Jump to content
Welcome to InsanelyMac Forum

Register now to gain access to all of our features. Once registered and logged in, you will be able to contribute to this site by submitting your own content or replying to existing content. You'll be able to customize your profile, receive reputation points as a reward for submitting content, while also communicating with other members via your own private inbox, plus much more! This message will be removed once you have signed in.

  • Announcements

    • Allan

      Forum Rules   04/13/2018

      Hello folks! As some things are being fixed, we'll keep you updated. Per hour the Forum Rules don't have a dedicated "Tab", so here is the place that we have our Rules back. New Users Lounge > [READ] - InsanelyMac Forum Rules - The InsanelyMac Staff Team. 

419 posts in this topic

Recommended Posts

Hi blackosx,

I've tried to dump BIOS from unflashed Radeon 5770 (on real Mac) and seems that your tool is able to dump only first 64KB of 128KB BIOS. Unless I'm missing something.

Anyway, great and useful tool, thanks.

Share this post


Link to post
Share on other sites

Thanks for the report blacksheep.

When run on a real Mac, the video bios is saved from IORegistry.

Can you please post the DarwinDumperReports directory of a dump with the 'BIOS - Video' and I/O Kit Registry' options ticked?

Share this post


Link to post
Share on other sites

v2.8.7 -> 2.8.8

 

- Don't write prefs file if using the faceless option.

- Add detection for BootIA32 and it’s version.

- Add separator lines to Boot Loaders.txt file.

- Read user id and group before writing prefs.

- Add note to html report to inform user that it doesn’t contain all dump info.

- Overhaul custom path coding to be more robust.

- Removed the need to supply the -r option for dumps requiring root privileges when running from the command line.

- Add red cross beside custom path menu option if path no longer exists.

- Update VoodooHDA.kext to v2.8.4 and revise audio dump script.

- Swap Graphics and Audio lines in the html report overview.

- Add more info to log to help in the event of problems.

- Other miscellaneous tweaks and changes.

 

There have been quite a few changes in this version. Please report any bugs

Share this post


Link to post
Share on other sites

Thanks for the report blacksheep.

When run on a real Mac, the video bios is saved from IORegistry.

Can you please post the DarwinDumperReports directory of a dump with the 'BIOS - Video' and I/O Kit Registry' options ticked?

Here you go.

Used 2.8.8 this time.

Share this post


Link to post
Share on other sites

Thanks for posting your dumps.

 

Looking at your IORegistry dump I see it contains only a 64K image (0x10000) which is what DarwinDumper saved out. You can see for yourself by loading up IOReg.txt and searching for ATY,bin_image

 

I'm sure there's a simple explanation as to why you do not see the full 128K ROM in OS X's IOReg but I don't know it. Maybe somebody else will be able to throw some light on the subject?

 

If you still want to dump the card's ROM then I understand you can save the card’s ROM from Windows using ATIFlash with a command like this (though check the command first just to make sure it is actually the right command):

atiflash -s 0 myrom.rom 20000

Share this post


Link to post
Share on other sites

DarwinDumper is now under GPL v3.

v2.8.9f -> 2.9.0

- Add additional logging for writeable save path.
- Add detection for 4K sector drives in the Disk Partition Table dump (Thanks JrCs).
- Add kernel sysctl_machdep_xcpm dump (Thanks Pike - http://bit.ly/NHg1JH).
- Split HTML report kernel info to separate tables.
- Fix decoding of more than one ATI Video ROM’s.
- Add physical block size disk info to Bootloaders & Disk Sectors dump files.
- Removed the use of Apple’s ‘Strings’ binary, using instead binary grep.
- Widen the HTML report to accommodate more info.
- Update dmidecode to v2.12 (Thanks Slice).

Share this post


Link to post
Share on other sites
v2.9.0 -> 2.9.1

 

- Fix incorrect bootlog path in privatise function.

- Add private mask for DMI table -> System UUID in both .txt and .bin files.

- UI now directs user to ‘Save Directory’ page if custom path is missing.

- Revise UI ‘Custom Path’ page and add option for opening the current path in the Finder.

- Change assigned file extensions to dumped EDID files.

Share this post


Link to post
Share on other sites
v2.9.1 -> 2.9.2

 

- Revise driver loading to fix bug where pciutils driver would be unloaded if already present on users system.

- Updated flashrom to v0.9.7-r1786 and amended script to dump first chip if more than one chip found (thanks THe KiNG).

- Updated edid-decode with revised version by Andy Vandijck which now decodes the Chroma Info.

- Kernel message buffer is now dumped using dmesg before any other dumps.

- Disassemble DSDT and any SSDT's as multiple tables from single namespace.

- Add last boot from Apple System Log to kernel log dump.

- Don’t load RadeonPCI kext for vBIOS dump when kernel is booted in 32-bit mode.

 

Please report any problems.

Share this post


Link to post
Share on other sites
v2.9.2 -> 2.9.3

 

- Fix bug where unique partition ID read from ioreg could be incorrect if more than one result was returned.

- Add error checking when disassembling DSDT and SSDT’s as multiple tables from single namespace.

- Add new style html report which now uses standard jQuery and jQueryUI libraries and makes use of the accordion and tab widgets.

- Improved markup results in a smaller html file for a full dump.

- Split dmi dump in the html report by table types.

- Fix clicking collapsible div to toggle state when both open and closed.

- Add missing filepath /EFI/CLOVER/BOOT/ when looking for UEFI boot files.

