[UEFIPatch] UEFI patching utility

[eof]

I'm trying to install a hackintosh on an AsRock Z87 Pro3 (my first hackintosh install). Having just downloaded the newest 2.90 BIOS for the mobo and running PMPatch I get:

 

$ ../git/PMPatch/build/PMPatch Z87Pro32.90 Z87Pro32.90.patched
PMPatch 0.5.14
PowerManagement modules not found.
PowerMgmtDxe/PowerManagement2.efi modules not found.
Trying to apply patch #1
Nested PowerMgmtDxe/PowerManagement2.efi module at 001DD60C not patched: Patch pattern not found.
AMI nest module at 002581C0 not patched: PowerManagement modules not found in nested module.
Phoenix nest modules not found.
CpuPei module at 00761200 not patched: Patch pattern not found.

 

I'm running Fedora 20 on this system. Any ideas of what's going on? BIOS internals is not my thing. UEFIPatch gives me:

 

$ ./UEFIPatch ~/Downloads/Z87Pro32.90
reconstruct: Aptio capsule checksum and signature can now become invalid
No patches can be applied to input file

[CodeRush]

@Download-Fritz, "index 0" is an NVRAM volume that changes every boot, because the system writes last known boot configuration there. "Index 1" is a copy of NVRAM volume done by BIOS Setup where you've selected "Save Changes and Reset", that is why both backups you have made are fine.

FPT is in fact more reliable then AFU, because it's much simpler and does no changes to input file, while AFU tries to preserve ROM holes, transfer some files and do other things no one really needs. Then it uses SMM-based flasher to do real writes to SPI chip, which can be handy on boards with BIOS Lock, but again more complex then FPT, that just uses chipset registers directly to write to SPI chip.

You don't have to worry about FPT or AFU. If writing with FPT works for you - go use it, if not - just use AFU, either way is fine.

 

@Net-burst, please update your Clover to the latest version, NVRAM problems are gone now thanks to dmazar. You can also experience problems with iMessage after this update, so I recommend to read this topic to the end.

 

@eof, looks like it's already unlocked, nothing to patch there.

[Net-burst]

@CodeRush, thanks. I thought that it is locked because of some messages on forums. Also OSX on boot writes something about inability to write to NVRAM. Also, some users stated that older version of bios did not have NVRAM lock (older versions don't have SMI lock enabled in BCP, if that matters). So, new Clover eliminates any need to unlock NVRAM?

 

PS. I'm already following that topic. But still waiting to some iMessages clarification, because I use it quite heavily

[savemosca]

PMPatch is obsolete and not supported by me anymore.

I have developed the successor of it, UEFIPatch, which is both more universal and reliable, and uses UEFITool's engine for proper UEFI modification.

Combined topic about all my UEFITool-based utilities is here, sources are available on GitHub, binaries can be downloaded here, full announce and short help on usage is here.

Bug reports are welcome. 

 

To any new readers of this topic: it's you who takes all the risk of bricking your board, it's you who is responsible for all things that you do to your PC, not me or any other developer out there!

BIOS modifications are risky by their nature, please be aware of it and don't blame me if anything is gone wrong for you.

 

 

Old PMPatch post and FAQ is in spoiler below:

 

 

I wrote an utility to patch modern UEFI BIOSes from different vendors to prevent them from locking MSR 0xE2 and therefore make the system with patched BIOS compatible with native OS X power management.

It's tested on AMI, Phoenix and Insyde UEFI BIOSes and it works.

 

This patch works on boards based on 5th, 6th, 7th and 8th series of Intel chipsets, so NM10 and similar ones are supported - there is nothing to patch in that BIOSes.

 

The utility is BSD-licensed and available on GitHub.

Compiled versions for Windows and OS X are here.

Latest version is 0.5.14

 

Usage: pmpatch /path/to/original.bios /path/to/patched.bios

 

This program can produce corrupt BIOS images, try them on your own risk.

Please attach AIDA64's or DarwinDumper's report file to your "PMPatch didn't work for me" message.

