Jump to content

How to enable iMessage

5 posts in this topic

Recommended Posts

Hello guys.

The user @fusion71au gave me the necessary information and appropriate sources for create this guide, in fact these posts already exist, what I did was just to gather them to become a topic.

Then give all the credit to him.


MLB & ROM explained.



  • MLB is the “Main Logic Board” serial number of a Mac and is 17 characters long for current models.  Older Macs can have shorter MLBs eg Mid 2010 MBP 6,2 has 13 character MLB and is still valid.
  • ROM corresponds to the Mac’s firewire MAC address (with two middle bytes removed if present - confirmed for Late 2012 Mac Mini, Mid 2010 MBP 6,2), or its the ethernet mac address ——>12 characters long.  The first 6 characters are a generic "Apple" prefix code, while the last 6 characters are unique to the system.
  • On a real Mac, both variables are stored in the machine's firmware NVRAM (non volatile RAM) and work as a pair.
  • The MLB value on a real Mac has no direct relation to its System Serial . The old method of generating an MLB - adding 5 random characters to the 12 character system serial - is wrong and fails Apple's recent syntax checking ---> iMessage login failure (mid Nov 2014)

Mac Cloning Procedure


Clover Users

I ran the attached tool on my Mac mini and used the values from the mini in the config.plist of my hack (easiest to edit config.plist with Clover Configurator):

  • IOPlatformSerialNumber---->Enter 12 character SerialNumber key in SMBIOS section of config.plist
  • IOPlatformUUID ----> Enter SmUUID key in SMBIOS section (32 characters separated by dashes ie XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX).  The System-ID of the Mac is related to its IOPlatformUUID and infact used to calculate IOPlatformUUID through some hashing process (but the two values are never the same).  To find its value, type in terminal: ioreg -l -p IODeviceTree | grep \"system-id.  So System-ID ----> Enter CustomUUID key in SystemParameters section (32 characters separated by dashes ie XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX).  Also set InjectSystemID to true in the config.plist.
  • ROM: ----> Enter 12 character ROM key in RtVariables section of config.plist (12 characters without the space).
  • MLB: XXXXXXXXXXXXXXXXX ----> Enter 17 character MLB in RtVariables section and also in BoardSerialNumber SMBIOS key

For Illustration Purposes Only (Serials below are fake)

1.  On your Mac, run the imessage_debug tool by double clicking on it and record the outputs eg copy & paste to text file, say imessage_debug.txt....

Last login: Sun Jul 20 17:46:04 on console
Macintosh:~ xxxxxxx$ /Users/xxxxxxx/Downloads/imessage_debug ; exit;
2014-07-20 17:53:27.769 imessage_debug[2168:507] Gq3489ugfi: <d8c15ff0 e78ee640 3706e44d fe02bcde 8d>
2014-07-20 17:53:27.771 imessage_debug[2168:507] Fyp98tpgj: <f55f3cfc 3b3a06b8 c36c8e3f 4585dd39 e1>
2014-07-20 17:53:27.772 imessage_debug[2168:507] kbjfrfpoJU: <b564e0c3 49a48929 eba1c85f d18faf47 b9>
2014-07-20 17:53:27.772 imessage_debug[2168:507] IOPlatformSerialNumber: CK129U13DB67
2014-07-20 17:53:27.773 imessage_debug[2168:507] IOPlatformUUID: 24A86654-2EBB-5998-A85E-266C65CD7005
2014-07-20 17:53:27.773 imessage_debug[2168:507] board-id: Mac-F2238BAE
2014-07-20 17:53:27.774 imessage_debug[2168:507] product-name: iMac11,3
2014-07-20 17:53:27.774 imessage_debug[2168:507] 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM: <61d67611 29f2>
2014-07-20 17:53:27.775 imessage_debug[2168:507] 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:MLB: CK148614DB6F940D2
2014-07-20 17:53:27.775 imessage_debug[2168:507] oycqAZloTNDm: <88d06b7b 2d2161b4 5715fe5a 3a952de4 4b>
2014-07-20 17:53:27.776 imessage_debug[2168:507] abKPld1EcMni: <130d938e 2277b7bc 01f04dd8 e25ce8e0 28>

[Process completed]

2.  Also open up OSX terminal & run the command below to determine the system-id of your Mac....

Macintosh:~ xxxxxxx$ ioreg -l -p IODeviceTree | grep \"system-id
| "system-id" = <a8dd17a0cf104323984129a9f08c1d49>

Again, copy and paste the output to a text file eg imessage_debug.txt

3.  On your hack, open Clover's config.plist with Clover Configurator and enter the serials you obtained in steps 1 & 2 into the corresponding SMBIOS, Rt Variables & System Parameters sections....







