Flashing a 2006 Mac Pro with a 2007 Mac Pro SMC Firmware 

Disclaimer: This is totally unsupported! I won't be responsible if you Mac Pro catches fire or simply refuses to boot afterwards. I did the update on a 2006 Mac Pro, running the MP21.007F.B06 EFI firmware and 1.7f10 SMC firmware. Anything else, I can't guarantee.

Following MacEFIRom's work on his Mac Pro 2006-2007 Firmware Tool (you need to be registered to see the download link), here is a way to update the SMC, to complete the 2006-2007 conversion.

First, get the firmware update tool from Apple, at http://support.apple.com/kb/DL222 (md5 sum: 40c5e766f5b59c56501240f6cb732112).

Next, get the required resources from the included package/app:
- SmcFlasher.efi (md5 sum: 16d3c5337c0bfeb8549a034490617737);
- m43a.smc (md5 sum: 79aa57d97697860f70dbb37a1a6f7ee8).

SmcFlasher.efi is the EFI update tool, m43a.smc is the SMC firmware.

Then, using a hex editor, you'll have to modify the EFI updater, in order to bypass the hardware check (which prevents from flashing anything that doesn't follow the approved path).

Here's how a diff should look like. Sorry, but I won't host proprietary licensed binaries here.

Here is the list of modifications you have to make:
- at 0x1797, replace 5 bytes with "33 C0 90 90 90";
- at 0x17AC, replace 9 bytes with "90 90 90 90 90 90 90 90 90";
- at 0x1805, replace 5 bytes with "33 C0 40 90 90".

The first 5 bytes replace the call to the function that checks whether the upgrade path is approved by Apple (isValidConfig) by xor eax, eax; nop; nop; nop.
The next 9 bytes replace a comparison and a conditional jump (related to a global variable set by isValidConfig) by 9 nops.
And the last 5 bytes replace the call to the function that prevents from downgrading the SMC firmware by xor eax, eax; inc eax; nop; nop.

If you edited the file properly, its md5 sum should now be 84dbe9708eafc0c29653414b06292f8e.

In order to use it, copy the two files to a EFI accessible partition (FAT or HFS), boot to the EFI Shell, and simply issue the command:
SmcFlasher.efi -LoadApp m43a.smc

To boot the EFI Shell, simply install rEFIt. you can also take a shell.efi binary (for instance, from rEFIt's tools), rename it to boot.efi and copy it at the root of a FAT formatted USB key. You can then boot the key using the Mac Pro built-in boot selector (holding Alt before the chime).

And voilà, you're set. Simply turn off your Mac Pro, reset the SMC, restart it, and start partying like it's 2007!


Add Comment

Comments are not available for this entry.