not really something that needs to be done on that level. Really that just a matter of going over the logic board with a microscope until you find the PLL Apple used. Then see if you can find the data sheet.

    You'd be amazed at the things you can learn with a data sheet. Likely it's an I2C device, and can be programed easily with a tool as simple as Grub2. There is some trial and error to it, and a small chance of killing you logic board, and sometimes the PLL is locked and you have to pull some pin to ground to program it, but it likely doable, just takes some effort.
     
  20. handheldgames, May 26, 2018
    Last edited: May 26, 2018

    handheldgames macrumors 65816

    handheldgames

    Joined:
    Apr 4, 2009
    Location:
    Pacific NW, USA
    #45
    BBD09BF7-69E3-4885-894E-C49773D58FCE.jpeg It’s the weekend. TIME FOR SOME OLD SCHOOL ROM HACKING.

    Following tutorials aimed at flashing a 2009 MacBook Pro, I’ve built a Flash ROM reader compatible with the 4,1/5,1 Mac Pro’s efi flash ram.

    The process of attaching the pins from a sparkfun Bus Pirate v 3.6 to the pins of a Pomona SOIC8 clip was relatively easy. Coming in at a cost of about $55.00, including a supply of cables and shipping.

    Accessing the ROM requires removal of the CPU tray housing and should take around 20 minutes to complete.

    FWIW... there is an easy to access diagnostic port near the PCIe slots that may allow flashing of the Efi rom without having to tear down the cmp. Near the port is a missing jumper that may be necessary to connect.
     
  21. MIKX macrumors 6502a

    MIKX

    Joined:
    Dec 16, 2004
    Location:
    Japan
    #46
    I wish you well. We certainly have a lot of talented, inquisitive, persistent members involved in this project.

    Sometime today I'll be attempting to dump my 4.1>5,1's MP51.0085.B00 bootrom using Flashrom in Linux.

    It will be interesting to see if there are major differences between the "84" & "85" bootROM versions.
     
  22. h9826790 macrumors G4

    h9826790

    Joined:
    Apr 3, 2014
    Location:
    Hong Kong
    #47
    You mean this file?
    Screen Shot 2018-05-27 at 12.28.20.png
    I mount the EFI partition, and it's still there. May be no need to dump.
     
  23. zozomester macrumors regular

    zozomester

    Joined:
    Apr 26, 2017
    Location:
    Hungary
    #48
    Hi Gilles,
    Has someone succeeded the second solution? You might not be able to make a video (Youtube)?
     
  24. expede macrumors regular

    expede

    Joined:
    Jan 15, 2018
    Location:
    Sweden
    #49
    @h9826790 I do not?!! I have a Firmware.scap file. But I do have firmware 84 not 85.

    /Per

    [​IMG]
     
  25. handheldgames macrumors 65816

    handheldgames

    Joined:
    Apr 4, 2009
    Location:
    Pacific NW, USA
    #50
    Attempting to backup the cmp efi rom using a 2018 and 2010 MacBook Pro with the bus pirate, Pomona clip combo using flashrom, the ST flash ram is not recognized while surface mounted. Mirroring the same results originally reported.
     

Share This Page