all right in this video I'm going to be
removing a firmware password on this
mid-2012 apple macbook pro now I
actually got this machine off eBay for
about a hundred and seventy-five dollars
or so and it ended up being fully
functional when I got it
however after putting it all back
together repeating it and whatnot I
turned it on with a hard drive connected
and I found out that it actually has a
firmware password so go ahead and plug
it in and turn it on and show you that
now alright so you can see the machine
works just fine I am holding down the
option key as you can see and a second
here you will see that there is a
firmware password on this machine so
basically what we're going to be doing
in this video is I'm going to be
desoldering the EEPROM from this macbook
logic board I'm going to put in my
EEPROM programmer and either do one of
two things either a I will take a dump
from another mid-2012 15-inch MacBook
Pro logic board and just write it on to
the EEPROM on this machine or I will
attempt to look through the dump find
the password and remove it I think
that's possible not only percent sure so
one way or another we will be removing
the firmware password from this machine
and so yeah so I guess I'll just get
started by removing the EEPROM from this
logic board and then we'll go through
the process of attempting to remove the
password so I'm going to go ahead and do
that and I will be right back all right
so I've now gotten the board out and the
EEPROM is right there as you can see so
this is what we're going to be removing
so the first thing I need to do is of
course turn on my hot air station here
let that warm up a little bit here
and while that's warming up I'll go
ahead and apply some flux to the chip
all right and then all we need to do
from here is heat it up and remove it
turn down a little bit
[Music]
[Music]
all right so you can see the chip is now
off the board so now I'll go ahead and
pause the video here and resume it on my
computer and show you what to do or I
should go over the process of editing
the dump of the EEPROM and flashing it
back on the chip so I'll be right back
alright so you can see I have my a prone
programmer right here and I actually
have this little adapter for it right
there so I can just clip in the chip
from the macbook logic board I don't
know why it's not focusing again you can
just push it down you can see that it
opens up and then it'll just clamp down
on the legs of the chip and allow the
EEPROM programmer to read it now I just
got this off ebay quite a while ago
actually but it does work perfectly fine
and you can see I've got the software
open on my computer right here ok so the
first thing you have to do is go to the
device thing and actually yeah you want
to do the 25 flash detects so it can
detect which type of IC is in the socket
so you can see it gives me a few options
here so I think the one in there is a
indexed 25 l 646 e there are a few
options for it here I'm not exactly sure
which it is I'm sure any of them will
work just fine probably this one this
will go ahead and select select and now
you can see that it will detect here and
now we have to do is go to the device
and read it and this will dump the
EEPROM obviously from or it will dump it
to a file on your computer so go ahead
and select to read and select to read
so you can see that it appears to be
working and on the EEPROM programmer you
can see the orange light is come on
indicating that it is reading so this
should take a few minutes to complete so
go and resume the video when it's done
alright so you can see that the EEPROM
programmer successfully read the EEPROM
so now I'm go ahead and close that and
you can see the entire jump right here
now what we want to do is do file save
and we're going to save it as a big file
so we're going to name it 2012 for
original and I will go ahead and select
save alright so you can see the file
right here and I believe this is an 8
megabytes deep problem so there should
be about 8 negative side as you can see
it is right there
so we're going to do now is I'm just
going to go ahead and make a copy of it
and then name this okay good just so I
know the just right you know I have a
backup so if something does go wrong I
can just you know really flash the
original firmware so now we're going to
go ahead and do is open a hex editor so
in my case I'm making hxd so now we're
going to just go ahead and open that
file so go ahead and edit open the edit
one and now we're going to want to do is
search for a string so go ahead and find
it here and it is dollars time execute
yes just like that
and this will indicate our where this
string is located is where the firmware
password in there should be located so
go ahead and search for that and so
here's the first instance as you can see
now there should be about two instances
of it so let's search it again
and then it looks like there is only one
instance my specialty I need to do here
to search next one oh here we go fine
again okay so there's the second
instance obviously we don't have to mess
with this one so what we're going to go
ahead and do here is first off keep note
of our first off we need to make sure
that we do not change the file size so
it's very important that you don't
change the file size here so we're going
to go ahead and highlight all of this
ever just kind of replace it all with F
so um I believe not exactly sure how to
do it on this let's see
here we go so it's FFF press okay all
right so you can see it changed that
entire area of data to all X which is
obviously blank so now we're going to go
ahead and do is save it and now let's go
ahead and check the file size and ensure
that it's still eight Meg's and as you
can see it is and we can just go ahead
and compare it with the original and
make sure that the byte count is exactly
the same and as you can see they are so
now we should be able to do is go ahead
it back to the EEPROM programmer
software open the edited file so go
ahead and search for that here alright
so here's the one I edited go ahead and
open it go ahead and select ok on this
and now we should go to device and first
off we're going to select erase go ahead
and erase the chip first we should only
take a few minutes or not even a minute
just a few seconds here
all right and as you can see the erase
was successful so I'm going to close
that and now we will go ahead and select
program I'm going to select it there and
now it is writing the modified a dump
onto the EEPROM once again so in theory
once this is complete we should be able
to resolder the EEPROM right back into
the macbook logic board
but the logic come back in the chassis
and it should no longer have a firmware
password so once this completes I'll go
ahead and show you the process of
soldering an EEPROM back on and from
there we'll go ahead and test it so I
will be right back
alright so I've gotten the chip ready to
be restarted back to the logic board so
we've got my hot air garden heating up
right here so let me go ahead and add a
little bit of flux to this so it flows a
little bit better
all right and now we'll go ahead and
place on the chip and then then heat up
the pads and solder it to the board
let's go ahead and place it right there
and make sure it's in the middle here
and we'll solder it in
[Applause]
[Music]
[Applause]
[Music]
all right so there we go the EEPROM has
now been restarted onto the logic board
so now we're going to go ahead and put
the board back in the chassis of the
machine turn it on and see if there is
no longer a firmware password so I will
be right back
all right so I've gone ahead and
reassemble the machine as you can see so
let's go ahead and plug it in and see if
it turns on and has no firmware password
[Music]
all right so the machines on not sure
why the maxi flight didn't come on
probably the same pan just didn't
connect but look at that as you can see
there is no more firmware password and
we can now boot from that hard disk so
I'll go ahead and let this boot up real
fast and then we can take a look at the
system and yeah now that the firmware
password has been removed so I'll be
right back
once the machine boots up all right so
as you can see the machine has just
finished booting up and it appears to be
working perfectly fine so you can see
everything seems to be working trackpad
keyboard works and yeah here the specs
you can see it has a two point three D
hurts quad core Intel Core i7 CPU it
does have dedicated video as well as the
Intel HD graphics 4000 it also has the
geforce GT 650 M as shown right there
but yeah this machine appears to be
working perfectly fine and I yeah it
works fine since I removed the firmware
password so that is how to remove the
firmware password from a MacBook Pro now
keep in mind you only need to do this on
the later MacBook Pros on the earlier
ones you can just take out one memory
module or something and then just reset
the fear in three times and that will
get rid of the former pass on those
older machines but um yeah as you can
see I was successful with moving it on
this machine just simply by removing
that hex string or that string in the
hex dump of this ROM so that is the
the removal of the firmware password
from this mid-2012 15-inch apple macbook
pro hope you enjoyed this video