Jump to content

XPC Releases and Instructions

4 posts in this topic

Recommended Posts

This thread is dedicated to XPC releases (be it debug or actual release builds) and intructions you need to follow in order to make the bootloader work for you.

It's not the most userfriendly bootloader to begin with, but if you've got enough patience to go through all of the explanations, then it won't be a problem after all.





XPC Bootloader is developed and maintained by a single person from Germany - iPhoneTom.

Development has started in 2008, publicly it was released in 2009, but sources are not public to this day. It may seem odd, but everyone has his reasons, so deal with it.

XPC is based on sources from Intel's DUET EFI bootloader, GUI is a custom interface, not based on rEfIt as with the Clover's case. There are currently minor attempts in making the GUI customizable by applying themes, but it's a WIP with a lower priority. XPC has accumulated a pretty decent user base during 2009-2013, but to be absolutely fair - majority of users switched to Clover because after releasing 0.90.26 on August 31st 2011 iPhoneTom has disappeared for well over a year. He has surfaced again in mid 2012 full of entusiasm to continue. We've been feeding him some ideas worth coding in, but as communication with the developer is done mostly through IRC, it is kind of finicky to constantly monitor whats happening over there, especially on the go.


- Bootloader Capabilities




- Apple eske looks with a classic custom coded minimalistic GUI

- Can boot OS X 10.5 and up, Windows EFI (x64 MSDN), Linux EFI (with UEFI GRUB)

- Booting Default volume with or without a timount, ability to skip GUI if Default Boot volume is set

- Customizable SMBIOS tables (complies with 2.6) for BIOS, System, Base Board, Chassis and OEM CPU information

- Users can edit configuration file (settings.plist) straight from bootloader's GUI (see shortcuts)

- Users can backup BIOS ACPI tables from GUI (see shortcuts, again)

- Ability to mount DMG images in GUI

- Installing OSX with a working Recovery partition (from InstallESD.dmg)

- Recovery partition can be used for reinstalling OSX straight from Apple servers

- Ability to load kexts from /efi/xpc/extra_kext folder, with different set of kexts for every OS or a common folder

- Patching of kexts inside kernelcache (10.7 and 10.8) for on-the-fly kext binary patching with XPC Mach-O patcher

- NVARM emulation via nvram.plist, provides Runtime Variables to the system

- Brightness levels are preserved for laptop LVDS panels (in 10.8 only)

- Startup Disk feature allows users to switch between installed OS X systems (additional configuration required)

- Fully customizable FACP table fix, which resolves all restart issues and allows to specify PM Profile (for Mobile platforms)

- User custom DSDT table loading from /efi/xpc/DSDT.aml

- User custom ACPI table injection from /efi/xpc/acpi (SSDT-x.aml, FACP.aml etc.)

- P-State (including IVB specifics) and C-State generator

- Ability to specify PLimitDict and minimal and maximal CPU multiplier if CPU overheats with on higher clocks

- PCI Root UID override for people who are struggling with "I boot with not DSDT" syndrome.

- Graphics (AMD, nVidia and Intel) injection including customizable injection (see explanations on settings)

- Separate settings for USB EHCI ownership fix and handoff (LegacyOff analog from Chameleon)

- Ethernet injection (for Apple services), HDEF injection (with HDMI injection by default)

- Working Apple services, including Messages (additional configuration required)



- GUI Commands



1 - Show EFI variables

4 - Load EFI apps/drivers

6 - Toggle display of Image-Boot media

7 - Show available EFI partitions

8 - Enable Debug mode

9 - Open XPC Hardware Browser


A - Mount a DMG.

Browse and select an image, after mounting, the volume icon will change to a typewriter icon.

You can toggle between the mounted image and the volume by pressing Ctrl+D.

D - Set Default Boot drive

F - Rescan Boot Drives and DVD-ROM for bootable media

I - Dump ACPI tables to a USB stick (into “efi/xpc/acpi”)

M - Open settings.plist Editor

R - Reboot System

S - Start EFI Shell, binary shell.efi needs to be placed in EFI folder

Y - Detect possible Screen Modes, you can set these in setting.plist


Ctrl + V - Start in Verbose Mode

Ctrl + X - Start in Safe Boot Mode

Ctrl + S - Start in Single User Mode




Now a brief overview on how this thread is updated:

1. Builds - builds are being published by iPhoneTom either on IRC, if there is none on IRC to test he will usually publish on the forums, in the announcement sticky:

http://board.xpc-efi-forum.de/ (registration no longer required to get the builds).

These builds will normally end up here, if I have time to update of course. So please be advised and check the forums from time to time, if possible.


2. Changelog - some builds will have commentary on changes, these are usually minor or cumbersome to understand due to a language barrier, but we figure it out eventually. These changes are bing added to the code version of a given number, as soon as a new code version build hits, the previous build is considered a release build and all the changes from debug build associated with this code version are merged under a release version.


3. Instructions - basic installation instructions, GUI command usually are commented on by developer. Sadly, iPhoneTom never documented settings himself, ever.

The only way to know what settings does what and for what it's worth is to keep up with discussions on IRC, sometimes brief explanation of a given settings entry gets noted under changelog for a dev build. As such, settings.plist guide is put together just from my experience, as I've been using XPC Bootloader since 2009. If, however you find that a setting entry description doesn't really matches with what it actually does, please let me know.. Now, as the sources are not disclosed it's pretty hard to keep track of changes.


