Extract Firmware from OS X installer

extract-firmware.md

• Download the full installer:

softwareupdate --list-full-installers
Finding available software
Software Update found the following full installers:
* Title: macOS Ventura, Version: 13.1, Size: 11931164KiB, Build: 22C65
* Title: macOS Ventura, Version: 13.0.1, Size: 11866460KiB, Build: 22A400
* Title: macOS Ventura, Version: 13.0, Size: 11866804KiB, Build: 22A380
* Title: macOS Monterey, Version: 12.6.2, Size: 12104568KiB, Build: 21G320
* Title: macOS Monterey, Version: 12.6.1, Size: 12108491KiB, Build: 21G217
* Title: macOS Monterey, Version: 12.6, Size: 12104042KiB, Build: 21G115
* Title: macOS Big Sur, Version: 11.7.2, Size: 12119307KiB, Build: 20G1020
* Title: macOS Big Sur, Version: 11.7.1, Size: 12119247KiB, Build: 20G918
* Title: macOS Big Sur, Version: 11.7, Size: 12118755KiB, Build: 20G817
* Title: macOS Big Sur, Version: 11.6.6, Size: 12121263KiB, Build: 20G624
* Title: macOS Big Sur, Version: 11.6.5, Size: 12121404KiB, Build: 20G527
* Title: macOS Big Sur, Version: 11.6.4, Size: 12147782KiB, Build: 20G417
* Title: macOS Big Sur, Version: 11.6.3, Size: 12143674KiB, Build: 20G415
* Title: macOS Big Sur, Version: 11.6.2, Size: 12141944KiB, Build: 20G314
* Title: macOS Big Sur, Version: 11.6.1, Size: 12137180KiB, Build: 20G224
* Title: macOS Big Sur, Version: 11.5.2, Size: 12149332KiB, Build: 20G95
* Title: macOS Catalina, Version: 10.15.7, Size: 8055650KiB, Build: 19H15
* Title: macOS Catalina, Version: 10.15.7, Size: 8055522KiB, Build: 19H2
* Title: macOS Catalina, Version: 10.15.6, Size: 8055450KiB, Build: 19G2021
* Title: macOS Mojave, Version: 10.14.6, Size: 5896894KiB, Build: 18G103
* Title: macOS High Sierra, Version: 10.13.6, Size: 5099306KiB, Build: 17G66

softwareupdate --fetch-full-installer --full-installer-version 12.6.2

• Or use Mist or sus-inspector

• For MacPro5,1 use this:

softwareupdate --fetch-full-installer --full-installer-version 10.14.6
cp /Applications/Install\ macOS\ Mojave.app/Contents/Resources/Firmware/MP51.fd  ~/Desktop

For older systems officially supporting:

• Catalina use the latest security update
• Mojave use the latest security update
• High Sierra use the latest security update

Apple security updates

pkgutil --expand [Double click the dmg file and drop file here] /destination/path/

pkgutil --expand /Volumes/macOS\ Catalina\ Security\ Update\ 2021-008/SecUpd2021-008Catalina.pkg ~/Desktop/Expanded
cp ~/Desktop/Expanded/FirmwareUpdate.pkg/Scripts/Tools/EFIPayloads/MM61.scap ~/Desktop/MM61.scap

Please check here for the latest firmware version and the latest full installer version or latest security update.

• Mounting Big Sur SharedSupport disk image:

/usr/bin/hdiutil mount /Applications/Install\ macOS\ Big\ Sur*.app/Contents/SharedSupport/SharedSupport.dmg

• Store ZIP file path to variable (handle unpredictable file name)

ZIP_FILE=`ls /Volumes/Shared\ Support/com_apple_MobileAsset_MacSoftwareUpdate/*.zip`

• List firmware files in ZIP file:

unzip -l-qq "$ZIP_FILE" "AssetData/boot/EFI/EFIPayloads/*"

• In Terminal.app, first verify your EFI version using the following command:

/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check | grep "EFI Version"

• Note: macOS Sonoma no longer prifides the eficheck utility. That has been removed from Sonoma. All T2 and Apple silicon models automatically check the integrity of their firmware in the early part of the boot process anyway.