Thank you in advance.

 

F.A.Q.

1. I have many "... not found" messages in program output, is it bad?

-- No, if the last message is "Output file generated", it's OK to have any other messages.

 

2. I have patched my BIOS, can you guarantee it will work after flashing?

-- No, but there are many people with patched BIOSes of all kinds, and very few negative reports.

 

3. I can't flash my patched BIOS due to "security verification failed", what can I do?

-- If you have ASUS board with USB BIOS Flashback support, use it to flash your modified BIOS.

-- If you have AMI UEFI BIOS (all modern desktop boards now have one, DO NOT TRY IT ON NOTEBOOKS), then you can use this method.

-- If you have non-AMI BIOS, I don't know any 100% working method except using external programmer, which are cheap and fast nowadays. 

 

4. Program version for OS X crashes with "Segmentation fault" message, what to do now?

-- It's a known issue with LZMA compression code compiled by Apple compilers, please try using version for Windows.

 

 

There is a guide to use UEFIPatch? I actually use SSDTPRGen script from Pike R. Alpha, result is the same? Or one of two is a better solution?

Thanks.

[CodeRush]

Pike's scripts are unrelated to the problem solved by UEFIPatch. If you don't know what UEFIPatch is - you don't need it.

[savemosca]

Pike's scripts are unrelated to the problem solved by UEFIPatch. If you don't know what UEFIPatch is - you don't need it.

I've read that one patch adds native speedstep to hackintoshes like pike's scripts and remove lock from MSR 0xE2.

Can you explain me wich problem UEFIPatch solve?

[tonydickinson]

Hi CodeRush - thanks for the great work here. 

 

My intention was to unlock the BIOS Nvram although I am using Dmazar's Clover Aptiofix to boot which works fine as does OS X iMessage - thanks for your valuable input there.

 

Mhhh not far off being a noob, but I think i have patched my Asus Z87 Deluxe Dual Bios using win8.1, the only concern I have although the patched BIOS appears to be working fine but I see an invalid region error (only in UEFI tools) which UEFIPatch appears to have ignored and updated the BIOS blocks OK during the Windows8.1 process. It still all works which is a relief.

 

This is a screenshot http://d.pr/i/AqHa

 

I see no BIOS errors on reboot.

 

This is the original Asus BIOS file.Z87-DELUXE-DUAL-ASUS-2004.CAP.zip

 

and this is the supposedly patched bios.bin.patched bios.bin.patched.zip

 

I would be grateful when you have the time to please check that it has completed it ok.

 

I am assuming.

1. it has all worked as planned.   2. It hasn't worked at all and I am not aware that it is still running an unmodded BIOS.

 

Just need some clarification from an expert as which is the more likely.

 

Thank you again.

[mhaeuser]

@CodeRush Sorry for the very late reply, but your little tool did the magic. I used FPT as you suggested and there weren't even minor signs of a problem; everything went through perfectly. For the others: You can feel free to use this patch on the "MS-7797" OEM board by MSI.

 

Thank you again for your great work. I really appreciate it!

 

(shhh... also thank you for taking my fears of flashing. With unlocked MSR and working NVRAM I might attempt Ozmosis next.)

[cc900]

I just have a question about this Tool.

I've got an MSI Z97 Gaming 7 motherboard and i downloaded the bios from MSI website as a zip-file.

I unzipped the file and found a file ending with .150

Should I just use uefipatch on this .150 file and then flash that generated file?

Just want to make sure I do it right.

I tried booting the installer but it keeps restarting into Windows so maybe flashing this will help!

Many thanks for any help!

[Chudus]

Hello there guys!

 

I have a question. Successfully pmpatched the msi G43 Gaming MB with Z87 onboard but after few powering on and off the OS X the UEFI gets to the default settings. It's not bothering me a lot but i wonder why is it happening. After CMOS clear it goes again with a full screen UEFi logo but than back to this fancy default.