Navigation menu:

- Releases/Debug Builds of XPC Bootloader

- Complete Changelog for Builds of XPC Bootloader

- Configuring XPC Bootloader - settings.plist explained


External links:

- XPC Bootloader General Discussion

- Official Forums (Registration Required)

IRC: ext3.net (irc.moofspeak.net), #xpc-boot

Release/Test builds of XPC
Most of new settings in new builds are covered in settings.plist explanation post.
Some settings come and go, if you don't see them in the settings guide, then most likely they were removed in later builds.
One of these settings is the ability to map SPD data from one slot to another.

-- New or fairly recent builds
-- Builds about to be extinct
-- Outdated debug builds

Please use XPC build 0.90.26 files as your base for the rest of the builds as only Efildr20 and Efildgpt binaries changes across versions.
Base files and catalog setup tend to remain the same (except for builds that involve theming).


Builds with code version 0.92.3:


- Some bugfix

- OSX 10.9 Mavericks support (create 10.9 folder if you need kext injection)
- settings.plist has been split into 3 sub-config files. settings.plist holds general configuration, xpc_patcher.plist holds a dictionary for XpcPatcher and xpc_smbios.plist holds a dictionary SmbiosTables from original settings.plist

Builds with code version 0.90.41:

- Some bugfix
- Display of XPC version changed
- Added new setting. Thx to aschar!

Builds with code version 0.90.40:

- Fix DDR2 speed detection, thx to TimeWalker75a!
- Some bugfix
- Display of XPC version changed

- Some bugfix
- Fixed VolumeLabelText gets not used, thx to Alex!
- Display of XPC version
- Added help window for GUI commands
- Added F2 hotkey to save screenshots in efi\xpc\screenshots. Included is an Windows-Tool (Dot.Net 3.0) to convert RAW screenshots to JPEG format.

- Fixed a bug introduced in build from 20.03.13 which prevented proper injection of ACPI tables (from efi/xpc/acpi)

- Bugfix for inject NVIDIA.

- Re-enabled small OS-Type indicator icons.
- Some small bugfix.

- Re-enabled use of efi\xpc\theme\xpc_wallpaper.png
- Some small bugfix.

- Some bugfix, scrolling in settings-editor is new gui now (smoother scrolling).

- Fixed Mach-O Patcher.
- For most Mach-O binaries to patch, XPC must not use kernelcache, because they are OSBundleRequired 'Safe Boot', and not in the cache.

- Native Ivybridge Powermanagement.
- Added code for creating X86PlatformPlugin needed P- and C-States. For this, an IvyBridge or SandyBridge cpu is required, as well as an Board-Id and Mac-Model.
- Set CreatePStates to 1 (XPC will choose old or new IVB code after checking if new code is possible).
- Added show CPU TDP in Hardware-Browser if Bridge-Cpu is used.
- Added new WorkaroundIvyBug key for SSDTHandling section, which will fix SpeedStep for IvyBridge CPU (try without, and use if SpeedStep will not work well this way)

- Fixed some DDR2/3 and SPD detection problem.

Late 06.03.2013
- New added create P-States from XPC. You should set RemoveSSDT to 1 when you want to create P-States.
- The new keys for SSDHandling Section are:
CreatePStates, 1 create, 0 dont create.
PLimitDict, the value you get from ACPI_SMC_PLATFORM.
MultiMin + MultiMax, the override for the min/max multi for your CPU. For example mine are 12 and 37, should not be used as you can control if XPC detects your multis with key '9' in GUI. So only use this if values are wrong. Multis displayed are 1C, 2C, 3C, 4C.

- Some bugfix build 2. Some more fixes, DDR2 detection fix, as well some other. Report all problems please! Thx!

- Some bugfix, fix DDR2 RAM detection

- Removed use of Wallpaper (for now).

- Bugfix for detecting CPU frequency. Please leave feedback!
- Reworked new XPC GUI 1.5 beta.
- Changed theme.plist, added theme folder in efi\xpc\, added xpc_wallpaper.png, and some code to make the GUI some smoother.

- Image-Boot devices will be shown or hidden in GUI after boot according to a new switch. If set to 0 or this switch is missing, Image-Boot devices will be shown.
- In GUI you can toggle between display and hide Image-Boot devices with key '6'.

- CPU speed fix for Nehalem.
- Some importent bugfix.
- Added boot from InstallESD.dmg inside Applications-Folder.
- In XPC GUI you will see your volume with an OSX version displayed, and your volume with an label "Image-Boot". This will boot the installer.
- InstallESD.dmg can still lay in root of any HFS+ volume to boot from this, like before.
- Bugfix Build from 22.02.2013, 00:10

- Bugfix for SMBIOS memory detection. Fix for display SPD wont work in GUI.
- Added GPT-Build.
- For booting an InstallESD.dmg do NOT MOUNT it in XPC GUI. Just select the Volume that contains it in root, and hit return to boot.

- You can bot now from InstallESD.dmg, or Apple Internet-Restore "OS X Install Data" with InstallESD.dmg in it.
- If you want to boot from dmg (no Internet-Restore), it must lay in root of an Mac OS X Partition. This Volume will be labeld with "Image-Boot" in XPC GUI.
- No restore to USB-Drive or such action is needed anymore.
- Fixed wrong SMBIOS len.
Thx to aschar!

- Fix for booting from Installer.
- Added 'XPC Hardware Browser' (for now displays CPU and SPD Memory Information). Call it by press '9' in XPC GUI.

- New setting to force boot with Kernelcache. When you try to boot the "Recovery HD" partition with this switch set off (0), you must have an working mach_kernel for this recovery partition in your extra_kext folder (e.g. "efi\xpc\extra_kext\10.8") or on the recovery partition in root directory!

