Extract Firmware from OS X installer

extract-firmware.md

• Download the full installer:

softwareupdate --list-full-installers
Finding available software
Software Update found the following full installers:
* Title: macOS Ventura, Version: 13.1, Size: 11931164KiB, Build: 22C65
* Title: macOS Ventura, Version: 13.0.1, Size: 11866460KiB, Build: 22A400
* Title: macOS Ventura, Version: 13.0, Size: 11866804KiB, Build: 22A380
* Title: macOS Monterey, Version: 12.6.2, Size: 12104568KiB, Build: 21G320
* Title: macOS Monterey, Version: 12.6.1, Size: 12108491KiB, Build: 21G217
* Title: macOS Monterey, Version: 12.6, Size: 12104042KiB, Build: 21G115
* Title: macOS Big Sur, Version: 11.7.2, Size: 12119307KiB, Build: 20G1020
* Title: macOS Big Sur, Version: 11.7.1, Size: 12119247KiB, Build: 20G918
* Title: macOS Big Sur, Version: 11.7, Size: 12118755KiB, Build: 20G817
* Title: macOS Big Sur, Version: 11.6.6, Size: 12121263KiB, Build: 20G624
* Title: macOS Big Sur, Version: 11.6.5, Size: 12121404KiB, Build: 20G527
* Title: macOS Big Sur, Version: 11.6.4, Size: 12147782KiB, Build: 20G417
* Title: macOS Big Sur, Version: 11.6.3, Size: 12143674KiB, Build: 20G415
* Title: macOS Big Sur, Version: 11.6.2, Size: 12141944KiB, Build: 20G314
* Title: macOS Big Sur, Version: 11.6.1, Size: 12137180KiB, Build: 20G224
* Title: macOS Big Sur, Version: 11.5.2, Size: 12149332KiB, Build: 20G95
* Title: macOS Catalina, Version: 10.15.7, Size: 8055650KiB, Build: 19H15
* Title: macOS Catalina, Version: 10.15.7, Size: 8055522KiB, Build: 19H2
* Title: macOS Catalina, Version: 10.15.6, Size: 8055450KiB, Build: 19G2021
* Title: macOS Mojave, Version: 10.14.6, Size: 5896894KiB, Build: 18G103
* Title: macOS High Sierra, Version: 10.13.6, Size: 5099306KiB, Build: 17G66

softwareupdate --fetch-full-installer --full-installer-version 12.6.2

• Or use Mist or sus-inspector

• For MacPro5,1 use this:

softwareupdate --fetch-full-installer --full-installer-version 10.14.6
cp /Applications/Install\ macOS\ Mojave.app/Contents/Resources/Firmware/MP51.fd  ~/Desktop

For older systems officially supporting:

• Catalina use the latest security update
• Mojave use the latest security update
• High Sierra use the latest security update

Apple security updates

pkgutil --expand [Double click the dmg file and drop file here] /destination/path/

pkgutil --expand /Volumes/macOS\ Catalina\ Security\ Update\ 2021-008/SecUpd2021-008Catalina.pkg ~/Desktop/Expanded
cp ~/Desktop/Expanded/FirmwareUpdate.pkg/Scripts/Tools/EFIPayloads/MM61.scap ~/Desktop/MM61.scap

Please check here for the latest firmware version and the latest full installer version or latest security update.

• Mounting Big Sur SharedSupport disk image:

/usr/bin/hdiutil mount /Applications/Install\ macOS\ Big\ Sur*.app/Contents/SharedSupport/SharedSupport.dmg

• Store ZIP file path to variable (handle unpredictable file name)

ZIP_FILE=`ls /Volumes/Shared\ Support/com_apple_MobileAsset_MacSoftwareUpdate/*.zip`

• List firmware files in ZIP file:

unzip -l-qq "$ZIP_FILE" "AssetData/boot/EFI/EFIPayloads/*"

• In Terminal.app, first verify your EFI version using the following command:

/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check | grep "EFI Version"

• Note: macOS Sonoma no longer prifides the eficheck utility. That has been removed from Sonoma. All T2 and Apple silicon models automatically check the integrity of their firmware in the early part of the boot process anyway.