[elfzweik]

Hi, CodeRush, 

 

My laptop is Thinkpad new X1 Carbon. I was stuck at device uuid is xxxxxx when trying to install Mac OS X using clover. I googled the problem, it seems pmpatch the bios will help. However, pmpatch does not work to my bios file. 

 

I just found you have developed this new tool. Hope this tool works to my bios.

 

I tried uefipatch and after several screens of sections with unknown type (f0), I got 2 patches and the .patch file generated. But I am not sure whether this means success and I can use this patched file to flash my bios. 

 

I attached my bios file and uefitools screen capture here. Could you help to tell me whether the patch is succeeded?

 

Vielen Danke!

 

 

$01E3000.zip

 

[CodeRush]

elfzweik, this image is not a BIOS image, but an update capsule. I don't think you can patch it like this, because of RSA signatures they are using right now top protect update images from modification. 

If you can, use hardware SPI programmer to dump the actual BIOS image from SPI chip, patch and and flash it back. If not - just use Clover to patch your kernel.

[hurrikenux]

@DirectXtraOrdinary, I spend days researching appropriate ways to fix the my BIOS in an ASUS Q550LF (Q550LF-BSI7T21). Thank you so much for posting your comment, it worked perfectly for me.

 

I originally started with Google search: "Haswell early reboot, Mavericks, locked MSRs". That led me to http://www.insanelymac.com/forum/topic/285444-uefipatch-uefi-patching-utility/ , the first page of this thread. I just want to update your instructions a little bit with current updates. This worked for me and hopefully for everyone on an ASUS Q550LF. I will paraphrase your info with some updates:

 

Q550LF MSR Unlock Patch for Native Power Management

 

Before you begin please click Here and Read Post #1! After you've read that over and over, and understand this could seriously brick your laptop, we can move on.

 

Please download the newest release of UEFIPatch from CodeRush (Thank you so much for all your hard work!). As of writing this, UEFIPatch is version 0.2.1 on win. Last you need AMI BIOS Support Tool - AFUWinx64 found here. It will be listed as AFUWin v4.xx. I created a directory on the root of my Win8x64 drive, "C:\UEFI\". I extracted everything I downloaded there. You will need to navigate to the following "C:\uefi\amiflash\Aptio\afuwin\64\" and extract "afuwin64.zip" to "C:\UEFI".

1. Start Command Prompt with Administrator Priveledges (How to).
2. Navigate to C:\UEFI ("cd c:\uefi\")
3. Backup (will only READ your BIOS and write to a file):      "afuwinx64 bios.bin /o"
4. Patch (patches the file you just backed up):     "uefipatch bios.bin bios-patched.bin"
5. Close Everything!: Shut off your virus software and anything unecessary. 
6. Warning: Last chance... You've read everything you possibly can about this subject and you're sure you want to continue. Good place to cross your fingers.
7. Apply : "afuwinx64 bios-patched.bin /gan"

Verification after reboot, here you will backup your BIOS again, if its patched it shouldn't do anything. If not you will see "patch applied":

1. Backup: afuwinx64 bios.bin /o
2. Test: uefipatch bios.bin bios-pmpatched.bin

Will report there's nothing left to patch.

Voila, you have a uefipatched UEFI now.

 

Most important: Don't use a different bios version, it potentially causes bricks. Work only with the created backup bios. I followed these instructions while at Bios version 214. I know that 215 was realeased on 01AUG14. I have no need to update to that, it only affects Sata0/2Dev Mode.

 

The AFU for APTIO /GAN switch appears to serve the same purpose as /SANTA on AFU for regular BIOS. No idea what the switch does, just do it!

 

That concludes this instruction, now go forth and install Mavericks! Your laptop should work with Native Power Management.

 

Thank you again DirectXtraOrdinary, CodeRush, and all others for your work!

 

~Kennyroody

PS. Please let me know if anyone needs help with anything, I'll help where I can.

 

I'm using these steps to update my P8H77-I using 1102 (I bricked the first chip and had to get a new one).  Everything appears to go fine other than afuwin doesn't actually write the patched bios, it looks successful but the mac partition won't boot and the dump always has to be repatched.

