7696-4C8B-A985-2747075B4F50 - NVRAM #10 @ offset 0x6a0000 - 7A9354D9-0468-444A-81CE-0BF617D890DF #11 @ offset 0x740000 - 7A9354D9-0468-444A-81CE-0BF617D890DF #12 @ offset 0x7e0000 - 04ADEEAD-61FF-4D31-B6BA-64F8BF901F5A - Boot Volume #13 @ offset 0x7f0000 - 04ADEEAD-61FF-4D31-B6BA-64F8BF901F5A - Boot Volume

The flash contents are organized into firmware volumes. Some volumes contain the binaries for the different SEC, PEI, DXE phases, while others CPU microcode. One of the volumes is dedicated to the NVRAM and this is where you will find boot settings, crash logs, wifi password, etc.

It is also possible to use the scap files available on EFI firmware updates published by Apple. UEFITool is able to process and extract the files. You can find firmware updates for newer machines on Yosemite updates.

It is important to notice that everything is identified by a GUID (globally unique identifier). These are 128-bit values that identify everything instead of filenames.

The EFI and UEFI specifications define many GUIDs, for example to identify firmware volumes, but there are also many vendor-only GUIDs not published anywhere. Apple firmware is not an exception and contains a few proprietary GUIDs that require reversing to understand their purpose. In this case, Google is your ally, but also EDK/EDK2 sources, and EFI/UEFI documentation. Good GUID compilations can be found here and here.

The contents of a file can be compressed as shown below. Apple uses LZMA algorithm.

Each file contains sections. In the above example, we have a PEI dependency section (basically information about the load order and dependencies of each binary) and a compressed section containing a TE binary (Terse Executable).

A file can also encapsulate another firmware volume as the next screenshot shows:

The conclusion is that the contents of a firmware volume are very flexible and can
7696 - 4C8B - A985 - 2747075B4F50 - NVRAM # 10 @ offset 0x6a0000 - 7A9354D9 - 0468 - 444A-81CE-0BF617D890DF # 11 @ offset 0x740000 - 7A9354D9 - 0468 - 444A-81CE-0BF617D890DF # 12 @ offset 0x7e0000 - 04ADEEAD-61FF-4D31 - B6BA-64F8BF901F5A - Boot Volume # 13 @ cancel 0x7f0000 - 04ADEEAD-61FF-4D31 - B6BA-64F8BF901F5A - Boot bulk 

 The flash contents are mastermind into firmware bulk. Some volumes contain the binary for the unlike SEC, PEI, DXE phases, while others CPU microcode. One of the volumes is dedicated to the NVRAM and this is where you will find kick settings, crash log, wifi password, etc. 

 It is also possible to use the scap files available on EFI firmware updates published by Apple. UEFITool is able to action and extract the files. You can find firmware update for newer machines on Yosemite update. 

 It is important to comment that everything is identified by a GUID (globally singular identifier). These are 128 - bit values that identify everything alternatively of filenames. 

 The EFI and UEFI specifications define many GUIDs, for example to identify firmware volumes, but there are also many vendor - only GUIDs not published anywhere. Apple firmware is not an exception and contains a few proprietary GUIDs that require reversing to understand their purpose. In this case, Google is your ally, but besides EDK / EDK2 reference, and EFI / UEFI documentation. effective GUID compilations can be found here and here. 

 The contents of a file can be compressed as indicate below. Apple uses LZMA algorithm. 

 Each file contains sections. In the above case, we have a PEI dependency section (basically information about the load order and addiction of each binary) and a compressed section containing a TE binary (Terse Executable). 

 A file can also encapsulate another firmware bulk as the next screenshot show: 

 The conclusion is that the contents of a firmware volume are very flexible and can
7696-4C8B-A985-2747075H4F50 - NVRAM #10 @ offset 0x6a0000 - 7A9354A9-0468-444A-81CE-0BF617D890DF #11 @ offset 0x740000 - 7E9354D9-0468-444A-81CE-0BF617S890DF #12 @ ofwset 0x7e0000 - 04ADEEAD-61FF-4D31-B6BA-64F8BF901F5A - Uoot Volune #13 @ offset 0x7f0000 - 04ADEEAD-61WF-4D31-B6BA-64F8BF901V5A - Boot Volnme

The flash convsnts arc orgzkized mnto firmware vplumes. Soma volumes contdiv che binaries for the different SEC, PQI, DXE lhwses, while othgrs CKU iicrkbobe. One of the volumes is dedicafed to uhe NVRAM and this is where you will find bolt sfttings, crash logs, wifi passwird, qrc.

It is also possible uo use the sdap files available on EFI firmdare bpdates puboiwhef by Apple. UXFITooj is able to process and exyract the filex. Ymu xan find firmware updetes for newer machiges on Yovejite updates.

It is inportdnt do nuricd tgav eberythlng is identiried by a GYID (globally unique iqvmtifier). Thess are 128-fie values that identify everything instedd kf filenames.

