CodeAsm CodeAsm

Removing a Mac's Firmware Password By Reflashing EFI ROM

According to Apple, the only way to remove an unknown firmware password from a MacBook (2011 and later) is to take it to the Apple Store with the original proof-of-purchase. However, I've found that there is another way, which I've been successful with for the unibody MacBook Pro--it's essentially just modifying a couple bytes in the EFI ROM, which should be simple. What's not simple, however, is figuring out how to read and write to the EFI chip. In this post, I'll talk about the process that I figured out and what worked for me.

The Official Method

Apple's method of resetting the firmware password is not reproducible, as Apple generates an SCBO file that unlocks the EFI using their private key. You can read more about this process here. The problem with this system is that, if you are in the unfortunate situation of neither having the firmware unlock pass

Porting coreboot to a Haswell / Lynx Point laptop: GIGABYTE P34G v2

This was sold by Schenker XMG as C404, while the original model name by GIGABYTE is P34G v2.

The board schematics are not publicly available. However, from another laptop board's schematics, we can learn a bit about the components it should have:

autoport

Unpacking XIP files on Linux:

Install xar from https://mackyle.github.io/xar/
Install pbzx from https://github.com/NiklasRosenstein/pbzx (use gcc -llzma -lxar -I /usr/local/include pbzx.c -o pbzx and copy the binary into your PATH)
use xar -xf XIP_FILE -C /path/to/extract/to
Change to the directory where you extracted the file.
Use pbzx -n Content | cpio -i to extract the contents.

32-bit ELF binary

how to assemble and link:

nasm -f elf32 -o <filename>.o <filename>.asm
ld -m elf_i386 -o <filename> <filename>.o

template code (hello world):

section .text
global _start

Setting up Qemu with a tap interface

There are two parts to networking within QEMU:

The virtual network device that is provided to the guest (e.g. a PCI network card).
The network backend that interacts with the emulated NIC (e.g. puts packets onto the host's network).

Example: User mode network

Configure EasyCAP SMI-2021CBE TV tuner card with debian 10

Identifying the device

check the device ID with this command lsusband the output should look like this.

Bus 001 Device 008: ID 1c88:0007 Somagic, Inc. SMI Grabber (EasyCAP DC60+ clone) (no firmware) [SMI-2021CBE]

Prepare for installing the driver

If you get this same output with lsusb then follow on with these link's

	#!/usr/bin/python
	# Command-line tool to decompress mozLz4 files used for example by Firefox to store various kinds of session backup information.
	# Works in both Python 2.7.15 and 3.6.7, as of version 2.1.6 of the LZ4 Python bindings at pypi.org/project/lz4.
	# To use in another script, simply cut and paste the import statement and the mozlz4_to_text() function (lines 8 to 17).

	import lz4.block # pip install lz4 --user


	def mozlz4_to_text(filepath):
	# Given the path to a "mozlz4", "jsonlz4", "baklz4" etc. file,

	/*
	* This program is free software: you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation, either version 3 of the License, or
	* (at your option) any later version.
	*
	* Based off code from:
	* https://gist.github.com/austinmarton/1922600
	*
	* Modified to send hand crafted IPv6 NDP Neighbor

	#!/bin/sh

	mount -t devtmpfs devtmpfs /dev
	mount -t proc none /proc
	mount -t sysfs none /sys

	mkdir -p /var/run/
	mkdir -p /etc/network/if-down.d
	mkdir -p /etc/network/if-post-down.d
	mkdir -p /etc/network/if-post-up.d

	=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2017.03.17 21:30:14 =~=~=~=~=~=~=~=~=~=~=~=

	BCM338031 TP0
	1
	Sync:1
	346890
	MemSize: 64 M

	BootLoader Version: 10.1.2 Release Gnu spiboot reduced DDR drive
	Build Date: Dec 23 2009