• locate the firmware file and store the exact file path into the variable FIRMWARE_FILE:

FIRMWARE_FILE=<firmware file path here>

• An example command would be:

FIRMWARE_FILE=AssetData/boot/EFI/EFIPayloads/MBP112.scap

• Extract the firmware file ( "-j" means don't create directory structure and "-d" designates that output directory):

unzip -j "$ZIP_FILE" $FIRMWARE_FILE -d ~/Desktop/

• Set your MacBook to upgrade the firmware on the next bootup (SIP must be disabled). Fill in the file name of your specific firmware file:

sudo /usr/sbin/bless -firmware ~/Desktop/<firmware file name here> --verbose --recovery

• Trigger firmware upgrade: Shut down your computer. (Do not choose the restart option!) After the MacBook is powered off, power it back on by pressing the power button. Next be patient, and if everything goes well your firmware will be updated.

Try this:

sudo  dd  if=/dev/zero  of=/dev/disk0  bs=100m  count=100

it gives me this:
dd: /dev/disk0: Input/output error
40+0 records in
39+0 records out
4089446400 bytes transferred in 897.401292 secs (4556987 bytes/sec)

It could be a bad drive or a bad cable.

Yeah that's what I assumed. Guess my only option to update the firmware is to find another genuine apple hard drive and open this thing up and replace the hard drive. Such a hassle since its an iMac and all just for the firmware :/. Thanks for all you help and tips though!

It does not have to be genuine but internal. The script is working on non-Apple drive.

Hi
I'm curious if this would could aid in downgrading an ibridge version, either through DFU Restore and/or imbedding in a legacy installer or even flashing? Forgive my verbiage/naivety as I'm just learning about all of this. I know there aren't any signed ibridge versions that go back as far as I need (10.13.6) but I'm not clued in as to how the ibridge version works with an installer.
I'm on an intel T2 iMac Pro, trying to revert back to the OS it was originally shipped. Since I bought it refurbished, I had just been updated to the latest OS + ibridge version, which will only allow Mojave 10.14 or newer to be booted to, internally or externally. And or course I'm trying to get to High Sierra 10.13. I had almost completely accepted defeat over the last few weeks after numerous failed attempts to find a work around until I saw this page. I know it's been done before but I haven't found anyone who has RECENTLY successfully downgraded to 10.13 after updating to the current OS/Ibridge v.
Do you think this tool be used in my situation? Any insight is very much apprecaited

You may take a look here:
https://www.reddit.com/r/macsysadmin/comments/bb32y5/comment/ekhiiqf/
Also you can most definately boot 10.13.6 with OpenCore. With OpenCore you can spoof the firmware version. Have you tried
-no_compat_check nvram variable?

Hi,

When I list the EFI payloads I only get 2 .scap files and plenty of .fd files. Are these the same, can I reference this .fd file as if it were a .scap?

% unzip -l-qq "$ZIP_FILE" "AssetData/boot/EFI/EFIPayloads/*"     
  Length      Date    Time    Name
---------  ---------- -----   ----
        0  02-26-2024 07:22   AssetData/boot/EFI/EFIPayloads/
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM161.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP133.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM171.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP142.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP143.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP132.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM183.fd
  8520304  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MP61.scap
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBA71.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MB91.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP121.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP131.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM162.fd
 16777216  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM191.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP114.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/IM181.fd
  8520304  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MM71.scap
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MBP141.fd
  8388608  12-21-2023 15:27   AssetData/boot/EFI/EFIPayloads/MB101.fd
---------                     -------
168035552                     20 files
myself@mbp2015 ~ % /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check | grep "EFI Version"
EFI Version: MBP114.88Z.F000.B00.2310070442  (Boot ROM Version: 489.0.0.0.0)

It's a MacBookPro11,5.

You need to get the latest Monterey security update.
https://support.apple.com/en-us/HT214083

Hi @startergo thank you for your reply. Sorry for my ineptitude but could you please tell where can I download that latest Monterey security update? I thought I already downloaded 12.7.4.
The support article doesn't seem to provide any options for download.

