Trying using .dfu firmware to enable bluetooth in macOS on "cold" start

[Drovosek]

Spoiler

 

Привет.
У меня есть системный блок Dell Vostro 3267 (i5-6400, Skylake). Информация в подписи.

В этом системном блоке установлен модуль Atheros AR9565 802.11b/g/n Wireless Network Adapter, который, как я понимаю, совмещает в себе Wifi - Atheros AR9565 и Bluetooth - Qualcomm QCA9565.

 

Мне удалось заставить работать Wifi, с помощью кекста от chunnann.

 

Bluetooth работает только если сначала загрузиться в Windows, а потом из нее перезагрузиться в macOS. При этом нужно установить в Windows драйвера для bluetooth с официального сайта Dell, потому что первоначальные драйвера, которые скачала и установила Windows сама - не позволяли работать bluetooth модулю даже в Windows.

В настройках bluetooth была неактивна кнопка выключения и был вечный поиск устройств (если macOS была загружена сразу после запуска ПК). Включение  кнопки выключение я вылечил просто добавив в папку /kexts/Other кекст BrcmBluetoothInjector, прописав внутри него в Info.plist файле соответствующие VendorID и ProductID моего bluetooth (которые отображаются в отчете о системе).

 

Меня разочаровывает то, что Windows умеет во время загрузки автоматически загружать прошивку в bluetooth модуль, а в hackintosh macOS еще не сделали такого кекста.

 

В ходе поисков решения проблемы я наткнулся на вот такие варианты кекста:

IOath3kfrmw (OS-X-Atheros-3k-Firmware)
https://bitbucket.org/RehabMan/os-x-atheros-3k-firmware/downloads/
https://github.com/RehabMan/OS-X-Atheros-3k-Firmware

 

OS-X-BrcmPatchRAM

https://github.com/the-darkvoid/BrcmPatchRAM

https://github.com/RehabMan/OS-X-BrcmPatchRAM

https://bitbucket.org/RehabMan/os-x-brcmpatchram/downloads/

https://bitbucket.org/anonymous_writer/os-x-brcmpatchram-catalina/downloads/

https://github.com/headkaze/OS-X-BrcmPatchRAM

BTFirmwareUploader (как я понял, это улучшенный IOath3kfrmwr)

https://osxlatitude.com/forums/topic/2925-bluetooth-firmware-uploader/

 

И вот такой способ - использовать виртуальную машину для того, чтобы ОС из нее загружала прошивку в bluetooth модуль

https://osxlatitude.com/forums/topic/10127-updated-nov-2017-fix-btfirmwareuploader-in-macos-high-sierra/

 

К сожалению, не один из этих вариантов мне не помог добиться того, чтобы работал bluetooth при "холодном" запуске ПК в macOS.

 

1.

Я начал более подробно читать информацию о кекстах. В кексте BrcmPatchRAM говорится, что можно самому добавить поддержку своего bluetooth модуля в этот кекст. Я скачал драйвера для своего bluetooth с официального сайта и извлек из .exe установщика сами файлы драйвера (Это легко делается с помощью 7-zip в Windows, либо с помощью Keka в macOS). Там было больше файлов .dfu, чем других. Как я выяснил, .dfu файлы это и есть скомпилированные файлы прошивки, которые драйвер загружает в bluetooth модуль. В инструкции к BrcmPatchRAM говорится только о .hex файлах прошивки для Broadcom.
Я начал искать информацию в интернете и узнал, что .hex файлы это исходный "текст" прошивки, а .dfu это скомпилированные .hex файлы.

Я сразу же начал искать конвертеры/декомпиляторы/дизассемблеры из .dfu в .hex, но нашел только то, что из .hex делает .dfu файл:
https://github.com/pjsg/hex2dfu
https://github.com/plietar/dfuse-tool
https://github.com/kuro68k/ihex2dfu

https://github.com/vpelletier/python-dfu

А так же консольные утилиты "dfu-tool" и "dfu-util" в Linux. Я узнал, что dfu-util можно установить в macOS с помощью Homebrew или использовать этот вариант (он отличается по функционалу) https://github.com/the-darkvoid/dfu-util-osx

 

2.

Так же я узнал, что .dfu файлы используются и в macOS в /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources

Я думаю надо попробовать заменить их все на тот файл, который загружает Windows в bluetooth модуль (я думаю если пробовать так делать, то нужно сделать несколько копий этого файла и переименовать его в те оригинальные .dfu файлы, которые будут удалены).

 

3.

