Patching AirPortBrcm4360 kext for unsupported Mac models

[Hervé]

We've had many posts from users who have a wireless card controlled (and sometimes natively supported) by the AirPortBrcm4360 kext in their laptop Hackintosh but are not able to get it to work unless they opt for, say, the MacBookAir5,2 SMBIOS. The DW1520 wifi card is one of those for instance: 14e4:4353 is supported OOB but only with some SMBIOS such as MBA5,2. It's also been stated that reason for this was "whitelisting" by Apple in the kext, i.e. Apple have specified a set of Mac models for which the card would work (and would not work for others as a consequence).
 
Those who want to get their cards working without switching to MBA5,2 SMBIOS have little choice but patching the kext in order to "inject" their specific profile. In this case, we're not talking about a simple traditional PCI id injection in the kext's Info plist, we're talking about binary patching the kext's binary file.
 
NB: some cards are not natively supported by the kext and PCI device patching (injection) is then required in the Info.plist file, i.e. "double" patching so to speak...
 
Let's look at the kext binary file to start with (it's located in the Contents/MacOS folder inside the kext package). Here, we'll look at the file from El Capitan 10.11.3 but the principle remains the same for other OS X versions/releases. The file contains a list of supported Mac models (aka a whitelist), a list expressed with references to product board in the form "Mac-<Hexadecimal string>".

 

In the above picture, we can clearly see the reference to MacBookAir5,2 board id "Mac-2E6FAB96566FE58C", something we can confirm with Chameleon Wizard or Clover Configurator SMBIOS tab if required:

 
In order to modify the kext to support an unsupported model, we're going to binary patch it by replacing an existing board reference by that of the targeted/desired Mac model. For instance, if we want to add support for the MacBookPro6,2 Mac model, we're going to replace all the octets referring to the MacBookAir5,2 board id (but we could replace another model of course) by those referencing the MacBookPro6,2's.
 
There are various ways to binary patch the kext: use a hex editor such as 0xED or Hex Fiend for instance, use a perl command from Terminal, or even use the Clover on-the-fly mechanism. Whilst a hex editor will support text (ASCII) replacement as well as hexadecimal replacement, perl will require sole use of hexadecimal octets. It is therefore necessary to convert the text string to hexadecimal in that case. Whilst the computer-literate people would be able to do this manually, non-IT people would find this rather tedious; fortunately there are various conversion tools around these days, including online (e.g.: http://hex.online-toolz.com/tools/text-hex-convertor.php). Generally speaking, it's always recommended to proceed with the hexadecimal replacement to avoid any confusion in text/ASCII.
 
In the case of the MacBookPro6,2 (board product: Mac-F22589C8), we obtain the following hex string:

4D 61 63 2D 46 32 32 35 38 39 43 38 (i.e. the hexadecimal notation of each ASCII character)

We can also notice that this particular board product contains 8 digits, i.e. less than the 16 digits of the models listed in the kext. With regards to binary patching, we'll therefore replace the "missing" 8 digits by null octets set to 00, making the replacement string:

4D61632D46323235383943380000000000000000

`
The binary patch can therefore be applied in the following manner:


 
For those using Clover, on-the-fly patching is done through the usual Find/Replace method. For instance:

Kext: AirPortBrcm4360
Find:    4D61632D32453646414239363536364645353843     --> MacBookAir5,2
Replace: 4D61632D46323235383943380000000000000000     --> MacBookPro6,2

 

Here's an example previously posted by JakeLo for injection of MacBookPro8,2 reference (text in Clover's config.plist):

<dict>
<key>Comment</key>
<string>DW1520 Whitelist Patch (MBP8,2)</string>
<key>Find</key>
<data>
TWFjLTJFNkZBQjk2NTY2RkU1OEM=
</data>
<key>Name</key>
<string>AirPortBrcm4360</string>
<key>Replace</key>
<data>
TWFjLTk0MjQ1QTM5NDBDOTFDODA=
</data>
</dict>

 

Like many other plist files, Clover's config.plist makes use of Base64 code for data. As such, test must be converted to Base64 code before it's entered through a text editor. Again, there are online tools to help with this (e.g.: http://online-toolz.com/tools/text-base64-convertor.php). The Clover Configurator app will provide a much easier mechanism to program this patch as plain text can be used instead, the app doing the conversion for you.

 

In a nutshell, in order to binary patch the AirPortBrcm4360 for an unsupported Mac model, one needs to:

• identify the board product id of the targeted/desired model
• convert that board id from text to hex
• add any necessary trailing null (00) octets to obtain the required 20bytes string
• binary modify/patch the kext to replace the 20bytes string of an existing model the 20bytes string of the desired model

 

NB: As usual, always keep a backup of the vanilla kext somewhere. To patch the kext, make a copy of the vanilla kext outside /S/L/E (like on the desktop) and patch that copy. The patched kext can then be copied/moved to /S/L/E, permissions repaired and cache/prelinked kernel rebuilt. Direct patching of a kext located in /S/L/E (or /L/E) is usually not allowed due to permission restrictions.

[Jake Lo]

You can also easily convert it with a simple command on the terminal:

echo -n whateveryouwant | xxd

 

For example,

To convert MacBookAir6,2 board id "Mac-7DF21CB3ED6977E5" 

echo -n Mac-7DF21CB3ED6977E5 | xxd

 

yields this:

00000000: 4d61 632d 3744 4632 3143 4233 4544 3639  Mac-7DF21CB3ED69

00000010: 3737 4535                                                        77E5

 

As you can see by adding lines 1 and 2 give you the full hexadecimal 4d61 632d 3744 4632 3143 4233 4544 3639 3737 4535

 

Here's what the Clover patch would look like:

<dict>
<key>Comment</key>
<string>DW1520 Whitelist Patch (MBA6,2)</string>
<key>Find</key>
<data>
TWFjLTJFNkZBQjk2NTY2RkU1OEM=
</data>
<key>Name</key>
<string>AirPortBrcm4360</string>
<key>Replace</key>
<data>
TWFjLTdERjIxQ0IzRUQ2OTc3RTU=
</data>
</dict>