Jump to content

-Archive- Macefix86 2006 -Archive-


  • This topic is locked This topic is locked
442 replies to this topic

#61
bofors

bofors

    ConvertIt2Mac.com

  • Members
  • PipPipPipPipPipPipPipPipPipPipPip
  • 3,462 posts

by doind it that way, i would not even know where to start.
I am not a programmer or a coder and have limited knowledge of c++.
I do not know what to do with an fd file: how would you reverse engineer it? How would you split it open and view it's contents?

The actual programming to do this would be very simple, again if the .efi files are merely concatenated. It is the reverse engineering that is the real issue, figuring out how the .efi files are packed into the .fd file, specifically, where each one starts and ends. The .fd file could include some kind of table which holds this information or the .efi files could delimited by special code sequences.

We can get back to the .fd file approach later, you almost got it the other way.

#62
bofors

bofors

    ConvertIt2Mac.com

  • Members
  • PipPipPipPipPipPipPipPipPipPipPip
  • 3,462 posts

[update]
I chose handle 87: the hfsplus.efi one.


Good choice, it is easy to test if that one works.

Finally, i did dmem to output just the memory address of handle 87.


Great, that should be your .efi file then, right?


All the files are attached. Notice that dmem_of_dh_87.txt has both hex (on the left) and ASCII (on the right).
That's what i've been talking about!
...
Now maybe we can (somehow) take all this and turn it into another type of file? I don't know how, though.


The ASCII is just a translations of the hex code. For example your hex starts with "4D 5A", that corresponds to "M" and "Z" in ASCII. I think you are a little confused here, just ignore the ASCII for now, it good for revealing clues and such for reverse engineering.

All we are interested in is the hex code. It looks like you opened up the hex code in a hex editor to get "dmem_of_dh_87.txt". So I think you already have it. It is just the raw "dmem to output" file.

#63
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada
Yeah that pretty much sums it up.
Sorry about the ASCII confusion...i guess i just haven't been explaining myself very well!
So yeah, there we have the hex code for hfsplus.efi.

Basically, now we need to take the code and turn it back into an efi file.
I don't have that microsoft compiler...

I was thinking maybe the intel hex format could help us in some way?
I haven't dont enough research...
anyone have some efi driver modules from like the tianocore implementation?

is there some sort of translator out there to convert the hex code to like the intel hex format? I know that with a real hex file, we could convert it to a binary file, which i THINK we can compile to an efi file...

If anyone wants to contribute, the first thing you could do (apart from looking for answer to the next objective) would be to delete everything else in the dmem_of_dh_87.txt except for the actual hex code... like everything around it, including the memory address to the left and text to the right.
I think that would be more usable than what we currently have. Any way to automate this?

#64
sbeehre

sbeehre

    InsanelyMac Geek

  • Retired Developers
  • 196 posts
  • Location:New Zealand

If anyone wants to contribute, the first thing you could do (apart from looking for answer to the next objective) would be to delete everything else in the dmem_of_dh_87.txt except for the actual hex code... like everything around it, including the memory address to the left and text to the right.
I think that would be more usable than what we currently have. Any way to automate this?


maybe we could write a small c application to remove the first 2 spaces of each line in the file and write it out to a new file.

#65
Rammjet

Rammjet

    InsanelyMac V.I.P.

  • Gurus
  • 5,302 posts
  • Gender:Male
I wonder if dmem has additional paramters where it dumps only hex and not ascii.

#66
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada

maybe we could write a small c application to remove the first 2 spaces of each line in the file and write it out to a new file.


Actually, since the lines are 79 characters long, we would have to remove 1-12, then all the spaces between hex pairs, that dash in the middle, and then the whole 2 spaces after the last hex pair and all the ASCII after that.


I wonder if dmem has additional paramters where it dumps only hex and not ascii.


I don't think so. I'll check again, but it doesn't look like it.

I'm currently working with a hex program just to analyse the text and compare it to exe and efi files. So far so good...

#67
bofors

bofors

    ConvertIt2Mac.com

  • Members
  • PipPipPipPipPipPipPipPipPipPipPip
  • 3,462 posts

Actually, since the lines are 79 characters long, we would have to remove 1-12, then all the spaces between hex pairs, that dash in the middle, and then the whole 2 spaces after the last hex pair and all the ASCII after that.
I don't think so. I'll check again, but it doesn't look like it.

I'm currently working with a hex program just to analyse the text and compare it to exe and efi files. So far so good...


I think there has to be a way to just dump the raw hex without the additional {censored}.

#68
sbeehre

sbeehre

    InsanelyMac Geek

  • Retired Developers
  • 196 posts
  • Location:New Zealand
Urby.... So the hex2bin pearl script looks like it could work then if we have a pure hex file?

