Collecting Intel Processor Data…

I am looking for specific information about Intel processors for a project that I am working on, and I hope that you are willing to help me with this. Here is one example of what I am looking for:

Intel® Core™ i7-5820K

Processor Brandstring....................: Intel(R) Core(TM) i7-5820K CPU @ 3.30GHz

Processor Signature..................... : 0x306F2
 - Family............................... : 6
 - Stepping............................. : 2
 - Model................................ : 0x3F (63)

MSR_IA32_PLATFORM_ID.............(0x17)  : 0x8000000000000
 - Processor Flags...................... : 2

Socket: FCLGA2011-3

And here is another example.

Intel® Core™ i7-6700 Processor

Processor Brandstring....................: Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz

Processor Signature..................... : 0x506E3
 - Family............................... : 6
 - Stepping............................. : 3
 - Model................................ : 0x5E (94)

MSR_IA32_PLATFORM_ID.............(0x17)  : 0x4000000000000
 - Processor Flags...................... : 1

Socket: FCLGA1151

You can grab this information with help of AppleIntelInfo.kext (preferred) or by entering three commands in a terminal window:

sysctl -n machdep.cpu.brand_string
sysctl -xn machdep.cpu.signature
sysctl -xn machdep.cpu.processor_flag

Then visit and select the processor family and processor model that you have. Now copy the link and let me know what you’ve got.

Note: One data set per processor model is enough.

Edit: The data for sockets FCLGA1151 and FCLGA2011-3 should now be covered, but if you have a different value in MSR(MSR_IA32_PLATFORM_ID) then please add yours!

Thank you!


The Geekbench’s Mac Benchmark Chart Is Pretty Much Useless…

The results of the Mac Benchmark Chart is stripped. Much of the important data is removed (from user submitted results). There is no information about the installed Operating System, Processor ID, Motherboard, BIOS and Memory. But you need to have this data, otherwise the results are completely useless. Just look at it:

What does that tell me? Nothing! Without the missing details, that could even be a coffee grinder. That’s how much I value it. Now it is meaningless, but it could have been so much better. For example. There should at least be one reference (link) to a user submitted Geekbench result where all data is visible. If not all of the used results. Also. You cannot compare one (Mac) result with another. And what about graphics?

Also. When you visit Mac Benchmark Chart and click on one of the links in the chart, then click on another link, then you’ll find that all links are broken. Look here:

This is what I get right now. Not good.

Well. I don’t know about you, but for now, I am going to ditch the and look for something better. A tool / website that does not hide significant details. Stuff that is uploaded by users, and then get ripped out of the results.

Ehm. No. I have no idea why Geekbench does this. I’m sure that the links will get fixed. Sooner or later. But we can only hope that the Mac chart will be improved and made meaningful again.

Edit: I don’t have access to my e-mail and can’t contact Geekbench right now, but someone (else) should at least inform them about the broken links. Thank you!

Update: Good news. The broken links are now fixed. Now, please, add references. Thank you!

HomePod detection located in High Sierra…

Ok. This is news to me. So the “AudioAccessory” and “HomePod” are not the same things? That is. Not for IMFoundation.framework:

#define NSNotFound    NSIntegerMax

void * +[IMDeviceSupport marketingNameForModel:](void * self, void * _cmd, void * arg2) {
    r15 = arg2;
    if ([r15 rangeOfString:@"iPod"] == NSNotFound) {
            rbx = @"iPad";
            if ([r15 rangeOfString:rbx] == NSNotFound) {
                    rbx = @"iPhone";
                    if ([r15 rangeOfString:rbx] == NSNotFound) {
                            rbx = @"Mac";
                            if ([r15 rangeOfString:rbx] == NSNotFound) {
                                    if ([r15 rangeOfString:@"AppleTV"] == NSNotFound) {
                                            if ([r15 rangeOfString:@"Watch"] == NSNotFound) {
                                                    rbx = @"HomePod";
                                                    if ([r15 rangeOfString:@"AudioAccessory"] == NSNotFound) {
                                                            rbx = @"Mac";
                                            else {
                                                    rbx = @"Apple Watch";
                                    else {
                                            rbx = @"Apple TV";
    else {
            rbx = @"iPod touch";
    rax = rbx;
    return rax;

So basically what happens here is that if it finds an “AudioAccessory” (as product/model identifier) then it returns “HomePod”. So that we, the users, know what it is. Fine. Not a big deal.

The string “HomePod” can also be found in Sharing.framework

Time to get some food. I’m hungry…

Edit: Right. Someone spotted an error – see comments. Fixed. Thank you. Back to my food now.

