Jump to content
holyfield

Pattern of MLB (Main Logic Board)

572 posts in this topic

Recommended Posts

 

I've gotten hold of a real MLB (from a 13 inch MBP 5,5 Mid 2009) to give you an example of how to generate a synthetic MLB using its component parts :).

 

It's comprised of 13 characters with the format

PPYWWSSSSCCCC

  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • ID - Model of hardware part = 6GCA

 

to many confusion here, what they changed in 17 char ?

Share this post


Link to post
Share on other sites
Advertisement

@Allan,

 

BoardSerialNumber is the same as MLB so if you already have the value specified in the SMBIOS section, it is not necessary to also place it in the RtVariables section.  However, if the value placed in SMBIOS is different to the value placed in RtVariables, Clover will inject the MLB value from RtVariables (it gives preference to the RtVariables value).

 

@Hanger1,

 

The pattern of the 13 character MLB (from older Macs) is better understood than the newer 17 character MLB from current Macs and appears to have less stringent syntax checking. 

 

Some users in Voldemort's forum have reported success with activating iMessage/FT using synthetic/fake 13 character MLBs and calling Apple Support with the customer error code to register them on Apple's whitelist.

 

AFAIK, no-one has completely figured out the 17 character MLB pattern to create synthetic/fake 17 character MLBs that pass the newer syntax check introduced by Apple after mid Nov 2014.  As an experiment, someone could try the genuine MLB from post#55, change the WW or NBR value slightly (refer Pike's post #205) ---> see if they get a customer code and register the new "fake" MLB by calling Apple Support....

Share this post


Link to post
Share on other sites

@Allan,

 

BoardSerialNumber is the same as MLB so if you already have the value specified in the SMBIOS section, it is not necessary to also place it in the RtVariables section.  However, if the value placed in SMBIOS is different to the value placed in RtVariables, Clover will inject the MLB value from RtVariables (it gives preference to the RtVariables value).

 

Perfect!

 

Thanks man!

Share this post


Link to post
Share on other sites

Anyone else have issues getting MAC apple hack to run? On 10.10.1 on a macbook pro 3,1 it crashes on the first dock bounce.

 

Console shows this:

com.greenosx.utility.Apple-MAC-Hack.33620(1057) Service exited due to signal: Segmentation fault: 11

Share this post


Link to post
Share on other sites

Hey Guys!

 

Finally, my iMessage are working!!  :thumbsup_anim:

 

DGc.png

 

I used my old ROM (Chameleon times) and i create one MLB following @fusion71au's tip.

 

MLB: 13 character.

 

EDIT: I called for Apple Support, and my Apple ID is enabled now.

EDIT2: Thank you very much fusion71au and holyfield you are a genius guys!


And FaceTime is also working!  B)

Share this post


Link to post
Share on other sites

 

I've gotten hold of a real MLB (from a 13 inch MBP 5,5 Mid 2009) to give you an example of how to generate a synthetic MLB using its component parts :).

 

It's comprised of 13 characters with the format

PPYWWSSSSCCCC

  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • ID - Model of hardware part = 6GCA

So our made up MBP 5,5 MLB serial number is W89260VOQ6GCA.  You can obviously change WW and SSSS to other values if you like...

 

Procedure to activate

  1. Set the ROM as your 12 character ethernet MAC address
  2. Put MLB & ROM in RtVariables/config.plist, keep everything else the same including current system serial and SMBIOS
  3. Disconnect from internet
  4. Reboot computer and run iMessage debug to confirm MLB/ROM values are persistent
  5. Reconnect internet
  6. Login to iMessage ---> will most likely get Customer code if you haven't accidently created someone's real MLB/ROM
  7. Call Apple Support saying you have a problem with your Apple ID while logging in to iMessage
  8. Cross fingers that they fix it :)!

 

I've got couple questions. If I have laptop with i5 CPU, then i should have S/N that indicates machine which had those (ex. macbook pro retina 13 late 2013)? How can I generate proper S/N? Should it be visible on Apple's selfsolve site, or should it be unique number generated in Clover?

Share this post


Link to post
Share on other sites

@Fusion71au

 

Here we getting already white listed MLB, with already white listed mlb and rom we don't need to call apple

This way will never close for imessage and FaceTime

Last month the calling apple way was closed but now working..... So....

Share this post


Link to post
Share on other sites

I guess we need a new extraction tool :-)

//
// setup rom variable
//
STATIC EFI_STATUS BlpSetupRomVariable()
{
__try
{
//
// ROM = [0xffffff01, 0xffffff07)
//
UINT32 attribute = EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS;
UINT8 romBuffer[6] = {0};
UINTN dataSize = sizeof(romBuffer);
if(EFI_ERROR(EfiRuntimeServices->GetVariable(CHAR16_STRING(L"ROM"), &AppleFirmwareVariableGuid, nullptr, &dataSize, romBuffer)))
EfiRuntimeServices->SetVariable(CHAR16_STRING(L"ROM"), &AppleFirmwareVariableGuid, attribute, sizeof(romBuffer), ArchConvertAddressToPointer(0xffffff01, VOID*));

