eficheck mismatch MacBook Pro (Retina, 13-inch, Early 2015)

[levanid]

Hello.
I have a 13" MacBook Pro Retina Early 2015 with upgraded SSD (Samsung EVO 1Tb) running Mojave 10.14.6 (18G4032)
And I recently found that EFI version version is 184.0.0.0.0 while 190.0.0.0.0 is expected

eficheck gives error

➜  ~ /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check
EFI Version: MBP121.88Z.F000.B00.1904111507  (Boot ROM Version: 184.0.0.0.0)
Matching allowlist not found in EFIAllowListShipping. Searching in EFIAllowListAll.
This system does now allow downloading background update data. Canceling.
Primary allowlist version match not found for version MBP121.88Z.F000.B00.1904111507  (Boot ROM Version: 184.0.0.0.0).

I read that 3rd party SSD might prevent updates from installing

Do you have an aftermarket SSD installed in your computer? If you do, this will prevent firmware updates from installing, which can lead to the error above.

Is there any workaround for that to update to the latest EFI on MacBook without disassembly and swapping disks?

 

[chrfr]

Is there any workaround for that to update to the latest EFI on MacBook without disassembly and swapping disks?

You need to put the original disk back in.

 

[levanid]

I don't have my original own SSD unfortunately - it has been substituted long time ago
Am I correct that any original MBP Pro early 2015 SSD would help to solve that issue or should I have exact (like 512Gb) model to update EFI?

 

[chrfr]

I don't have my original own SSD unfortunately - it has been substituted long time ago
Am I correct that any original MBP Pro early 2015 SSD would help to solve that issue or should I have exact (like 512Gb) model to update EFI?

You really just need an Apple branded SSD that's compatible. A 128GB would be completely fine.

 

[bogdanw]

There is a script for extracting firmware updates from the Install macOS app, but it hasn't been updated for Mojave https://github.com/munki/macadmin-scripts/blob/master/make_firmwareupdater_pkg.sh

 

[levanid]

There is a script for extracting firmware updates from the Install macOS app, but it hasn't been updated for Mojave https://github.com/munki/macadmin-scripts/blob/master/make_firmwareupdater_pkg.sh

Thank you
So is that still possible to extract firmware from installer and update? Why it has not been done by Apple via installation?

 

[bogdanw]

Thank you
So is that still possible to extract firmware from installer and update? Why it has not been done by Apple via installation?

I haven't tried, but I think it's possible. More, the FirmwareUpdate.pkg the can be downloaded directly from Apple

http://swcdn.apple.com/content/downloads/15/16/061-96660-A_JYSG1XZRD9/zaelzr378c9vcwpxcactt03spc89v41u13/FirmwareUpdate.pkg

To the second question, maybe use the Combo Update at the next update, it might include the firmware update as well.

 

[chrfr]

I haven't tried, but I think it's possible. More, the FirmwareUpdate.pkg the can be downloaded directly from Apple

http://swcdn.apple.com/content/downloads/15/16/061-96660-A_JYSG1XZRD9/zaelzr378c9vcwpxcactt03spc89v41u13/FirmwareUpdate.pkg

To the second question, maybe use the Combo Update at the next update, it might include the firmware update as well.

The issue isn’t that the firmware update isn’t available, it’s that it won‘t install with a 3rd party disk in the computer.

 

[bogdanw]

The issue isn’t that the firmware update isn’t available, it’s that it won‘t install with a 3rd party disk in the computer.

I might be wrong, but my understanding of the process is that the new firmware (MBP121.fd in this case) is copied to the EFI partition of the hard drive, from where it is applied on restart. If this is correct, at what point does it stop for a non-Apple disk?

 

[levanid]

It somehow checks for original SSD to install
After lockdown is gone I'll try to reinstall Mojave on someone's original SSD to check if firmware got it update.

