Mac Efi Tool
The Brutus is our brute force EFI PIN code finder. The tool you need when you forgot your EFI PIN and locked yourself out of your Mac. It is incredibly easy to use. Just plug it in and forget about it. Once it has found the code it will let you know. Suitable for 4 digit and 6 digit PIN codes. Scanning all 4-digit codes takes up to 2 days.
If you think your Mac might have a hardware issue, you can use Apple Diagnostics to help determine which hardware component might be at fault. Apple Diagnostics also suggests solutions and helps you contact Apple Support for assistance.
How You Can Check the EFI Firmware Version. You can check what EFI version your system is running by clicking on the Apple menu and selecting About This Mac System Report Hardware. In the hardware overview section macOS displays the Model Identifier, the Boot ROM version and the SMC version number your Mac is running. Description This device removes and unlocks the Apple Mac (2010 – 2017) EFI BIOS passwords in around 10 – 15 seconds (new version) The purpose of this device is to help people who doesn’t have soldering skills, wants to unlock their device without dismantling. EasyUEFI is a free software which allows you to manage the EFI/UEFI boot options & the EFI System Partitions. With this software you can easily fix EFI/UEFI boot issues, such as missing or corrupt EFI/UEFI boot option, missing or corrupt EFI System Partition. The EFI check utility is one of Apple’s security features designed to protect your Mac’s firmware from unauthorized tampering. The tool runs silently in the background every week, and you’ll only notice it when you get the warning message.
Prepare your Mac
- Shut down your Mac.
- Disconnect all external devices except keyboard, mouse, display, Ethernet connection (if applicable), and connection to AC power.
- Make sure that your Mac is on a hard, flat, stable surface with good ventilation.
Start Apple Diagnostics
Determine whether you're using a Mac with Apple silicon, then follow the appropriate steps:
Apple silicon
- Turn on your Mac and continue to press and hold the power button as your Mac starts up.
- Release when you see the startup options window, which includes a gear icon labeled Options.
- Press Command (⌘)-D on your keyboard.
Intel processor
- Turn on your Mac, then immediately press and hold the D key on your keyboard as your Mac starts up.
- Release when you see a progress bar or you're asked to choose a language.
View the test results
Apple Diagnostics shows a progress bar while it's checking your Mac:
When testing is complete, Apple Diagnostics shows the results, including one or more reference codes. Learn about Apple Diagnostics reference codes.
To repeat the test, click “Run the test again” or press Command-R.
To restart your Mac, click Restart or press R.
To shut down, click Shut Down or press S.
To get information about your service and support options, make sure that your Mac is connected to the internet, then click ”Get started” or press Command-G. Your Mac will restart to a webpage with more information. When you're done, choose Restart or Shut Down from the Apple menu.
Learn more
On an Intel-based Mac, if you can't start Apple Diagnostics with the D key, try these solutions:
- Press and hold Option-D at startup to use Apple Diagnostics over the internet.
- Make sure that your Mac isn't using a firmware password.
EFI Bootup CS Graph
820-4924
Mac Efi Tool
SPI CS during a successful bootup on an 820-4924. The first 200ms burst seems to signify there is good communications with the EFI. With bad traces, that initial burst lasts around 2ms. Near the start of the 1.2 second burst the chime sounds and backlight turns on.
820-3437
Communication issue
CPU VCore, SLP_S5# and SPI_CS0_L when R6120 is removed on an 820-3437, simulating communication issue with SPI ROM causing power cycling.
Commmunication ok
Expected SPI_CS0_L behaviour before RAM initialization. This board has RAM issue, on a working board there will be more activity afterwards when EFI is copied into RAM.
820-00840
EFI ONLY
SPI_MLB_CS_L 2.4 second graph
SPI_MLB_CS_L 12 second graph
SPI_MLB_CS_L 24 second graph. Charger chime happens at the end of the communications
SPI_MLB_CS_L in blue, SPIROM_USEMLB in yellow. 24 second chart.
EFI + SMC
LPC_FRAME_L in blue, SPI_MLB_CS_L in yellow. 2.4 second graph.
