A year ago it all seemed too good to be true: Apple’s team of firmware engineers wanted to bring order to the chaotic state of EFI firmware. In High Sierra, they introduced a new tool, eficheck, which ran every week and quietly ensured that your firmware wasn’t being nobbled by malware, and was reasonably up to date.

Then this week, a couple of security updates and Mojave 10.14.1 put all that good work at risk. Without any warning, every model of Mac underwent firmware update which not only changed the version number, but the system used to express its versions. Except that eficheck continues to give version numbers using the old system.

This new version of LockRattler tries to help you untangle this mess, by revealing the current EFI firmware version using both numbering systems. For the new system, I keep track of the latest versions on this page. The old system, returned still by eficheck and also shown in this new version of LockRattler, gives the date of that version in its last group of digits, e.g. 1809251200 means [20]18/09/25 12:00.

Another problem which Mojave brought was failure in Apple’s macOS installation information. Prior to 10.14, each time that you upgraded or updated macOS, the official name of that version and its version number were logged in the installation records. The first full release of Mojave broke that: it gave its name as SU_UPDATE, without any version number, and has even confused Apple’s own System Information as a result. Mojave 10.14.1 also breaks previous rules, as it too fails to give a version number.

These issues mean that previous versions of LockRattler don’t recognise the Mojave 10.14.1 update, just as SystHist didn’t before I updated it yesterday. This new version accommodates these errors, and does record it properly.

I have updated the documentation and Help book to explain the EFI version checks.

Macs with T2 chips

This new version of LockRattler should be treated as a beta when run on Macs with a T2 chip. This is because they don’t support the eficheck command. At present, this should be handled gracefully and write an appropriate error to the scrolling text view. However, I am unable for the moment to test on a T2-equipped Mac, so I would greatly appreciate reports on their behaviour.

The worst case is that the new LockRattler doesn’t handle the T2’s quirks gracefully, and crashes when starting up. If so, please let me know, and revert to the previous version 4.12 for the time being.

LockRattler 4.13 is available from here: lockrattler413
and from Downloads above.