Jump to content

How to enable iMessage

5 posts in this topic

Recommended Posts

Hello guys.

The user @fusion71au gave me the necessary information and appropriate sources for create this guide, in fact these posts already exist, what I did was just to gather them to become a topic.

Then give all the credit to him.


MLB & ROM explained.



  • MLB is the “Main Logic Board” serial number of a Mac and is 17 characters long for current models.  Older Macs can have shorter MLBs eg Mid 2010 MBP 6,2 has 13 character MLB and is still valid.
  • ROM corresponds to the Mac’s firewire MAC address (with two middle bytes removed if present - confirmed for Late 2012 Mac Mini, Mid 2010 MBP 6,2), or its the ethernet mac address ——>12 characters long.  The first 6 characters are a generic "Apple" prefix code, while the last 6 characters are unique to the system.
  • On a real Mac, both variables are stored in the machine's firmware NVRAM (non volatile RAM) and work as a pair.
  • The MLB value on a real Mac has no direct relation to its System Serial . The old method of generating an MLB - adding 5 random characters to the 12 character system serial - is wrong and fails Apple's recent syntax checking ---> iMessage login failure (mid Nov 2014)

Share this post

Link to post
Share on other sites

Mac Cloning Procedure


Clover Users

I ran the attached tool on my Mac mini and used the values from the mini in the config.plist of my hack (easiest to edit config.plist with Clover Configurator):

  • IOPlatformSerialNumber---->Enter 12 character SerialNumber key in SMBIOS section of config.plist
  • IOPlatformUUID ----> Enter SmUUID key in SMBIOS section (32 characters separated by dashes ie XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX).  The System-ID of the Mac is related to its IOPlatformUUID and infact used to calculate IOPlatformUUID through some hashing process (but the two values are never the same).  To find its value, type in terminal: ioreg -l -p IODeviceTree | grep \"system-id.  So System-ID ----> Enter CustomUUID key in SystemParameters section (32 characters separated by dashes ie XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX).  Also set InjectSystemID to true in the config.plist.
  • ROM: ----> Enter 12 character ROM key in RtVariables section of config.plist (12 characters without the space).
  • MLB: XXXXXXXXXXXXXXXXX ----> Enter 17 character MLB in RtVariables section and also in BoardSerialNumber SMBIOS key

For Illustration Purposes Only (Serials below are fake)

1.  On your Mac, run the imessage_debug tool by double clicking on it and record the outputs eg copy & paste to text file, say imessage_debug.txt....

Last login: Sun Jul 20 17:46:04 on console
Macintosh:~ xxxxxxx$ /Users/xxxxxxx/Downloads/imessage_debug ; exit;
2014-07-20 17:53:27.769 imessage_debug[2168:507] Gq3489ugfi: <d8c15ff0 e78ee640 3706e44d fe02bcde 8d>
2014-07-20 17:53:27.771 imessage_debug[2168:507] Fyp98tpgj: <f55f3cfc 3b3a06b8 c36c8e3f 4585dd39 e1>
2014-07-20 17:53:27.772 imessage_debug[2168:507] kbjfrfpoJU: <b564e0c3 49a48929 eba1c85f d18faf47 b9>
2014-07-20 17:53:27.772 imessage_debug[2168:507] IOPlatformSerialNumber: CK129U13DB67
2014-07-20 17:53:27.773 imessage_debug[2168:507] IOPlatformUUID: 24A86654-2EBB-5998-A85E-266C65CD7005
2014-07-20 17:53:27.773 imessage_debug[2168:507] board-id: Mac-F2238BAE
2014-07-20 17:53:27.774 imessage_debug[2168:507] product-name: iMac11,3
2014-07-20 17:53:27.774 imessage_debug[2168:507] 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM: <61d67611 29f2>
2014-07-20 17:53:27.775 imessage_debug[2168:507] 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:MLB: CK148614DB6F940D2
2014-07-20 17:53:27.775 imessage_debug[2168:507] oycqAZloTNDm: <88d06b7b 2d2161b4 5715fe5a 3a952de4 4b>
2014-07-20 17:53:27.776 imessage_debug[2168:507] abKPld1EcMni: <130d938e 2277b7bc 01f04dd8 e25ce8e0 28>

[Process completed]

2.  Also open up OSX terminal & run the command below to determine the system-id of your Mac....

Macintosh:~ xxxxxxx$ ioreg -l -p IODeviceTree | grep \"system-id
| "system-id" = <a8dd17a0cf104323984129a9f08c1d49>

Again, copy and paste the output to a text file eg imessage_debug.txt

3.  On your hack, open Clover's config.plist with Clover Configurator and enter the serials you obtained in steps 1 & 2 into the corresponding SMBIOS, Rt Variables & System Parameters sections....