• locate the firmware file and store the exact file path into the variable FIRMWARE_FILE:

FIRMWARE_FILE=<firmware file path here>

• An example command would be:

FIRMWARE_FILE=AssetData/boot/EFI/EFIPayloads/MBP112.scap

• Extract the firmware file ( "-j" means don't create directory structure and "-d" designates that output directory):

unzip -j "$ZIP_FILE" $FIRMWARE_FILE -d ~/Desktop/

• Set your MacBook to upgrade the firmware on the next bootup (SIP must be disabled). Fill in the file name of your specific firmware file:

sudo /usr/sbin/bless -firmware ~/Desktop/<firmware file name here> --verbose --recovery

• Trigger firmware upgrade: Shut down your computer. (Do not choose the restart option!) After the MacBook is powered off, power it back on by pressing the power button. Next be patient, and if everything goes well your firmware will be updated.

Hi. I know this is kinda older now but I desperately need to force and update to my firmware for my Mac 13.2. By the way thank you so much for writing this!! I'm really hoping it solves my problems. Please note I am really not good at terminal commands or whatever you call this, this is probably the most advanced thing I have ever done, but I really need the firmware upgraded. I followed the steps and so far everything has worked but I'm confused at the step where you say "locate the firmware file and store the exact file path into the variable FIRMWARE_FILE:" . locate which firmware file? The one in the shared support dmg in assetdata/boot/EFI/EFIpayloads/ ? if that is where I'm looking then the firmware file for my iMac 13.2 doesn't exist there because this is the Big Sur installer and the last update for iMac 13,2 is in Catalina. Or are you talking about the firmware file that is currently on my system? in which case how would I find that? Sorry I'm really not that great at this haha any help would be amazing !

You will need to download latest Catalina security update

yes I did that. But so what you mean by the step "locate the firmware file and store the path" ? The firmware file you are talking about is the one from the Catalina security update? the one that was taken out of the Catalina installer and stored on the desktop? in my case it would be /Deskptop/IM13.2.scap for my iMac 13.2?

Or (like the example you provided in the next step) is it in the zipped file from the Big Sur installer?(FIRMWARE_FILE=AssetData/boot/EFI/EFIPayloads/MBP112.scap) ?
Thanks!

• Find your EFI version:

/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check | grep "EFI Version"

• List firmware files in ZIP file:

unzip -l-qq "$ZIP_FILE" "AssetData/boot/EFI/EFIPayloads/*"

• locate the firmware file and store the exact file path into the variable FIRMWARE_FILE:

FIRMWARE_FILE=AssetData/boot/EFI/EFIPayloads/MBP112.scap

Replace MBP112.scap with your EFI found earlier and listed in the ZIP file.

Thanks for the help! It seems it worked but right at the end it looks like something went wrong.
Temp@Devins-iMac ~ % sudo /usr/sbin/bless -firmware ~/Desktop/IM131.scap --verbose --recovery
Password:
EFI found at IODeviceTree:/efi
Will need to copy 8458240 bytes to EFI system partition
No auxiliary booter partition required
System partition found
Returning booter information dictionary:
{
"Auxiliary Partitions" = (
);
"Data Partitions" = (
disk3s5
);
"Preboot Volumes" = (
disk3s2
);
"System Partitions" = (
disk1s1
);
}
No appropriate ESP could be found
Error while writing firmware updater for EFI
Temp@Devins-iMac ~ %

Any ideas what's happening here?
I looked it up and it seems maybe the issue is I'm booting off external drive? Problem is my internal Hard drive is completely dead. looks like I'm destined to never get this firmware up to date .

What is the output of:

diskutil list
csrutil status

Did you disable SIP? It needs to be turned OFF.

yeah I disabled it.Temp@Devins-iMac ~ % diskutil list
/dev/disk0 (internal, physical):
#: TYPE NAME SIZE IDENTIFIER
0: *4.1 GB disk0

/dev/disk1 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *512.1 GB disk1
1: EFI EFI 209.7 MB disk1s1
2: Apple_APFS Container disk3 511.9 GB disk1s2

/dev/disk2 (external, physical):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *63.3 GB disk2
1: EFI EFI 209.7 MB disk2s1
2: Apple_HFS Untitled 63.0 GB disk2s2

/dev/disk3 (synthesized):
#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +511.9 GB disk3
Physical Store disk1s2
1: APFS Volume Macintosh SSD-Adata-... 408.7 GB disk3s1
2: APFS Volume Preboot 30.1 MB disk3s2
3: APFS Volume Recovery 526.8 MB disk3s3
4: APFS Volume VM 14.0 GB disk3s4
5: APFS Volume Macintosh SSD-Adata-... 11.4 GB disk3s5

/dev/disk4 (disk image):
#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme +950.1 GB disk4
1: EFI EFI 209.7 MB disk4s1
2: Apple_HFS Time Machine Backups 949.8 GB disk4s2

Temp@Devins-iMac ~ % cseutil status
zsh: command not found: cseutil
Temp@Devins-iMac ~ % csrutil status
System Integrity Protection status: disabled.
Temp@Devins-iMac ~ %

based on this (https://discussions.apple.com/thread/253304073) I would say its because the genuine Apple original hard drive is dead, and that's why the firmware hasn't been updated in the first place.

