Jump to content

DarwinDumper

Bootloader BIOS IOReg Device Properties LSPCI Dump VBIOS SMC ACPI NVRAM

  • Please log in to reply
230 replies to this topic

#181
blacksheep

blacksheep

    InsanelyMac Protégé

  • Members
  • PipPip
  • 50 posts
  • Gender:Male
  • Location:Warsaw, Poland

Thanks for the report blacksheep.

When run on a real Mac, the video bios is saved from IORegistry.

Can you please post the DarwinDumperReports directory of a dump with the 'BIOS - Video' and I/O Kit Registry' options ticked?

Here you go.

Used 2.8.8 this time.

Attached Files



#182
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK

Thanks for posting your dumps.

 

Looking at your IORegistry dump I see it contains only a 64K image (0x10000) which is what DarwinDumper saved out. You can see for yourself by loading up IOReg.txt and searching for ATY,bin_image

 

I'm sure there's a simple explanation as to why you do not see the full 128K ROM in OS X's IOReg but I don't know it. Maybe somebody else will be able to throw some light on the subject?

 

If you still want to dump the card's ROM then I understand you can save the card’s ROM from Windows using ATIFlash with a command like this (though check the command first just to make sure it is actually the right command):

atiflash -s 0 myrom.rom 20000


#183
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK

DarwinDumper is now under GPL v3.

v2.8.9f -> 2.9.0

- Add additional logging for writeable save path.
- Add detection for 4K sector drives in the Disk Partition Table dump (Thanks JrCs).
- Add kernel sysctl_machdep_xcpm dump (Thanks Pike - http://bit.ly/NHg1JH).
- Split HTML report kernel info to separate tables.
- Fix decoding of more than one ATI Video ROM’s.
- Add physical block size disk info to Bootloaders & Disk Sectors dump files.
- Removed the use of Apple’s ‘Strings’ binary, using instead binary grep.
- Widen the HTML report to accommodate more info.
- Update dmidecode to v2.12 (Thanks Slice).



#184
MARKBOARD NETSET

MARKBOARD NETSET

    InsanelyMac Protégé

  • Members
  • Pip
  • 33 posts
  • Gender:Male
  • Interests:Luck for Hack

Hi Blackosx :)

 

Edit: Using darwindumper 2.9.1 to dump my Dell inspiron N4050 & iMac mid2010  :D

 

Thank you for this nice helpful app. Good luck for improving it more and more  :thumbsup_anim:

Attached Files



#185
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK
v2.9.0 -> 2.9.1
 
- Fix incorrect bootlog path in privatise function.
- Add private mask for DMI table -> System UUID in both .txt and .bin files.
- UI now directs user to ‘Save Directory’ page if custom path is missing.
- Revise UI ‘Custom Path’ page and add option for opening the current path in the Finder.
- Change assigned file extensions to dumped EDID files.


#186
bronxteck

bronxteck

    InsanelyMac Protégé

  • Members
  • PipPip
  • 51 posts

thanks.



#187
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK
v2.9.1 -> 2.9.2
 
- Revise driver loading to fix bug where pciutils driver would be unloaded if already present on users system.
- Updated flashrom to v0.9.7-r1786 and amended script to dump first chip if more than one chip found (thanks THe KiNG).
- Updated edid-decode with revised version by Andy Vandijck which now decodes the Chroma Info.
- Kernel message buffer is now dumped using dmesg before any other dumps.
- Disassemble DSDT and any SSDT's as multiple tables from single namespace.
- Add last boot from Apple System Log to kernel log dump.
- Don’t load RadeonPCI kext for vBIOS dump when kernel is booted in 32-bit mode.
 
Please report any problems.