4.  After rebooting your hackintosh, run the debug tool again and confirm the MLB, ROM, IOPlatformUUID, IOPlatformSerialNumber are identical to your Mac's. In my case, the hack even shows as a Mac mini (late 2012) in 'About this Mac' despite using an iMac SMBIOS  :hysterical: ....




Chameleon Users with FileNVRAM

You can change your MLB and ROM using terminal commands.  In the above example, we want to set ROM=61d6761129f2 & MLB=CK148614DB6F940D2, so type the following....

sudo nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM=%61%d6%76%11%29%f2

sudo nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:MLB=CK148614DB6F940D2

Note ROM is represented as: %%%...

and not as sudo nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM=61d6761129f2


The other serials are entered into your SMBIOS.plist:

IOPlatformSerialNumber---->Enter 12 character SMserial key and SMchassisserial key

System-ID ----> Enter SMsystemuuid key (32 characters separated by dashes ie XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX)


Sample SMBIOS.plist using Serials from iMessage_debug

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">


Share this post

Link to post
Share on other sites

How to Generate a synthetic 13 character MLB
It's comprised of 13 characters with the format


  • PP = Manufacturing location ID = W8
  • Y = Year of manufacturing =  2009
  • WW = Week of manufacture (01-52) Say 26
  • SSSS = Production number, within this week.  Say it is 41 066 decimal converted to Base-36 = 0VOQ
  • CCCC = ID-Model of hardware part = 6GCA

So our made up MBP 5,5 MLB serial number is W89260VOQ6GCA.  You can obviously change WW and SSSS to other values so that the MLB is unique...
Procedure to activate

  • Set the ROM as your 12 character ethernet MAC address.  To make it more "genuine", replace the first 6 characters with an "Apple Prefix" code.
  • Put MLB & ROM in RtVariables/config.plist, keep everything else the same including current system serial and SMBIOS
  • Disconnect from internet
  • Reboot computer and run iMessage debug to confirm MLB/ROM values are persistent
  • Reconnect internet
  • Login to iMessage ---> will most likely get Customer code if you haven't accidently created someone's real MLB/ROM
  • Call Apple Support saying you have a problem with your Apple ID while logging in to iMessage
  • Cross fingers that they fix it     :)!

Other examples:
Google for sellers of Mac parts or "Mac Logic Board Model No" (model no is usually in format AXXXX).  I have found that CCCC is often the EEE code followed by the letter A eg for MacPro 3,1, EEE = XDA, CCCC = XDAA.
MacPro 3,1
PP=J5, Year=2008, Week=17, Production No=6506 (decimal)=050Q (Base36), CCCC=XDAA ---> J5817050QXDAA
MacPro 4,1
PP=J5, Year=2009, Week=47, Production No=32075 (decimal)=0OQZ (Base36), CCCC=BXZA ---> J59470OQZBXZA
MacPro 5,1
PP=J5, Year=2010, Week=33, Production No=5802 (decimal)=04H6 (Base36), CCCC=BH8A ---> J503304H6BH8A
iMac 10,1 27 inch
PP=W8, Year=2009, Week=49, Production No=8512 (decimal)=06KG (Base36), CCCC=BZRA ---> W894906KGBZRA
iMac 11,1 27 inch
PP=W8, Year=2010, Week=15, Production No=11303 (decimal)=08PZ (Base36), CCCC=BA1A ---> W801508PZBA1A

Share this post

Link to post
Share on other sites

How to Extract MLB/ROM from older Macs running OSX Lion or Snow Leopard


A few of you may have older Macs running Snow Leopard or Lion that have been "retired" from service.  

These make good candidates for borrowing their MLB and ROM for the purpose of activating iMessage on your own hacks.