- Only include relevant css and js for ioregistry viewer dump to html report if necessary.

- Move the Apple System Log to it’s own dump as root privileges are not needed for it.

- Many other small bug fixes, tweaks and improvements.

Share this post


Link to post
Share on other sites
v2.9.3 -> 2.9.4

 

- Replace the MacGap UI with newly compiled fat binary. (Thanks alexq/STLVNUB).

- Fix problem with new html report where more than one edid exists.

- Revise cleanup of temporary dmi files.

- Add atomdis to disassemble ATI Radeon vbios ROM (Thanks Slice).

- Add AnalyseVBIOS to analyse Nvidia vbios ROM (Thanks Slice).

- Replace 32-bit version of RadeonPCI.kext for OS X 10.6 and 10.7 with revised version by Slice that does not kernel panic.

- Add word decoded to decoded Radeon ROM txt file.

- Revised AppleSystemLog dump code.

- Try twice to unload VoodooHDA.kext (because of dependencies), if the script loaded it.

Share this post


Link to post
Share on other sites
v2.9.4 -> 2.9.5

 

- Firmware log should now correctly dump regardless of firmware-vendor.

- Replaced edid-decode with binary version that works on 10.8.

- Fix bdisk script output for partition type 0f (WIN95: Extended partition, LBA-mapped).

- Include Ozmosis Defaults.plist in bootloader configuration files dump.

- Adjust privatise routine to only mask loader confing data thats longer than 3 chars to avoid multiple search/replace issue.

- Add detection for a Non System FAT16 partition boot sector to the boot loader detection routine, to match the disk partition routine.

Share this post


Link to post
Share on other sites
Not currently, since Apple removed them from ioreg.

 

One way to get the ACPI tables from within the OS would be to access them directly from memory but that will require the attention of a kind developer with some spare time.

Share this post


Link to post
Share on other sites

From pokenguyen's note about MacIASL working fine in Yosemite, I've taken a look at PHPdev32's excellent MacIASL app and from that gone on to create a small program to dump the ACPI tables (as a binary .plist) which DarwinDumper can then use. So thank you for MacIASL PHPdev32.

 

The app and sources are currently posted at:

http://www.projectosx.com/forum/index.php?s=&showtopic=2447&view=findpost&p=41150

 

There's also DarwinDumper_v2.9.6beta4 which makes use of it and can now dump the ACPI tables in Yosemite.

http://www.projectosx.com/forum/index.php?s=&showtopic=2447&view=findpost&p=41154

 

I hope to release DarwinDumper_v2.9.6 soon.

Share this post


Link to post
Share on other sites
v2.9.5 -> 2.9.6

 

- Add CPU Info option. Using x86info binary (Thanks Slice).

- Add dumpACPI tool to dump ACPI tables from OS X, including Yosemite.

Share this post


Link to post
Share on other sites
I'm working towards adding an option to DarwinDumper to dump native ACPI tables, or at least the native DSDT, from memory. I've created a script to do this and have run many tests here on my hack (booting from Chameleon, CloverEFI and Ozmosis), an iMac11,2 and MacMini6,2. The scans on these machines all work well.
 
I am now at the stage where I require more data and would like to ask for testers to run the script and provide results for examination.
 
The script does the following:
1 - Attempts to load pmem.kext which presents /dev/pmem.
2 - Runs the FirmwareMemoryMap dtrace script to create a memory map.
3 - Identifies areas of memory to scan.
4 - Looks for valid RSDP pointers.
5 - Follows all pointers found and subsequently finds, verifies and writes all located ACPI tables to file.
 
The script creates a save directory named dump_<TIME> in the same directory as the script.
 
If anyone is willing to run this test then I would like the following:
- a copy of the dump_<TIME> directory.
- which bootloader used for current boot.
- any errors or problems with the script.
 
Please note:
1 - The script requires root priviliges to load the kext, and will ask for your password.
2 - As the script accesses direct memory, there may be a chance your system could freeze. This is unlikely as it's following a memory map, but it's worth being aware of so I recommend saving all open files and finish any work before testing.
 
Thanks
 
 
EDIT: Fixed a bug in the memory region detection routine.
 
EDIT2: Take into account 4 byte address pointers in ACPI v1.0 RSDT.
 
EDIT3: Fix bug when looking in FACP for FACS and DSDT address pointers when parsing ACPI v1.0 RSDT.
 
EDIT4: Replaced pmem.kext with signed version from http://www.rekall-forensic.com
 
EDIT5: Reduce block size for more accuracy.
 
EDIT6: Check for non-original SSDT-CpuPM tables and don’t scan for further tables.
 
EDIT7: 
- Add check for SSDT with table ID CpuSsdt. Previously only checked for CpuPm.
- Reset facs and dsdt address vars before interpreting an RSDT/XSDT table.
- Tables with 00 in signature no longer get saved.
- Dump directories that contain just an RSDT with invalid address pointers are deleted.

 

Share this post


Link to post
Share on other sites

Thank you kyndder. :D

I'll take a look.

 

EDIT: Well we got a successful dump!

However, your dump highlighted a bug in the routine that detects the memory regions to scan.

I have fixed it and posted v0.39 of the script above.

 

If you get time, can you please test the new version?

 

EDIT2: And was that dump from Clover UEFI or CloverEFI?

 

Thanks

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Recently Browsing   0 members

    No registered users viewing this page.



×