#188
asquare

asquare

    InsanelyMac Protégé

  • Members
  • Pip
  • 10 posts
  • Gender:Male

Tanks



#189
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK
v2.9.2 -> 2.9.3
 
- Fix bug where unique partition ID read from ioreg could be incorrect if more than one result was returned.
- Add error checking when disassembling DSDT and SSDT’s as multiple tables from single namespace.
- Add new style html report which now uses standard jQuery and jQueryUI libraries and makes use of the accordion and tab widgets.
- Improved markup results in a smaller html file for a full dump.
- Split dmi dump in the html report by table types.
- Fix clicking collapsible div to toggle state when both open and closed.
- Add missing filepath /EFI/CLOVER/BOOT/ when looking for UEFI boot files.
- Only include relevant css and js for ioregistry viewer dump to html report if necessary.
- Move the Apple System Log to it’s own dump as root privileges are not needed for it.
- Many other small bug fixes, tweaks and improvements.


#190
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK
v2.9.3 -> 2.9.4
 
- Replace the MacGap UI with newly compiled fat binary. (Thanks alexq/STLVNUB).
- Fix problem with new html report where more than one edid exists.
- Revise cleanup of temporary dmi files.
- Add atomdis to disassemble ATI Radeon vbios ROM (Thanks Slice).
- Add AnalyseVBIOS to analyse Nvidia vbios ROM (Thanks Slice).
- Replace 32-bit version of RadeonPCI.kext for OS X 10.6 and 10.7 with revised version by Slice that does not kernel panic.
- Add word decoded to decoded Radeon ROM txt file.
- Revised AppleSystemLog dump code.
- Try twice to unload VoodooHDA.kext (because of dependencies), if the script loaded it.


#191
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK
v2.9.4 -> 2.9.5
 
- Firmware log should now correctly dump regardless of firmware-vendor.
- Replaced edid-decode with binary version that works on 10.8.
- Fix bdisk script output for partition type 0f (WIN95: Extended partition, LBA-mapped).
- Include Ozmosis Defaults.plist in bootloader configuration files dump.
- Adjust privatise routine to only mask loader confing data thats longer than 3 chars to avoid multiple search/replace issue.
- Add detection for a Non System FAT16 partition boot sector to the boot loader detection routine, to match the disk partition routine.


#192
Onixs

Onixs

    Since 2007

  • Members
  • PipPipPipPipPipPipPip
  • 749 posts
  • Gender:Male

still no way to dump AcpiTables on Yosemite? Tried 2.9.5 but still no .AML found in Acpi Tables folder.



#193
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK
Not currently, since Apple removed them from ioreg.
 
One way to get the ACPI tables from within the OS would be to access them directly from memory but that will require the attention of a kind developer with some spare time.


#194
pokenguyen

pokenguyen

    InsanelyMac Sage

  • Members
  • PipPipPipPipPipPip
  • 442 posts
  • Gender:Male
MacIASL can still get ACPI tables from system.

#195
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK

I've just tried PHPdev32's MacIASL and it does indeed retrieve the ACPI tables from Yosemite. Nice!

Thanks for the info pokenguyen.



#196
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK

From pokenguyen's note about MacIASL working fine in Yosemite, I've taken a look at PHPdev32's excellent MacIASL app and from that gone on to create a small program to dump the ACPI tables (as a binary .plist) which DarwinDumper can then use. So thank you for MacIASL PHPdev32.

 

The app and sources are currently posted at:

http://www.projectos...indpost&p=41150

 

There's also DarwinDumper_v2.9.6beta4 which makes use of it and can now dump the ACPI tables in Yosemite.

http://www.projectos...indpost&p=41154

 

I hope to release DarwinDumper_v2.9.6 soon.



#197
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK
v2.9.5 -> 2.9.6
 
- Add CPU Info option. Using x86info binary (Thanks Slice).
- Add dumpACPI tool to dump ACPI tables from OS X, including Yosemite.


#198
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK
I'm working towards adding an option to DarwinDumper to dump native ACPI tables, or at least the native DSDT, from memory. I've created a script to do this and have run many tests here on my hack (booting from Chameleon, CloverEFI and Ozmosis), an iMac11,2 and MacMini6,2. The scans on these machines all work well.
 