- New setting for iMessage fix, will set MLB. The data can be any values, if length is 17 digits.
- Some bugfix for SSDT loading, speed improvements,etc.
Thaks to aschar, timewalker75a,GLXOZ!

- Imporoved load speed, serval bug fix.
- New is iMessage fix: replace the ROMMacAddress string with the Mac Address of your Ethernet en0 Adaptor
- New setting for maping SPD Data if wrong. The example below will map SPD Data from Slot 2 to DIMM Slot 1.
- New setting for disable usb legacy support. May be needed on some maschines, like MCP79
- New setting to adjust Intel IGP Platform ID.

Builds with code version 0.90.31:

- FSB correction for SNB/IVB
- Implement NVRAM funcionality via nvram.plist
- Preserve laptop screen brightness in Mac OS 10.8
- Silent booting with no GUI
- You can now use Startup-Volume Tool in OS X. Read more on NVRAMSaveLocation in settings.plist guide
- Bug fixes and other new things, read changelogs

Builds with code version 0.90.26:

- minor fixes and optimisations

Complete Changelog for builds of XPC

Release 0.90.40 - Mar 31st 2013

- massive speed improvements, added checks for existance of settings.plist file before entering GUI
- injection for HD3000 and HD4000 Intel graphics controllers
- added support for specifying IGD Platform ID required for HD3000/HD4000 graphics injection.
- legacy USB support can now be toggled on or off
- corrected SPD data being detected incorrectly, if still not showing up properly a key was added to map data from slot x to slot y
- fixed Messages signon, requires 17 character MLB key as well as system MAC to be set in settings.plist
- addressed an issue which plagued machines with ITE IT8518E keyboard controlllers, now touchpad and keyboard works
- corrected a bug preventing SSDT tables from being loaded from xpc/acpi folder
- added XPC Hardware Browser, which is accessible from GUI by pressing '9', display CPU and SPD data for now
- corrected wrong SMBIOS lenght which prevented tools like DarwinDumper (dmidecode .. meh) from parsing it properly,
- fixed the ability of installing OS X from InstallESD.dmg, it can be place either in the root of a HFS+ volume or in Applications folder
- installer volumes will appear as Image-Boot in GUI, to toggle display of these volumes press '6'
- added NoImageBootDevices key to settings.plist in order to permanently hide installer volumes
- added support for reinstalling OS from Recovery HD "Reinstall OS X"
- minor FSB corrections for mobile Nehalem CPUs
- reworked GUI, added the ability to change color of volume labels in theme.plist
- DDR2 RAM info detection improved
- added the ability of specifying minimal and maximal multiplier for P-State generation
- you can now specify PLimitDict
- X86PlatformPlugin is now properly added to generated ACPI tables for IVB CPUs when WorkaroundIvyBug key is used, resolves speedster issues
- added CPU TDP information to Hardware-Browser for SNB/IVB CPUs
- fixed issues with Mach-O-Patcher not being able to patch long sequences
- improved scrolling speed in Settings Menu in GUI (accessed by M)
- more things related to theming are now implemented
- some bug fixes for nVidia GPU injection
- added the ability to save screenshots in GUI, mostly for people putting up guides (requires a windows .NET3.0 tool to convert them)
- users can now access a list of GUI hotkeys by pressing H
- displaying build number from now on

Release 0.90.31 - Aug 30th 2012

- fixed kext loading from extra_kext, added support for Mountain Lion 10.8 folder
- added nvram.plist support, requires rc.shutdown.local script as well as changes in settings.plist for NVRAMSaveLocation
- added Startup Disk support to switch between OS X installations
- added screen brightness save and restore after boot/reboot on mobile platforms
- fixed internal keyboard not working on some laptops (thanks sunny)
- added the ability to hide GUI when defaul boot volume is set, requires NoGuiOnDefaultBoot in settings.plist, access GUI by pressing Esc when XPC Startup! appears
- added the ability to control kernelcache loading, ie skipping it or loading via a key ForceLoadKernelcache in settings.plist
- added an option to inject HDEF audio layout, hda-gfx and Pin Configuration using InjectHDA in settings.plist
- implemented kext patcher which allows for patching any kext binaries in kernelcache (ForceLoadKernelcache has to be enabled)
- added SMBIOS release date key BiosReleaseDate to Table_01, format is as per Apple mm/dd/yy
- fixed iCloud signon
- FSB corrections for SNB/IVB CPUs

Release 0.90.26 - Aug 31st 2011

- minor fixes and optimisations
- support for setting prefered Language and Keyboard (settings.plist changed!)(to get your used value type 'nvram -ґp' in Terminal and get the value for 'prev-lang:kbd'. This value goes into 'LanguageKeyboard' setting. Example: 'de:3')
- set Bootvolume to OSX (check Startup-Folder-Panel in OSX)
- support for boot from Lion "Recovery HD"-Partition, there is still no way to restore Lion from booting the “Recovery HD” though
- new setting "DsdtRTCLength" patches RTC Length field in DSDT Table if value is > 0 (patch will not be applies when value = 0)
- new folder 'efi\xpc\acpi' holds binary files (*.aml) loaded and inject as ACPI-Tables (e.g. SSDT Tables,etc)
- fix Smbios-Table Length (dmidecode reports an wrong size, this in an bug in dmidecode!)
- fix reported boot-args (check in Terminal with nvram -x -p)
- settings-switch PciRootOverride (will allow to fix Pci-Root UID if it can not be found)
- nVidia Custom Card section added
- EHCI Ownerfix (to use that fix, set USBFix in settings.plist to 1, to deactivate it set it to 0)

Release 0.89.6

- added DefaultModel-Setting in settings.plist for set an Mac-Model by Name (i.e. iMac11,1)
- added AMD Radeon injection, added AtiFramebuffer-Setting in settings.plist (force the Framebuffer to set)
- added Intel GMA 950 injection
- fixed SMBIOS issues
- some bugfixes


Now, lets dive into the madness of editing settings.plist for XPC

First chapter covers general purpose settings of settings.plist
These are just related to all sorts of injectors, GUI settings and other bells an whistles you possibly have to set to gain certain functionality.

