IOKit Patch Broken by El Cap Security Update - Unknown version of IOKit found..

[BabzGits2It]

The IOKit Pixel Clock patch worked fine for me under El Capitan (10.11.6) when I ran it back in early Dec. 2017. During the process, something called “otool” was required and it was automatically downloaded and installed as part of the script. All good. I was able to get 2560x1080/60Hz for my LG Ultrawide monitor on my 2012 Mac Mini.

Then yesterday I ran the latest El Capitan Security Patch and I lost 2560x1080/60Hz.

I thought, “No problem, I’ll just run the script again.” No joy!

I got a message saying something about missing otool. It apparently could not find otool this time and unlike last time would not automatically download and install it.

I located and installed Xcode 7 (the latest version that would install under El Capitan).

Now when I run the patch I get:

Unknown version of IOKit found..
---- BEGINNING MD5 HASH SUMS ---- version: 10.11.6 build:15G18013

     otool IOKit: fdaff44c23350298cb47e33f01c1b284
 otool IOKit.bak: d8829f2234464985863c7a501c288547
           IOKit: 03820d62ca1ffbbe7eed0e2ad3e5b101
       IOKit.bak: 972287f63601ee522401a000eaf02a36

---- ENDING MD5 HASH SUMS -------

Can you help?

(Please note, I am not a programmer and know next to nothing about terminal and commands.)

[Floris497]

Hm, actually I'll take a look at the IOKit again, and I'll be getting a TV that has HDMI 2.0 anyway so i can test is as well. Will be back here later

[Floris497]

Actually, just force the patch it should still work. Please let me know if you need some help with that, but I'll not be able to help now. Tonight i can give some info. (And please see the readme :) it should show some information that could help)

[BabzGits2It]

Thanks, Floris! I don't know how to "force the patch." How would I do that?

[Floris497]

Please check readme something like patch.command patch v4 (idk what version you would need exactly check the code to find out should not be to difficult. Thake a version that's closest to the version you have :)

[BabzGits2It]

Thanks. I have no way of knowing which version to try. Just as an experiment I tried v7 and got this message:

---- ENDING MD5 HASH SUMS -------
[User]-Mini:~ [User]-Mini$ ~/Downloads/IOKit-patcher.command patch v7
An backup file already exists, if you force this patch on an already patched version you will loose the original backup!
This will lead you to reinstall the OS if you loose a working version of IOKit. be carefull
It might be wise to undo the patch before trying to redo it using: /Users/[User]-Mini/Downloads/IOKit-patcher.command unpatch
Do you want to continue? [Y/n] 

Since I don't know what "backup file" is or what losing it would mean or what "undoing the patch" means, and "reinstall the OS" sounds terrifying, this all seemed way too scary to proceed at my present level of knowledge. Therefore, I chose n and aborted.

[Floris497]

I'll get back to you in like 2h okay?

[BabzGits2It]

Ping?

Still out there, Floris? I'm guessing you ran into a snag?

[Floris497]

Ah sorry I didn't remember..

[Floris497]

So why not use the CoreDisplay patch?

[Floris497]

Wait you are on old version of macOS ehm try IOKit-patcher.command patch v7 that should do the trick

[BabzGits2It]

I am still on El Capitan. I would like to upgrade to High Sierra but cannot at present. See above for what happened when I tried to do v7. I don't understand the warning message but it seems to suggest that I could mess up my OS and have to reinstall. I cannot take that risk.

[Floris497]

You can ignore the warning I think. As the backup file was not removed on update of the system. That happens sometimes. If you want to be really sure go to the directory where the backup file is and make another copy of the file. Reinstalling the system is usually only annoying because of the time it takes. But no time files will be lost. It's basically replacing all systems files.

[BabzGits2It]

Forgive me if what you're saying doesn't exactly fill me with confidence. For starters, what is this "backup file" we are talking about? You say "go to the directory where the backup file is and make another copy of the file" but I don't know what I'm looking for, much less the directory in which to find it. And what good will having this back up file do me? That is, at what point will the process go wrong and I will an opportunity to "replace" this "missing file."

Reinstalling the system... We are talking about a complete reinstall of Mac OS 10.11.6? That can be done without losing the data file contents on the system drive? I have no back up of this drive, mind you. Having never done something like this before, even if possible, would be quite harrowing for me.

[BabzGits2It]

I deeply appreciate the help with this, Floris. But it kind of sounds like you are saying there is nothing you can do to IOKit (a tweak to the code, perhaps ) to fix this problem? My only option is to "force" it to install and possibly corrupt my System drive to the point where I'd have to reinstall the system? But I should ignore the warning and try anyway... Is that it? Thank you for helping me to understand more about what is going on.

[Floris497]

Nah, it sounds all more 'dangerous' as it is tweaking the code has the same result actually.. i fell asleep :p

Okay, so the case is:
IOKit file you have right now is identified with this hash: fdaff44c23350298cb47e33f01c1b284 The backup file is identified as an original for 10.11.6. This means this backup is the old original. You can actually remove it (the code of the patch shows the directory where everything is happening, if you care to know)
So if anything would go wrong it could be easily fixed by booting the recovery and choose reinstall macOS it solely replaces the system files not any user files. It's basically the same as running sn update.. but the difference is that you fix instead of update the system.
Anyway.. it's never a bad thing to run backups.

[BabzGits2It]

OK, some things are starting to become a little clearer. (A little. :) )

So all this time I thought that "IOKit" was just the name of the patch script. But I see now that it is a part of the system. It is in fact a "framework". It can be found in /System/Library/Frameworks. And what the patch does is alter this framework.

