Jump to content

Pattern of MLB (Main Logic Board)

holyfield

By holyfield,
in Tutorials (The Genius Bar)

 Share
573 posts in this topic

Recommended Posts

Alien::X
Alien::X
Posted
Posted

 

I've gotten hold of a real MLB (from a 13 inch MBP 5,5 Mid 2009) to give you an example of how to generate a synthetic MLB using its component parts :).

 

It's comprised of 13 characters with the format

PPYWWSSSSCCCC

  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • ID - Model of hardware part = 6GCA

 

to many confusion here, what they changed in 17 char ?

Link to comment
Share on other sites
fusion71au
fusion71au
Posted
Posted

@Allan,

 

BoardSerialNumber is the same as MLB so if you already have the value specified in the SMBIOS section, it is not necessary to also place it in the RtVariables section.  However, if the value placed in SMBIOS is different to the value placed in RtVariables, Clover will inject the MLB value from RtVariables (it gives preference to the RtVariables value).

 

@Hanger1,

 

The pattern of the 13 character MLB (from older Macs) is better understood than the newer 17 character MLB from current Macs and appears to have less stringent syntax checking. 

 

Some users in Voldemort's forum have reported success with activating iMessage/FT using synthetic/fake 13 character MLBs and calling Apple Support with the customer error code to register them on Apple's whitelist.

 

AFAIK, no-one has completely figured out the 17 character MLB pattern to create synthetic/fake 17 character MLBs that pass the newer syntax check introduced by Apple after mid Nov 2014.  As an experiment, someone could try the genuine MLB from post#55, change the WW or NBR value slightly (refer Pike's post #205) ---> see if they get a customer code and register the new "fake" MLB by calling Apple Support....

  • Like 2
Link to comment
Share on other sites
Allan
Allan
Posted
Posted

@Allan,

 

BoardSerialNumber is the same as MLB so if you already have the value specified in the SMBIOS section, it is not necessary to also place it in the RtVariables section.  However, if the value placed in SMBIOS is different to the value placed in RtVariables, Clover will inject the MLB value from RtVariables (it gives preference to the RtVariables value).

 

Perfect!

 

Thanks man!

Link to comment
Share on other sites
Allan
Allan
Posted
Posted

Hey Guys!

 

Finally, my iMessage are working!!  :thumbsup_anim:

 

DGc.png

 

I used my old ROM (Chameleon times) and i create one MLB following @fusion71au's tip.

 

MLB: 13 character.

 

EDIT: I called for Apple Support, and my Apple ID is enabled now.

EDIT2: Thank you very much fusion71au and holyfield you are a genius guys!


And FaceTime is also working!  B)

  • Like 4
Link to comment
Share on other sites
Majkwin
Majkwin
Posted
Posted

 

I've gotten hold of a real MLB (from a 13 inch MBP 5,5 Mid 2009) to give you an example of how to generate a synthetic MLB using its component parts :).

 

It's comprised of 13 characters with the format

PPYWWSSSSCCCC

  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • ID - Model of hardware part = 6GCA

So our made up MBP 5,5 MLB serial number is W89260VOQ6GCA.  You can obviously change WW and SSSS to other values if you like...

 

Procedure to activate

  1. Set the ROM as your 12 character ethernet MAC address
  2. Put MLB & ROM in RtVariables/config.plist, keep everything else the same including current system serial and SMBIOS
  3. Disconnect from internet
  4. Reboot computer and run iMessage debug to confirm MLB/ROM values are persistent
  5. Reconnect internet
  6. Login to iMessage ---> will most likely get Customer code if you haven't accidently created someone's real MLB/ROM
  7. Call Apple Support saying you have a problem with your Apple ID while logging in to iMessage
  8. Cross fingers that they fix it :)!

 

I've got couple questions. If I have laptop with i5 CPU, then i should have S/N that indicates machine which had those (ex. macbook pro retina 13 late 2013)? How can I generate proper S/N? Should it be visible on Apple's selfsolve site, or should it be unique number generated in Clover?