1.1 OSXSettings

OSX Setting dictionary for now consists only from a single key, which is required for determining your keyboard type. This is an NVRAM variable, but for now it's basically useless, it is however advisable to set it properly nevertheless.


Possible options consist of the most commonly used en:0, de:3, ru:3. To determine which keyboard type is your keyboard, execute nvram -p from terminal and you should see something along the lines of 'prev-lang:kbd ru:3'.

1.2. DsdtRTCLengt

This key basically allows you to specify the length of RTC by patching your DSDT table, which prevents CMOS reset after sleep cycles on certain machines. If length is found to be zero the patch will not be applied. At this point of time most older systems already have a patched DSDT, which change the length from 0x08 to 0x02. Modern systems on the other hand do not require this changed at all, so you are better of without this option.


You can set the length to 1 or 2, though 2 is recommended.

1.3. PciRootOverride

Some machines require PCI Root UID to be set to values different then default 0x00 used on most platforms. If however you have a UID predefined in your DSDT, like Name (_UID, Zero), then you most likely don't need that, but some people do.


If your system just freezes on a black screen doing nothing or stops right in the middle of booting then it's advisable to try and change this to 1, since most likely UID of PCI0 can't be determined.

1.4. InjectAmd / InjectNvidia / InjectIntel

Creates a device-property string for graphics card injection. Most graphics card do need injection enabled, but some modern cards like nVidia 6xx series work right out of the box without injectors. If you are not happy with the outcome default injection produces you can set your custom injection to your liking. Please use one injector at a time, I believe simultaneous use won't work, but you can try and report what you encounter.




All the custom injections are required to be forces, this is done by using an additional dictionary and a ForceCustomCard key to tell the bootloader to utilize information you have specified and not the information, which is hardcoded for injection of certain graphics adapter.


Most information for nVidia custom injection can be obtained from device-property strings of original Apple machines. You have to get hold of an IORegistry dump and look for device-property string under IODeviceTree -> efi. You can decode the string using an old utility called gfxutil, which was used during the days of inventing injectors back in OS 10.4 times. Now there are more advocated utilities such as DarwinDumper, which can do the work for you, but you would have to perform a system dump from a real machine with an nVidia card you are looking for reference.

Finally, here's an complete nVidia example:

<string>EVGA GTX 275</string>
<string>nVidia GeForce GTX275 OpenGL Engine</string>

Here's an example of AMD card:

<string>ATI Radeon 5770 Series</string>

As you can see from the above you can do comprehensive injection. In case of AMD cards a Framebuffer to utilize can be specified. Device ID and Vendor ID should match your card and, again.. can be obtained from System Profiler data. Most end-users will be perfectly fine with default injection, more advanced users most likely should lean towards the device-properties approach, which will be described later on.

There is no CustomIntelCard, but one is coming for sure. Meanwhile the only custom option that you can set for HD4000 graphics is the AAPL,igp-platform-id. Which is required to determine what connector table from the frame buffer your computer will utilize. InjectIntel has to be enabled for this to work.


You either use a Desktop or a Mobile entry, don't leave both at the same time. In the example above a mobile [ig-platform-id: 01660004, Stolen RAM for FB: 32MB, Pipes: 3, Ports: 1, FBMem: 1] and a desktop [ig-platform-id: 01620005, Stolen RAM for FB: 32MB, Pipes: 2, Ports: 3, FBMem: 2 ] are set. For HD4000 graphics there is this table to help you determine the required value:


ig-platform-id: 01660000, Stolen RAM for FB: 96MB, Pipes: 3, Ports: 4, FBMem: 3
ig-platform-id: 01660001, Stolen RAM for FB: 96MB, Pipes: 3, Ports: 4, FBMem: 3
ig-platform-id: 01660002, Stolen RAM for FB: 64MB, Pipes: 3, Ports: 1, FBMem: 1
ig-platform-id: 01660003, Stolen RAM for FB: 64MB, Pipes: 2, Ports: 2, FBMem: 2
ig-platform-id: 01660004, Stolen RAM for FB: 32MB, Pipes: 3, Ports: 1, FBMem: 1
ig-platform-id: 01660008, Stolen RAM for FB: 64MB, Pipes: 3, Ports: 3, FBMem: 3
ig-platform-id: 01660009, Stolen RAM for FB: 64MB, Pipes: 3, Ports: 3, FBMem: 3
ig-platform-id: 0166000A, Stolen RAM for FB: 32MB, Pipes: 2, Ports: 3, FBMem: 2
ig-platform-id: 0166000B, Stolen RAM for FB: 32MB, Pipes: 2, Ports: 3, FBMem: 2

ig-platform-id: 01620005, Stolen RAM for FB: 32MB, Pipes: 2, Ports: 3, FBMem: 2
ig-platform-id: 01620006, Stolen RAM for FB: 0MB, Pipes: 0, Ports 0, FBMem: 0
ig-platform-id: 01620007, Stolen RAM for FB: 0MB, Pipes: 0, Ports 0, FBMem: 0

Basically you have decide for yourself what is the shared RAM for your HD4000 and what is the amount of physical connectors on your unit (if it's a laptop, take LVDS - internal display into account). With Desktop you don't have a great selection to choose from… The actual port type selection and their configuration has to be done by means of patching the framebuffer.