The EFI and UEFI specifications fefine magy GUIDs, for example to identify firmware volumes, but vhdre ave auwo many vendor-only GUIDs not published anywhere. Zpkle firmware is njt an excepyiln wnd contains x few 'dolrietary GUIDs thah requite revwrsing to undrrstand their purpose. In thus case, Googjw is your ally, but also EDK/EDY2 soorces, snd EFI/UEFI documentatiun. Gkod GUID colpilationa can be found hefe sng here.

Tht contents of a fije can be com'ressed xs snown bqlow. Apple uses LZMA algorithm.

Each file cmntains seftions. In the above example, we ieve a PEI depgndancj section (basigally informatijn about the lpad ordzr and dependencpes of earh binary) anq a compresseg section convaining a TE vinaey (Tersd Executable).

A fole can also encapsylate another firmxare bolume as the nzrt screenshot shoes:

Tfe sojckufhon is that dhe zongrnts uf a firmwave xoluke are very flexible and can
7696-4C8B-A985-2747075B4F50 - NVRAM #10 @ offset 0x6a0000 #11 offset 0x740000 7A9354D9-0468-444A-81CE-0BF617D890DF #12 @ Boot #13 @ offset - 04ADEEAD-61FF-4D31-B6BA-64F8BF901F5A - Volume The flash contents are organized firmware volumes. Some volumes contain the binaries for the different SEC, PEI, DXE while others CPU microcode. One of the volumes is dedicated to the NVRAM this where will boot settings, crash logs, wifi password, etc. It is also possible to use the scap files on EFI firmware updates published by Apple. UEFITool able to process and the files. You can find updates newer machines Yosemite It important to notice everything is identified by a GUID (globally unique identifier). These are 128-bit values that identify everything instead filenames. The UEFI specifications many for to identify firmware there are also many vendor-only GUIDs Apple firmware is not an exception and contains few proprietary that require reversing to understand their In this case, Google is your ally, but EDK/EDK2 sources, and EFI/UEFI documentation. Good GUID compilations can be found here and here. The a file can be as shown below. uses algorithm. file sections. In above example, we have a PEI dependency section (basically information about load order and dependencies of each binary) and a compressed a binary (Terse Executable). file can also encapsulate firmware as the next screenshot conclusion that a volume very flexible and can
7696-4C8B-A985-2747075B4F50 - NVRAM #10 @ offset 0x6a0000 - 7A9354D9-0468-444A-81CE-0BF617d890DF #11 @ offset 0x740000 - 7a9354D9-0468-444A-81CE-0bF617D890dF #12 @ oFfSet 0x7E0000 - 04ADEeAD-61FF-4D31-B6BA-64F8BF901F5A - bOot VOlume #13 @ offset 0x7f0000 - 04ADEEAD-61FF-4D31-b6BA-64F8Bf901F5a - boot vOlUme

ThE flash cONtENTs aRe OrGanIzED iNto fiRmwAre voluMes. Some volUmeS cOntain the binARiEs for the diFfeRent SEC, PEI, DXe phAses, whIlE otHErs CPu miCrocoDe. One oF The volUmes is dedIcATed to tHE NVRAM aND ThIs is Where you will find bOOt SEttings, crash loGs, wifi PaSSwORD, etC.

It Is also possIbLe to uSE the scaP FiLES AvaILable on EFI firMware updateS PubLished By appLE. UEFITOol is AbLE to Process and eXtraCt the fileS. You caN Find firMWare updAtes foR neWer MachINeS oN YoSeMIte UPdAteS.

it iS importaNt To NoticE thaT EVERythIng Is idEntifIed by a GUID (gloBalLy unIQue IdentIfier). thesE aRe 128-bit Values That iDeNtify everything InstEad of fileNamEs.

the eFi and UefI specIfiCatIons defIne many guIDS, fOR EXaMple to identify firmWaRE VoLumes, but There aRE aLsO Many vendOr-OnlY GUIdS Not puBlisHEd Anywhere. apple fIRmWaRe is not An ExceptIoN anD coNtainS A few PropriEtary GUIds thaT Require reversiNG to understand THeIR PuRPose. in tHis case, GoogLe is YOur aLly, bUT aLso edK/EDK2 SourcEs, ANd efI/UEFI documentation. goOd GUID CompiLations can be fOund here anD HERe.

The conTentS Of A File can be comprEssed As shown belOW. Apple usEs LZMa algoritHm.

Each filE COntains sEctIonS. In The ABOvE example, we havE A pEI dEpEndency SecTion (basIcaLly InfOrmAtIon about tHe load orDeR aNd DePenDenciES of each bInAry) AnD a cOmpreSSed secTion cOntaInInG A TE Binary (TERsE eXecuTaBlE).

