Macbook Air 11" Mid 2011 - Unable to dump the EFI

[the_end]

I want to dump the EFI from a Macbook Air 11" Mid 2011 with a Raspberry Pi Rev1 Model B and a "Rebel Easy Mac Book Pro / Air Flasher 2010-2014 Model Macbook Air EFI Firmware Chip Clip Flash"

I'm using a 1.500 mA micro-USB power supply and the adapter is connected to the pi with 10 cm cables


I have conneted (Adapter to Header Pin)

3.3V -------> 17
SLCK-------> 23
SI----------> 19
GND-------> 25
SO---------> 21
CS---------> 24

But I can not read the EFI.

I'm using flashrom v0.9.9-r1954 on Linux 4.9.41+ (armv6l) (Raspbian)

____

flashrom -p linux_spi:dev=/dev/spidev0.0

No EEPROM/flash device found.
____


I have tried:

- The switch on the Connector to the left and right
- Battery and Magsafe connected to the Macbook
- Battery and Magsafe disconnected
- Battery disconnecte - Macsafe conneted
- Only wit the Battery connected

but it doesn't work.

Any idea, what could be wrong?

Unfortunately I can not post pictures of my setup ... You need 10 Post ... even to include Pictures in a Thread.

[the_end]

Edit: Some further information (but I don't understand it)

I have found this on the rebelsimcard site:

----
For models A1398 - A1369 - A1370 switch to the right.
----

ok ... I must switch to the right position. No problem.


----
Use the 3.3v for the WP and the HOLD from pin 8 or from external Power Source
----

This adapter has no WP and HOLD. It has only 6 connectors.

[epidemija]

Remove EFi with SN+HASH instead wasting time on dumping it.

[the_end]

This adapter is useless, if you have a Macbook Air 11" 2011 (1370). WP and HOLD are on the backside of the logic board. So I have to:

- remove the logic board
- solder a cable to the WP and HOLD pins and connect them to 3.3 V

Removing the board is quite easy, but soldering cables to the tiny connetors is to much for me.

Let's see what "Remove EFi with SN+HASH" means. I guess there is a decription here in the forum.

Will try to find it.

Thank you for the hint.

[the_end]

I still can not post links. If you google for:

"Apple EFI firmware passwords and the SCBO myth"

you will find a description. Seems to be easy.

I only need the Hash (Control-Option-Command-Shift-S), the serial number on the Logic Board and a "clean" SCBO.

Step 1
---------

Get the Hash (Control-Option-Command-Shift-S)

---------
Step 2

Get the serial number. I have opend the Air, but I can't find it. Maybe it is on the backside of the Logic Board. Google will tell me.

--------
Step 3

I have to change the serial number in the clean SCBO to my serial number.
(Not shure about this .. I don't use iCloud ... has the serial number in the SCBO to match the serial number on the Logic Board?)

-------
Step 4

This file can be "flashed" with a USB stick.

------
Step 5

Clear the NVRAM (alt+cmd+P+S)

-----
Step 6

Install MacOS

-----


I have to check my bookmarks. There was a site with SCBOs for all kind of Macbooks.

Wow ... no Adapter needed .... no soldering ... and easy to do it again without opening the Macbook again (If I write down the serial number).

Really ... that's all????

[the_end]

The "Remove EFi with SN+HASH" means, that I have to pay 100 - 150 $ and it is a "one shot"? Fair for an expensive device like a new Air or a Macbook Pro ... but for an old (2010) Air ... to much. Soldering cables to the connetors on the backside of the Logic Board (by a professional electronics) would cost about 20 $.


Reading my EFI with the adapter... one step further. When I connect the adapter to my Macbook (battery at 100% and magsafe conneted):

----
Calibrating delay loop... OK.
Found Generic flash chip "unknown SPI chip (RDID)" (0 kB, SPI) on linux_spi.
----

So flashrom was able to find the IC, but can not read it.

Seems to be a power problem. That means:

- Cables to long or to thin (10 cm at the moment)
- The 1.500 mA power supply is not strong enough
- One ore more Jumper Wires are on the wrong raspberry pin

btw ... I was wrong ... The Macbook Air ist not a 2011 model. It is a "Late 2010".

I still don't know, where I can find the serial number of the Logic Board. Maybe it is on the backside.

I have found a (almost) clean SCBO in a thread here and a locked one. At the moment I playing with some emulators that can run EFI binaries and I have IDA Pro + some plugins to disassemble and analyse EFI code.

[the_end]

It was a power problem. I was able to read and flash after using a 2.5 A power supply.