Got SYS_FAN working on BMC firmware v12.61.39 yesterday, without SSH access.
Newer firmware versions disable BMC SSH completely, so running bmcprog directly on the BMC, as discussed earlier in this thread, was no longer an option. JTAG was not something I felt comfortable attempting at the time either.
Fortunately, I had a spare board available, which allowed me to work through and validate the entire process before touching the main system. It turns out that bmcprog is simply an ARM binary contained in the firmware root filesystem. You can extract it from a full gigaflash -dump image, run it under qemu-arm in a disposable VM, and use it to compile a valid SKU.BIN without requiring BMC shell access.
I tested the complete procedure on the spare board first and then applied it successfully to the production system.
I documented the full process here, in case it is useful to anyone else:
GitHub - Gizmo-Ger/sys-fan-mj11-g431mm0: SYS_FAN sensor unlock + custom fan curves for Gigabyte MJ11-EC1/G431-MM0 BMC boards
This was honestly a project I had been putting off for quite some time. I had known about both the SSH-based method and the JTAG approach for a while, but never found the time or motivation to work through it properly. A failed USB-TTL adapter and a rainy Sunday afternoon finally pushed me to investigate an alternative approach. AI also helped me structure and polish the documentation, which is what finally got the project over the line.
The method worked cleanly on both of my boards, but please verify every step yourself before attempting it on your own hardware.
The result is a noticeably quieter system now that the case fans are properly detected and controllable instead of running at full speed.
One additional finding while digging through the BMC config partition:
On the locked firmware, the sysadmin account does not appear to be disabled at the account level. Instead, ssh_server_config simply contains:
DenyUsers sysadmin
The account itself still has a valid password hash and UID 0.
I have not yet tested whether gigaflash -restore also restores this file. According to the documentation, -restore does restore user-related settings, while deliberately leaving FRU/SKU identity data untouched. It is therefore possible that removing the DenyUsers sysadmin line from a config backup and restoring it may re-enable SSH without requiring the full repack-and-write procedure used for the SKU fix.
If -restore does not touch this file, the same extraction, repacking, and flashing approach may be required.
Anyone who still has a board with working BMC SSH access could test this much more quickly than I can on a locked board.