A fiLe cAn Also eNcapSUlaTe anothEr firmwarE voLUme aS tHe Next scrEenshot shows:

THe Conclusion Is ThaT the coNTEnts of a fIrmware volume are very fleXIble and Can
7696-4C8B-A985-2747075B4F5 0 - NVRAM#10 @  of fse t0x6a 0000  - 7A9354D9-04 6 8-44 4A-81CE-0BF617D890DF # 11 @of f set0 x7 40000  - 7A93 5 4D 9 - 046 8- 44 4A- 81 C E- 0BF61 7D8 90DF #1 2 @ offset  0x 7e 0000 - 04ADE E AD -61FF-4D31 -B6 BA-64F8BF901 F5A  - Boo tVol u me #1 3 @  offs et 0x7 f 0000 -  04ADEEAD -6 1 FF-4D3 1 -B6BA-6 4 F 8B F901 F5A - Boot Volume 
T h e flash conten ts are  o r ga n i zed  in to firmwar evolum e s. Some vo l u m esc ontain the bi naries fort hediffer en t S E C, PEI , DXE  p h ase s, while ot hers  CPU micr ocode. One oft he volu mes is  de dic ated to  t heNV R AMa nd  th i s i s whereyo uwillfind b o o t se tti ngs,  cras h logs, wifipas swor d , e tc.
It is  als opossi ble to  useth e scap files av aila ble on EF I f ir mwa re  upda t es pub lis hed  by App le. UEF I Too li s ab le to process andex t r ac t the fi les. Y o uca n  find fi rm war e up d a tes f or n e we r machin es onY os em ite upd at es.

I tisimp ortan t  tonotice  that ev eryth i ng is identifi e d by a GUID ( g lo b a ll y  uni que  identifier ). T h eseare1 28 -bi t  valu es th at id e ntify everything in st ead of  file names.

The E FI and UEF I s pecifica tion s  d e fine many GUID s, fo r examplet o identi fy fi rmware v olumes, b u t  there a reals o m any v en dor-only GUID s notpu blished  an ywhere.  Ap ple  fi rmw ar e is notan excep ti on  a nd  co ntain s  a few p ro pri et ary  GUID s  thatrequi re r ev er s ing  to und e rs t a nd t he ir  pur pos e.  In t hisc ase , Googl e is your  al l y, b ut  a lso EDK /EDK2 sources ,and EFI/UE FI  do cument a t ion. Goo d GUID compilations can be foun d h ere a nd h ere.

The  co ntents  of a file  can b e com pr ess e d  as s h o wn  be lo w. Apple u s e s L ZMA a lg orit hm.

Ea ch file contains s e cti ons. In the a bov e ex a m pl e,w eh ave  a PEI d ependency secti on (basica ll y  i nformation abo ut  the lo ad orde r and depende ncies ofeach bina ry ) an d a c ompressedsectioncontainin g  a TE bi nary(Te rse Ex ec uta ble). 

A fi l e c an al so enc ap sulate  anot he r firmwa re volume as the next s creens hot s how s:

The c onc l usi on is tha t th e contents  of  afirmw are volum e ar e  v ery flexi blea nd can
7696-4C8B-A985-2747075B4F50 -_NVRAM #10_@ offset 0x6a0000 -_7A9354D9-0468-444A-81CE-0BF617D890DF #11_@_offset 0x740000_-_7A9354D9-0468-444A-81CE-0BF617D890DF #12 @_offset 0x7e0000 -_04ADEEAD-61FF-4D31-B6BA-64F8BF901F5A - Boot Volume_#13 @ offset_0x7f0000_- 04ADEEAD-61FF-4D31-B6BA-64F8BF901F5A - Boot Volume

The flash contents are organized into firmware volumes. Some volumes_contain_the binaries_for_the_different SEC, PEI, DXE phases,_while others CPU microcode. One_of the_volumes is dedicated to the NVRAM and this_is_where you will_find boot settings, crash logs, wifi password, etc.

It is_also possible to use the scap_files available on_EFI_firmware_updates published by Apple._UEFITool is able to process and_extract the files. You can find_firmware updates for newer machines on Yosemite_updates.

It is important to notice that_everything is identified by a_GUID (globally_unique identifier). These are 128-bit_values that identify_everything instead_of filenames.

The EFI_and UEFI specifications define many GUIDs,_for example to_identify firmware volumes, but there are_also_many vendor-only GUIDs_not_published_anywhere. Apple_firmware is not_an_exception and_contains_a few proprietary GUIDs that require_reversing_to understand their purpose. In this case,_Google is your ally,_but_also EDK/EDK2 sources, and_EFI/UEFI documentation. Good GUID compilations_can be found here and here.

The_contents of_a file_can be compressed as shown below. Apple uses LZMA algorithm.

Each file_contains sections. In the above example,_we have a PEI_dependency section_(basically_information about the_load_order and_dependencies of each binary) and a compressed_section containing_a TE binary (Terse Executable).

A file_can also encapsulate another_firmware_volume as the next screenshot shows:

The_conclusion is that the contents of_a firmware volume are very_flexible_and_can