LPC_FRAME_L in blue, SPI_MLB_CS_L in yellow. 24 second graph.
EFI Quad SPI
because they switched to Quad SPI, they can't use HOLD# directly to bypass SPI ROM as it's now an I/O pin.
It uses a different SPI ROM chip (the smaller WSON8 footprint IIRC) which supports Quad SPI. Typically it has to be enabled by setting the 'QE' (Quad Enable bit) with a programmer, then those 4 pins will act as I/O all the time. With Dual SPI that was used before, the communication starts in standard (single) SPI and then a command is used to switch to Dual SPI.
[5:01 PM] piernov: SPI is originally a protocol that works with 2 simplex data lines(only one direction, one transmit MISO, one receive MOSI, viewed from the SPI ROM). In dual mode, those 2 lines are now half-duplex data lines (bidirectional, but not at the same time, it alternates directions) and data is shared across them (so that the device can send or receive twice as fast). In quad SPI mode, it's similar to dual SPI but you now have 4 data lines because you use the Hold and Write Protect signal lines as data lines, so you can transmit 4 times as fast as on a standard SPI bus.
EFI Tools
GUI EFI Tool
Script EFI Tool
Mac Efi Password Removal Tool
EFI ME Cleaning
How to clean the Intel ME (Management Engine) region of the EFI
EFI Change Serial Number
How to edit the serial number of a Mac
EFI Bootup Diagram
POST
SPI ROM compatibility
It is not recommended to replace the SPI ROM chip with a different model. Different SPI ROM chips may have different working voltage (1.8V or 3.3V), different operating frequency and latency, different command set and especially support for Quad SPI mode which may not be enabled by default. In particular, the 2015 MacBooks use Quad SPI mode, so the chip must support it and have its QE bit set to one. Additionally, Intel platforms all have Intel Management Engine nowadays, and it can be picky about the SPI ROM. The firmware contains a list of supported chip in the VSCC table, you can check it with UEFITool NE or Intel FITC if ever you have to swap with a different chip.
Swapping SPI ROM between boards and using pre-programmed ICs
Buying pre-programmed chip off of eBay is not a good idea. Sometimes it works, sometimes it doesn't, because the people that sell them don't necessarily know what they are doing and just flash random dumps found on badcaps.net or Vinafix.
Using a pre-programmed chip or a chip from another machine means you will have the wrong serial number. In the best case the serial number is blank and the board has to be serialized using Apple's Blank Board Serializer. Otherwise it has to be edited to match the original one, and the checksum for the Fsys store (which contains the ssn variable) has to be recalculated.
Using a chip from another machine means you get the ME region that has already been tied to the new machine's PCH. This will cause all sorts of random problems depending on the machine, incl. shutdown after 30 minutes, long POST delay, fan running at full speed, ME not working, freeze/kernel panic while booting macOS, apparently even webcam not working on some Mac boards. The ME region has to be cleaned, and there's a specific procedure for that, 90% of the videos or tutorials you'll find are wrong about it. Don't copy/paste with an hex editor, don't use MEInject. This will put a raw ME region without manufacturer settings, and Macs for example have specific settings for the ME region that will be lost (and it can also cause similar issues to 'dirty' ME region). The correct way is to use Intel FITC, see tutorial on win-raid forums. Some pre-programmed chip also may not have the ME region cleaned properly.
APFS BootROM
Apple switched to APFS by default with High Sierra on machines with SSD (and HDD since Mojave), which required a BootROM update (part of the EFI) to support booting from this filesystem. Meaning that if you use an EFI with an old BootROM (either flashing a random dump or using a pre-programmed chip without the update), suddenly you won't be able to boot from a drive with High Sierra or newer on it, and you won't even see it in the boot menu. One solution is to reinstall macOS on the internal SSD to trigger the BootROM update.
WSON8 adapter
You can buy a WSON8 adapter board for your programmer, it should come with both the 8x6 and the 6x5 footprints for 2013 and 2015 machines respectively. You don't need to use hot air to solder it on the adapter, you can just run the solder iron with some solder on the edges.