Apple Mac Mini 2015
2015 Mac Mini Specs
Mac Mini 2015 Ram Upgrade

The Mission

There has been much controversy on removing the firmware lock on a MBP, MBA, or similar Mac’s. The MBA is a bit more complicated without a specialty tool to interface with a header on the board. We use to have to remove the board, scratch back traces, and solder directly to them which can be seen in EX-1.1. This is just short of replacing the entire chip, which is what we are all trying to avoid right? I also have a project I have been forking on called the iFLRT (Firmware Lock Removal Tool) that can be found HERE. Donate what you can to keep my development process alive, every little red cent helps.

Oct 13, 2019 Officially, macOS Catalina is only supported on the following Mac models, since they have graphics processors with support for Metal, Apple's graphics API. MacBook (Early 2015. The Mac mini was introduced as the least expensive system ever shipped by Apple, packing modest performance in extremely compact and elegantly simple cases. The Mac mini can be divided into three basic groups - PowerPC, Intel Polycarbonate, and Aluminium. However, there are significant differences between systems within each group.

First you need to understand what the firmware lock is and how removing it will affect you. Then maybe you will be able to decide if this procedure is for you. In most cases a MBP has been purchased from a third party who may have stolen it or simply forgotten to remove their iCloud account. In this case the symptoms would be a four digit pin lock when the OS loads. When you try to do a re-install you are met with a lock screen shown in EX-1. This is the result of the Mac being most definitely locked from the cloud. There are two options from this point which are explained below.

EX-1

EX-1.1

NOTE: If you have a 2010 model MBP or earlier all you have to do is change the amount of RAM in your MBP and clear the PRAM. This is all you have to do to get past OS lock. But you will still have a firmware lock as far as I know as in many cases this has happened. There have been occasions where the firmware lock has also been removed but I cannot contest to any exact models. Remember to set the Mac up like new and register the Mac with a new iCloud account to avoid any future lock-downs.

Option A: You can assume that a firmware lock was never set and brute force the firmware lock with a HID device such as a Teensy. This operation can take quite a while because it has to go through 10,000 iterations of possible pass-phrases in the worst case scenario. This will ONLY work if it was set by the iCloud!

Option B: You can assume that a firmware lock was indeed implicated when the MBP was set up and that the brute force method will not work. This can save you time but requires you to have a SPI programmer at hand such as the Bus Pirate or in this case a Raspberry Pi.

In A Nutshell

I won’t waste time on the brute force method as I believe it isn't relevant in most cases. I will focus on the process of flashing the EFI chip that is usually easily accessible by removing the Macs’s back-plate, either by a small 15X2 header, 17X2 header, or the 8 pin SOIC chip itself. You can see an image of the SOIC8 chip in EX-2 and the header in EX-2.1. The process is simple but requires a bit of knowledge in micro controllers. I will use the easiest and cheapest route that I know. The process goes briefly like this:

EX-2

EX-2.1

Step 1 – Buy a SPI programmer such as the Raspberry Pi and a clip to interface with the chip. You can find the Pi on eBay, doesn't matter what model and you can find the Pomona SOIC8 clip there as well, usually with the female-to-female wires included. If you have a MBA then you can contact me about purchasing a clip for the header.

Step 2 - Read the chip three times and verify MD5 check-sum to ensure you have a good backup if things go wrong.

Step 3 – Make a copy of the dump and open it in a hex editor. I use Notepad ++.

Step 4 - Search for “$SVS” in the dump and you should find 2 instances. The first instance is what you will need to clear out making sure to keep the file length the same. It is safe to replace it with an empty value such as “ÿ”. The string including the $SVS should be replaced, you can copy and paste a portion of the string below if needed. each 'ÿ' is 2 bits and 8 bits make a byte So keep that in mind when you replace the string. The file size has to be exactly the same size as the chip or it will return an error.

This is an example of what to replace in a hex editor.

Step 4.1 – Get a clean dump that is not firmware locked from the community making sure you use the correct EMC and processor architecture. Make absolutely sure it is the same size as your original dump which is usually 2, 4, or 8 MB. If you go this route then you will need to replace the serial of the donated dump with your own serial in order to not register over their Mac. You can do this my simply searching for 'override-version' and on that same line there will be an 11 to 12 digit serial number that you will replace with your own. I also have a repository found HERE which you can use to search for your EMC number and I may have a clean dump.

Step 5 – Hook your programmer up to the chip, erase the chip, write the new dump and verify it.

Step 6 – Remove the clip and turn your Mac over to turn it on and test. You will immediately use the hot-keys to get to single user mode to test.

Step 7 – If you do not get to SU mode or the Mac does not boot right you will need to erase the chip and write the old dump back to it. You then can exhaust other options.

Step 7.1 – If you do get to SU mode turn the Mac back off and use the hot-keys to clear the PRAM. This will get rid of the 4 digit lock at OS load. Or you can simply re-install at this point. Remember to register the Mac to a new iCloud account to avoid future lock downs.

NOTE: Here are a few things worth mentioning..

Make sure your chip is supported in Flashrom which is the program you will be using to talk to the chip.
You need to make sure the clip makes a solid connection to avoid misreads.
You need to verify your chips datasheet to correctly identify the pin-out to the SPI programmer.
The wires connecting the clip to the SPI programmer need not be any longer than 8 cm.
The battery may need to be connected due to voltage drop in special cases (RARE).
The power cable should be removed from the Mac during the entire process, up until boot time testing.
Always make sure to back up your original dump and verify the write.
Optionally you can wire in resistors between the SPI programmer and the clip on the 3.3v pins.

That is the entire process in a nutshell. Now I will explain how you can do this in as much detail as possible. The first thing that you will need to do is pick up your entire inventory before you begin. After that lay everything out and do some testing. Make sure your chip is supported having the datasheet and any diagrams available. I also suggest after you get the clip connected to all the wires you check for continuity from the clips pins to the end of the F-F wires on each pin.

Down And Dirty

NOTE:Read this guide in its entirety before you attempt to do anything to your Mac; Read it twice if you have to. I would also like to take this time to tell you that I am not responsible for any damages to your personal property or your physical/mental wellness if the guide is used. There is no guarantee, implied or expressed, in this procedure. You are following this guide knowingly and accept that damaging your property may be the outcome. Although I do not for see that being the case as I have tested this method many times. With that being said, let’s get started.

This is the list of things you will need in order to successfully and easily fix your MBP:

Raspberry Pi (Doesn't matter what version) with power supply and an SD card with Rasbian installed.
8 Pin Pomona SOIC clip or my EFI Easy Flash clip.
8 Female-to-Female wires.
Flashrom.
Your chip's datasheet (To verify the chips pin-out and voltage requirements).

Now, I am going to assume that you at least have some e

Mac Mini Hacks 2015