Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Zeke D

macrumors 65816
Original poster
Nov 18, 2011
1,024
168
Arizona
Talk about frustrating! I did as you suggested, and when I did the reboot, I got the firmware update screen for a few seconds, then the cMP crashed.
 

tsialex

Contributor
Jun 13, 2016
13,077
13,277
Talk about frustrating! I did as you suggested, and when I did the reboot, I got the firmware update screen for a few seconds, then the cMP crashed.
I've downgraded several times, but I have the means to replace the SPI flash/reprogram it externally.

Like I said, it's risky and you shouldn't do this.
 

Zeke D

macrumors 65816
Original poster
Nov 18, 2011
1,024
168
Arizona
Well, I guess that pretty much finishes up the i7 then, since I can't SPI/flash etc. Thanks for the advice though.
 

bookemdano

macrumors 68000
Jul 29, 2011
1,512
843
Yikes. Will your cMP not boot now? There have been several reports of this, but I'm not sure any common thread was identified (and on the ones whose flash chip was damaged I think that the firmware update process got stuck and they had to manually power off).

Zeke I would say if your cMP actually still boots then you should just replace your CPU and forget about trying to downgrade firmware. It seems too risky!
 

Zeke D

macrumors 65816
Original poster
Nov 18, 2011
1,024
168
Arizona
Yikes. Will your cMP not boot now? There have been several reports of this, but I'm not sure any common thread was identified (and on the ones whose flash chip was damaged I think that the firmware update process got stuck and they had to manually power off).

Zeke I would say if your cMP actually still boots then you should just replace your CPU and forget about trying to downgrade firmware. It seems too risky!

Yeah. I put the Xeon back in it. The 4,1 is my spare (my spare has a spare cMP3,1.) I hate to waste $15, but I also would hate bricking my 4,1 even more. Maybe if I get a nice royalty check next month, I'll spring for a 6-core i7.
 
  • Like
Reactions: bookemdano

tsialex

Contributor
Jun 13, 2016
13,077
13,277
Well, I guess that pretty much finishes up the i7 then, since I can't SPI/flash etc. Thanks for the advice though.
If you really want to try, downgrade to 0087 then to 0085. Do this by baby steps since the LOCKED.fd file don't contain the complete BootROM. Do a backup before, using ROMTool.
 

bookemdano

macrumors 68000
Jul 29, 2011
1,512
843
Yes, definitely the right call. I know some people have been able to downgrade at least one version back, but sounds like it's best avoided.
 

Zeke D

macrumors 65816
Original poster
Nov 18, 2011
1,024
168
Arizona
If you really want to try, downgrade to 0087 then to 0085. Do this by baby steps since the LOCKED.fd file don't contain the complete BootROM. Do a backup before, using ROMTool.
same steps? find 87, rename it to 90, then rename 85 to 92 or something?

Should I be worried like bookemdano?
 

bookemdano

macrumors 68000
Jul 29, 2011
1,512
843
LOL well my worry came from tsialex. If he's worried then I'm worried, because he knows a hell of a lot more about this stuff than I do. ;)

Also, I don't have 10.13.5 saved anywhere so I can't help you find 0087. Maybe someone else has it.
 

tsialex

Contributor
Jun 13, 2016
13,077
13,277
same steps? find 87, rename it to 90, then rename 85 to 92 or something?
1) Do a full BootROM dump with dosdude1 ROMTool
2) rename 0087 to 0090, then "upgrade" it to the previous version
3) rename 0085 to 0088, then "upgrade" it to the previous version
[doublepost=1533435571][/doublepost]
Another thought. Is the firmware chip on the logic board, or on the tray?
Board.
MP51 - SPI flash.jpg
 
Last edited:

Zeke D

macrumors 65816
Original poster
Nov 18, 2011
1,024
168
Arizona
1) Do a full BootROM dump with dosdude1 ROMTool
2) rename 0087 to 0090, then "upgrade" it to the previous version
3) rename 0085 to 0086, then "upgrade" it to the previous version
Shouldn't 85 be renamed "88"?
 

tsialex

Contributor
Jun 13, 2016
13,077
13,277
LOL well my worry came from tsialex. If he's worried then I'm worried, because he knows a hell of a lot more about this stuff than I do. ;)

Also, I don't have 10.13.5 saved anywhere so I can't help you find 0087. Maybe someone else has it.
The problem is that the LOCKED.fd file it's a unpersonalised one. You can boot with a SPI flash restored to it, but you will loose iCloud/Facetime/iMessage.

