Hi, I managed to remove the EFI lock following this tutorial but upon OSX install it is now asking me for a 6 digit passcode.
i think this macbook is tied to an iCloud account.
how can i bypass this ? am I missing a step or is this iCloud locked motherboard that can't be unlocked?
Procedures:
detached EFI chip with hot air
Firmware dump using - EZP2010 SPI programmer
verified firmware - ok
executed scan-n-patch.pl
programmed firmware back to EFI chip
Holding Command + R
no longer shows pad lock
select WIFI to begin restore MAC OSX
asking for a 6 digit pin to unlock to proceed with install
Attached Scan-n-patch
System byteorder: Little Endian
Mode: Only scanning = 0, Silent = 0
ROM: 25l6045d.bin
Intel BIOS signature found
Apple Specific Data block start found at: 0x00610000
Scanner should find first var within 2048 bytes of data...
'PchInit' usually... or 'Setup'
Variable at: 0x00610060 RFT: 2, Sizes (Key: 12 Value: 176)
GUID: abbafb4d9213de4fabb8c41cc5ad7d5d at: 0x00610070 (6357104)
Key: Setup Value: 0000000000000000010000000000010001000001000001010201010301010001020000000000000101010101010101010100000000000000000000000000000000010100000001010000000000000000000000000000000000000001010a01010100030000000000000101010101000000010101010100000000000000000000000101010101000000030303030303030301010101010101010000000000000000000000000000000000000000000000
====
File size: 0x007fffff (8388608) bytes. Record format type 2 detected
Image for 8 Mbytes flash chip
= Calculated SVS start offset: 0x00632050 (6496336)=
SVS: 24535653b01f00005afefe0100000000
== Match stamp type: 2
= Calculated SVS end offset: 0x00634050 (6504528)=
SVS: 24535653b01f00005afefe0100000000
== Match stamp type: 2
Password area looks fine... Password is set or was set.
Password record parsing...
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x00632070 (6496368)
State: 7f00, Key: 3E6D568B, Value Size: 4
Value: 02000500
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x006320aa (6496426)
State: 7c00, Key: , Value Size: 8
Value: 0000000000000000
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x006320e8 (6496488)
State: 7f00, Key: CBF2CC32, Value Size: 69
Value: ff23804e9aa7d147a3427524cfc96dc45dc743d345ccfd4f14ca701e8286465ac959ce6bb399bc80eced658dec2290931a347ba5a05e86580026d300004ca6010001000000
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x00632163 (6496611)
State: 7f00, Key: BC9772C5, Value Size: 8
Value: e64070fbcb57991e
==
RFT: 2, SVS offset: 0x00632050, password set 1 time(s) and ACTIVE
Ready for pathing... [confirm]
FireUp
Output to: 25l6045d.bin.modified
SVS area cleaner: SVS_Type2.bin at offset: 0x00632050
Layout file for 'flashrom':
00000000:0063204f UpperZone
00632050:0063404f SVS
00634050:007fffff LowerZone
UpperZone end at: 0x0063204f, 6496335 bytes
LowerZone end at: 0x007fffff, 1884080 bytes
Copy original file... done.
Setup pointer to: 0x00632050 returned: 0x00632050 patching... done.
Created files:
Modified ROM: 25l6045d.bin.modified
Flashrom Layout: ./flashrom.layout
===
Arguments for 'flashrom': --layout ./flashrom.layout --image SVS -w 25l6045d.bin.modified
===
This website uses cookies to manage authentication, navigation, and other functions. By using our website, you agree that we can place these types of cookies on your device.
You have declined cookies. This decision can be reversed.
You have allowed cookies to be placed on your computer. This decision can be reversed.
This website uses cookies to manage authentication, navigation, and other functions. By using our website, you agree that we can place these types of cookies on your device.