A client brought in a IMAC A1311 that had been firmware locked and said he forgot the password.
I fixed the problem by reading the ROM and removing the part where it enabled the firmware lock and rewriting it to the MAC.
In my case this is what i did: i search for the string of text "$SVS" inside the dump, and found there were two, the first one was followed by a lot of non 0xFF bytes, the second one instead was followed by only a few non 0xFF bytes.
What i did to fix it was copy the second apperance of "$SVS" along with all the following non 0xFF bytes to the location of the first apperence of "$SVS" matching the bytes, and then filled the remaning data with 0xFF.
Then i rewrote it and the firmware lock was no more.
I fixed the problem by reading the ROM and removing the part where it enabled the firmware lock and rewriting it to the MAC.
In my case this is what i did: i search for the string of text "$SVS" inside the dump, and found there were two, the first one was followed by a lot of non 0xFF bytes, the second one instead was followed by only a few non 0xFF bytes.
What i did to fix it was copy the second apperance of "$SVS" along with all the following non 0xFF bytes to the location of the first apperence of "$SVS" matching the bytes, and then filled the remaning data with 0xFF.
Then i rewrote it and the firmware lock was no more.