Так же есть идея просто мой .dfu файл переименовать в файл .zhx и добавить его в кекст OS-X-BrcmPatchRAM (в BrcmFirmwareRepo.kext). Но есть проблема - во-первых, я не знаю какой из .dfu файлов загружается в мой bluetooth, возможно даже несколько, потому что там 3 файла размером > 40 KB и много файлов размером ~ 2 KB.

 

4.

В "dfu-tool" и "dfu-util" я увидел команды, которые извлекают прошивку из устройства. Может быть можно будет загрузиться в Linux и, если bluetooth начнет там работать, то попробовать извлечь прошивку из bluetooth этими утилитами, а потом уже эту прошивку как-то добавлять в кексты.

 

5.

В файле BTFirmwareUploader.kex/Contents/MacOS/BTFirmwareUploader внутри уже есть какой-то список прошивок, но они в .hex формате. Может быть можно как-то заменить их на содержимое .dfu файлов?

 

Я буду продолжать описывать идеи и результаты экспериментов. Если у вас есть какие-нибудь идеи или вы можете помочь решить эту проблему, то не стесняйтесь - пишите.

 

 

Hello.
I have system unit Dell Vostro 3267 (i5-6400, Skylake). Information in signature.

In this system block module installed Atheros AR9565 802.11 b/g/n Wireless Network Adapter, which, as I understand it, combines Wi-Fi - Atheros AR9565 and Bluetooth Qualcomm QCA9565.

 

I managed to get working Wifi with kext from chunnann.

https://www.insanelymac.com/forum/topic/312045-atheros-wireless-driver-os-x-101112-for-unsupported-cards/?page=17&tab=comments#comment-2509900

https://www.insanelymac.com/forum/topic/328426-qualcomm-atheros-ar9565-wireless-for-os-x-108-1014/

 

Bluetooth works only if you first boot into Windows and then reboot into macOS from it. At the same time, you need to install drivers for bluetooth in Windows from the official Dell website, because the original drivers that Windows downloaded and installed itself - did not allow the bluetooth module to work even in Windows.

In bluetooth settings, the power button was inactive and there was an eternal search for devices (if macOS was loaded immediately after the PC started). Enable button disable I cured just by adding the folder /kexts/Other kext BrcmBluetoothInjector by writing inside it in the Info.the plist file corresponds to the VendorID and ProductID of my bluetooth (which are displayed in the system report). BrcmBluetoothInjector_Mod.kext.zip

 

I am disappointed that Windows is able to automatically download the firmware to the bluetooth module during the download, and Hackintosh macOS has not yet done such a kext.

 

In the search for solutions to the problem I came across here are the options for the text:

 

IOath3kfrmw (OS-X-Atheros-3k-Firmware)
https://bitbucket.org/RehabMan/os-x-atheros-3k-firmware/downloads/
https://github.com/RehabMan/OS-X-Atheros-3k-Firmware

 

OS-X-BrcmPatchRAM

https://github.com/the-darkvoid/BrcmPatchRAM

https://github.com/RehabMan/OS-X-BrcmPatchRAM

https://bitbucket.org/RehabMan/os-x-brcmpatchram/downloads/

https://bitbucket.org/anonymous_writer/os-x-brcmpatchram-catalina/downloads/

https://github.com/headkaze/OS-X-BrcmPatchRAM

BTFirmwareUploader (as I understand it, this is an improved IOath3kfrmwr)

https://osxlatitude.com/forums/topic/2925-bluetooth-firmware-uploader/

And here's a way - to use a virtual machine to the OS from it to download the firmware to the bluetooth module

https://osxlatitude.com/forums/topic/10127-updated-nov-2017-fix-btfirmwareuploader-in-macos-high-sierra/

Unfortunately, not one of these options did not help me to ensure that bluetooth worked when "cold" start the PC in macOS.

 

1.

I started to read more about kexts. In texte BrcmPatchRAM says that it is possible to add support for their bluetooth module in this kext. I downloaded the drivers for my bluetooth from the official site and extracted from .exe installer driver files themselves (This is easily done using 7-zip in Windows or using Keka in macOS). There were more files .dfu than others. As I found out .dfu files are compiled firmware files that the driver loads into the bluetooth module. In the instructions to BrcmPatchRAM States only .hex firmware files for Broadcom.
I started looking for information on the Internet and found out that .hex files are the original "text" of the firmware as well .dfu is compiled .hex files.