To personalize it again, you will need the SystemSerialNumer (label next to the video card port, behind the Mac), LogicBoardSerial number (it's on a label next to the CPU tray conector) and the SalesOrderNumber ( sometimes you can use the SKU for a retail bought Mac, but on a Refurb or on a BTO/CTO, only Apple has it). Next you will need to carefully edit the LOCKED.fd file with the needed information, on the correct places that don't exist on the unpersonalised one.

It's a royal pain in the _ss to get the SON on a Mac that don't use the SKU as the SON. So, I recommend to everyone do a full BootROM dump and save more than one backup.

[doublepost=1533435937][/doublepost]
Shouldn't 85 be renamed "88"?
Yes, sorry.
 
Last edited:

Zeke D

macrumors 65816
Original poster
Nov 18, 2011
1,024
168
Arizona
LOL well my worry came from tsialex. If he's worried then I'm worried, because he knows a hell of a lot more about this stuff than I do. ;)

Also, I don't have 10.13.5 saved anywhere so I can't help you find 0087. Maybe someone else has it.
I'm running 10.13.3 right now, but I doubt I can get just 10.13.5 either.
 

tsialex

Contributor
Jun 13, 2016
13,077
13,277
I'm running 10.13.3 right now, but I doubt I can get just 10.13.5 either.
You can get it hidden on the 10.13.5 ComboUpdate. Extract RecoveryHDMeta.dmg, then re-open it on Pacifist, on the Firmware folder you will have the MP51.0087.B00.LOCKED.fd file.
 
Last edited:

Zeke D

macrumors 65816
Original poster
Nov 18, 2011
1,024
168
Arizona
LOL. downloading 10.13.5 combo update!
[doublepost=1533436792][/doublepost]since dosdude's ROMTool can write firmware, is that an option?
 

tsialex

Contributor
Jun 13, 2016
13,077
13,277
LOL. downloading 10.13.5 combo update!
[doublepost=1533436792][/doublepost]since dosdude's ROMTool can write firmware, is that an option?
If you overwrite your personalised by Apple BootROM with the LOCKED.fd file you will loose access to iCloud/Facetime/iMessage. Read again my previous post about it.
 

Zeke D

macrumors 65816
Original poster
Nov 18, 2011
1,024
168
Arizona
If you overwrite your personalised by Apple BootROM with the LOCKED.fd file you will loose access to iCloud/Facetime/iMessage. Read again my previous post about it.
with no way to re-add it?
[doublepost=1533437193][/doublepost]I could temporarily use the LOCKED vie dosdude to verify that the i7 works again, then use the dump to restore cloud/face/message.
[doublepost=1533437259][/doublepost]I've got the 10.13.5 combo, plus pacifist 3.6, so I guess when you're off youriPhone, you can walk me through it.
 

tsialex

Contributor
Jun 13, 2016
13,077
13,277
with no way to re-add it?
[doublepost=1533437193][/doublepost]I could temporarily use the LOCKED vie dosdude to verify that the i7 works again, then use the dump to restore cloud/face/message.
Without knowing what to add, what to remove, what to overwrite on the LOCKED.fd file, no.
[doublepost=1533437440][/doublepost]
with no way to re-add it?
[doublepost=1533437193][/doublepost]I could temporarily use the LOCKED vie dosdude to verify that the i7 works again, then use the dump to restore cloud/face/message.
[doublepost=1533437259][/doublepost]I've got the 10.13.5 combo, plus pacifist 3.6, so I guess when you're off youriPhone, you can walk me through it.
RecoveryHDMeta.DMG, extract it, reopen it on Pacifist, go to the Firmware folder, extract the LOCKED.fd file.
 

crjackson2134

macrumors 601
Mar 6, 2013
4,827
1,950
Charlotte, NC
I had to downgrade mine from 0087 to 0085 using @tsialex ’s method described above. For me it went perfectly. Then when 0089 came out and fixed the microcode problem, I flashed to that without issue.

You need to think it all out, and get a firm understanding of what’s taking place, and run through it in your head or on paper the first time. You personally may not need to do all that, but this isn’t the time for mistakes.

I just flashed mine again today with modified firmware for NVMe boot support. It went well, but I cringed a bit myself. Sigh of relief when I saw that it all went well.

Good luck, I wish you success.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.