Jump to content
Drovosek

Trying using .dfu firmware to enable bluetooth in macOS on "cold" start

5 posts in this topic

Recommended Posts

Spoiler

 

Привет.
У меня есть системный блок Dell Vostro 3267 (i5-6400, Skylake). Информация в подписи.

В этом системном блоке установлен модуль Atheros AR9565 802.11b/g/n Wireless Network Adapter, который, как я понимаю, совмещает в себе Wifi - Atheros AR9565 и Bluetooth - Qualcomm QCA9565.

 

Мне удалось заставить работать Wifi, с помощью кекста от chunnann.

 

Bluetooth работает только если сначала загрузиться в Windows, а потом из нее перезагрузиться в macOS. При этом нужно установить в Windows драйвера для bluetooth с официального сайта Dell, потому что первоначальные драйвера, которые скачала и установила Windows сама - не позволяли работать bluetooth модулю даже в Windows.

В настройках bluetooth была неактивна кнопка выключения и был вечный поиск устройств (если macOS была загружена сразу после запуска ПК). Включение  кнопки выключение я вылечил просто добавив в папку /kexts/Other кекст BrcmBluetoothInjector, прописав внутри него в Info.plist файле соответствующие VendorID и ProductID моего bluetooth (которые отображаются в отчете о системе).

 

Меня разочаровывает то, что Windows умеет во время загрузки автоматически загружать прошивку в bluetooth модуль, а в hackintosh macOS еще не сделали такого кекста.

 

В ходе поисков решения проблемы я наткнулся на вот такие варианты кекста:

IOath3kfrmw (OS-X-Atheros-3k-Firmware)
https://bitbucket.org/RehabMan/os-x-atheros-3k-firmware/downloads/
https://github.com/RehabMan/OS-X-Atheros-3k-Firmware

 

OS-X-BrcmPatchRAM

https://github.com/the-darkvoid/BrcmPatchRAM

https://github.com/RehabMan/OS-X-BrcmPatchRAM

https://bitbucket.org/RehabMan/os-x-brcmpatchram/downloads/

https://bitbucket.org/anonymous_writer/os-x-brcmpatchram-catalina/downloads/

https://github.com/headkaze/OS-X-BrcmPatchRAM

BTFirmwareUploader (как я понял, это улучшенный IOath3kfrmwr)

https://osxlatitude.com/forums/topic/2925-bluetooth-firmware-uploader/

 

И вот такой способ - использовать виртуальную машину для того, чтобы ОС из нее загружала прошивку в bluetooth модуль

https://osxlatitude.com/forums/topic/10127-updated-nov-2017-fix-btfirmwareuploader-in-macos-high-sierra/

 

К сожалению, не один из этих вариантов мне не помог добиться того, чтобы работал bluetooth при "холодном" запуске ПК в macOS.

 

1.

Я начал более подробно читать информацию о кекстах. В кексте BrcmPatchRAM говорится, что можно самому добавить поддержку своего bluetooth модуля в этот кекст. Я скачал драйвера для своего bluetooth с официального сайта и извлек из .exe установщика сами файлы драйвера (Это легко делается с помощью 7-zip в Windows, либо с помощью Keka в macOS). Там было больше файлов .dfu, чем других. Как я выяснил, .dfu файлы это и есть скомпилированные файлы прошивки, которые драйвер загружает в bluetooth модуль. В инструкции к BrcmPatchRAM говорится только о .hex файлах прошивки для Broadcom.
Я начал искать информацию в интернете и узнал, что .hex файлы это исходный "текст" прошивки, а .dfu это скомпилированные .hex файлы.

Я сразу же начал искать конвертеры/декомпиляторы/дизассемблеры из .dfu в .hex, но нашел только то, что из .hex делает .dfu файл:
https://github.com/pjsg/hex2dfu
https://github.com/plietar/dfuse-tool
https://github.com/kuro68k/ihex2dfu

https://github.com/vpelletier/python-dfu

А так же консольные утилиты "dfu-tool" и "dfu-util" в Linux. Я узнал, что dfu-util можно установить в macOS с помощью Homebrew или использовать этот вариант (он отличается по функционалу) https://github.com/the-darkvoid/dfu-util-osx

 

2.