Link to comment
Share on other sites
Alien::X
Alien::X
Posted
Posted

@Fusion71au

 

Here we getting already white listed MLB, with already white listed mlb and rom we don't need to call apple

This way will never close for imessage and FaceTime

Last month the calling apple way was closed but now working..... So....

Link to comment
Share on other sites
Pike R. Alpha
Pike R. Alpha
Posted
Posted

I guess we need a new extraction tool :-)

//
// setup rom variable
//
STATIC EFI_STATUS BlpSetupRomVariable()
{
__try
{
//
// ROM = [0xffffff01, 0xffffff07)
//
UINT32 attribute = EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS;
UINT8 romBuffer[6] = {0};
UINTN dataSize = sizeof(romBuffer);
if(EFI_ERROR(EfiRuntimeServices->GetVariable(CHAR16_STRING(L"ROM"), &AppleFirmwareVariableGuid, nullptr, &dataSize, romBuffer)))
EfiRuntimeServices->SetVariable(CHAR16_STRING(L"ROM"), &AppleFirmwareVariableGuid, attribute, sizeof(romBuffer), ArchConvertAddressToPointer(0xffffff01, VOID*));

//
// check MLB
//
UINT8 mlbBuffer[0x80] = {0};
dataSize = sizeof(mlbBuffer);
if(!EFI_ERROR(EfiRuntimeServices->GetVariable(CHAR16_STRING(L"MLB"), &AppleFirmwareVariableGuid, nullptr, &dataSize, mlbBuffer)))
try_leave(NOTHING);

//
// search [0xffffff08, 0xffffff50)
//
UINT8 tempBuffer[0x48];
memset(tempBuffer, 0xff, sizeof(tempBuffer));
EfiBootServices->CopyMem(tempBuffer, ArchConvertAddressToPointer(0xffffff08, VOID*), sizeof(tempBuffer));
for(UINTN i = 0; i < 4; i ++)
{
if(tempBuffer[i * 0x12] == 0xff)
{
if(i)
{
dataSize = 0;
UINT8* mlbBuffer = tempBuffer + i * 0x12 - 0x12;
while(mlbBuffer[dataSize] != ' ')
dataSize += 1;

EfiRuntimeServices->SetVariable(CHAR16_STRING(L"MLB"), &AppleFirmwareVariableGuid, attribute, dataSize, mlbBuffer);
}
break;
}
}
}
__finally
{

}

return EFI_SUCCESS;
}

I mean. We should figure out what data is stored at this location.

  • Like 2
Link to comment
Share on other sites
Beefcat
Beefcat
Posted
Posted

 

I've gotten hold of a real MLB (from a 13 inch MBP 5,5 Mid 2009) to give you an example of how to generate a synthetic MLB using its component parts :).

 

It's comprised of 13 characters with the format

PPYWWSSSSCCCC

  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • ID - Model of hardware part = 6GCA

So our made up MBP 5,5 MLB serial number is W89260VOQ6GCA.  You can obviously change WW and SSSS to other values if you like...

 

Procedure to activate

  1. Set the ROM as your 12 character ethernet MAC address
  2. Put MLB & ROM in RtVariables/config.plist, keep everything else the same including current system serial and SMBIOS
  3. Disconnect from internet
  4. Reboot computer and run iMessage debug to confirm MLB/ROM values are persistent
  5. Reconnect internet
  6. Login to iMessage ---> will most likely get Customer code if you haven't accidently created someone's real MLB/ROM
  7. Call Apple Support saying you have a problem with your Apple ID while logging in to iMessage
  8. Cross fingers that they fix it :)!

 

 

@fusion71au: How do you determine the ID - Model of hardware part = 6GCA

 

Is that the EEE code ?

 

The pattern take 4 characters "CCCC" What do you do when the EEE Code is only 3 character?

 

Thanks

Link to comment
Share on other sites
Beefcat
Beefcat
Posted
Posted

I created a random value model of hardware part = 6GCA i.e = 7VWZ

 

And works  :P 

Thanks Allan, so what you are saying we can manufacture / create any random value for "CCCC" part in the 13 character  MLB?

 

I'm not sure how long this would stick with apple

Link to comment
Share on other sites
Allan
Allan
Posted
Posted

So, i can't confirm for you if exists some rule about this.