  • iMessage was introduced in "beta" phase on OSX Lion and only officially supported from Mountain Lion onwards
  • Older Macs had shorter MLBs eg MBP 6,2 has 13 character MLB (still 12 character ROM)
  • Macs as old as a 2006 MBP 2,2 have been used for MLB/ROM to validate iMessage
  • ElNono_'s iMessage_debug tool only works on systems running Mountain Lion or later so how to extract MLB/ROM without upgrading to ML or later?

On Lion, MLB and ROM were introduced as NVRAM variables so can be extracted from your real Mac's NVRAM using Darwin Dumper by @BlackOSX:

Run Darwin Dumper and tick the following dumps - DMI Tables (SMBIOS), I/O Kit RegistryNVRAM.  Make sure that "Make Dumps Private" is unticked.



The following are EXAMPLES only from my hack using GENERATED serials but give you an idea on what to look for on a real Mac....

under the section NVRAM/uefi_firmware_vars/4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM &


000000: 34 4f c0 d5 6c 38                                |..&T.n|

000000: 43 4b 39 34 38 34 32 37 31 47 30 31 32   |CK9484271G012|

On Snow Leopard, MLB and ROM don't exist in NVRAM so the values must be extracted from the DMI Tables and I/O Kit Registry...

MLB=Main Logic Board Serial Number found in the section DMI Tables/DMI type 2: Base Board/Serial Number
Handle 0x0200, DMI type 2, 16 bytes
0000: 02 10 00 02 01 02 03 04 05 09 06 00 03 0a 00 00

Base Board Information
    Manufacturer: Apple Computer, Inc.
    Product Name: Mac-F42D86C8
    Version: MacBookPro5,1
    Serial Number: CK9484271G012
    Asset Tag:           
        Board is a hosting board
        Board is replaceable
    Location In Chassis: Part Component
    Chassis Handle: 0x0300
    Type: Motherboard
    Contained Object Handles: 0

In the section IORegistry/IOService:
ROM=Firewire IOMACAddress (format xxxxxxyyyyxxxxxx) 8 bytes with the middle 2 bytes removed to leave 6 byte/12 character serial: xxxxxxxxxxxx

eg search for "Firewire"



fw IOMACAddress = 344fc00035d56c38
ROM = 344fc0d56c38


or on other Macs, ROM is sometimes reported as the Ethernet IOMACAddress so in this case, search for "Ethernet".


You can also determine the MAC addresses of all your Mac's network interfaces by running the following command in OSX terminal:

networksetup -listallhardwareports

Alternative if DDumper doesn't work:  procedure from post#171:

1.  Boot your Mac in single user verbose mode (Command-S) with a Mavericks or Yosemite Installer USB created with "createinstallmedia" method

2.  After the white text has finished scrolling type the following lines (pressing after each)

/sbin/fsck -fy
/sbin/mount -uw /
nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:MLB
nvram 4D1EDE05-38C7-4A6A-9CC6-4BCCA8B38C14:ROM 

3.  Record the output.  Note the ROM value shown with the NVRAM command can be a mix of HEX and ASCII:

'%xx' values are HEX-Values, the other characters have to be converted from ASCII to HEX to get the right ROM value.

Share this post

Link to post
Share on other sites

Precautions for sharing MLB/ROM after Apple's introduction of system-id blocking



  • Consider generating unique MLB/ROM (with correct pattern/format) for your hacks and registering them by calling Apple Support
  • Cloning a Mac's MLB/ROM for your hack should only be done if you own the Mac whose MLB/ROM you are intending to use. Ideally, take MLB/ROM from an older Mac that has been “retired” from service
  • If you want to continue with cloned values on your hack, its prudent to take extra precautions to protect the "donor" Mac IDs from blacklisting caused by mismatches on your hack
  • Never share MLB/ROM values publicly
  • Try not to have more than one machine connected to the internet and logged into iMessage/FT at the same time (using the same MLB/ROM). If you want to connect both hack and Mac to the internet at the same time, make sure to logout of iMessage/FT on one of them.
  • To prevent Apple flagging ID mismatches, make the cloned system match the original Mac more closely - at a minimum, MLB/ROM & system-id.