Так же я узнал, что .dfu файлы используются и в macOS в /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources

Я думаю надо попробовать заменить их все на тот файл, который загружает Windows в bluetooth модуль (я думаю если пробовать так делать, то нужно сделать несколько копий этого файла и переименовать его в те оригинальные .dfu файлы, которые будут удалены).

 

3.

Так же есть идея просто мой .dfu файл переименовать в файл .zhx и добавить его в кекст OS-X-BrcmPatchRAM (в BrcmFirmwareRepo.kext). Но есть проблема - во-первых, я не знаю какой из .dfu файлов загружается в мой bluetooth, возможно даже несколько, потому что там 3 файла размером > 40 KB и много файлов размером ~ 2 KB.

 

4.

В "dfu-tool" и "dfu-util" я увидел команды, которые извлекают прошивку из устройства. Может быть можно будет загрузиться в Linux и, если bluetooth начнет там работать, то попробовать извлечь прошивку из bluetooth этими утилитами, а потом уже эту прошивку как-то добавлять в кексты.

 

5.

В файле BTFirmwareUploader.kex/Contents/MacOS/BTFirmwareUploader внутри уже есть какой-то список прошивок, но они в .hex формате. Может быть можно как-то заменить их на содержимое .dfu файлов?

 

Я буду продолжать описывать идеи и результаты экспериментов. Если у вас есть какие-нибудь идеи или вы можете помочь решить эту проблему, то не стесняйтесь - пишите.

 

 

Hello.
I have system unit Dell Vostro 3267 (i5-6400, Skylake). Information in signature.

In this system block module installed Atheros AR9565 802.11 b/g/n Wireless Network Adapter, which, as I understand it, combines Wi-Fi - Atheros AR9565 and Bluetooth Qualcomm QCA9565.

 

I managed to get working Wifi with kext from chunnann.

https://www.insanelymac.com/forum/topic/312045-atheros-wireless-driver-os-x-101112-for-unsupported-cards/?page=17&tab=comments#comment-2509900

https://www.insanelymac.com/forum/topic/328426-qualcomm-atheros-ar9565-wireless-for-os-x-108-1014/

 

Bluetooth works only if you first boot into Windows and then reboot into macOS from it. At the same time, you need to install drivers for bluetooth in Windows from the official Dell website, because the original drivers that Windows downloaded and installed itself - did not allow the bluetooth module to work even in Windows.

In bluetooth settings, the power button was inactive and there was an eternal search for devices (if macOS was loaded immediately after the PC started). Enable button disable I cured just by adding the folder /kexts/Other kext BrcmBluetoothInjector by writing inside it in the Info.the plist file corresponds to the VendorID and ProductID of my bluetooth (which are displayed in the system report). BrcmBluetoothInjector_Mod.kext.zip

 

I am disappointed that Windows is able to automatically download the firmware to the bluetooth module during the download, and Hackintosh macOS has not yet done such a kext.

 

In the search for solutions to the problem I came across here are the options for the text:

 

IOath3kfrmw (OS-X-Atheros-3k-Firmware)
https://bitbucket.org/RehabMan/os-x-atheros-3k-firmware/downloads/
https://github.com/RehabMan/OS-X-Atheros-3k-Firmware

 

OS-X-BrcmPatchRAM

https://github.com/the-darkvoid/BrcmPatchRAM

https://github.com/RehabMan/OS-X-BrcmPatchRAM

https://bitbucket.org/RehabMan/os-x-brcmpatchram/downloads/

https://bitbucket.org/anonymous_writer/os-x-brcmpatchram-catalina/downloads/

https://github.com/headkaze/OS-X-BrcmPatchRAM


BTFirmwareUploader (as I understand it, this is an improved IOath3kfrmwr)

https://osxlatitude.com/forums/topic/2925-bluetooth-firmware-uploader/

And here's a way - to use a virtual machine to the OS from it to download the firmware to the bluetooth module

https://osxlatitude.com/forums/topic/10127-updated-nov-2017-fix-btfirmwareuploader-in-macos-high-sierra/

Unfortunately, not one of these options did not help me to ensure that bluetooth worked when "cold" start the PC in macOS.

 

1.