1.5. InjectEthernet

Required for setting your Ethernet card as internal device (even though it's internal on your motherboard, it doesn't necessarily appears internal for OSX), essentially needed for Apple services sign-on.. like AppStore or iCloud. If you have your Ethernet set as internal by means of DSDT then you obviously don't need this key.


If you are uncertain, Vendor and Device ID can be obtained from System Profiler, or programs like DPCI Manager.

1.6. InjectHDA

This is required for layout-id injection for use with AppleHDA kext. Of course, if you have done necessary modifications to your DSDT this key is not required. Also one should be warned, that for this injection to work properly and for your audio to work thru AppleHDA, you have to have a device HDEF in your DSDT, otherwise AppleHDA won't have a way of attaching to your coded even if you've patched the kext properly.


Enabling or disabling of HDA injection is controlled by Apply key, setting it to 1 will enable HDEF injection.
Layout ID should be specified in decimal, for OS X 10.8 this has to be one of the stock layouts found in the genuine AppleHDA resources. This only means that you can't be using layouts 888 or 665, 892 etc. which first surfaced in the works of Toleda. If you have an Intel SNB/IVB graphics adapter, i.e. HD3000 or HD4000 then it's a disable to utilize the HDAU injection as well, since HDMI output will most likely support audio output if not out of the box, then at leaf you won't have sound assertions in your IO Log due to HDMI audio not being injected. PinConfiguration usually appears blank in Apple's device-propery dumps, because Pin Configuration is being picked up from Hardware Config plugin inside AppleHDA. It's just a dummy string which follows the "Apple guidelines".

1.7. NVRAMSaveLocation

In XPC version 0.90.31 support for emulated NVRAM from nvram.plist parsing was added, which allows your NVRAM settings to be preserved across reboots and shutdowns. This is a huge leap from the classic EFI booting approaches because some crucial information can be stored and reinjected into the system after working session is terminated. This allowed for Location services settings preserving (Find my Mac token saving etc.), Startup Disk feature implementation and laptop LCD brightness preserving across reboots.

A culprit that is required for this to work is a shutdown script, which stores an nvram.plist file in the root of your boot volume which is being overwritten upon every reboot and shutdown. The script is fairly simple in contents, but may be complicated to install for some. Your best bet would be to do the following:

- authorize yourself as root by typing sudo -s in terminal, enter your password when prompted
- navigate to /etc by performing cd /etc
- perform a copy command on one of the rc. scripts found in the folder: cp rc.common /etc/rc.shutdown.local
- now we need to edit the script, perform: sudo nano /etc/rc.shutdown.local
- editor comes up at this point, position your cursor on the first line and keep pressing ctrl+k which will delete line by line until the document is blank
- write the following in the editor:

nvram -xp > nvram.plist

- when done, press ctrl+x, agree with y and save changes to your file
- sudo chown root:wheel /etc/rc.shutdown.local
- sudo chmod 755 /etc/rc.shutdown.local

Now that we are done with this, we can set our settings accordingly.

<string>Macintosh HD</string>

Now, the script will save the nvram.plist file in the root of your boot volumes, in this case it's name happens to be Macintosh HD, yours can be anything .. put the name of your OSX volume in there. The FilePath will be just the root of the volume, so we're specifying where the file is and we are all set. You will have to shut down your machine in order to the file to generate properly for the first time, further reboots will update the files accordingly.

1.8. ForceEnableHPET



If for some reason (due to a series of checks for OS version for example) your High Precision Event Timer device (which is a crucial thing for OSX and not only OSX nowadays) fails to initialize, because it's status is set to 0x00, setting this key on will force it to be enabled (i.e. set 0x0F). If your DSDT has this covered, then you don't need this key.

1.9. USBFix and DisableLegacyUSB

This fix implements EHCI ownership workaround, which is necessary if your controllers are getting unloaded across sleep.


If you are seeing messages similar to these:


USBF: 26.816 Attempting to get EHCI Controller from BIOS
USBF: 26.816 EHCI - Ownership conflict - attempting to resolve ...
USBF: 26.825 EHCI - Try resetting OS Ownership to 0
USBF: 26.826 Found USBLEGSUP_ID - value 0x10001 - writing OSOwned
USBF: 29. 5 acquireOSOwnership done - value 0x1000001
USBF: 29. 62 AppleUSBEHCI[0x41bf000]::start EHCI controller will be unloaded across sleep

Then you obviously need to enable this setting. Though this can be fixed via editing DSDT, which tends to be a more superior fix to this, but if you don't feel comfortable editing ACPI tables, then this is a key just for you.

Now, there's another setting for fixing issues with USB. Some controllers may fail with Legacy Mode enabled (people who need to disable Legacy USB Support in BIOS may know this). nVidia ION platform is notorious for this. Essentially you either can't boot from USB at all, or it fails to initialize after sleep or it doesn't allow for sleeping the system at all.


Setting this to 1 will override the default EHCI/UHCI handoff to BIOS and will forcefully write values to required registers. It's not the cleanest solution possible, but it does the job for platforms like MCP79.