 

[bogdanw]

"two main actions taken to update the firmware:
/usr/libexec/FirmwareUpdateLauncher -p “$PWD/Tools”
/usr/libexec/efiupdater -p “$PWD/Tools/EFIPayloads”

https://duo.com/assets/ebooks/Duo-Labs-The-Apple-of-Your-EFI.pdf

The Apple of Your EFI: Mac Firmware Security Research

The security research team at Duo known as Duo Labs has published a research paper on Apple’s EFI firmware security - learn more about their findings and recommendations, including a link to security tools developed to mitigate the risk. Get the full technical paper here.

duo.com

High Sierra firmware updates outside of the OS installer.app

High Sierra firmware updates outside of the OS installer.app - gist:2dfa119e959ae6f35389d4d56054f067

gist.github.com

 

[tinygoblin]

"two main actions taken to update the firmware:
/usr/libexec/FirmwareUpdateLauncher -p “$PWD/Tools”
/usr/libexec/efiupdater -p “$PWD/Tools/EFIPayloads”

https://duo.com/assets/ebooks/Duo-Labs-The-Apple-of-Your-EFI.pdf

The Apple of Your EFI: Mac Firmware Security Research

The security research team at Duo known as Duo Labs has published a research paper on Apple’s EFI firmware security - learn more about their findings and recommendations, including a link to security tools developed to mitigate the risk. Get the full technical paper here.

duo.com

High Sierra firmware updates outside of the OS installer.app

High Sierra firmware updates outside of the OS installer.app - gist:2dfa119e959ae6f35389d4d56054f067

gist.github.com

Nice finding, however I cannot find FirmwareUpdate.pkg in recent macOS releases, i.e. Big Sur 11.3.1+ and Monterey 12.2. So unfortunate! Please let me know if you happen to know how to extract FirmwareUpdate.pkg from recent SharedSupport.dmg (I only see bunch of JSON, XML & huge ZIP there) or BaseSystem.dmg. I'm quite sure firmware update mechanism has beet transformed and there's no PKG anymore but who knows...

 

[bogdanw]

Please let me know if you happen to know how to extract FirmwareUpdate.pkg from recent SharedSupport.dmg

As Catalina is still supported, the last FirmwareUpdate.pkg, coresponding to the Security Update 2022-002 Catalina, should include the latest firmware available.

https://swcdn.apple.com/content/downloads/17/04/002-65666-A_N12DGDB4NY/w1f2wkeysjf03wnkx0wkjxbdxf2r2oqowv/FirmwareUpdate.pkg

In SharedSupport.dmg for Big Sur and Monterey, look into com_apple_MobileAsset_MacSoftwareUpdate.

 

[tinygoblin]

Thanks so much for pointing out to Catalina standalone combo update. In fact this article from TEC made me think if it's possible to get FirmwareUpdate.pkg from Catalina's update earlier today (for some reason I didn't get notification of your valuable answer) because it's stated there that Catalina Security Update 2022-001 bumps up firmware version of Macs running Catalina to the same version as Moneterey 12.2 provides. So I downloaded Security Update 2022-001 Catalina (SecUpd2022-001Catalina.dmg) and indeed found FirmwareUpdate.pkg there! PKG contains required Scripts folder as mentioned in Duo-Labs-The-Apple-of-Your-EFI.pdf and Github Gist you've linked above.

However thanks so much for taking time to get the link from Apple's catalog! The [TOC].xml inside standalone FirmwareUpdate.pkg file via your link says that package was built on February 5th, 2022 when according to TEC article the Security Update 2022-002 Catalina update was released on January 26th, 2022. The file size difference isn't huge but it made me unsure. I then verified your link with Catalina's update catalog. Looks it's all good, just SecUpd2022-002Catalina.dmg is not here yet (SecUpd2022-002Catalina.smd is in catalog with all contents).

Since my 2020 16-inch MacBook Pro (the one updated with AMD Radeon Pro 5600M) came with Big Sur preinstalled and was actually released June, 15th, 2020 which is before macOS Big Sur release on November, 12th, 2020, I think FirmwareUpdate.pkg from SecUpd2022-002Catalina.smd via your link will do the job. I'd be really happy to know if you think it's a good idea to do it since I didn't do standalone firmware update before.

As it goes to EFIPayloads folder, I've found it myself previously, but this very folder doesn't contain firmwares for Mac with T2 security chips, one of which I happen to own. Firmware versions that are contained in that folder and Mac models corresponding to files were posted in this TEC article (data fetched by Pico and posted in different article's comments on TEC). I'm not sure if BridgeOS update (it's somewhere in SharedSupport.dmg) contains EFI firmware and uses /usr/libexec/efiupdater so I won't try it on my own for sure.