//
// check MLB
//
UINT8 mlbBuffer[0x80] = {0};
dataSize = sizeof(mlbBuffer);
if(!EFI_ERROR(EfiRuntimeServices->GetVariable(CHAR16_STRING(L"MLB"), &AppleFirmwareVariableGuid, nullptr, &dataSize, mlbBuffer)))
try_leave(NOTHING);

//
// search [0xffffff08, 0xffffff50)
//
UINT8 tempBuffer[0x48];
memset(tempBuffer, 0xff, sizeof(tempBuffer));
EfiBootServices->CopyMem(tempBuffer, ArchConvertAddressToPointer(0xffffff08, VOID*), sizeof(tempBuffer));
for(UINTN i = 0; i < 4; i ++)
{
if(tempBuffer[i * 0x12] == 0xff)
{
if(i)
{
dataSize = 0;
UINT8* mlbBuffer = tempBuffer + i * 0x12 - 0x12;
while(mlbBuffer[dataSize] != ' ')
dataSize += 1;

EfiRuntimeServices->SetVariable(CHAR16_STRING(L"MLB"), &AppleFirmwareVariableGuid, attribute, dataSize, mlbBuffer);
}
break;
}
}
}
__finally
{

}

return EFI_SUCCESS;
}

I mean. We should figure out what data is stored at this location.

Share this post


Link to post
Share on other sites

 

I've gotten hold of a real MLB (from a 13 inch MBP 5,5 Mid 2009) to give you an example of how to generate a synthetic MLB using its component parts :).

 

It's comprised of 13 characters with the format

PPYWWSSSSCCCC

  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • ID - Model of hardware part = 6GCA

So our made up MBP 5,5 MLB serial number is W89260VOQ6GCA.  You can obviously change WW and SSSS to other values if you like...

 

Procedure to activate

  1. Set the ROM as your 12 character ethernet MAC address
  2. Put MLB & ROM in RtVariables/config.plist, keep everything else the same including current system serial and SMBIOS
  3. Disconnect from internet
  4. Reboot computer and run iMessage debug to confirm MLB/ROM values are persistent
  5. Reconnect internet
  6. Login to iMessage ---> will most likely get Customer code if you haven't accidently created someone's real MLB/ROM
  7. Call Apple Support saying you have a problem with your Apple ID while logging in to iMessage
  8. Cross fingers that they fix it :)!

 

 

@fusion71au: How do you determine the ID - Model of hardware part = 6GCA

 

Is that the EEE code ?

 

The pattern take 4 characters "CCCC" What do you do when the EEE Code is only 3 character?

 

Thanks

Share this post


Link to post
Share on other sites

I created a random value model of hardware part = 6GCA i.e = 7VWZ

 

And works  :P 

Thanks Allan, so what you are saying we can manufacture / create any random value for "CCCC" part in the 13 character  MLB?

 

I'm not sure how long this would stick with apple

Share this post


Link to post
Share on other sites

So, i can't confirm for you if exists some rule about this.

 

I follow this steps:

  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • ID - Model of hardware part = 6GCA

Just the last step i generate a random value.

Share this post


Link to post
Share on other sites

@Allan, what about your S/N? Have you change it? Now your MLB indicates, that you have 13 inch MBP 5,5 Mid 2009, but is your S/N visible on selfsolve apple site as 13 inch MBP 5,5 Mid 2009, something else, or is it unique S/N and does't appear at all?

Share this post


Link to post
Share on other sites

So yours S/N is from genuine apple machine or is it made up? During phone activation stuff member always asks about S/N, what did you say to them? :D

Share this post


Link to post
Share on other sites

My S/N was generated by Champlist.

 

During the call just informed my AppleID, and they unlocked my ID, told me to restart, and...Works!!  :lol:

 

EDIT: But I had already done the steps taken by fusion71au

 

1. I follow the fusion71au's tips.

2. And then I called to Apple.

Share this post


Link to post
Share on other sites

One more thing :D Can You post screen what you get when you paste your S/N here?:

https://selfsolve.apple.com/agreementWarrantyDynamic.do

 

Is obvious:

We're sorry, but the serial number you have provided cannot be found in our records. Please verify the number and try again, or contact us.

 

:) 

Share this post


Link to post
Share on other sites

@Majkwin,

At the risk of sounding like a broken record, iMessage/FT activation is all about the MLB/ROM combination, NOT system serial.    

 

You can use ANY system serial/SMBIOS (whether fake or real) and iMessage will still activate as long as MLB/ROM is registered on Apple's servers and MLB has the correct formatting/syntax.

 

Presently, MLB cross checking is NOT done against system serial or system-id (only against ROM), so it is still possible to use an older MLB/ROM eg MBP 5,5 to activate a hack using a newer SMBIOS and system serial eg MacPro 6,1.

 

How to ring Apple support and answer their questions has already been described in plenty of other iMessage threads...use google to find Voldemort's forum.

 

 

@TomcatDive,

There is no publicly available database for CCCC so I extracted it from a real MBP 5,5 MLB.  It seems that there is less stringent syntax checking with 13 character MLBs as @Allan has proved by making a random value for CCCC :P.

