CMIzapper Medusa 2
The Medusa is our line of tools to play with the EFI ROM. The tool you need when repairing boards and you want to see the serial number or the firmware version without putting the board in a Mac or when you forgot your EFI PIN and locked yourself out of your Mac. Great if you are in the refurbishing business: the Medusa will also read model, serial number, locked status, etc. from non working Macs.
It is easy to use. The built in LCD display will show you what is going on.
1) Display info from the EFI ROM:
ROM chip model, ROM chip size, Mac Firmware version, ME version, EFI lock state, Mac serial number, production date and time.
2) Copy the ROM to and from the Mac
3) Clean the ME region (many models)
4) Clean the PRAM
5) Clean the NVRAM (Unlocks Firmware password)
6) Set the QE enable bit in Winbond chips, so that they will work in a Mac.
The Medusa 2 plugs into the 'LPC+SPI Connector' (J6100) of the motherboard.
CMIzapper Medusa 2 (for Macs with Hirose-12 or Hirose-30 connector)
Works on: A1398 (from Late 2013 onwards) A1425, A1465, A1466, A1502, A1706, A1708.
A1707 requires extra EasyFlash A4163.
Price 295 euro including shipping world wide.
Includes EasyFlash adapters A4140, A4160 and A4052 and A4043 DIL adapter. More adapters are available here.
Clear display to see what's going on. Switches for the settings.
Included are: USB cable, Adapter (red) for Hirose-12 connector, Adapter (green) for Hirose-30 connector, DIL adapter (to connect to programmer).
To connect to newer macs use the red Hirose-12 adapter.
To connect to older Macs use the green Hirose-30 adapter.
Even older macs with Molex-30 connector are not supported (yet).
With the Medusa connected to the Mac you can read the Mac ROM into an internal ROM in the Medusa. You can the disconnect from the Mac and connect the Meduse to any programmer with the DIL adapter. That way you can then read the ROM into anywhere you want. In the same way you can use any programmer to write the Medusa ROM. Then connect the Medusa to a mac using one of the two adapters. you can then write the (modified) Medusa ROM back into the Mac.
With the switches you choose the following options:
- Show all data from the ROM
- Copy the Mac ROM into the Medusa
- Verify the Mac ROM with the Medusa
- Write the Medusa ROM into te Mac ROM
- Unlock the Mac (if it is EFI locked)
- Set the QE bit in case of a Winbond ROM chip
Reading information and copying the ROM on a MacBook Pro A1708.
From time to time we update the hardware or the firmware in the Medusa.
Use the Firmware page to checkout what the changes are. Please note that it is not possible to upgrade the firmware. But for existing customers payed exchanges might be possible.
You can connect the Medusa to your computer using a SPI ROM programmer. If you connect Port-B of the (unpowered) Medusa to your programmer, the programmer will see the internal ROM in the Medusa. You can then read or write this ROM using your computer and programmer.
The programmer need not be a fancy one. Even the cheapest of the cheap will work on the Medusa.
The included A4140, A4060 and A4052 EasyFlash adapters support the following models.
More models are supported if you buy additional EasyFlash adapters. See those here.
A4140 and A4060 EasyFlash adapter Hirose-12
For use on Macs with a 12-pin Hirose connector. The A4060 tries to manipulate the Mac to keep it quiet the A4140 does not. Depending on the Mac one might work better than the other.
MacBook air 11-Inch A1465 emc2924 (Early 2015) 820-00164
MacBook air 13-Inch A1466 emc2925 (Early 2015) 820-00165
MacBook Pro 'retina' 13-Inch A1502 emc2835 (Early 2015) 820-4924
MacBook Pro 'retina' 15-Inch A1398 emc2909 (Mid 2015) 820-00138
MacBook Pro 'retina' 15-Inch A1398 emc2910 (Mid 2015) 820-00163 & 820-00426
MacBook Pro 'F-keys' 13-Inch A1708 emc2978 (Late 2016) 820-00875
MacBook Pro 'F-keys' 13-Inch A1708 emc3164 (Mid 2017) 820-00840
MacBook Pro 'Touchbar' 13-Inch A1706 emc3071 (Late 2016) 820-00239
MacBook Pro 'Touchbar' 13-Inch A1706 emc3163 (Late 2017) 820-00923
MacBook 'retina' 12-Inch A1534 emc2746 (Early 2015) 820-00045
MacBook 'retina' 12-Inch A1534 emc2991 (Early 2016) 820-00244
MacBook 'retina' 12-Inch A1534 emc3099 (Mid 2017) 820-00687
A4052 EasyFlash adapter Hirose-30
For use on Macs with a 30-pin Hirose connector.
MacBook air 11-Inch A1370 (Mid 2011) 820-2955 and 820-3024
MacBook air 11-Inch A1465 (Mid 2012) 820-3208
MacBook air 11-Inch A1465 (Mid 2013 and Early 2014) 820-3435
MacBook air 13-Inch A1466 (Mid 2012) 820-3209
MacBook air 13-Inch A1466 (Mid 2013 and Early 2014) 820-3437
MacBook pro 'retina' 13-Inch A1425 (Late 2012 and Eary 2013) 820-3462
MacBook pro 'retina' 13-Inch A1502 (Late 2013 and Mid 2014) 820-3476 and 820-3536
MacBook pro 'retina' 15-Inch A1398 (Late 2013 and Mid 2014) 820-3662 and 820-3787
Mac mini A1347 (Late 2012 and Late 2014) 820-3227, 820-3228 and 820-5509
Extra options for Medusa 2:
Extra EasyFlash adapters to support more flavours of Mac.
Boards to program loose ROM chips.
Keyboard for entering serial numbers.