I started to read more about kexts. In texte BrcmPatchRAM says that it is possible to add support for their bluetooth module in this kext. I downloaded the drivers for my bluetooth from the official site and extracted from .exe installer driver files themselves (This is easily done using 7-zip in Windows or using Keka in macOS). There were more files .dfu than others. As I found out .dfu files are compiled firmware files that the driver loads into the bluetooth module. In the instructions to BrcmPatchRAM States only .hex firmware files for Broadcom.
I started looking for information on the Internet and found out that .hex files are the original "text" of the firmware as well .dfu is compiled .hex files.

I immediately started looking for converters/decompilers/disassemblers from .in dfu .hex, but found only what's out .hex does .dfu file:
https://github.com/pjsg/hex2dfu
https://github.com/plietar/dfuse-tool
https://github.com/kuro68k/ihex2dfu

https://github.com/vpelletier/python-dfu

As well as console utilities "dfu-tool" and "dfu-util" in Linux. I found out that dfu-util can be installed in macOS using Homebrew or use this option (it differs in functionality) https://github.com/the-darkvoid/dfu-util-osx

 

2.

I also learned that .dfu files are used in macOS /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources

I think we should try to replace all of them on that file that Windows loads the bluetooth module (I think if you try to do so, you need to make several copies of this file and rename it to the original ones .dfu files to be deleted).

 

3.

As is the idea is just mine .dfu file rename to file .zhx and add it to the kext OS-X-BrcmPatchRAM (in BrcmFirmwareRepo.kext). But there is a problem - first, I don't know which one .dfu files are downloaded to my bluetooth, maybe even a few, because there are 3 files > 40 KB IN size and a lot of files ~ 2 KB in size.

 

4.

In "dfu-tool" and "dfu-util" I saw commands that extract firmware from the device. Maybe it will be possible to boot into Linux and if bluetooth starts working there, then try to extract the firmware from bluetooth with these utilities, and then add this firmware to kexts somehow.

 

5.

In the file BTFirmwareUploader.kex/Contents/MacOS/BTFirmwareUploader inside already have a list of firmwares, but they are in .hex format. Maybe there's a way to replace them with the contents .dfu file?

 

I will continue to describe the ideas and results of the experiments. If you have any ideas or you can help to solve this problem, do not hesitate to write.

 

Screenshots:

Spoiler

1.jpg

2.jpg

 

Links to download drivers:

 

Share this post


Link to post
Share on other sites
Advertisement

Yeah I think converting the .dfu files to .hex may be problematic. Originally I was going to write my own Bluetooth uploader but in the end realized that the BrcmPatchRAM project did things perfectly well. So I just modified it to work in Catalina instead.

 

I did start work on some earlier versions based on IOath3kfrmw and get it compiling. So what I've done is merge that code into the OS-X-Atheros-3k-Firmware project (https://github.com/headkaze/OS-X-Atheros-3k-Firmware). All I've done is update it to compile in the latest Xcode and nothing has been tested. I don't have Atheros hardware and I don't have time to work on this but it could be a good starting point for you.

 

So what I would do is get a Linux boot disk and use dfu-util to extract the firmware. Then you will need to convert the binary file into a C array and place it into the ath3k-1fw.h header file. From there I guess it would be a matter of seeing if you can actually upload it using the kext.

 

Best of luck!

Edited by headkaze

Share this post


Link to post
Share on other sites
Spoiler

Я проводил вот такой эксперимент. Я посмотрел в /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources и там увидел определенное количество файлов .dfu (волде бы было 22 файла). Потом я создал папку и сделал в ней 22 копии одного из .dfu файлов (AthrBT_0x31010000_ss01.dfu), который был в драйверах моего Bluetooth модуля и переименвал эти копии так же, как называются файлы в /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources и потом заменил файлы от туда теми файлами, которые я "создал".
Потом я перезагрузился, но, ОС выдала kernel panic.

I conducted an experiment like this. I looked in /System/Library/Extensions / IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources and there saw a certain number of files .dfu (volde would have been 22 files). Then I created folder and made in it 22 copies one of .dfu files (AthrBT_0x31010000_ss01.dfu), which was in the drivers of my Bluetooth module and renamed these copies in the same way as the files in /System/Library/Extensions/IOBluetoothFamily are called.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources and then replaced the files from there with the files I "created".
Then I rebooted, but the OS gave kernel panic.