I immediately started looking for converters/decompilers/disassemblers from .in dfu .hex, but found only what's out .hex does .dfu file:
https://github.com/pjsg/hex2dfu
https://github.com/plietar/dfuse-tool
https://github.com/kuro68k/ihex2dfu

https://github.com/vpelletier/python-dfu

As well as console utilities "dfu-tool" and "dfu-util" in Linux. I found out that dfu-util can be installed in macOS using Homebrew or use this option (it differs in functionality) https://github.com/the-darkvoid/dfu-util-osx

 

2.

I also learned that .dfu files are used in macOS /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources

I think we should try to replace all of them on that file that Windows loads the bluetooth module (I think if you try to do so, you need to make several copies of this file and rename it to the original ones .dfu files to be deleted).

 

3.

As is the idea is just mine .dfu file rename to file .zhx and add it to the kext OS-X-BrcmPatchRAM (in BrcmFirmwareRepo.kext). But there is a problem - first, I don't know which one .dfu files are downloaded to my bluetooth, maybe even a few, because there are 3 files > 40 KB IN size and a lot of files ~ 2 KB in size.

 

4.

In "dfu-tool" and "dfu-util" I saw commands that extract firmware from the device. Maybe it will be possible to boot into Linux and if bluetooth starts working there, then try to extract the firmware from bluetooth with these utilities, and then add this firmware to kexts somehow.

 

5.

In the file BTFirmwareUploader.kex/Contents/MacOS/BTFirmwareUploader inside already have a list of firmwares, but they are in .hex format. Maybe there's a way to replace them with the contents .dfu file?

 

I will continue to describe the ideas and results of the experiments. If you have any ideas or you can help to solve this problem, do not hesitate to write.

 

Screenshots:

Spoiler

 

Links to download drivers:

Spoiler

https://www.dell.com/support/home/us/en/19/drivers/driversdetails?driverid=g66t8&oscode=wt64a&productcode=vostro-3267-desktop&lwp=rt
Extracted bluetooth drivers:
https://yadi.sk/d/cYGax0NEdoCF3w

QCA9565 Bluetooth-Driver.7z

https://www.acer.com/ac/en/US/content/support-product/5977?b=1&pn=NX.MVGER.002
https://global-download.acer.com/GDFiles/Driver/Bluetooth/Bluetooth_Atheros_10.0.1.0_W10x64_A.zip?acerid=635736531919697771&Step1=NOTEBOOK&Step2=ASPIRE&Step3=ASPIRE E5-573G&OS=ALL&LC=ru&BC=ACER&SC=EMEA_23

 

[headkaze]

Yeah I think converting the .dfu files to .hex may be problematic. Originally I was going to write my own Bluetooth uploader but in the end realized that the BrcmPatchRAM project did things perfectly well. So I just modified it to work in Catalina instead.

 

I did start work on some earlier versions based on IOath3kfrmw and get it compiling. So what I've done is merge that code into the OS-X-Atheros-3k-Firmware project (https://github.com/headkaze/OS-X-Atheros-3k-Firmware). All I've done is update it to compile in the latest Xcode and nothing has been tested. I don't have Atheros hardware and I don't have time to work on this but it could be a good starting point for you.

 

So what I would do is get a Linux boot disk and use dfu-util to extract the firmware. Then you will need to convert the binary file into a C array and place it into the ath3k-1fw.h header file. From there I guess it would be a matter of seeing if you can actually upload it using the kext.

 

Best of luck!

Edited August 24, 2019 by headkaze

[Drovosek]

Spoiler

Я проводил вот такой эксперимент. Я посмотрел в /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources и там увидел определенное количество файлов .dfu (волде бы было 22 файла). Потом я создал папку и сделал в ней 22 копии одного из .dfu файлов (AthrBT_0x31010000_ss01.dfu), который был в драйверах моего Bluetooth модуля и переименвал эти копии так же, как называются файлы в /System/Library/Extensions/IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources и потом заменил файлы от туда теми файлами, которые я "создал".
Потом я перезагрузился, но, ОС выдала kernel panic.

I conducted an experiment like this. I looked in /System/Library/Extensions / IOBluetoothFamily.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources and there saw a certain number of files .dfu (volde would have been 22 files). Then I created folder and made in it 22 copies one of .dfu files (AthrBT_0x31010000_ss01.dfu), which was in the drivers of my Bluetooth module and renamed these copies in the same way as the files in /System/Library/Extensions/IOBluetoothFamily are called.kext/Contents/PlugIns/IOBluetoothUSBDFU.kext/Contents/Resources and then replaced the files from there with the files I "created".
Then I rebooted, but the OS gave kernel panic.