 

Am I missing a step here?

 

EDIT: Nevermind, I found that the AMI utilities never actually write anything to the BIOS no matter what the version is.  Using FPT (how I originally bricked a chip in the first place due to an error) gave me an error writing to the BIOS space.  I downgraded the BIOS to 0904 and restored from my original FPT backup which was already patched.  This resolved my issues and has me back working.  I shouldn't have tried a new BIOS in the first place (don't fix what ain't broke).

[roysong]

Hey CodeRush,

 

I have a asus z87-k haswell motherboard. And I'm assuming I need to patch the bios, since osx wont run with nullcpupowermanagement

I am on osx on a different computer. I have downloaded the bios for the z87-k. The uefipatch, patches.txt, and bios are all in the same folder.

 

Terminal is as follows:

 

sudo ~/Downloads/UEFIPatch_0.2.1_osx/UEFIPatch ~/Downloads/UEFIPatch_0.2.1_osx/Z87-K-ASUS-1401.CAP
patches.txt file not found or can't be read

 

I am certainly missing something simple here.

[roysong]

cd to ~/Downloads/UEFIPatch_0.2.1_osx/UEFIPatch FIRST!!

well I feel dumb. I assumed uefipatch would search its own directory when run.

 

thank you STLVNUB

 

patch: replaced 10 bytes at offset 0x00001366 75080fbae80f89442430 -> eb080fbae80f89442430

reconstruct: Aptio capsule checksum and signature can now become invalid

Image patched

 

Now when I try to upload it, I get the Security Verification Error. I'm assuming the only way around this is installing Windows, dumping the bios, patching, then uploading it with afuwinx64. Is there any other way? I'll be installing windows in the mean time.

[roysong]

I seem to have gone through the dumping, patching, and reuploading process successfully. But osx w/ clover still doesn't boot without nullcpu. Do I have to reinstall osx after bios update?

[roysong]

remove nullcpu

My mistake, I meant *without. I still need nullcpu to boot. I've corrected it

[crz]

Hello all.

My attempts to patch my Z87 Extreme4 uefi with UEFI Patcher were unsuccessfull, both downloaded from Asrock or backuped from ROM.
It seems that things have changed in latest firmwares for this mobo (tried 2.70 and 3.00)

Does there exist some solution or guide how to patch necessary sections manually? or maybe new version of UEFI Patcher is coming soon?

I've attached v3.00 backup to this post just in case some research is needed.

UEFIPatch.exe backup.rom
No patches can be applied to input file

PMPatch_0.5.14.exe backup.rom modified.rom
PMPatch 0.5.14
PowerManagement modules not found.
PowerMgmtDxe/PowerManagement2.efi modules not found.
Trying to apply patch #1
Nested PowerMgmtDxe/PowerManagement2.efi module at 001DB6CC not patched: Patch pattern not found.
AMI nest module at 000571C0 not patched: PowerManagement modules not found in nested module.
Phoenix nest modules not found.
CpuPei module at 00560200 not patched: Patch pattern not found.

backup.zip

[CodeRush]

crz, there is nothing to patch in this BIOS, it must be factory unlocked.

[6rollo6]

Hi everyone,

 

I've now spent nearly two days trying to flash a PM patched firmware without success, I think I've really tried everything...    

 

The board is an ASUS P8H77-M Pro.

 

Attached arethe original and the modded firmware. I've used a hex editor to patch PM manually, think I've done everything right (?!)

I just need a tool/workaround to flash the image, that security protection really sucks... 

 

Can somebody please help me? 

 

Thanks in advance & Greetings

6rollo6

 

 

firmwares.zip

[ZhuangJW]

PMPatch is obsolete and not supported by me anymore.

I have developed the successor of it, UEFIPatch, which is both more universal and reliable, and uses UEFITool's engine for proper UEFI modification.

