Encryption algorithm

Does anybody know how the EFI password is encrypted on the newer Macs (2011 and later)?
It's probably a one-way encryption, but if the password is a 4-digit PIN, there are only 10.000 possibilities, and this should be easy to brute-force once we know the encryption algorithm.
If we are able to brute force it, there is no more need to reflash the EFI chip, and less risk of damaging the Mac.

I've noticed that no matter what the password is, the encrypted version always seems to be 69 (0x45) bytes in length.

Krayzeeman

I did some more investigation on the password record, and compared records from several locked ROM’s.

I noticed that the first 16 bytes of the active password record are exactly the same in all of the ROMS, and also the last 5 bytes of that password record are the same in all dumps.

When I set a known password “1234” to a Mac, and dump the EFI boot ROM, I noticed that bytes 16 through 63 of the password record contain a sort of hash, and when I change the password to ‘0006’ I get a completely different set of numbers in this area.

However when I change the password back to ‘1234’ this area is completely different from the first time I set the password to ‘1234’, and when I change the password back to ‘0006’ it’s again different form the fist time I set it to ‘0006’.

This suggests that the stored password is some kind of salted hash.

Another thing I noticed is that when using the one mac I have at hand to play with, bytes 56 through 63 in the active password record stay the same, regardless of the password. These bytes are however completely different in the other ROM’s I have examined.

This suggests that the password hash is stored in bytes 16 through 55, and is exactly 40 bytes in length, and bytes 56 through 63 are related to some sort of ID of the Mac.

On another Mac however bytes (56 through 63) also changed when changing the password. The difference between these two Macs is that the first one uses a record format 1, and the second one uses record format 2 in the $SVS area.

PS. on Macs with Mac OS X 10.9 and lower you can read the EFI ROM with a tool called DarwinDumper, so no need to open the Mac and use tools like the Bus Pirate or a Raspberry Pi. On later OS’s Apple has closed this security leak by not allowing unsigned kexts to be installed, and hereby blocking direct access to the EFI ROM.