[Drovosek]

I also tried to follow this review (https://osxlatitude.com/forums/topic/2925-bluetooth-firmware-uploader/page/65/?tab=comments#comment-88003)I removed the kexts IOUSBFamily and IOUSBBluetoothFamily from /S/L/E and put instead kexts that were attached to the comment. I rebooted the system but only saw kernel panic.
PS
I did it in macOS Mojave 10.14.6

[Genxster]

Your best bet is  to reverse engineer or ask @emilydinesh to open source btfirmwareuploader binary which upload firmware.as you can see upon loading it , it does interact with Bluetooth (send it in service mode) but can't make it for HS+ due to Apple Bluetooth changes.

I tried dfu_util in Linux Distro to extract Bluetooth Firmware but it doesn't recognise this as dfu_device neither any of mac os ports works with these dfu files, (maybe Libusb issue or PatchRam bl adapter only) .you also need to see  btusb.c beside ath3k.c in Linux as it might be one responsible to put bt in userland or dfu service mode .As far as I know my device ar9565 ,dell 1705 use 0x36,0xcf3 device which requires majorly two files. PatchRam which is Ath3k**31010000.dfu and Sys config which is Ramps***31010000.**40.dfu .you also needs to know data len to patch address on bt ram for both files.

 

Edited May 29, 2020 by Genxster

[LockDown]

On 8/24/2019 at 9:53 AM, headkaze said:

I did start work on some earlier versions based on IOath3kfrmw and get it compiling. So what I've done is merge that code into the OS-X-Atheros-3k-Firmware project (https://github.com/headkaze/OS-X-Atheros-3k-Firmware). All I've done is update it to compile in the latest Xcode and nothing has been tested. I don't have Atheros hardware and I don't have time to work on this but it could be a good starting point for you.

Hi @headkaze

 

OS: High Sierra & Mojave

Xcode: 10.1 & 11.3.1

I tried compiling the latest source from your repo, and it was successful.

However the kext wont load due to the following errors.

 

kextutil:

bash-3.2# kextutil /Users/ella/Desktop/IOath3kfrmwr.kext 
Kext with invalid signatured (-67062) allowed: <OSKext 0x7fce7ed00f40 [0x7fffac5d7c30]> { URL = "file:///Users/ella/Desktop/IOath3kfrmwr.kext/", ID = "org.rehabman.driver.IOath3kfrmwr" }
Code Signing Failure: not code signed
(kernel) kxld[org.rehabman.driver.IOath3kfrmwr]: The following symbols are unresolved for this kext:
(kernel) kxld[org.rehabman.driver.IOath3kfrmwr]: 	__ZN15IOUSBHostDevice9metaClassE
(kernel) kxld[org.rehabman.driver.IOath3kfrmwr]: 	__ZN25org_rehabman_IOath3kfrmwr18findFirstInterfaceEv
(kernel) kxld[org.rehabman.driver.IOath3kfrmwr]: 	__ZN25org_rehabman_IOath3kfrmwr20initFirmwareTransferEPvj
(kernel) kxld[org.rehabman.driver.IOath3kfrmwr]: 	__ZN25org_rehabman_IOath3kfrmwr8findPipeEPP13IOUSBHostPipehh
(kernel) kxld[org.rehabman.driver.IOath3kfrmwr]: 	__ZN25org_rehabman_IOath3kfrmwr9getStatusEPt
(kernel) Can't load kext org.rehabman.driver.IOath3kfrmwr - link failed.
(kernel) Failed to load executable for kext org.rehabman.driver.IOath3kfrmwr.
(kernel) Kext org.rehabman.driver.IOath3kfrmwr failed to load (0xdc008016).
(kernel) Failed to load kext org.rehabman.driver.IOath3kfrmwr (error 0xdc008016).
Failed to load /Users/ella/Desktop/IOath3kfrmwr.kext - (libkern/kext) link error.
Check library declarations for your kext with kextlibs(8).

kextlibs:

bash-3.2# kextlibs /Users/ella/Desktop/IOath3kfrmwr.kext 
For all architectures:
    com.apple.iokit.IOUSBHostFamily = 1.2
    com.apple.kpi.iokit = 17.7
    com.apple.kpi.libkern = 17.7

For x86_64:
    4 symbols not found in any library kext.

kextload:

ash-3.2# kextload -v /Users/ella/Desktop/IOath3kfrmwr.kext 
Requesting load of /Users/ella/Desktop/IOath3kfrmwr.kext.
/Users/ella/Desktop/IOath3kfrmwr.kext failed to load - (libkern/kext) link error; check the system/kernel logs for errors or try kextutil(8).

I cant test your work as its not loading.

 

Thank you