hoakley November 11, 2020 Macs, Technology, Updates

SilentKnight and LockRattler updates for Big Sur and Apple Silicon

I have two new versions of my popular utilities for checking firmware and security updates, SilentKnight and LockRattler. These make further adjustments to read firmware versions, particularly in current Apple Silicon Macs.

Until I know the model designators for the new Macs, I’m unable to make final adjustments for full compatibility with them. For them moment, these updates read firmware versions and, where it recognises non-Intel hardware, displays those versions appropriately. Apple Silicon Macs aren’t reliant on Intel’s EFI firmware architecture, but are most likely to use just iBoot as already used in iPhones and iPads. This should greatly simplify managing firmware on those models.

SilentKnight version 1.13 is available from here:silentknight113
LockRattler version 4.28 is available from here: lockrattler428
Both are available from Downloads above, from their Product Page, and via their auto-update mechanism.

6Comments

Add yours

1

Will Blume on November 12, 2020 at 6:30 pm

On my late ’13 MacPro, SK113 and previous versions report:
“EFI version found 425.0.0.0.0; expected 137.0.0.0.0”
However, eficheck reports:
“EFI Version: MP61.88Z.F000.B00.2010191953 (Boot ROM Version: 425.0.0.0.0)
Primary allowlist version match found. No changes detected in primary hashes.”
SK113 also reports:
❌ Gatekeeper 181, 8.0 should be 94, 8.0
On Big Sur installed over a clone of my working volume, but a “clean” Big Sure install reports 94,8.0. It seems Gatekeeper 181 carried over from Mojave, and neither any of the Big Sur installs or Silent Knight can update it?

LikeLiked by 1 person
- 2
  
  hoakley on November 12, 2020 at 6:35 pm
  
  Thank you.
  SilentKnight’s database hasn’t yet been updated for the Big Sur firmware updates, not for any changes in other security data.
  Please give me a chance!
  Howard
  
  LikeLike
  - 3
    
    Will Blume on November 12, 2020 at 11:39 pm
    
    Not meaning to harass you… 🙂 The Gatekeeper thing is what confuses me the most. Is it a bug in Apple’s installer that just doesn’t recognize version 181 is older than 94? As I said my clean install appears to have the right Gatekeeper, just the one from Mojave is weird,
    
    LikeLiked by 1 person
    - 4
      
      hoakley on November 12, 2020 at 11:48 pm
      
      The simple answer is that I don’t know. All that I know is that, throughout the beta cycle, Big Sur installations which are completely fresh have remained at those old version numbers. Those which have been installed over a previous version of macOS have inherited the version numbers from that previous installation.
      I don’t know why. I don’t know which if either is ‘right’. I just have to choose one of them to use as the reference for the values reported by SilentKnight. I arbitrarily chose those from a completely clean install.
      There’s absolutely nothing that you can do about it either: Apple’s servers determine which version gets pushed at your Mac. Not softwareupdate, not SilentKnight.
      Furthermore, if you’d like to look at those databases, you’ll see that neither has been opened for over a year. In other words, Catalina and Big Sur don’t refer to them any more, in any case.
      Sure, this is all weird. It’s Apple security – undocumented, ever-changing, and baffling.
      Howard.
      
      LikeLike
5

Marcos on November 16, 2020 at 2:40 am

Dear Dr. Oakley,

this is what I found in https://forums.macrumors.com/threads/upgrading-2013-2014-macbook-pro-ssd-to-m-2-nvme.2034976/page-306

Can you use this information to force SilentNight to download and update the firmware?

Thank you and I apologize if you have already covered this topic before.

Marcos
————————–

I am still running macOS Catalina 10.15.7 (19H15) on my MacBookPro11,1, but updated from Boot ROM version 162.0.0.0.0 to Boot ROM version 427.0.0.0.0 that came with macOS Big Sur 11.0.1 (20B29).

sudo /usr/sbin/bless -firmware Desktop/Big\ Sur/MBP111.scap –verbose –recovery

Followed by a system shutdown (not restart), and immediate power on using the power button.

I didn’t see details in this thread around where the EFI firmware files are located these days. The EFI firmware/Boot ROM/system firmware files are now hiding in ee3ab6c04234b360dd8fca93c0ae49f957bf0843/AssetData/boot/EFI/EFIPayloads from the archive /Volumes/Shared\ Support/com_apple_MobileAsset_MacSoftwareUpdate/ee3ab6c04234b360dd8fca93c0ae49f957bf0843.zip that was in the disk image Install\ macOS\ Big\ Sur.app/Contents/SharedSupport/SharedSupport.dmg.

LikeLike
- 6
  
  hoakley on November 16, 2020 at 7:31 am
  
  Thank you.
  What you detail there is an unofficial and unsupported method which could brick your Mac. Furthermore, only Apple installers can perform that sequence automatically.
  If you want to update your firmware to the latest version, then the approved, supported and safest way to do so is to install the latest version of macOS. Normally, once the annual major upgrade to macOS has been released, Apple follows up with Security Updates for the two supported previous versions (now Catalina and Mojave) which bring those to the same firmware versions. These are likely to follow in the next few weeks, and it is well worth having a little patience. Where necessary, they may bring update kernels, and sometimes kernel extensions too, which improve compatibility of the old macOS with the new firmware.
  Howard.
  
  LikeLike

·Comments are closed.

Share this:

Like this:

Related