 

[tinygoblin]

Regarding last paragraph (I have to double-post because moderator approval of any post takes like 2 hours), I've found out a little bit about about applying firmware SCAP/FD files in this thread (quite good explanation). But though it's more or less clear, I see no reason to risk it because standalone updated FirmwareUpdate.pkg is still around.

 

[bogdanw]

The [TOC].xml inside standalone FirmwareUpdate.pkg file via your link says that package was built on February 5th, 2022 when according to TEC article the Security Update 2022-002 Catalina update was released on January 26th, 2022.

I got the link for FirmwareUpdate.pkg from Monterey's seed catalog.

 

[tinygoblin]

I got the link for FirmwareUpdate.pkg from Monterey's seed catalog.

My bad, I compared [TOC].xml date of PKG from Catalina SU 2022-002 to release date of SU 2022-001. Anyway, thanks for clarification, sounds like I'm all set now since FirmwareUpdate.pkg link is same in both Catalina, Big Sur & Monterey release version update catalogs (though it's clearly in Catalina Security Update 2022-002 section):

https://swscan.apple.com/content/catalogs/others/index-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog.gz

https://swscan.apple.com/content/catalogs/others/index-11-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog.gz

https://swscan.apple.com/content/catalogs/others/index-12-10.16-10.15-10.14-10.13-10.12-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1.sucatalog.gz

Gotta try it.

 

[tinygoblin]

Looks like I'm out of luck. Any ideas? This is mac with T2, current EFI Firmware (BootROM) version: 1554.100.64.0.0 (iBridge 18.16.14556.0.0,0)

/usr/libexec/FirmwareUpdateLauncher -p “$PWD/Tools”

FirmwareUpdateLauncher 31.40.2~476 (Official), built 2021-02-28T03:46:19-0800
Clearing (VNRAM, etc.)
Setting multiupdater-state
Setting multiupdater-retry-limits
Checking for MultiUpdater at <path to my expanded FirmwareUpdate>/Tools/MultiUpdater/MultiUpdater.efi
Running (many log entries, I'll leave only results)
dp2hdmiupdater exited with status: 13
sdfwupdater exited with status: 255
usbcupdater exited with status: 13
smcupdater <path>/SMCPayloads/Mac-A61BADE1FDAD7B05
smcupdater failed dir stat
smcupdater exited with status: 11
vbiosupdater exited with status: 255
psfupdater exited with status: 127
ssdupdater exited with status: 255
FirmwareUpdateLauncher exiting with status: 1 (Success: no updates needed)

/usr/libexec/efiupdater -p “$PWD/Tools/EFIPayloads”

efiupdater 28~2275 (Official), built 2021-02-29T03:51:21-0800
ROM Payload URL <path to EFIPayloads directory> -- file:///
Current System
Board-ID: Mac-A61BADE1FDAD7B05
Board-REV: 4
EFI ROM: MBP164 1554.100.64 202103102046 Release B&I
Firmware updates are not supported for this system using this tool
Exit status: 1 (Success: no firmware update needed)

 

[bogdanw]

Looks like I'm out of luck. Any ideas? This is mac with T2, current EFI Firmware (BootROM) version: 1554.100.64.0.0 (iBridge 18.16.14556.0.0,0)

Your idea should work https://forums.macrumors.com/threads/monterey-install-error.2319354/post-30875648

 

[tinygoblin]

Your idea should work https://forums.macrumors.com/threads/monterey-install-error.2319354/post-30875648

Unfortunately, this way seems to destroy Recovery, at least according to this thread - https://forums.macrumors.com/thread...overy-partition-in-every-other-drive.2334562/. Too risky, I use internal Recovery partition and I need it.
macOS updates are so out of hand today. Looks like the only way to get fresh firmware is to do softwareupdate online with enough space (no data on how much free space is required). I dug into SharedSupport.dmg of Monterey 12.2 looking for MBP164 or Mac-A61BADE1FDAD7B0 but only found iBridge 19.16.10744.0.0 version name in file com_apple_MobileAsset_MacSoftwareUpdate\9a71c5fc091fc9270135473b183da69b12b853d9.zip\AssetData\boot\BridgeVersion.plist, that's it, no idea how to fetch it from boot directory.
I've also tried to examine preinstall and postinstall scripts in FirmwaUpdate.pkg but I couldn't read that at all.
Guess there's no way to update EFI manually. Thanks for your time and support!

