ismaelhg / undervoltpatchmacbook Goto Github PK

Firmware patch for unlocking FIVR control + Overclocking on Apple computers

Home Page: https://ismaelhg.github.io/Undervolt-Apple/

firmware undervolt macbooks rom haswell fivr msr-0x194 msr-0x150

undervoltpatchmacbook's Introduction

Undervolt Patch for MacBooks

Disclaimer: This tutorial requires some knowledge about disassembling laptops and using EEPROM programmers. Always make sure you have a backup of your original Firmware ROM. If the firmware gets corrupted, you won't be able to use your computer at all until you flash a proper ROM.

Full explanation about how this mod works will be available soon at my site

This tutorial is currently only for Haswell based macs (2013-2014). Macs with Broadwell CPUs (2015) are already unlocked. Support for Skylake/Kaby Lake models (2016-2017) is expected on the future.

Once you follow the steps, you should be able to write on "MSR 0x150" which basically means you can do Undervolting with VoltageShift/Volta/ThrottleStop on your Mac.

You should only use this tutorial if you get an "OC_Locked" message on VoltageShift or "FIVR Control - locked" on ThrottleStop

Dump the firmware from your mac: You can do this by using the flashrom tool on a live usb with a Linux distribution (like Ubuntu) or directly with an external programmer like the CH341A using an SOP8 Clip (only for 15" 2013-2015 models) / JTAG adapter or desoldering the Firmware Chip. Check issue #1 about how to connect the programmer
When you're done, you should have an 8MB (8.388.608 bytes) file. Make sure you have a backup of this unmodified file
Download UEFIPatch , it's available for both Windows and Mac
Extract the zip and open the extracted folder. You'll see an "patched.txt" file.
Replace this file with the patches.txt file I uploaded on this repository
Copy the ROM file from step 1 into the folder
Open a terminal, cd to the extracted folder, type the command "UEFIPatch.exe firmware.bin" or "UEFIPatch firmware.bin" on macOS. Don't worry about any "Unknown file system" warnings, if it says "Image Patched" you're ready to go.
Now you should see a new file "firmware.bin.patched" on your folder with same size as the old file (8.388.608 bytes).
Flash this patched firmware with an external programmer and your done. For my model, I used an CH341A connected with an SOP8 Clip

As you can see, I'm now able to undervolt with my 2014 15" MBP while using the latest Big Sur 11.3 Update which includes the 431.0.0.0.0 firmware.

This tutorial was tested on the following MacBooks:

Mid 2014 MacBook Pro 15" | Haswell
Late 2013 MacBook Pro 15" | Haswell (tested by binh-geomatics)

UPDATES

23/07/2021 - Big Sur 11.5 Update introduces a new firmware version (431.140.6.0.0 on 15"). Patcher is still compatible but you'll need to repatch the ROM.
28/04/2021 - First Release

undervoltpatchmacbook's People

Contributors

Stargazers

Watchers

Forkers

xiaxichen

undervoltpatchmacbook's Issues

Will it work on 478.0.0.0.0?

Programmer Connector

You will need an external programmer for the firmware flashing process.

@IsmaelHG programmer with which type of connector? Proprietary Apple's one?
Cause I've searched it recently on AliExpress and one connector with short cable costs more than 100$.

Originally posted by @th3sk4 in sicreative/VoltageShift#44 (comment)

If you have an 15" 2013-2015 MacBook Pro, you can flash with a SOP8 Clip which costs only $3.

On other MacBooks, you can use a JTAG adapter or desolder the BIOS chip and solder it into an WSON8 adapter.

Bad news is that the JTAG cable is expensive as you said, the cheapest option I found is this one in eBay for $60
https://www.ebay.com/itm/133187974519

I bought this exact same cable a year ago and it works fine.

parseVolume: non-UEFI data found in volume's free space

Hello, this github has saved many 2013 and 2014 macbooks, but i cannot get it to work on 2015 15": i can read and flash the original rom correctly, but if i try to mod it i get the error "parseVolume: non-UEFI data found in volume's free space" and the resulting patched file (i still get success) doesn't boot. This is with latest 476 firmware
If you can help i am willing to provide donation, thanks!

Bricked my rMBP 2013?

I did all the process on osx 11.3 with success, but after 11.5 I did same and my rMBP doesn't startup properly. Could you guys give me some help to figure out what's going wrong?

The process I follow was:

I did boot with Linux ubuntu 18, on terminal I did use sudo flashrom --programmer internal -r backup.rom -c MX25L6406E/MX25L6408E to dump eprom original rom.
Copy the the file to a Win10 PC and with a ch341a mini and SOP8 I connected to the eprom chip.
After patch the original rom with UEFI I tried to write the new patched rom using ch341A programmer v1.29 and all I did get was "CHIP MAIN MEMORY WITH THE CONTENTS ARE IN DISAGREEMENT" error. I tried different programmer versions as v1.18, v1.30 and get same message.
After that my MacBook didn't startup.
I tried to revert all trying to flash my backup but all I can get is same error. Only fan start to spin when I try to start my rMBP

Error image similar to this one. "CHIP MAIN MEMORY WITH THE CONTENTS ARE IN DISAGREEMENT"

My dumb rom has same size of my previous backup that I get on first patch on osx 11.3, around 8mb (8,388,608 bytes).

Will this method work with Volta

First, thank you for creating this tool and guide.

I was looking for a way to undervolt my mid-2104 MacBook Pro with Volta in BigSur and came across VoltageShift and your mod.

Would you happen to know if this method will work with Volta as well?

Connecting CH341A with SOP8 clip to BIOS chip at 3.3V

Could someone please post some details pictures for how to connect the CH341A programmer with SOP8 chip to the MacBook Pro chip? I get "No EEPROM/flash device found." after using flashrom on MacOS.

Looking up the bios chip (mxic mx 25L6406E) online shows it should be read / written to at 2.7V to 3.6V. How do you set the programmer to 3.3V mode? Some are saying online that the data lines are always 5V anyway and the programmer has to be modded. I can't get it to read the chip using flashrom.

Full output from flashrom:

sudo flashrom -p ch341a_spi -r test.bin

flashrom v1.3.0 on Darwin 20.6.0 (x86_64)

flashrom is free software, get the source code at https://flashrom.org/

Calibrating delay loop... OK.

libusb: info [darwin_detach_kernel_driver] no capture entitlements. may not be able to detach the kernel driver for this device

libusb: info [darwin_claim_interface] no interface found; setting configuration: 1

No EEPROM/flash device found.

Note: flashrom can never write if the flash chip isn't found automatically.

skylake/kabylake support

Hi! Is there any hint on the patches for skylake and later cpus? assuming the t1/t2 will not lock it

Does it work for an Imac Late 2013

Hi,

I would like to undervolt an haswell i7 on an imac late 2013.
I would like to know if your patches.txt works for this type of compteur ?

Best regards, Nicolas

Patching firmwares after Big Sur

Has anyone tried this after Big Sur? I am now looking to try OCLP on my late 2013 15" MacBook Pro with Sonoma. Will that update my firmware from my patched Big Sur 478.0.0.0 firmware? Will that require patching it again?