Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!nntp.club.cc.cmu.edu!micro-heart-of-gold.mit.edu!bloom-beacon.mit.edu!bloom-beacon.mit.edu!panix!MIX!Blackbird From: billy@MIX.COM Newsgroups: comp.sys.mac.system Subject: Re: File vault, firmware password, etc Date: Wed, 5 Mar 2014 18:22:31 +0000 (UTC) Organization: PANIX Public Access Internet and UNIX, NYC Lines: 78 Message-ID: References: <1lhxa48.1f825xadchjy0N%dcohenspam@talktalk.net> NNTP-Posting-Host: panix5.panix.com X-Trace: reader2.panix.com 1394043751 682 166.84.1.5 (5 Mar 2014 18:22:31 GMT) X-Complaints-To: abuse@panix.com NNTP-Posting-Date: Wed, 5 Mar 2014 18:22:31 +0000 (UTC) Xref: csiph.com comp.sys.mac.system:57622 I wrote, quoting Jolly Roger about the EFI Firmware Password: > > Also, someone with root access to the machine can read the firmware > > password easily with the nvram command-line utility. > > I will try to look at this later (don't have a password protected > machine available right now). This is from a 2013 MacBook Pro running 10.9.2. Output has been truncated for posting here, but you may rest assured the password is not anywhere in these data. $ sudo nvram -p [Results are the same when not run as root...] boot-image %02%01%0c%00%d0A%03%0a%00%00%00%00%01%01%06%00%02%1f boot-gamma %10%06%00%00%c5%9c%00%00%00%00%00%00%f2%00%00%00%00 boot-args -v debug=0x100 SystemAudioVolume L backlight-level r%04 SmcFlasherResult %00%00%00%00%00%00%00%00%00%00%00%00%00 prev-lang:kbd en:0 efi-apple-payload0-data %02%01%0c%00%d0A%03%0a%00%00%00%00%01 RemoteDisabled %01 fmm-computer-name Sluggy bluetoothActiveControllerInfo %1d%82%ac%05%00%00%00%13%18%1d%88 efi-apple-payload0 IOMatch efi-boot-device-data %02%01%0c%00%d0A%03%0a%00%00%00%00 efi-boot-device IOMatch LocationServicesEnabled %01 This is with the EFI security mode set to full, as opposed to command. I didn't try the command mode, but I don't expect it'd be different. The only way to do this is by running (or fishing out and copying to someplace like /usr/local/bin) Apple's setregproptool, which lives in the recovery partition (or on the install DVD for older OS versions), in /Applications/Utilities/Firmware\ Password\ Utility/Contents/Resources/. $ setregproptool -h Error: this tool must be run as root. $ sudo setregproptool -h Password: setregproptool v 2.0 (9) Aug 24 2013 Copyright (C) 2001-2010 Apple Inc. All Rights Reserved. Usage: setregproptool [-c] [-d [-o ]] [[-m -p ] -o ] -c Check whether password is enabled. Sets return status of 0 if set, 1 otherwise. -d Delete current password/mode. Requires current password on some machines. -p Set password. Requires current password on some machines. -m Set security mode. Requires current password on some machines. Mode can be either "full" or "command". Full mode requires entry of the password on every boot, command mode only requires entry of the password if the boot picker is invoked to select a different boot device. When enabling the Firmware Password for the first time, both the password and mode must be provided. Once the firmware password has been enabled, providing the mode or password alone will change that parameter only. -o Old password. Only required on certain machines to disable or change password or mode. Optional, if not provided the tool will prompt for the password. Billy Y.. -- sub #'9+1 ,r0 ; convert ascii byte add #9.+1 ,r0 ; to an integer bcc 20$ ; not a number