 

I follow this steps:

  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • ID - Model of hardware part = 6GCA

​Just the last step i generate a random value.

  • Like 1
Link to comment
Share on other sites
Majkwin
Majkwin
Posted
Posted

@Allan, what about your S/N? Have you change it? Now your MLB indicates, that you have 13 inch MBP 5,5 Mid 2009, but is your S/N visible on selfsolve apple site as 13 inch MBP 5,5 Mid 2009, something else, or is it unique S/N and does't appear at all?

Link to comment
Share on other sites
Allan
Allan
Posted
Posted

My S/N was generated by Champlist.

 

During the call just informed my AppleID, and they unlocked my ID, told me to restart, and...Works!!  :lol:

 

EDIT: But I had already done the steps taken by fusion71au

 

1. I follow the fusion71au's tips.

2. And then I called to Apple.

Link to comment
Share on other sites
fusion71au
fusion71au
Posted
Posted

@Majkwin,

At the risk of sounding like a broken record, iMessage/FT activation is all about the MLB/ROM combination, NOT system serial.    

 

You can use ANY system serial/SMBIOS (whether fake or real) and iMessage will still activate as long as MLB/ROM is registered on Apple's servers and MLB has the correct formatting/syntax.

 

Presently, MLB cross checking is NOT done against system serial or system-id (only against ROM), so it is still possible to use an older MLB/ROM eg MBP 5,5 to activate a hack using a newer SMBIOS and system serial eg MacPro 6,1.

 

How to ring Apple support and answer their questions has already been described in plenty of other iMessage threads...use google to find Voldemort's forum.

 

 

@TomcatDive,

There is no publicly available database for CCCC so I extracted it from a real MBP 5,5 MLB.  It seems that there is less stringent syntax checking with 13 character MLBs as @Allan has proved by making a random value for CCCC :P.

 

We need more people with older Macs (that have 13 character MLBs) to submit their PP & CCCC values if we are to create an automated tool for MLB generation.

 

In the mean time, others can try changing the WW and SSSS variables with the example I already provided to generate their own unique MLBs....

  • Like 2
Link to comment
Share on other sites
Majkwin
Majkwin
Posted
Posted

@fusion71au, thanks - that was a reply, that I was waiting for. Now everything is clear for me. So, if I call apple support and They will be asking for S/N I can give them any number I want and it won't be signed with my account? If I give them my unique S/N they won't find it in their database and it will be suspicious, so i'll better find genuine one.

 

I'm using SmUUID value generated with "uuidgen" command in terminal. Can i replace only last 12 characters for my wifi card MAC adress (just to be clear - if i'm using wifi card i copy its MAC, not this from ethernet module)?

Link to comment
Share on other sites
fusion71au
fusion71au
Posted
Posted

 

Procedure to activate

  1. Set the ROM as your 12 character ethernet MAC address
  2. Put MLB & ROM in RtVariables/config.plist, keep everything else the same including current system serial and SMBIOS
  3. Disconnect from internet
  4. Reboot computer and run iMessage debug to confirm MLB/ROM values are persistent
  5. Reconnect internet
  6. Login to iMessage ---> will most likely get Customer code if you haven't accidently created someone's real MLB/ROM
  7. Call Apple Support saying you have a problem with your Apple ID while logging in to iMessage
  8. Cross fingers that they fix it :)!

 

@Majkwin, please READ the previous post before asking. The proper place to enter MLB and ROM in Clover's config.plist is RtVariables.

 

However, from the the link I provided about MLB/ROM combination:

 

"if you omit to specify them in RtVariables, Clover automatically injects MLB from the BoardSerialNumber entry and ROM from the last 12 characters of the SmUUID entry"

 

I also stated that ROM is a MAC address.  In fact on the examples I have seen, in genuine Macs, it is often the firewire MAC address with 2 middle bytes removed.

 

Why don't you try @holyfield's utility Apple MAC Hack from the first post, since it claims to generate correctly formatted Apple ROM/MAC addresses and report back?  I haven't used it personally though....

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...