1.10. FacpFix

This fix was first proposed by fassl and is intended for fixing restart issues on older generation motherboards (P31/G31/P35/P43/P45 Gigabyte and P5 series Asus). These boards don't have a full length FACP table, thus they are missing information about which is the restart register address and which is the value to cause restart that is needed to be written into given register. Most newer platforms past Nehalem (P6 Asus boards, H55/P55 Gigabite boards) have extended FACP tables that carry this sensitive information, which is required for properly working restart action.
Also, some platforms are missing the PM Profile identification (its set to 0 by default), which identifies the type of the chassis of a given computer. 0x02 is a mobile platform, 0x03 is a Desktop platform (as per Apple Mac Pro), though some PC desktops use 0x01.


This may look as a pretty complex dictionary to edit, though only some of the values have to be altered. For mobile platforms 0x02 has to be specified in PMProfile in order for Energy Saver in OSX to take advantage from Battery (and actually display the tab in System Preferences).
Now, the restart address and values can be two combinations.. The one (0x0CF9 and 0x06) given in the example is for performing the restart via PCI bus, which is commonly used on desktop platforms. There's another option possible for mobile platforms, which performs restart through PS/2 controller.


This is how the address and value would look for mobile platforms. Though please note, this is not a always true, as such one may need to play with these two combination (don't mismatch the address and values across combinations) in order to achieve a working restart on a given platform.

1.11. SSDTHandling

In this dictionary settings related to SSDT table generation and dropping are present. Most of the user will know, that for a proper power management in OSX you have to craft SSDT tables in a certain way to enable speedstep on Intel CPUs.



The first block of this dictionary has been there for ages, the second block was introduced in 0.90.40 (built from 11.03.13)

1.11.1. RemoveSSDT
If you desire to drop (avoid using) OEM SSDT tables, which are present in your BIOS, you can do so by setting 1 to key RemoveSSDT.

1.11.2. CreateCST2/CreateCST3/CreateCST4
Setting these keys to 1 will make the boot loader to generate SSDT C-States with respective states of C2, C3 and C4 accordingly to settings used. These essentially are sleep states, the higher the number the deeper the state. There's no dedicated key such as CreateCStates like in most boot loaders, so if you are not using your own custom ACPI tables in EFI/XPC/ACPI at least one of these has to be enabled in order to support C-State creation.

1.11.3. CreatePStates
This is a familiar key if you have been around since PC-EFI/Chameleon/Chimera times and don't have your SSDT tables around, which would enable your speedstep. Enabling this will obviously generate P-States for your CPU.

1.11.4. PLimitDict
This key is intended for limiting the maximum frequency of a given CPU. If set to 0 CPU will utilize all of it's multipliers, if you specify a value of 1 it will reduce the maximum multiplier by 1, set this to 2 and 2 multipliers will be cut off (if max is 18, setting this value to 1 will make the max 17 etc.) This can help protect CPU from overheating if a cooling assembly is now doing a great job. Same can be done by other settings, but they works somewhat differently, keep on reading.

1.11.5. MultiMin and MultiMax
This pair of keys is intended for limiting the minimum and maximum multipliers of your CPU. You can check what multi are supported by your CPU by going into XPC Hardware Browser, by pressing 9 in GUI. At this point it is not really known whether this key really overrides the speedstep behavior or it's just a cosmetic workaround to display proper min and max multipliers of a given CPU. Your can be 8 and 23 per se, which on an SNB platform will result in 800 to 2300 MHz frequency range.

1.11.6. WorkaroundIvyBug
Given key is intended for IVB CPUs, which require additional information in CPU section in SSDTs, namely plugin-type of 0x01 for CPU0. This is because IVB-based Macs utilize a different platform plugin - X86PlatformPlugin. An IVB CPU is required, also a Mac-Model and Board-ID of a real IVB-based Mac has to be set in order for this to work. If this option is enabled, these parameters will be checked to decide whether a classic PSS generation algorithm or an IVB-specific one has to be used.

1.12. OSXKernelSettings

This dictionary resamples the settings related to OSX kernel, namely kernel flags and kernel name.


If you are attempting to boot with a patched kernel (on an Atom CPU per se) then chances are you will be stuck for good and unable to recover. You can place the kernel you are trying out in the root of your OSX volume, name it 'test_kernel' for example and then from GUI open the settings editor (M) and specify this name to temporarily utilize a patched kernel instead of a vanilla one, without actually replacing the original one.

Kernel flags are your classic flags, such as -v, -s, -x .. (there's no -f flag as it's Chemeleon/Chimera specific flag, we will discuss how to skip or load kernelcahce with XPC). Please note, that you can also boot verbose, safe boot and single user prompt by pressing Shift+ relaxed key while in GUI (Shift+V will start verbose boot). XPC doesn't use kernel flags for specifying settings, like Chameleon or Clover, here we are dealing with boot.efi and kernel flags only, so all your npci and darkwake flags are still valid.

1.13. ForceLoadKernelcache

As promised above, here's the way you make the boot loader load or don't load the kernlecache. By default, if you don't have any kexts in your extra_kext folder it will be loaded, however if there is at least one kext in any of the folder for a corresponding OS version (common and 10.8 for e.g.) kernelcache will be skipped and all the kernel extensions will be loaded from S/L/E and EFI/XPC/extra_kext.


If you have kexts in your folder just for maintenance sakes (e.g. kexts are not mandatory for OS to boot), then set this option to 1 - it will load the kernel cache, by tricking boot loader into thinking that there are no kexts in extra_kext folder. Change this back to 0 and kexts from extra_kexts will be loaded.