Share this post


Link to post
Share on other sites

I also tried to follow this review (https://osxlatitude.com/forums/topic/2925-bluetooth-firmware-uploader/page/65/?tab=comments#comment-88003)I removed the kexts IOUSBFamily and IOUSBBluetoothFamily from /S/L/E and put instead kexts that were attached to the comment. I rebooted the system but only saw kernel panic.
PS
I did it in macOS Mojave 10.14.6

Share this post


Link to post
Share on other sites
Posted (edited)

Your best bet is  to reverse engineer or ask @emilydinesh to open source btfirmwareuploader binary which upload firmware.as you can see upon loading it , it does interact with Bluetooth (send it in service mode) but can't make it for HS+ due to Apple Bluetooth changes.

I tried dfu_util in Linux Distro to extract Bluetooth Firmware but it doesn't recognise this as dfu_device neither any of mac os ports works with these dfu files, (maybe Libusb issue or PatchRam bl adapter only) .you also need to see  btusb.c beside ath3k.c in Linux as it might be one responsible to put bt in userland or dfu service mode .As far as I know my device ar9565 ,dell 1705 use 0x36,0xcf3 device which requires majorly two files. PatchRam which is Ath3k**31010000.dfu and Sys config which is Ramps***31010000.**40.dfu .you also needs to know data len to patch address on bt ram for both files.

 

Edited by Genxster

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

Announcements

  • Similar Content

    • By james2058
      Hello guys!
      I have a Asus Zenbook with the following characteristics:
      Model: ASUS Zenbook UX310UQ
      CPU: Intel Core i7-7500U CPU @ 2.70GHz
      IGPU: Intel HD Graphics 620
      RAM: 8GBx2 => 16GB RAM Bus 2133
      Wifi: Replaced with DW1560.
      Clover: Clover 5120
      OS: 10.15.6
      UEFI/LEGACY: UEFI
      Storage: SSD Crucial 500GB
      Everything works fine!

      I have the WiFi/Bluetooth chipset DW1560 (DCM20702A) and a Logitech K380 Keyboard and magic mouse. My Hackintosh is sleeping fine only problem is that it won't wake from sleep on key presses. I already tested this USB port with a normal keyboard and the result was that it wakes up my Hackintosh on key presses. And in system settings the Bluetooth wake option is enabled, too.
      Has someone an idea where the problem could be or which additional settings I have to verify?
      Thank you all
       
    • By Sammis
      Hello everyone,
      I would like to know how to transfer (downgrade) the bluetooth module from Sierra to High Sierra.
      On my iMac 2011, equipped with a bluetooth 4 dongle, I have three partitions: one with Sierra, one with High Sierra and one with Catalina (patch).
      There is no way or program to connect High Sierra with the iPhone via bluetooth, while with Sierra and Catalina there are no problems.
      After many unsuccessful attempts (I tried all the methods found on Google), I decided to try to transfer the Sierra bluetooth drivers to High Sierra, but I don't know which files should be moved.
      Can anyone more experienced than me help me?
    • By denixx95
      Hello,
      Big Problem.., My Hack can not recognize my USB3 and no Bluetooth ....
      I'm on High Sierra 10.13.6  (max with my NVIDIA GeForce GTX 970 CG 4070 MB)
      My Setup
      - Rampage V + 5820K config  
      - 32G Ram
      - GeForce GTX 970
      - full of HD ssd
      I am attaching my config.plist! and print my ktext screen ( I have to clean my room...)
       
      Thank you for your help !!
      config.plist.zip

    • By Mieze
      Key Features of the Driver
      Supports Qualcomm Atheros AR816x, AR817x, Killer E220x, Killer E2400 and Killer E2500. Support for multisegment packets relieving the network stack of unnecessary copy operations when assembling packets for transmission. No-copy receive and transmit. Only small packets are copied on reception because creating a copy is more efficient than allocating a new buffer. TCP, UDP and IPv4 checksum offload (receive and transmit). Support for TCP/IPv6 and UDP/IPv6 checksum offload. Makes use of the chip's TCP Segmentation Offload (TSO) feature with IPv4 and IPv6 in order to reduce CPU load while sending large amounts of data. Fully optimized for Mountain Lion, Mavericks and Yosemite (64bit architecture) but should work with Lion (only 64bit) too, provided you build from source with the 10.7 SDK. Wake on LAN support. VLAN support used to be broken in older versions but is working since version 2.3.2. The driver is published under GPLv2.
×