Cool. I also found some interesting strings. I think that this is for a (future) HomePod setup app on Mac’s.

	<string>My Home</string>

	<string>Default Room</string>
	<string>Dining Room</string>
	<string>Living Room</string>
	<string>Master Bedroom</string>

I can’t remember it, but haven’t we seen this before? For the AppleTV maybe?

Scripts to install High Sierra DP7 (17A352a)…

We have a new handy script ( to install macOS High Sierra Beta DP-7.

The installer.pkg created by the script will simulate the App Store download and installation method, and all you have to do is:

1.) Run
2.) Run /Applications/Install macOS High Sierra
3.) Reboot

Notes: I have yet to try the scripts myself – I cannot download the files right now (we’re still at sea). Also. You may want to run in single-user mode.

Please note that the App downloads files to: /Library/Updates but this script will use: /tmp/091-28482 and the downloaded files will be gone after a reboot, so you may want to make a backup of the files!

Note: The preferred way of installing / upgrading High Sierra (DP-7) on a Mac is to use the App Store !!!


Apple to cleanup a BIOS region of your AMI or Phoenix (PC) BIOS…

Ok. So you use Clover with an AMI or Phoenix BIOS. Well. In that case you may be interested in this:
Image of AM and Phoenix BIOS cleanup code
LOL Why would Apple do this? Because you and your hack are such good friends?

Oh yeah. I should add that this can be found in: /usr/libexec/firmwarecheckers/eficheck

usage: eficheck: [ --save -b  ]
                 [ --cleanup -b  ]
                 [ --generate-hashes [ -b  ] [ -p  ] ]
                 [ --integrity-check [ -h  [ -b  ] ] ]
                 [ --show-hashes [ -h  ] | [ -b  ] ]

	  'eficheck --save -b firmware.bin'
		 Save this system's EFI firmware as firmware.bin
	  'eficheck --cleanup -b firmware.bin'
		 Overwrite the EFI variables portion of the firmware, enabling the file to be shared for analysis
	  'eficheck --generate-hashes'
		 Analyze the current system's installed EFI firmware, and store the hashes into hash file(s) in current folder
		 File name(s) will be selected according to image's EFI version(s)
	  'eficheck --generate-hashes -b firmware.bin'
		 Analyze the firmware.bin, and store the hashes into hash file(s) in current folder
	  'eficheck --generate-hashes -p /usr/local/allowlists'
		 Analyze the current system's installed EFI firmware, and store the hashes into hash file(s) in /usr/local/allowlists folder
	  'eficheck --integrity-check'
		 Attempt to automatically determine which firmware you are running, and integrity check against the appropriate file, and report any differences
	  'eficheck --integrity-check -h /usr/libexec/firmwarecheckers/eficheck/EFIAllowListShipping.bundle/allowlists/IM171.88Z.0105.B08.1604111319.0.ealf'
		 Compare the current system's EFI firmware against the Apple-provided expected measurements for an "iMac17,1" at firmware revision B08, and report any differences
	  'eficheck --integrity-check -h hash.ealf -b firmware.bin'
		 Compare the given hash file against against the given firmware image and report any differences
	  'eficheck --show-hashes'
		 Print the hashes for the current system's installed EFI firmware to stdout
	  'eficheck --show-hashes -b firmware.bin'
		 Print the hashes for the given firmware.bin to stdout
	  'eficheck --show-hashes -h allowlist.ealf'
		 Print the hashes for the given allowlist.ealf to stdout

Data is downloaded from: and the initial package (EFIAllowListAll.pkg) can be downloaded here. There’s also EFIAllowListInternal.pkg for Apple engineers, but that is not a public download.

_IsInternalOsBuild calls csr_check(CSR_ALLOW_APPLE_INTERNAL) to differentiate between public and internal OS builds.

It works with /System/Library/Extensions/eficheck.kext which matches via PCI device-id’s with one of the Intel LPC Controller/eSPI Controllers in this list:


So what is this? What does it mean?

Well. Apple is likely using eficheck as an extra layer of security. To verify your EFI ROM checksum against the original one in a EFI ROM database, with the checksum of files that were produced by Apple. Or that you are using some modified copy of their EFI ROM firmware. This may mean that your EFI ROM is either broken or otherwise altered. And then it gets invalidated. So far it sounds good, but what about wiping a BIOS region in a PC BIOS (dump)? Why would Apple want your PC BIOS dump? Sorry but I don’t understand that. Why? Maybe someone else can help me here.

Edit: someone e-mailed me and said that a possible reason could be that Apple wants to know how many people are using a hack. That is possible, but I don’t think so. I’m sure that Apple has all the data they need. Likely for years already.