Try this:

 diskutil eraseDisk JHFS+ Emptied /dev/disk0

unfortunately I think the drive is too far gone. I got this:
Temp@Devins-iMac ~ % diskutil eraseDisk JHFS+ Emptied /dev/disk0
Started erase on disk0
Unmounting disk
Creating the partition map
Error: -69760: Unable to write to the last block of the device

Try this:

sudo  dd  if=/dev/zero  of=/dev/disk0  bs=100m  count=100

it gives me this:
dd: /dev/disk0: Input/output error
40+0 records in
39+0 records out
4089446400 bytes transferred in 897.401292 secs (4556987 bytes/sec)

It could be a bad drive or a bad cable.

Yeah that's what I assumed. Guess my only option to update the firmware is to find another genuine apple hard drive and open this thing up and replace the hard drive. Such a hassle since its an iMac and all just for the firmware :/. Thanks for all you help and tips though!

It does not have to be genuine but internal. The script is working on non-Apple drive.

Hi
I'm curious if this would could aid in downgrading an ibridge version, either through DFU Restore and/or imbedding in a legacy installer or even flashing? Forgive my verbiage/naivety as I'm just learning about all of this. I know there aren't any signed ibridge versions that go back as far as I need (10.13.6) but I'm not clued in as to how the ibridge version works with an installer.
I'm on an intel T2 iMac Pro, trying to revert back to the OS it was originally shipped. Since I bought it refurbished, I had just been updated to the latest OS + ibridge version, which will only allow Mojave 10.14 or newer to be booted to, internally or externally. And or course I'm trying to get to High Sierra 10.13. I had almost completely accepted defeat over the last few weeks after numerous failed attempts to find a work around until I saw this page. I know it's been done before but I haven't found anyone who has RECENTLY successfully downgraded to 10.13 after updating to the current OS/Ibridge v.
Do you think this tool be used in my situation? Any insight is very much apprecaited

You may take a look here:
https://www.reddit.com/r/macsysadmin/comments/bb32y5/comment/ekhiiqf/
Also you can most definately boot 10.13.6 with OpenCore. With OpenCore you can spoof the firmware version. Have you tried
-no_compat_check nvram variable?

Hi,

When I list the EFI payloads I only get 2 .scap files and plenty of .fd files. Are these the same, can I reference this .fd file as if it were a .scap?

% unzip -l-qq "$ZIP_FILE" "AssetData/boot/EFI/EFIPayloads/*"     
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  02-26-2024 07:22   AssetData/boot/EFI/EFIPayloads/
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM161.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP133.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM171.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP142.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP143.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP132.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM183.fd
  8520304  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MP61.scap
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBA71.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MB91.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP121.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP131.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM162.fd
 16777216  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM191.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP114.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM181.fd
  8520304  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MM71.scap
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP141.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MB101.fd
---------                     -------
168035552                     20 files
myself@mbp2015 ~ % /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check | grep "EFI Version"
EFI Version: MBP114.88Z.F000.B00.2310070442  (Boot ROM Version: 489.0.0.0.0)

It's a MacBookPro11,5.