I am now at the stage where I require more data and would like to ask for testers to run the script and provide results for examination.
 
The script does the following:
1 - Attempts to load pmem.kext which presents /dev/pmem.
2 - Runs the FirmwareMemoryMap dtrace script to create a memory map.
3 - Identifies areas of memory to scan.
4 - Looks for valid RSDP pointers.
5 - Follows all pointers found and subsequently finds, verifies and writes all located ACPI tables to file.
 
The script creates a save directory named dump_<TIME> in the same directory as the script.
 
If anyone is willing to run this test then I would like the following:
- a copy of the dump_<TIME> directory.
- which bootloader used for current boot.
- any errors or problems with the script.
 
Please note:
1 - The script requires root priviliges to load the kext, and will ask for your password.
2 - As the script accesses direct memory, there may be a chance your system could freeze. This is unlikely as it's following a memory map, but it's worth being aware of so I recommend saving all open files and finish any work before testing.
 
Thanks
 
Attached File  dumpACPIfromMem_v0.38_auto_debug.zip   19.07KB   3 downloads
 
EDIT: Fixed a bug in the memory region detection routine.
Attached File  dumpACPIfromMem_v0.39_auto_debug.zip   19.08KB   2 downloads
 
EDIT2: Take into account 4 byte address pointers in ACPI v1.0 RSDT.
Attached File  dumpACPIfromMem_v0.40_auto_debug.zip   19.11KB   2 downloads
 
EDIT3: Fix bug when looking in FACP for FACS and DSDT address pointers when parsing ACPI v1.0 RSDT.
Attached File  dumpACPIfromMem_v0.41_auto_debug.zip   19.17KB   0 downloads
 
EDIT4: Replaced pmem.kext with signed version from http://www.rekall-forensic.com
Attached File  dumpACPIfromMem_v0.42_auto_debug.zip   25.12KB   4 downloads
 
EDIT5: Reduce block size for more accuracy.
Attached File  dumpACPIfromMem_v0.43_auto_debug.zip   28.17KB   3 downloads
 
EDIT6: Check for non-original SSDT-CpuPM tables and don’t scan for further tables.
Attached File  dumpACPIfromMem_v0.44_auto_debug.zip   28.35KB   4 downloads
 
EDIT7: 
- Add check for SSDT with table ID CpuSsdt. Previously only checked for CpuPm.
- Reset facs and dsdt address vars before interpreting an RSDT/XSDT table.
- Tables with 00 in signature no longer get saved.
- Dump directories that contain just an RSDT with invalid address pointers are deleted.
Attached File  dumpACPIfromMem_v0.45_auto_debug.zip   28.18KB   3 downloads

 



#199
kyndder

kyndder

    InsanelyMac Geek

  • Members
  • PipPipPip
  • 145 posts
  • Gender:Male
  • Location:Brazil

Here you go > http://cl.ly/1W0r2B0G0k2B

 

Thank you blackosx!



#200
blackosx

blackosx

    InsanelyMacaholic

  • Coders
  • 3,089 posts
  • Gender:Male
  • Location:UK

Thank you kyndder. :D

I'll take a look.

 

EDIT: Well we got a successful dump!

However, your dump highlighted a bug in the routine that detects the memory regions to scan.

I have fixed it and posted v0.39 of the script above.

 

If you get time, can you please test the new version?

 

EDIT2: And was that dump from Clover UEFI or CloverEFI?

 

Thanks







Also tagged with one or more of these keywords: Bootloader, BIOS, IOReg, Device Properties, LSPCI, Dump, VBIOS, SMC, ACPI, NVRAM


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

© 2014 InsanelyMac  |   News  |   Forum  |   Downloads  |   OSx86 Wiki  |   Mac Netbook  |   PHP hosting by CatN  |   Designed by Ed Gain  |   Logo by irfan  |   Privacy Policy