#69
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada
I'm working with a few programs...
the best seems to be FlexHEX for windows.
If we can get it all without the additional {censored}, we should have no problems just importing the text file to this program and tell it that the text it contains is hex data.
Then, we have to make sure it recognizes separators (not sure precisely how that works, still testing).

The script wont be necessary. I should be able to just export the newly created hex file, rename it as efi and there's the hfsplus module.

Again, nothing is certain, but i have strong evidence to back this up. I'm also gonna try working with some spreadsheets to import and export the text file, perhaps getting the "{censored}" out that way. There must be a way to manipulate the text file and kill all but what we want.

Stay posted.

#70
bofors

bofors

    ConvertIt2Mac.com

  • Members
  • PipPipPipPipPipPipPipPipPipPipPip
  • 3,462 posts

I'm also gonna try working with some spreadsheets to import and export the text file, perhaps getting the "{censored}" out that way. There must be a way to manipulate the text file and kill all but what we want.

I think it would much easier to just write program like dmem that dumps it raw. I mean, this would like a 10 line program in C.

#71
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada
Well then we need someone that is capable of that...
I unfortunately am not there in my c++ studies yet, so can be of no help.

However, give me a few hours and i'll surely find another way of doing it.
It won't be the most accommodating method, but it will be the easiest for me.

If anyone is up to it, go right ahead. Hell, i'm sure applescript can be used for something like this...

#72
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada
WOOHOOOO!!!!!!
ONE STEP CLOSER TO AN EFI MODULE!

Attached Files



#73
bofors

bofors

    ConvertIt2Mac.com

  • Members
  • PipPipPipPipPipPipPipPipPipPipPip
  • 3,462 posts
Great, so all need to do is remove the "white space" and "return" commands?

#74
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada
no, all i need to do is put together a hex file from this text file, save it as efi and hope for the best!

Everyone cross your fingers!

#75
bofors

bofors

    ConvertIt2Mac.com

  • Members
  • PipPipPipPipPipPipPipPipPipPipPip
  • 3,462 posts
Urby3, have you looked at the "hexedit" EFI command:

hexedit

hexedit [[-f]FileName|[-d DiskName Offset Size]|[-m Offset Size]]

-f - Open file to edit
-d - Open disk block to edit
DiskName - Editing disk's name (for example fs0)
Offset - Starting block's No. (beginning from 0)
Size - Number of blocks that to be edited
-m - Open memory region to edit
Offset - Starting offset of memory region (beginning from 0)
Size - Size of memory region that to be edited

This command allows a file, block device, or memory region to be edited. The region being edited
is displayed as hexadecimal bytes
, and the contents can be modified and saved. The following
example shows typical output for help on this command.


http://www.intel.com...ll_cmnd_1_1.pdf

EDIT: I actually think that this will have the same result as "dmem".

#76
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada
yes, i looked at that.
However, it can only be used in the memory itself.
it doesn't allow you to save the internal data, nor print the command to a text file. It would, however, let you change the contents of the memory.

So, using the edit command, you could copy all the hex from the file i posted above and paste it into the memory and i am assuming it should be the same as loading the efi module.

I will try this soon, at the moment i'm just trying to create the efi file.

#77
bofors

bofors

    ConvertIt2Mac.com

  • Members
  • PipPipPipPipPipPipPipPipPipPipPip
  • 3,462 posts

Well then we need someone that is capable of that...


If you have the ability to load and execute custom EFI programs in the EFI Shell, this should be no big deal. It will be even easier if the source code is availble for the "dmem", "hexedit" or "dblk" EFI commands is availble in some "sample" EFI implementation.

#78
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada
We actually need none of that.

Ladies and Gents, I give you HFSPlus.efi. Fully loadable, complete and working.

Attached Files



#79
bofors

bofors

    ConvertIt2Mac.com

  • Members
  • PipPipPipPipPipPipPipPipPipPipPip
  • 3,462 posts
That's great.

How much work is it going to be to get the complete .efi set?

#80
Urbz

Urbz

    La cr�me de la cr�me...(?)

  • Retired Developers
  • 837 posts
  • Gender:Male
  • Location:Montreal, QC, Canada
not much.
a few hours in all.
Do you happen to know how many there are?

BTW i'm out for tonight, and i won't be home most of tomorow.
Would all the drivers in the drivers.txt that i posted above be everything we need?
If so, this will happen very quickly indeed!

Finally, the forum wouldn't let me post the actual .efi file. Is this illegal?





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

© 2014 InsanelyMac  |   News  |   Forum  |   Downloads  |   OSx86 Wiki  |   Mac Netbook  |   PHP hosting by CatN  |   Designed by Ed Gain  |   Logo by irfan  |   Privacy Policy