Combined topic about all my UEFITool-based utilities is here, sources are available on GitHub, binaries can be downloaded here, full announce and short help on usage is here.

Bug reports are welcome. 

 

To any new readers of this topic: it's you who takes all the risk of bricking your board, it's you who is responsible for all things that you do to your PC, not me or any other developer out there!

BIOS modifications are risky by their nature, please be aware of it and don't blame me if anything is gone wrong for you.

 

 

Old PMPatch post and FAQ is in spoiler below:

 

 

I wrote an utility to patch modern UEFI BIOSes from different vendors to prevent them from locking MSR 0xE2 and therefore make the system with patched BIOS compatible with native OS X power management.

It's tested on AMI, Phoenix and Insyde UEFI BIOSes and it works.

 

This patch works on boards based on 5th, 6th, 7th and 8th series of Intel chipsets, so NM10 and similar ones are supported - there is nothing to patch in that BIOSes.

 

The utility is BSD-licensed and available on GitHub.

Compiled versions for Windows and OS X are here.

Latest version is 0.5.14

 

Usage: pmpatch /path/to/original.bios /path/to/patched.bios

 

This program can produce corrupt BIOS images, try them on your own risk.

Please attach AIDA64's or DarwinDumper's report file to your "PMPatch didn't work for me" message.

Thank you in advance.

 

F.A.Q.

1. I have many "... not found" messages in program output, is it bad?

-- No, if the last message is "Output file generated", it's OK to have any other messages.

 

2. I have patched my BIOS, can you guarantee it will work after flashing?

-- No, but there are many people with patched BIOSes of all kinds, and very few negative reports.

 

3. I can't flash my patched BIOS due to "security verification failed", what can I do?

-- If you have ASUS board with USB BIOS Flashback support, use it to flash your modified BIOS.

-- If you have AMI UEFI BIOS (all modern desktop boards now have one, DO NOT TRY IT ON NOTEBOOKS), then you can use this method.

-- If you have non-AMI BIOS, I don't know any 100% working method except using external programmer, which are cheap and fast nowadays. 

 

4. Program version for OS X crashes with "Segmentation fault" message, what to do now?

-- It's a known issue with LZMA compression code compiled by Apple compilers, please try using version for Windows.

 

 

 

The UEFITool can be used in NoteBook ?

 

[CodeRush]

ZhuangJW, sure, why not, but only if you manage to flash the modified image properly. Consider making a full SPI chip backup first using hardw2are SPI flasher, so you will be sure nothing can go wrong.

6rollo6, you can use this method to disable BIOS lock on your board, then just use FTK to flash your modified BIOS.

[ZhuangJW]

ZhuangJW, sure, why not, but only if you manage to flash the modified image properly. Consider making a full SPI chip backup first using hardw2are SPI flasher, so you will be sure nothing can go wrong.

6rollo6, you can use this method to disable BIOS lock on your board, then just use FTK to flash your modified BIOS.

How to make a full SPI chip ? What is SPI ?

[6rollo6]

6rollo6, you can use this method to disable BIOS lock on your board, then just use FTK to flash your modified BIOS.

 

I've flashed an older firmware and finally the flashing of the modded one worked! Nevertheless thank you very much for letting me know about this alternative method! 

[taetae]

@CodeRush

 

hello and thank you for the work you've done,

 

I wanted to ask your help for my ASUS UEFI patches n550vj 

 

gives me this error when I try to run your program:

 

reconstruct: aptio capsule checksum and signature can now become invalid 

Image patched

 

 

I can safely say that rifleshare the bios or I would find myself with a paperweight?

 

thanks for replying,

 

 

 

 

 

• Processore
  Intel® Core™ i7 4700HQ Processor
• Chipset
  Intel® HM86 Express Chipset
• Memoria
  DDR3L 1600 MHz SDRAM, DIMM Up to 16 G
• Grafica
  Integrated Intel® HD Graphics 4600 
  NVIDIA® GeForce® GT 750M with 2GB/4GB DDR3 VRAM

 

N550JVAS208.zip