myself@mbp2015 ~ % softwareupdate --list-full-installers
Finding available software
Software Update found the following full installers:
* Title: macOS Monterey, Version: 12.7.4, Size: 12117810KiB, Build: 21H1123
* Title: macOS Monterey, Version: 12.7.3, Size: 12109975KiB, Build: 21H1015
* Title: macOS Monterey, Version: 12.7.2, Size: 12116623KiB, Build: 21G1974
* Title: macOS Big Sur, Version: 11.7.10, Size: 12125478KiB, Build: 20G1427
* Title: macOS Catalina, Version: 10.15.7, Size: 8055650KiB, Build: 19H15
* Title: macOS Catalina, Version: 10.15.7, Size: 8055522KiB, Build: 19H2
* Title: macOS Catalina, Version: 10.15.6, Size: 8055450KiB, Build: 19G2021
* Title: macOS Mojave, Version: 10.14.6, Size: 5896894KiB, Build: 18G103
* Title: macOS High Sierra, Version: 10.13.6, Size: 5099306KiB, Build: 17G66
myself@mbp2015 ~ % softwareupdate --fetch-full-installer --full-installer-version 12.7.4
Scanning for 12.7.4 installer
Install finished successfully
myself@mbp2015 ~ %

I mentioned that in the guide. Use SUS-inspector
https://github.com/hjuutilainen/sus-inspector

Ok, I didn't understand from the guide that I would be using softwareupdate --fetch-full-installer --full-installer-version 12.7.4 and the tool sus-inspector, I thought it was an alternative gui tool for the same end.

edit: sus-inspector requires python2 to work...

Things may have changed. They were supposed to be in the full installer as well.

If they are not, how should I get it?
I'm figuring the .fd file isn't it.

Should I download versions before that 12.7.4 until I find one with the .scap file?

I had installed OpenCore Legacy Patcher on my Mac and didn't like it at all. I reverted back to Monterey but I believe my EFI is altered but signaled as OK because of OCLP. I am really looking for a way to reinstall the native Apple firmware.

If they are not, how should I get it? I'm figuring the .fd file isn't it.

Should I download versions before that 12.7.4 until I find one with the .scap file?

I had installed OpenCore Legacy Patcher on my Mac and didn't like it at all. I reverted back to Monterey but I believe my EFI is altered but signaled as OK because of OCLP. I am really looking for a way to reinstall the native Apple firmware.

Firmware has nothing to do with the EFI and it cannot be altered by OCLP especially on the MBP11,4 or 11,5. I have 11.4. Using SilentKnight 2:

This is what is within my EFI folder:

So I guess .fd file is what you need now.

After the update:

/usr/bin/hdiutil mount /Applications/Install\ macOS\ Monterey*.app/Contents/SharedSupport/SharedSupport.dmg
ZIP_FILE=`ls /Volumes/Shared\ Support/com_apple_MobileAsset_MacSoftwareUpdate/*.zip`  
unzip -l-qq "$ZIP_FILE" "AssetData/boot/EFI/EFIPayloads/*"
FIRMWARE_FILE=AssetData/boot/EFI/EFIPayloads/MBP114.fd
unzip -j "$ZIP_FILE" $FIRMWARE_FILE -d ~/Desktop/  
sudo /usr/sbin/bless -firmware ~/Desktop/MBP114.fd --verbose --recovery

First let me thank you for your time and effort in putting these answers here. I really appreciate it and I'm sure others will too.

Firmware has nothing to do with the EFI and it cannot be altered by OCLP especially on the MBP11,4 or 11,5. I have 11.4.

Immediately after installing OCLP one issue that arised on my Mac was that the boot Chime was distorted. This persisted after removing OCLP and doing a clean install of Monterey.

After reading about the problem there was some discussion on the Apple forums mentioning it could be a firmware problem on how the sound was being processed, which let me into this.
But if OCLP has nothing to do with firmware, how can I make sure my EFI partition doesn't have any leftovers from OCLP?

Chime sound volume can be set through NVRAM. That is how OC sets it. Just do an NVRAM reset. Or better yet set the desired volume level through the NVRAM variable in the configuration file for OC.

It's not really about volume, rather a distortion. I have reset the NVRAM plenty since and did not resolve. (when I removed ventura and did a clean install, reset both nvram and smc)
what is the configuration file for OC?

Anyway, I haven't reinstalled the firmware using the bless command yet, I will do it in a bit after work. I am thinking when updating the firmware you're supposed to use the command bless, rather than just copying the file over to EFI/APPLE/FIRMWARE. So I was really hoping the process would trigger something that would fix my problem.

No you should not copy anything just follow the instructions above. I just performed firmware update.

I performed the firmware update as well but didn't resolve anything. Ah well, thanks for all the help!!