Macbook Pro A1502 13 EMC2678 820-3476-A EFI unlock


Rendering Error in layout Widget/Social: Call to a member function exists() on null. Please enable debug mode for more information.
More
5 years 10 months ago #9957 by markq1919
Hi, I managed to remove the EFI lock following this tutorial but upon OSX install it is now asking me for a 6 digit passcode.
i think this macbook is tied to an iCloud account.

how can i bypass this ? am I missing a step or is this iCloud locked motherboard that can't be unlocked?

Procedures:
detached EFI chip with hot air
Firmware dump using - EZP2010 SPI programmer
verified firmware - ok
executed scan-n-patch.pl
programmed firmware back to EFI chip

Holding Command + R
no longer shows pad lock
select WIFI to begin restore MAC OSX
asking for a 6 digit pin to unlock to proceed with install


Attached Scan-n-patch

System byteorder: Little Endian
Mode: Only scanning = 0, Silent = 0
ROM: 25l6045d.bin
Intel BIOS signature found
Apple Specific Data block start found at: 0x00610000
Scanner should find first var within 2048 bytes of data...
'PchInit' usually... or 'Setup'
Variable at: 0x00610060 RFT: 2, Sizes (Key: 12 Value: 176)
GUID: abbafb4d9213de4fabb8c41cc5ad7d5d at: 0x00610070 (6357104)
Key: Setup Value: 0000000000000000010000000000010001000001000001010201010301010001020000000000000101010101010101010100000000000000000000000000000000010100000001010000000000000000000000000000000000000001010a01010100030000000000000101010101000000010101010100000000000000000000000101010101000000030303030303030301010101010101010000000000000000000000000000000000000000000000
====
File size: 0x007fffff (8388608) bytes. Record format type 2 detected
Image for 8 Mbytes flash chip

= Calculated SVS start offset: 0x00632050 (6496336)=
SVS: 24535653b01f00005afefe0100000000
== Match stamp type: 2
= Calculated SVS end offset: 0x00634050 (6504528)=
SVS: 24535653b01f00005afefe0100000000
== Match stamp type: 2
Password area looks fine... Password is set or was set.
Password record parsing...
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x00632070 (6496368)
State: 7f00, Key: 3E6D568B, Value Size: 4
Value: 02000500
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x006320aa (6496426)
State: 7c00, Key: , Value Size: 8
Value: 0000000000000000
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x006320e8 (6496488)
State: 7f00, Key: CBF2CC32, Value Size: 69
Value: ff23804e9aa7d147a3427524cfc96dc45dc743d345ccfd4f14ca701e8286465ac959ce6bb399bc80eced658dec2290931a347ba5a05e86580026d300004ca6010001000000
GUID: 5ea78df6551b704eb41ba7b7a5b758ea offset: 0x00632163 (6496611)
State: 7f00, Key: BC9772C5, Value Size: 8
Value: e64070fbcb57991e

==
RFT: 2, SVS offset: 0x00632050, password set 1 time(s) and ACTIVE
Ready for pathing... [confirm]
FireUp
Output to: 25l6045d.bin.modified
SVS area cleaner: SVS_Type2.bin at offset: 0x00632050
Layout file for 'flashrom':
00000000:0063204f UpperZone
00632050:0063404f SVS
00634050:007fffff LowerZone
UpperZone end at: 0x0063204f, 6496335 bytes
LowerZone end at: 0x007fffff, 1884080 bytes
Copy original file... done.
Setup pointer to: 0x00632050 returned: 0x00632050 patching... done.
Created files:
Modified ROM: 25l6045d.bin.modified
Flashrom Layout: ./flashrom.layout
===
Arguments for 'flashrom': --layout ./flashrom.layout --image SVS -w 25l6045d.bin.modified
===

thanks in advance.

Please Log in or Create an account to join the conversation.

More
5 years 8 months ago #10282 by GhostJas
just upload A1502 BIOS dump, I can clear the bios pass for you.

Please Log in or Create an account to join the conversation.

Who's Online

We have 270 guests and no members online

N00BZ

  • ljamal
  • ljamal74
  • mikeg2atest
  • ducchinhbui
  • anjarezt

Cookies