4.  After rebooting your hackintosh, run the debug tool again and confirm the MLB, ROM, IOPlatformUUID, IOPlatformSerialNumber are identical to your Mac's. In my case, the hack even shows as a Mac mini (late 2012) in 'About this Mac' despite using an iMac SMBIOS  :hysterical: ....




Chameleon Users with FileNVRAM

You can change your MLB and ROM using terminal commands.  In the above example, we want to set ROM=61d6761129f2 & MLB=CK148614DB6F940D2, so type the following....

sudo nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM=%61%d6%76%11%29%f2

sudo nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:MLB=CK148614DB6F940D2

Note ROM is represented as: %%%...

and not as sudo nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM=61d6761129f2


The other serials are entered into your SMBIOS.plist:

IOPlatformSerialNumber---->Enter 12 character SMserial key and SMchassisserial key

System-ID ----> Enter SMsystemuuid key (32 characters separated by dashes ie XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)


Sample SMBIOS.plist using Serials from iMessage_debug

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">


How to Generate a synthetic 13 character MLB
It's comprised of 13 characters with the format


  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • SSSS = Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • CCCC = ID-Model of hardware part = 6GCA

So our made up MBP 5,5 MLB serial number is W89260VOQ6GCA.  You can obviously change WW and SSSS to other values so that the MLB is unique...
Procedure to activate

  • Set the ROM as your 12 character ethernet MAC address.  To make it more "genuine", replace the first 6 characters with an "Apple Prefix" code.
  • Put MLB & ROM in RtVariables/config.plist, keep everything else the same including current system serial and SMBIOS
  • Disconnect from internet
  • Reboot computer and run iMessage debug to confirm MLB/ROM values are persistent
  • Reconnect internet
  • Login to iMessage ---> will most likely get Customer code if you haven't accidently created someone's real MLB/ROM
  • Call Apple Support saying you have a problem with your Apple ID while logging in to iMessage
  • Cross fingers that they fix it     :)!

Other examples:
Google for sellers of Mac parts or "Mac Logic Board Model No" (model no is usually in format AXXXX).  I have found that CCCC is often the EEE code followed by the letter A eg for MacPro 3,1, EEE = XDA, CCCC = XDAA.
MacPro 3,1
PP=J5, Year=2008, Week=17, Production No=6506 (decimal)=050Q (Base36), CCCC=XDAA ---> J5817050QXDAA
MacPro 4,1
PP=J5, Year=2009, Week=47, Production No=32075 (decimal)=0OQZ (Base36), CCCC=BXZA ---> J59470OQZBXZA
MacPro 5,1
PP=J5, Year=2010, Week=33, Production No=5802 (decimal)=04H6 (Base36), CCCC=BH8A ---> J503304H6BH8A
iMac 10,1 27 inch
PP=W8, Year=2009, Week=49, Production No=8512 (decimal)=06KG (Base36), CCCC=BZRA ---> W894906KGBZRA
iMac 11,1 27 inch
PP=W8, Year=2010, Week=15, Production No=11303 (decimal)=08PZ (Base36), CCCC=BA1A ---> W801508PZBA1A

How to Extract MLB/ROM from older Macs running OSX Lion or Snow Leopard


A few of you may have older Macs running Snow Leopard or Lion that have been "retired" from service.  

These make good candidates for borrowing their MLB and ROM for the purpose of activating iMessage on your own hacks.


  • iMessage was introduced in "beta" phase on OSX Lion and only officially supported from Mountain Lion onwards
  • Older Macs had shorter MLBs eg MBP 6,2 has 13 character MLB (still 12 character ROM)
  • Macs as old as a 2006 MBP 2,2 have been used for MLB/ROM to validate iMessage
  • ElNono_'s iMessage_debug tool only works on systems running Mountain Lion or later so how to extract MLB/ROM without upgrading to ML or later?

On Lion, MLB and ROM were introduced as NVRAM variables so can be extracted from your real Mac's NVRAM using Darwin Dumper by @BlackOSX:

Run Darwin Dumper and tick the following dumps - DMI Tables (SMBIOS), I/O Kit RegistryNVRAM.  Make sure that "Make Dumps Private" is unticked.