1.14. PlatformUUID

This is a unique platform identification used to tell your machine apart from the others. Some people tend to take hardware UUID from System Profiler after booting with Chameleon, some say that it has to be in a form of 00000000-0000-1000-8000-XXXXXXXXXXXX, where the last part is the MAC address of your primary (en0) network adapter. It is still uncertain what is the correct way of setting the UUDI, but it is most certainly obligatory, as without a UUDI you won't be able to utilize any of the Apple's services. Also without any UUID you are most likely to get huge boot delays, as the boot process will hang on
GetHostUUIDString: unable to determine UUID for host. Error: 35

1.15. ScreenMode

If you are willing to set preferred VESA resolution for GUI, you have to change this key.


The value may seem random, as in the example above (which is 1600x1200), but it has an explanation - while you are in GUI press Y and a list of possible screen modes will come up. There have been attempt of making this detection automatic, i.e. setting the highest possible VESA resolution by default if the value of this key is set to 0, but it was later changed, so to this day it's uncertain if the automatic detection is working. It won't hut to try though.

1.16. DeviceProperties

Good old device-property string, which was originally used for graphics and network injection. Some people may still prefer this approach to DSDT editing as they have a custom device-property string for their hardware since 10.5 Leopard times (I'm one of those people, actually). So you may want to disable network and graphics injectors if you are certain your device-property truing has this covered.


If you are not willing to use device-property, then it's better of to remove this key completely, don't set it to 0, as it has a higher priority and thus you will end up with blank device-properties in your IORegistry.

1.17. DefaultBoot

This is the default boot entry, which will be set (filled in by boot loader) when you press D in GUI on a Volume you decided to bake bootable by default.

1.18. NoGuiOnDefaultBoot

If you have used Startup Disk feature from the Preference Pane or you have a default boot volume set by pressing D in GUI you can make the boot loader skip GUI and load this desired partition straight away.


Set this key to 1 and GUI will be skipped. In order to get back into GUI you have to press Esc as soon as XPC Startup! message appears in the left upper corner.

1.19. NoImageBootDevices

As of 0.90.40 there is a way of reinstalling OSX from Recovery partition as well performing a clean installation by having the 'Install OS X Mountain Lion.app' in your Applications folder. Another option is to have InstallESD.dmg in the root of a volume. These installers will appear in GUI as Image-Boot volumes. If you desire to keep these on your HDD, but don't want to see them in GUI you can set this key to 1 to hide them.


You can toggle displaying of these Image-Boot volumes by hitting 6 in GUI.

1.20. ROMMacAddress and MLBData

This pair for keys is required for iMessages authentication after Apple has stopped the iMessages Beta on 10.7. Everything here is pretty straight forward.


ROMMacAddress is the MAC address of your en0 network adapter, you can get it from System Preferences > Network > Advanced > Hardware
MLBData is a 17 character key, which firs off has to be unique and has to consist of both numbers and letters, it can be anything, but of 17 chars.


1.21. SkipExtraKextIfKCContainsFakeSMC


Skip loading kext from extra_kext if kernelcache contains FakeSMC kernel extension. In some weird occasions there may be issues with system not starting up properly if kernelcache and extra_kext both contain FakeSMC.


If set to 1, kernelcache will be searched for FakeSMC, and extra_kext will be skipped if it will be found in cache.




Second chapter is dedicated to XpcPatcher dictionary.  

Since build 0.92.3 this part of settings.plist is moved into a dedicated configuration file called xpc_patcher.plist


XPC Patcher is intended for binary patching kernel extension binaries from the kernel cache. So for this to work ForceLoadKernelcache has to be set to 1.

Essentially it is the same thing as patching binaries by hand, but it doesn't really patch the actual kext, just the kernel cache and as such you don't need to repatch every kext after software updates.



<string>To use TRIM support on all SSD</string>

<string>To use AICPM on Sandybridge and Ivybridge Systems</string>

Numeration of the entires starts from 0, and increases incrementally, after 9 comes 10, not A as one may think.
Every entry consists of 6 keys:

1.21.1. Apply - set this to 1 and the given kext patch will be applied during boot. 0 - do not apply.
1.21.2. SystemVersion

You can have patches for same purpose that will differ across OSX versions, especial major releases. Essentially there are 3 options possible (as 10.6 uses mkext for kernel cache). Set this to 0x000 for any OS version. 0x107 for 10.7 or Mac OS Lion and 0x108 for 10.8, OS X Mountain Lion, respectively.
1.21.3. Description - this key serves for commentary purpose only, it is meant for the user to be able to tell what is what.
1.21.4. FileName - the name of the kernel binary to patch, at most times this will be the same as the name of the kext itself
1.21.5. Search - what has to be searched and patched
1.21.6. Replace - what has to be put in place of the original HEX sequence

In the examples above there is a TRIM patch for SSDs as well as AICPM patch for machines that have 0xE2 register locked for writing in their BIOS by OEM.



Third chapter is dedicated to SmbiosTables dictionary.  