1. Run imessage_debug V2 on the real Mac to obtain system-id, MLB, ROM etc
2. Logout of iMessage & iCloud on hack
3. Disconnect from internet
4. Edit config.plist on hack so at a minimum you have matching the real Mac
     * MLB in RtVariables/config.plist
     * ROM in RtVariables/config.plist
     * CustomUUID in System Parameters/config.plist = System-ID of Mac, set inject system-id to true.
     * If cautious, change board-id and system serial in SMBIOS/config.plist to real Mac's value also

Note: changing ProductName/Mac Model to a different SMBIOS (eg to the same as the original Mac) may affect power management/sleep and other functions on the hack.


5. Run imessage_debug V2 on the hack to confirm new values
6. Reconnect internet
7. Login to iMessage and iCloud on hack

Finally, if your Mac's MLB/ROM is blacklisted, there is no need to panic if you are its rightful owner. Contact Apple Support - that is what they are there for   :).

Share this post

Link to post
Share on other sites
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By Hectorsky
      Hello InsanelyMac users,
      I'm constantly getting into troubles with iMessage & FaceTime on my Hackintosh.
      When I'm trying to activate iMessage on my hackintosh I'm getting message to contact apple with a customer code.
      Registration failed for <private> (Error: 31) My build is based on Lenovo ThinkCentre M83 MT which specifications is:
      CPU: Intel Core i7-4770
      MB: Lenovo SHARKBAY (Intel Q85)
      AD: Realtek 662v2
      LAN: Intel I217-LM
      BL: Clover 5070
      Native NVRAM
      My SMBIOS seems be properly generated for iMac14,2
      I've used macserial to generate serial numbers and MLB.
      For RTVariables I've use MacAddr0 of my LAN Card.
      Maybe someone else haves idea which thing can cause these errors?
    • By fusion71au
      Clover r5051 ISO compiled with GCC and minimal config.plist compatible for use in VMWare Workstation.
      Tested with unlocked Workstation 15 running OSX 10.9 -->10.15 guest in Windows X64 host.
      1. Download and unzip "EFI_Clover_r5051 for VMware.zip". Mount Clover-v2.5k-5051-X64.iso by double clicking on it.
      2. Mount your VM's EFI System Partition eg in terminal
      sudo diskutil mount disk0s1   3. Copy EFI folder from step 1 into the EFI partition
      4. Shutdown the VM, add bios.bootDelay = "3000" to your VM's vmx file
      5. Reboot your VM, press <F2> to access the VMware Boot Manager and add CLOVERX64.efi to the boot menu.
      Substitute your own unique and valid MLB and ROM variables in the /EFI/CLOVER/config.plist (Rt Variables section) to activate iMessage/Facetime on your VM.
    • By Installus
      Hello all!
      I have successfully got my Hackbook online, using USB tethering. Thanks to Herve (can't use special characters, you know who you are!), I also got my audio working.
      I am very much ready to begin setting up iCloud, the App Store, and iMessage/FaceTime. Those services (especially the latter two) are what got me into hackintoshing.
      Problem: The listed services fail to sign me in. iCloud sign in from System Preferences returns "Unable to sign in because of a problem communicating with iCloud."
      FaceTime returns a registration process fail, the App Store reports that my computer can't be verified, and iMessage reports an activation error. However, iTunes works, except no Apple Music.
      Intel Core i7-2630QM
      GeForce GT 525M (using integrated HD 3000 graphics instead)
      Custom Dell L502X A12 BIOS w/ UEFI support
      OS X Mavericks 10.9.5
      AppleALC + VoodooHDA for audio
      VoodooPS2Controller (trackpad kext likes to cause KP during boot, sometimes)
      Any possible fixes for this?
      Thanks in Advance!
    • By Allan
      Hello guys!
      Here's how you can add a signature in your profile.
      Follow the rules.
      Signatures, Avatars and Nicks
      Keep your signature/avatar clean and tidy - should you receive a PM from the staff regarding your signature/avatar, please make the requested alterations or it may be removed/shortened appropriately.
      To keep pages loading fast for everyone, we request that your signatures and avatars contain no animations or high-definition graphics of any kind.
      Signatures should be no more than 6 lines of text using a regular font. If you can't fit all of your system specs in that you'd like, why not create a small graphic to contain the information?
    • By Allan
      Hey guys, how are you?
      @MaLd0n and I was doing some tests with iMessage.
      And for most impossible that it seems, now we can use it without worries with MLB, ROM and specific SN. Look...
      MaLd0n 2018-10-26 às 12.15.59.mov
      But who can made this possible?
      Clover VirtualSMC Apple??