Update: Don’t you worry. Apple is not going to brick your PC. Apple will never do something like that. This was also not the whole point of this writeup. No. It’s more about the technical aspects and implementation of eficheck and eficheck.kext and what it does. I was just curious. As always.

Also. There appears to be this dialog:
Image of the eficheck dialog
Honestly. I personally had never seen it, but there you have it. Thanks to @stroughtonsmith. Anyway. Just don’t click “Send to Apple” on a hack. Or wait. Let’s just click that button and wait and see if the ROM’s checksum shows up in a next update – this may as well be a fully automated process, like Apple used to add unsigned kexts to OSKextExcludeList (think AppleKextExcludeList.kext).

But seriously. Does eficheck --integrity-check even work with a Clover setup? What is the console output that you get when you run it? And in case that works for you, then my next question would be; Is your personal/identifiable data really removed?

There is one other thing that I’d like to figure out, and that is why Apple reads the PlatformUUID. That should not be required. Not ever.

Xeon Microcode Located In iMac Pro Firmware…

Ok. I said to check the Intel microcode that Apple used in the “accidentally” released firmware for the iMac Pro and here it is;
Snippet of Intel microcode of the iMac Pro
The above image shows you the header of the Intel microcode that I located in the firmware file of the iMac Pro. The data in the red box is the CPUID.

Right. You need to know how to read it, but that 52 06 05 00 is CPUID 0x050652 of the Intel Xeon processor (B-0 stepping) in the iMac Pro.

This CPUID – and the one for the H-0 stepping – can be found in the Intel® Xeon® Processor Scalable Family datasheet (see: xeon-scalable-spec-update.pdf).

Edit: I checked the processor flags in the header (97 00 00 00) and that is exactly the same as what you see on X299 platforms. You can check this with:

sysctl -xn machdep.cpu.processor_flag

With a Skylake processor with CPU signature 0x000506e3 that is 0x00000001. You can check this with:

sysctl -xn machdep.cpu.signature

But perhaps it is better to use the latest version of AppleIntelInfo.kext (v2.7) since it logs all bits from MSR_IA32_PLATFORM_ID/0x17. Or some other tool that can dump the output of MSR_IA32_PLATFORM_ID.

iMac Pro Xeon Processor…

Aha. This is cool. Thanks to Intel lifting a lid in their documentation for developers. The iMac Pro comes with the Intel® Xeon® Processor Scalable Family, based on Skylake microarchitecture. Which is confusing the crap out of me.

The CPUID checks (0x5065X) for it are already there in High Sierra!!!

The Developer Previews of High Sierra supports both Skylake X and new Xeon models!

Apple can use processors from the Scalable Family for a new Mac Pro, without having to change anything in the xcpm_bootstrap and cpuid_set_info routines!

This particular piece of XNU code has changed for High Sierra:

static uint32_t
cpuid_set_cpufamily(i386_cpu_info_t *info_p)
	uint32_t cpufamily = CPUFAMILY_UNKNOWN;

	switch (info_p->cpuid_family) {
	case 6:
		switch (info_p->cpuid_model) {
		case 23:

	info_p->cpuid_cpufamily = cpufamily;
	DBG("cpuid_set_cpufamily(%p) returning 0x%x\n", info_p, cpufamily);
	return cpufamily;

In the currently available source code (for Sierra 10.12.4) the lines for Kabylake are missing, as well, of course, for the line to support the new Skylake processors.

There are currently no CPUID checks (0x5067X) for the Intel® Xeon PhiTM Processor 3200, 5200, 7200 Series in High Sierra, but then again, that may change with a future update!

Warning: My assumption here is that the xcpm_bootstrap and cpuid_set_info routines in the XNU source code for High Sierra aren’t going to change anymore, since the iMac Pro (iMac19,1) is already being used with High Sierra (websites can confirm this by checking their logs) but we still don’t know for sure what Apple will use in the iMac Pro.

Ok. So the CPUID checks are there, and there is (still) no Apple hardware with a Skylake X processor, but the iMac Pro won’t be available before December 2017 so anything can happen. Please keep that in mind!

Edit: For people wondering about what CPUID’s are, here are a few example:

0x506E3 Skylake Desktop
0x50650 Skylake-X
0x50652 Skylake Xeon (stepping B-0)
0x50654 Skylake Xeon (stepping H-0)
0x6066X Cannonlake
0x706EX IceLake

This number is used to identify the processor family, model and stepping. In CPU-Z you would see this next to “Ext. Model”:


In the same order as the numbers above.