 

[bogdanw]

Unfortunately, this way seems to destroy Recovery, at least according to this thread - https://forums.macrumors.com/thread...overy-partition-in-every-other-drive.2334562/.

In my experience, that is not true. I have installed Monterey on the same SSD with Catalina, deleted Monterey and installed Big Sur, both Catalina and Big Sur installations have their recovery volumes bootable.

 

[tinygoblin]

In my experience, that is not true. I have installed Monterey on the same SSD with Catalina, deleted Monterey and installed Big Sur, both Catalina and Big Sur installations have their recovery volumes bootable.

Q1. However in my initial plan external SSD installation of macOS Monterey 12.2 was a way to get firmware update (or better Big Sur 11.6.4 standalone). According to report by toke lahti, Recovery gets destroyed once external drive is used. Would you clarify if you succeeded with external SSD?

Q2. By the way maybe you happen to to have any idea where updates are downloaded using Terminal softwareupdate -d in Recovery mode? Apple developers report updates fail for many reasons when there's limited disk capacity available so I'd love to at least get free SSD space amount out of equation by using different location that my Macintosh HD.

Q3. I came across your post at StackExchange with download location then macOS is in regular non-Recovery mode while googling. My other idea is if it's possible to point softwareupdate -i to different location instead of
/Volumes/Macintosh HD/System/Library/AssetsV2/com_apple_MobileAsset_MacSoftwareUpdate/. Like, in worst scenario first I'll get required update with softwareupdate -d to my internal drive, and second I'll move update files to different drive/partition and execute softwareupdate -i from Recovery Terminal. To me it looks like this is impossible due to softwareupdate tool limitations but I hope I'm wrong.

Q4. According to this article on installing OS, it's possible to use

'/Applications/Install macOS Monterey.app/Contents/Resources/startosinstall' --agreetolicense --forcequitapps

to do "upgrade" of OS. Maybe it's a good idea to get "Install macOS Big Sur.app" 11.6.4, place it onto external drive and run from Recovery Terminal to execute "upgrade" which should result in "update"?

 

[bogdanw]

I made the installs on an internal SSD, with separate partitions for Catalina and Big Sur/Monterey.
I don’t see why booting/installing a different operating system would “destroy” another.
Many people are using external drives to run macOS, here is a recent example https://forums.macrumors.com/thread...ne-or-on-a-thuderbolt-external-drive.2335321/
Create bootable USB drives with the macOS systems you want and you will always have a recovery option available https://support.apple.com/en-us/HT201372
A 16GB USB flash drive is 5$

 

[tinygoblin]

Well I'm worried to try it because Apple is making things over complicated with each iteration and you never know what goes wrong until you try it. I've got 16 GB USB flash drive lying around as well as an external SSD, so it's not $5 limitation that gets me concerned. I do run other OS' from external drive. But macOS is a core thing to this machine. The link you've provided refers to 2017 iMac which doesn't have T2 chip while the link which reported messed Recovey refers to 2018 Mac mini with is T2-equipped - https://support.apple.com/en-us/HT208862. I hope that guy who reported messing up Recovery HD when macOS Monterey is installed to external drive will clarify details.

P.S. T2 brings a lot of difficulties with installing other OS, i.e. you can't do it easy way without external keyboard with Boot Camp (if you want internal keyboard and trackpad to work you have to remaster install.wim by injecting Apple's drivers to image via DISM, IIRC, did it twice). So I got reasons to go into details, that's from experience, sorry.

 

[bogdanw]

T2 brings a lot of difficulties with installing other OS,

Apple T2 Security Chip - No Security & allow booting from external or removable media
https://support.apple.com/en-us/HT208198
The Recovery volume can be recreated
https://forums.macrumors.com/threads/how-to-create-recovery-partition-post-install.2161426/
https://gist.github.com/jonathantneal/f20e6f3e03d5637f983f8543df70cef5
If you already have the latest version of Big Sur installed, the firmware should have been updated.
SilentKnight can tell the EFI version found and expected https://eclecticlight.co/lockrattler-systhist/