 

We need more people with older Macs (that have 13 character MLBs) to submit their PP & CCCC values if we are to create an automated tool for MLB generation.

 

In the mean time, others can try changing the WW and SSSS variables with the example I already provided to generate their own unique MLBs....

Share this post


Link to post
Share on other sites

@fusion71au, thanks - that was a reply, that I was waiting for. Now everything is clear for me. So, if I call apple support and They will be asking for S/N I can give them any number I want and it won't be signed with my account? If I give them my unique S/N they won't find it in their database and it will be suspicious, so i'll better find genuine one.

 

I'm using SmUUID value generated with "uuidgen" command in terminal. Can i replace only last 12 characters for my wifi card MAC adress (just to be clear - if i'm using wifi card i copy its MAC, not this from ethernet module)?

Share this post


Link to post
Share on other sites

 

Procedure to activate

  1. Set the ROM as your 12 character ethernet MAC address
  2. Put MLB & ROM in RtVariables/config.plist, keep everything else the same including current system serial and SMBIOS
  3. Disconnect from internet
  4. Reboot computer and run iMessage debug to confirm MLB/ROM values are persistent
  5. Reconnect internet
  6. Login to iMessage ---> will most likely get Customer code if you haven't accidently created someone's real MLB/ROM
  7. Call Apple Support saying you have a problem with your Apple ID while logging in to iMessage
  8. Cross fingers that they fix it :)!

 

@Majkwin, please READ the previous post before asking. The proper place to enter MLB and ROM in Clover's config.plist is RtVariables.

 

However, from the the link I provided about MLB/ROM combination:

 

"if you omit to specify them in RtVariables, Clover automatically injects MLB from the BoardSerialNumber entry and ROM from the last 12 characters of the SmUUID entry"

 

I also stated that ROM is a MAC address.  In fact on the examples I have seen, in genuine Macs, it is often the firewire MAC address with 2 middle bytes removed.

 

Why don't you try @holyfield's utility Apple MAC Hack from the first post, since it claims to generate correctly formatted Apple ROM/MAC addresses and report back?  I haven't used it personally though....

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By Hectorsky
      Hello InsanelyMac users,
       
      I'm constantly getting into troubles with iMessage & FaceTime on my Hackintosh.
      When I'm trying to activate iMessage on my hackintosh I'm getting message to contact apple with a customer code.
      Registration failed for <private> (Error: 31) My build is based on Lenovo ThinkCentre M83 MT which specifications is:
       
      CPU: Intel Core i7-4770
      MB: Lenovo SHARKBAY (Intel Q85)
      AD: Realtek 662v2
      LAN: Intel I217-LM
      BL: Clover 5070
      Native NVRAM
       
      My SMBIOS seems be properly generated for iMac14,2
      I've used macserial to generate serial numbers and MLB.
       
      For RTVariables I've use MacAddr0 of my LAN Card.
       
       
      Maybe someone else haves idea which thing can cause these errors?
       
    • By fusion71au
      Clover r5051 ISO compiled with GCC and minimal config.plist compatible for use in VMWare Workstation.
       
      Tested with unlocked Workstation 15 running OSX 10.9 -->10.15 guest in Windows X64 host.
       
      Installation
      1. Download and unzip "EFI_Clover_r5051 for VMware.zip". Mount Clover-v2.5k-5051-X64.iso by double clicking on it.
      2. Mount your VM's EFI System Partition eg in terminal
      sudo diskutil mount disk0s1   3. Copy EFI folder from step 1 into the EFI partition
      4. Shutdown the VM, add bios.bootDelay = "3000" to your VM's vmx file
      5. Reboot your VM, press <F2> to access the VMware Boot Manager and add CLOVERX64.efi to the boot menu.
       
      Substitute your own unique and valid MLB and ROM variables in the /EFI/CLOVER/config.plist (Rt Variables section) to activate iMessage/Facetime on your VM.
    • By Installus
      Hello all!
       
      I have successfully got my Hackbook online, using USB tethering. Thanks to Herve (can't use special characters, you know who you are!), I also got my audio working.
       
      I am very much ready to begin setting up iCloud, the App Store, and iMessage/FaceTime. Those services (especially the latter two) are what got me into hackintoshing.
       
      Problem: The listed services fail to sign me in. iCloud sign in from System Preferences returns "Unable to sign in because of a problem communicating with iCloud."
      FaceTime returns a registration process fail, the App Store reports that my computer can't be verified, and iMessage reports an activation error. However, iTunes works, except no Apple Music.
       
      HARDWARE:
      Intel Core i7-2630QM
      GeForce GT 525M (using integrated HD 3000 graphics instead)
      Custom Dell L502X A12 BIOS w/ UEFI support
       
      SOFTWARE:
      OS X Mavericks 10.9.5
      AppleALC + VoodooHDA for audio
      VoodooPS2Controller (trackpad kext likes to cause KP during boot, sometimes)
       
      Any possible fixes for this?
      Thanks in Advance!
       
      Installus.
×