Since build 0.92.3 this part of settings.plist is moved into a dedicated configuration file called xpc_smbios.plist

In a nutshell, this is everything related to emulating real SMBIOS/DMI information.
Most of this information can be obtained by looking at dumps from a Mac machine of the model you are trying to mimic, this would be your best bet. Especially if a dump contains a decoded SMBIOS data. You can visit http://tdev.me/2010/...hardware-dumps/

2.1. Table_01 - DMI table responsible for BIOS Information


<string>Apple Inc.</string>

2.1.1. Type 0 doesn't have to be altered, it just specifies DMI type 0
2.1.2. BiosVendor - vendor of the BIOS software, which is always Apple Inc. if we want to mimic real Macs
2.1.3. BiosVersion - boot ROM version of a selected Mac model.
2.1.4. BiosReleaseDate - release date of the Boot ROM in a form of mm/dd/yy. Rough estimation can be obtained by looking at released dates on the official support page: http://support.apple.com/kb/ht1237

2.2. Table_02 - DMI table responsible for System Information


<string>Apple Inc.</string>
<string>System SKU#</string>

2.2.1. Type 1 doesn't have to be altered, it just specifies DMI type 1
2.2.2. Manufacturer - as always mimicking Apple hardware we want this to be Apple Inc.
2.2.3. ProductName - your model identifier, it can be any real Mac model you desire, but your serial number and board identifiers have to match selected model.
2.2.4. Version - the revision of the hardware, normally is 1.0 as Apple doesn't really rerelease same things. Though later hardware revisions may be with different version identifier.
2.2.5. SerialNumber - your system serial number, which has to match with the rest of the identifiers used. You can generated adequate number using Chameleon Wizard, Champlist or other software, as the alto is known.
2.2.6. SKUNumber - this usually appears blank with the value of System SKU# on most genuine machines, so leave it be like that
2.2.7. Family - denotes the Mac chassis family, can be either MacPro, MacMini, MacBook, MacBookPro etc..
This table also hold the UUID you've specified in PlatformUUID, make sure you fill it in.

2.3. Table_03 - DMI table responsible for Base Board Information


<string>Apple Inc.</string>
<string>Base Board Serial#</string>
<string>Base Board Asset Tag#</string>
<string>Part Component</string>

2.3.1. Type 2 doesn't have to be altered, it just specifies DMI type 2
2.3.2. Manufacturer - you know the catch, use Apple Inc.
2.3.3. ProductName - the model of the logic board of the actual Mac computer. There are a lot of resources that will tell you the model identifier for a certain Mac Model, you just have to search around. But make sure it matches the rest of the config.
2.3.4. Version - can be 1.0, can be Proto1 or may appear in some other way, just leave this be..
2.3.5. SerialNumber - board serial number, as this is not usually specified you can make it read the same serial you've put in previous config, or you can leave it as is.
2.3.6. AssetTag -same as above, leave it alone
2.3.7. LocationInChassis - as this is a Base Board or in other words a logic board it's a dedicated component, it will always be like that.
2.3.8. BoardType - it will always be type 10, which means it's a Motherboard.

2.4. Table_04 - DMI table responsible for Chassis Information


<string>Apple Inc.</string>
<string>Asset Tag#</string>

2.4.1. Type 3 doesn't have to be altered, it just specifies DMI type 3
2.4.2. ChassisType - identifies the type of chassis, i.e. Desktop or Mobile. Apple uses 3 for Desktop and 2 for Mobile.
2.4.3. Manufacturer - hope we are clear by now.
2.4.4. Version - this has to match the Product Name of the Board.
2.4.5. SerialNumber - has to match the serial number from System Information table.
2.4.6. AssetTag - just leave this as it is, you won't come up with a proper tag number anyway.

2.5. Table_05 - DMI table responsible for identification of Apple specific Processor Type



2.5.1. Type 131 - doesn't have to be altered, it just specifies DMI type 131
2.5.2. ProcessorType - Apple usually specifies this in a HEX form, but we specify it in decimal. In this example we have 0x0402, which translates into 1026 decimal and means Intel® Xeon® CPU. You can set this to 0 for auto detection.

2.6. Table_06 - DMI table responsible for identification of Apple specific Processor Interconnect Speed



2.6.1. Type 132 - doesn't have to be altered, it just specifies DMI type 132
2.6.2. ProcessorBusSpeed - you can set this to 0 for auto detection (but it then appears as 0 MT/s in SMBIOS), this will show up as Bus Speed in System Profiler. To be absolutely honest, this table is not even required for older CPUs (such as Core Duo, Quad, Atom ..)

Though there is automatic SDP detection for most DDR memory, sometimes it fails to read proper info from DIMM modules. There are additional configurable tables coded in to specify this data by hand.
2.7. Table_07 - DMI table responsible for proper display of SPD data on Memory Devices


<string>BANK 1</string>
<string>DIMM 1</string>
<string>OCZ Inc.</string>
<string>Asset Tag#</string>

2.7.1. Type 17 - doesn't have to be altered, it just specifies DMI type 17
2.7.2. Id - identification of this SPD masking. Starts with 1 and for every additional slot it has to be incremented by 1.
2.7.3. BankLocator - which memory BANK the specified information has to be set to.
2.7.4. DeviceLocator - which device in a given BANK has missing information. For example if your DIMM1/BANK 0 is missing Serial Number in System Profiler > Memory you set these two accordingly.
2.7.5. MemoryType - defines what type of memory is installed in slot, Non-ECC DDR2 is 18, ECC-DDR2 is 20, DDR3 is type 24)
2.7.6. Speed - well, obviously your memory clock speed.. not the effective, but nominal value you read on the actual sticks
2.7.7. Manufacturer - DIMM manufacturer, get this from the label
2.7.8. SerialNumber - read your label or come up with something from the top of your head.
2.7.9 PartNumber - same as above.
2.7.10. AssetTag - just leave it alone, as we did previously.
2.7.11. Size - the amount of memory on the module you are trying to make prettier… i.e. 1Gb = 1024, 2Gb = 2048 etc..

If you would like to make another slot prettier .. as it just cosmetics for your personal satisfaction, you would have to create additional table in the form of:



Hope this editing of settings.plist is more clear now.

  • Create New...