The following are EXAMPLES only from my hack using GENERATED serials but give you an idea on what to look for on a real Mac....

under the section NVRAM/uefi_firmware_vars/4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM &


000000: 34 4f c0 d5 6c 38                                |..&T.n|

000000: 43 4b 39 34 38 34 32 37 31 47 30 31 32   |CK9484271G012|

On Snow Leopard, MLB and ROM don't exist in NVRAM so the values must be extracted from the DMI Tables and I/O Kit Registry...

MLB=Main Logic Board Serial Number found in the section DMI Tables/DMI type 2: Base Board/Serial Number
Handle 0x0200, DMI type 2, 16 bytes
0000: 02 10 00 02 01 02 03 04 05 09 06 00 03 0a 00 00

Base Board Information
    Manufacturer: Apple Computer, Inc.
    Product Name: Mac-F42D86C8
    Version: MacBookPro5,1
    Serial Number: CK9484271G012
    Asset Tag:           
        Board is a hosting board
        Board is replaceable
    Location In Chassis: Part Component
    Chassis Handle: 0x0300
    Type: Motherboard
    Contained Object Handles: 0

In the section IORegistry/IOService:
ROM=Firewire IOMACAddress (format xxxxxxyyyyxxxxxx) 8 bytes with the middle 2 bytes removed to leave 6 byte/12 character serial: xxxxxxxxxxxx

eg search for "Firewire"



fw IOMACAddress = 344fc00035d56c38
ROM = 344fc0d56c38


or on other Macs, ROM is sometimes reported as the Ethernet IOMACAddress so in this case, search for "Ethernet".


You can also determine the MAC addresses of all your Mac's network interfaces by running the following command in OSX terminal:

networksetup -listallhardwareports

Alternative if DDumper doesn't work:  procedure from post#171:

1.  Boot your Mac in single user verbose mode (Command-S) with a Mavericks or Yosemite Installer USB created with "createinstallmedia" method

2.  After the white text has finished scrolling type the following lines (pressing after each)

/sbin/fsck -fy
/sbin/mount -uw /
nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:MLB
nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM 

3.  Record the output.  Note the ROM value shown with the NVRAM command can be a mix of HEX and ASCII:

'%xx' values are HEX-Values, the other characters have to be converted from ASCII to HEX to get the right ROM value.

Precautions for sharing MLB/ROM after Apple's introduction of system-id blocking



  • Consider generating unique MLB/ROM (with correct pattern/format) for your hacks and registering them by calling Apple Support
  • Cloning a Mac's MLB/ROM for your hack should only be done if you own the Mac whose MLB/ROM you are intending to use. Ideally, take MLB/ROM from an older Mac that has been “retired” from service
  • If you want to continue with cloned values on your hack, its prudent to take extra precautions to protect the "donor" Mac IDs from blacklisting caused by mismatches on your hack
  • Never share MLB/ROM values publicly
  • Try not to have more than one machine connected to the internet and logged into iMessage/FT at the same time (using the same MLB/ROM). If you want to connect both hack and Mac to the internet at the same time, make sure to logout of iMessage/FT on one of them.
  • To prevent Apple flagging ID mismatches, make the cloned system match the original Mac more closely - at a minimum, MLB/ROM & system-id.

1. Run imessage_debug V2 on the real Mac to obtain system-id, MLB, ROM etc
2. Logout of iMessage & iCloud on hack
3. Disconnect from internet
4. Edit config.plist on hack so at a minimum you have matching the real Mac
     * MLB in RtVariables/config.plist
     * ROM in RtVariables/config.plist
     * CustomUUID in System Parameters/config.plist = System-ID of Mac, set inject system-id to true.
     * If cautious, change board-id and system serial in SMBIOS/config.plist to real Mac's value also

Note: changing ProductName/Mac Model to a different SMBIOS (eg to the same as the original Mac) may affect power management/sleep and other functions on the hack.


5. Run imessage_debug V2 on the hack to confirm new values
6. Reconnect internet
7. Login to iMessage and iCloud on hack

Finally, if your Mac's MLB/ROM is blacklisted, there is no need to panic if you are its rightful owner. Contact Apple Support - that is what they are there for   :).

  • Allan locked this topic
This topic is now closed to further replies.
  • Create New...