Jump to content

2 Screenshots

About This File

Usage

Drag & drop Disk Utility.app on the icon to patch

 

Description

This app will patch a restriction inside the Disk Utility that prevents it from starting in OS X 10.11 El Capitan. In addition it will patch the binary so that debugMode and advanced-image-options are always enabled on the resulting Disk Utility.app without the need to modify defaults.

 

This will allow you to use this version under El Capitan and with a small modification to your USB Installer you can have access to both new and old Disk Utility with the debug menu enabled during install.

 

 

What is patched

 

systemVersionCheck

------------------------

\xD5\x84\xC0\x0F\x85\x44\x01\x00\x00\x48\x8B\x05\x10\x5B\x06\x00 [original]

\xD5\x84\xC0\xE9\x45\x01\x00\x00\x00\x48\x8B\x05\x10\x5B\x06\x00 [patched]

 

perl -pi -e 's|\xD5\x84\xC0\x0F\x85\x44\x01\x00\x00\x48\x8B\x05\x10\x5B\x06\x00|\xD5\x84\xC0\xE9\x45\x01\x00\x00\x00\x48\x8B\x05\x10\x5B\x06\x00|g' [Drag & Drop Disk Utility binary]

 

 

enableDebugMenu

----------------------

debugMode can also be achieved by drag and dropping the Disk Utility binary on a terminal window and adding --debugMenu at the end.

 

\x3C\x33\x74\x48\x48\x85 [original]

\x3C\x33\x66\x90\x48\x85 [patched]

 

\x85\xFF\x75\x58\x48\x8B [original]

\x85\xFF\x66\x90\x48\x8B [patched]

 

perl -pi -e 's|\x3C\x33\x74\x48\x48\x85|\x3C\x33\x66\x90\x48\x85|g' [Drag & Drop Disk Utility binary]

 

perl -pi -e 's|\x85\xFF\x75\x58\x48\x8B|\x85\xFF\x66\x90\x48\x8B|g' [Drag & Drop Disk Utility binary]

 

expertMode

--------------

\xFF\x00\x75\x25\x4C\x89\xEF

\xFF\x00\xEB\x25\x4C\x89\xEF

 

perl -pi -e 's|\xFF\x00\x75\x25\x4C\x89\xEF|\xFF\x00\xEB\x25\x4C\x89\xEF|g' [Drag & Drop Disk Utility binary]

 

 

List of md5

 

md5 for original 10.10.5 DiskUtility v13 (606)

f4de87e306c1bc6acdef6c6166e574ca

 

md5 for systemVersionCheck binary (only)

3890ef83d60c9e1838be6cf2eee35d18

 

md5 combo systemVersioncheck & expertMode & enableDebugMenu

28e835bf915205c922b892cf01b5b19f




User Feedback

Recommended Comments

What do you mean by decoded? This is all my original work, I had this sitting for a while and decided to make an app to make it easy. I found out today there is a tutorial for the system version check and I found out while trying to upload the app here.

 

In addition my patches activate couple of more perks.

 

Also look for two more apps I am uploading how to get it to run during the El Capitan Installer.

 

So basically if your question is whether I copied someone and I have to give them credit, no I didn't.

Share this comment


Link to comment
Share on other sites

I understand, I am sorry if my reply sounded a little harsh. I had the systemversioncheck patch since the developer beta, but recently I wanted to enable the debugmode and advanced-image-options so I can include it to the USB installer without the need to modify the defaults. I tried to bypass the show all partitions options but clicking the menu item does modify the defaults while at the installation.

 

So I wasn't rushing to release first or whatever, don't care for fame or money. But here you have it. 

 

Actually since I am new to reversing especially on the mac, Disk Utility was a great way to experiment with Hopper Disassembler.

In case someone is interested this is the procedure I used : Modify the binary with hopper, produce new executable, compare the two executable differences with iHex, use perl to patch the bytes.

 

You can actually use a discontinued program called iPatch to generate the patches. It normally doesn't run   under yosemite or el capitan but I took care of that.

Share this comment


Link to comment
Share on other sites

By the way I just looked at the link you provided (glanced to be honest) but from what I saw he/she just patches the JNE (Jump Not Equal, opcode 0F 85) to JE (Jump Equal, opcode 0F 84). If you see my patches I don't do that. If you patch the binary like that the resulting Disk Utility will not run under Yosemite. And I just verified it by downloading it and trying to execute in Yosemite. Try it yourself if you like. My patch changes it to JMP (00000001000061e3         jmp        0x10000632d) which will work in any OS version (not technically speaking).

Share this comment


Link to comment
Share on other sites

By the way since you are the only one that replied did you by any chance try it? I mean I tested every single one before I uploaded them but no one so far gave any feedback. Curious to see if any problem that can be fixed. I am currently working on two little projects that I would like to upload here. Insanelymac is my favorite site on the subject by far.

Share this comment


Link to comment
Share on other sites

Having an issue... I extracted Disk Utility from the 10.10.5 Combo update and dropped it on your patch program -->> Got an error: The document "Disk Utility" could not be opened. diskutilitypatch cannot open files in the "application" format. I used Pacifist to extract with admin rights and am working in folder within downloads.

 

Thanks!

 

( Note: doing this in 10.11.3 )

Share this comment


Link to comment
Share on other sites

Having an issue... I extracted Disk Utility from the 10.10.5 Combo update and dropped it on your patch program -->> Got an error: The document "Disk Utility" could not be opened. diskutilitypatch cannot open files in the "application" format. I used Pacifist to extract with admin rights and am working in folder within downloads.

 

Thanks!

 

( Note: doing this in 10.11.3 )

Sorry for the late response, but did you drop it on the app icon on the dock? That wouldn't work. You have to drop it on the place holder with the monitor and the magic wand.

Share this comment


Link to comment
Share on other sites

It worked great for El Capitan, but not on Sierra. Any hope of a patch to make it work on Sierra?


 


Also, would love to be able to add this to the recovery partition. My one attempt failed. Maybe I just did something wrong. Or is there something different about the Disk Utility on the recovery partition?

Share this comment


Link to comment
Share on other sites
×