You need to get the latest Monterey security update.
https://support.apple.com/en-us/HT214083

Hi @startergo thank you for your reply. Sorry for my ineptitude but could you please tell where can I download that latest Monterey security update? I thought I already downloaded 12.7.4.
The support article doesn't seem to provide any options for download.

myself@mbp2015 ~ % softwareupdate --list-full-installers
Finding available software
Software Update found the following full installers:
* Title: macOS Monterey, Version: 12.7.4, Size: 12117810KiB, Build: 21H1123
* Title: macOS Monterey, Version: 12.7.3, Size: 12109975KiB, Build: 21H1015
* Title: macOS Monterey, Version: 12.7.2, Size: 12116623KiB, Build: 21G1974
* Title: macOS Big Sur, Version: 11.7.10, Size: 12125478KiB, Build: 20G1427
* Title: macOS Catalina, Version: 10.15.7, Size: 8055650KiB, Build: 19H15
* Title: macOS Catalina, Version: 10.15.7, Size: 8055522KiB, Build: 19H2
* Title: macOS Catalina, Version: 10.15.6, Size: 8055450KiB, Build: 19G2021
* Title: macOS Mojave, Version: 10.14.6, Size: 5896894KiB, Build: 18G103
* Title: macOS High Sierra, Version: 10.13.6, Size: 5099306KiB, Build: 17G66
myself@mbp2015 ~ % softwareupdate --fetch-full-installer --full-installer-version 12.7.4
Scanning for 12.7.4 installer
Install finished successfully
myself@mbp2015 ~ %

I mentioned that in the guide. Use SUS-inspector
https://github.com/hjuutilainen/sus-inspector

Ok, I didn't understand from the guide that I would be using softwareupdate --fetch-full-installer --full-installer-version 12.7.4 and the tool sus-inspector, I thought it was an alternative gui tool for the same end.

edit: sus-inspector requires python2 to work...

Things may have changed. They were supposed to be in the full installer as well.

If they are not, how should I get it?
I'm figuring the .fd file isn't it.

Should I download versions before that 12.7.4 until I find one with the .scap file?

I had installed OpenCore Legacy Patcher on my Mac and didn't like it at all. I reverted back to Monterey but I believe my EFI is altered but signaled as OK because of OCLP. I am really looking for a way to reinstall the native Apple firmware.

If they are not, how should I get it? I'm figuring the .fd file isn't it.

Should I download versions before that 12.7.4 until I find one with the .scap file?

I had installed OpenCore Legacy Patcher on my Mac and didn't like it at all. I reverted back to Monterey but I believe my EFI is altered but signaled as OK because of OCLP. I am really looking for a way to reinstall the native Apple firmware.

Firmware has nothing to do with the EFI and it cannot be altered by OCLP especially on the MBP11,4 or 11,5. I have 11.4. Using SilentKnight 2:

This is what is within my EFI folder:

So I guess .fd file is what you need now.

After the update:

/usr/bin/hdiutil mount /Applications/Install\ macOS\ Monterey*.app/Contents/SharedSupport/SharedSupport.dmg
ZIP_FILE=`ls /Volumes/Shared\ Support/com_apple_MobileAsset_MacSoftwareUpdate/*.zip`  
unzip -l-qq "$ZIP_FILE" "AssetData/boot/EFI/EFIPayloads/*"
FIRMWARE_FILE=AssetData/boot/EFI/EFIPayloads/MBP114.fd
unzip -j "$ZIP_FILE" $FIRMWARE_FILE -d ~/Desktop/  
sudo /usr/sbin/bless -firmware ~/Desktop/MBP114.fd --verbose --recovery

First let me thank you for your time and effort in putting these answers here. I really appreciate it and I'm sure others will too.

Firmware has nothing to do with the EFI and it cannot be altered by OCLP especially on the MBP11,4 or 11,5. I have 11.4.

Immediately after installing OCLP one issue that arised on my Mac was that the boot Chime was distorted. This persisted after removing OCLP and doing a clean install of Monterey.

After reading about the problem there was some discussion on the Apple forums mentioning it could be a firmware problem on how the sound was being processed, which let me into this.
But if OCLP has nothing to do with firmware, how can I make sure my EFI partition doesn't have any leftovers from OCLP?

Chime sound volume can be set through NVRAM. That is how OC sets it. Just do an NVRAM reset. Or better yet set the desired volume level through the NVRAM variable in the configuration file for OC.

It's not really about volume, rather a distortion. I have reset the NVRAM plenty since and did not resolve. (when I removed ventura and did a clean install, reset both nvram and smc)
what is the configuration file for OC?

Anyway, I haven't reinstalled the firmware using the bless command yet, I will do it in a bit after work. I am thinking when updating the firmware you're supposed to use the command bless, rather than just copying the file over to EFI/APPLE/FIRMWARE. So I was really hoping the process would trigger something that would fix my problem.

No you should not copy anything just follow the instructions above. I just performed firmware update.

I performed the firmware update as well but didn't resolve anything. Ah well, thanks for all the help!!