So this "back up" that we are talking about would be making a copy of the IOKit.framework file before doing the patch, then?

And then if something went wrong (what might that be? A Kernel Panic on boot or something? One shudders to think...) I would somehow have the ability to drop in the backed up version of the framework (the copy made before running the patch), and all would be restored, then?

[BabzGits2It]

Keep in mind, while this might all seem obvious to you, Floris, I am just a humble soul who prior to all this was just looking to plug in and use my new LG Ultrawide monitor via HDMI. :-)

[BabzGits2It]

Also, and this is just a guess... I am asking for your advice, your confirmation on this... If you reveal the contents of the IOKit.framework file you get this:

Am I correct in assuming that the "IOKit.bak" file buried in the "A" folder is a backup of the original default OS 10.11.6 framework file, before I altered it back in December by running the patch?

[Floris497]

Yes the .bak file is indeed the backup file i was talking about. So when something (if anything at all) goes wrong you can swap out the corrupted file with the backup when booting into Single User Mode (cmd + s) while booting.
Maybe send me a message on imessage that will be a bit easier to explain it all (find my dutch email somewhere in the readme, there is a link to it.) (not the me.com one)

[BabzGits2It]

Thanks Floris! I need to ponder my next move for now. Ultimately I do want to upgrade to High Sierra, and then I will have to go through this all over again. I may try getting by w/ SwitchResX for now until the issues with High Sierra get sorted out (two pieces of software I use are currently incompatible under High Sierra, but a fix is in the works).

If I do end up trying to force v7 and run into problems, I may try to text you! Thanks. Babz.

[Floris497]

As far as incan see it's copletely safe to try Patch v7 :) (but i can never gurantee it ofc..)

[BabzGits2It]

Hi Floris. Back again! :)

I decided to force run the v7 patch (after making a copy of IOKit.framework and storing it on an external drive just for safety). The patch ran but it seems it did not work. This is what it says in Terminal:

SIP looks to be disabled, all good!
Patching IOKit with patch version 7
Password:
Re-signing /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit: replacing existing signature
The code is still the same.. Patch did seem to run, but was probbably from the wrong version..
If you are running an new os run /Users/[User]-Mini/Downloads/IOKit-patcher.command md5 and ask the maintainer of this script to add support for your system

What does this mean? Nothing was changed? Right? It seems to suggest I need to ask the "maintainer of this script" (you) to "add support". I'm guessing that the recent Apple Security Update for El Capitan that I did last week changed 10.11.6 in such a way that the pixel clock patch will no longer work, unless it is updated to take into account whatever was changed by the Apple Security Update. Is that right?

[BabzGits2It]

Ping?

Any ideas or suggestions?

Would it help to try to run another version, v6, v5, etc.?

[Floris497]

Ah.. sorry.. I thought I responded to the message.. if you email me the backup from the framework I'll have a look at it later this week :)

[BabzGits2It]

You want the IOKit.framework before or after I ran v7?

[BabzGits2It]

I sent you the version before I ran V7 to your .nl address. Thx! :)

[BabzGits2It]

Hi Floris. Just checking... Did you receive the file I sent you? Thx.

[Floris497]

Hi, yes i did (i think i send back an email that i would look at it this weekend, tomorrow it'll be)

[BabzGits2It]

Oh yes, I found the email now in my spam folder. Thanks for the update!

[Floris497]

Oh I feel like a fool now.. You should have used v6 instead of v7 (7 is for 10.12) I didn't realise there was an update for 10.12 in there.. anyway I updated the script and it should work for you now :)

[BabzGits2It]

I downloaded the latest version and ran it but it did not work. This is what I got (same as before) :

Unknown version of IOKit found..
---- BEGINNING MD5 HASH SUMS ---- version: 10.11.6 build:15G18013

 otool IOKit: fdaff44c23350298cb47e33f01c1b284

otool IOKit.bak: d8829f2234464985863c7a501c288547
IOKit: 03820d62ca1ffbbe7eed0e2ad3e5b101
IOKit.bak: 972287f63601ee522401a000eaf02a36

---- ENDING MD5 HASH SUMS -------

[BabzGits2It]

Also, (question about your previous comment), you say v7 is for 10.12, but I thought 10.2 or higher were supposed to use CoreDisplay Patcher ??? Not applicable to me, since I'm still on 10.11, but just trying to understand your comment.

[Floris497]

Wait that's strange.. just run v6 :) will check later

[BabzGits2It]

Guess what? It looks like v6 worked! Hooray! :-)

So it seems I'm good for a while. Next challenge will be when I have to update to High Sierra.

Thanks so much for your help with this, Floris!

[Floris497]

Yay! You're welcome :)

Enjoy!

[lssbq]

Hi patch v6 seems does not work for me(OSX 10.13.5).
The output is:

[xxxx@XXXX Temp]$ ./patch.sh patch v6
SIP looks to be disabled, all good!
Patching IOKit with patch version 6
Password:
Re-signing /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit: replacing existing signature
The code is still the same.. Patch did seem to run, but was probbably from the wrong version..
If you are running an new os run ./patch.sh md5 and ask the maintainer of this script to add support for your system
[xxxx@XXXX Temp]$ ./patch.sh md5
---- BEGINNING MD5 HASH SUMS ---- version: 10.13.5 build:17F77

 otool IOKit: 08eabeeb096012ee4e2e41ca208186e0

otool IOKit.bak: 08eabeeb096012ee4e2e41ca208186e0
IOKit: b46fa3ee5c3f219c0c7faf2c1cb4f8ef
IOKit.bak: 75befea287581c8e8e08d1d3a42dab5c

---- ENDING MD5 HASH SUMS -------**