Slashdot Mirror
EFI Modifications Leaves iMac Unbootable?
jerbare writes "In attempting to run Linux and Windows on the new iMac Core Duo, people experimenting with configuring the EFI Console/Boot loader have found they can no longer boot the machine at all. Dave Schroeder of appleintelfaq.com comments, 'We have already irreversibly lost a couple of iMacs trying to load various EFI modules'. Instructions for breaking the iMac's are presently located at the bottom of the comments."
Reminds me of a situation I faced back in the day when I was a tech at a small mom-and-pop computer repair establishment. We received a shipment of motherboards, and found out that the BIOS on every single one of them was corrupt. Since the boards wouldn't even post, the traditional remedy of flashing the BIOS via a bootable floppy was not available. Normally, we would have just boxed up the boards again and returned them for replacements, but we desperately needed those boards to fill orders.
Well, desperate times call for desperate measures...
I got to thinking, "you know...once you've started booting to an OS, that BIOS chip isn't even being used anymore....hmmm". With this in mind, I pulled a working BIOS from another board, swapped it out with the bad BIOS, and powered the system on, booting from the BIOS flash floppy. Once the board had booted to the flash program, I carefully pulled the good chip back out, and put in the bad chip. I then ran the flash program to overwrite the bad BIOS.
Long story short, it worked like a charm. I managed to revive every board in the bad shipment without incident using this unorthodox technique.
Anyway, it should be possible to rig up a similar arrangement here, although as I am unfamilliar with EFI, I'll leave the details up to someone else.
____
~ |rip/\/\aster /\/\onkey
Instructions for breaking the iMac's are presently located at the bottom of the comments.
Uhh, thanks.
Religion for nerds. Stuff that really matters
I have a feeling that a virtualization/emulation with hardware graphics support will be available within 6 months that'll make dual booting pointless. I have a feeling that dual-booting OS X with XP or Vista will not work because it's got EFI/BIOS issues and the hard drive formatting issue. And any number of issues that haven't come up yet.
Unbootable iMacs support an even wider selection of games than do bootable iMacs.
+1, damn clever hardware hackery.
You cannot truly appreciate Dilbert until you read it in the original Klingon.
If you can get it to boot at all, try reinstalling from the 10.4.4 media. That's supposed to fix some changes in the EFI.
i am confident that a workaround will eventually be developed. if it takes destroying a few macs, so be it...
Isn't this kind of like trying to open the mummy's tomb? Nothing good can come out of it.
This is an early warning!
Wait for virtualization so all of Microsoft's inherent evil can be sandboxed into a self-destructing disk image of darkness and peril.
Great. How about attacks on EFI by malware? An iMac costs just a few hundred bucks. Bad enough. But, what about those shiny new Itanium systems with EFI for 10 grants per box?
Just substitute Apple for Microsoft, Mac for Xbox and Internet for Xbox Live in the following...
Denial Of Service - Putting people at threat:
When you screw this up, do you still get the sad mac?
Hexy - a strategy game for iPhone/iPod Touch
**WARNING** The following instructions will render the iMac Core Duo (Intel) TOTALLY USELESS. There is NO KNOWN METHOD OF RESTORING the iMac Core Duo to a previous functioning state. **WARNING**
/Volumes/EFI; sudo mount_msdos /dev/disk0s1 /Volumes/EFI)
/Volumes/EFI/BIOS32/Bin/GraphicsConsole.efi
I AM NOT KIDDING. THE FOLLOWING METHODS WILL PUT THE IMAC IN A STATE OF DISREPAIR BY AN END USER, EVEN WITH ACCESS TO THE INTERNAL HARDWARE.
With that said, here is how I killed the iMac Core Duo:
1. Downloaded EFI sample implementation and unzipped
2. Moved the 'Binary' folder to the hidden EFI partition (sudo mkdir
*NOTE: this partition appeared EMPTY*
3. 'blessed'
4. Rebooted in to GraphicsConsole
5. Attempted to load an EFI 'Driver' via GraphicsConsole (I forget the process, but it was a submenu. The drivers I attempted were AtapiPassThru.efi and Partition.efi)
6. Reboot and stare at your new broken iMac Core Duo. It's dead, Jim...
Just as Dave mentioned, unplugging the Hard Drive, removing the battery and leaving the iMac without power WILL NOT RESET IT TO ITS FACTORY DEFAULTS.
Because settings are stored in NVRAM, POWER IS NOT REQUIRED TO KEEP THE SETTINGS INTACT.
http://en.wikipedia.org/wiki/Flash_memory
BECAUSE THE APPLE EFI SOFTWARE DOES NOT LOAD THERE IS NO WAY TO 'ZAP' or 'FLASH' THE NVRAM TO DEFAULTS.
The caps are really necessary, folks. Apples implementation of EFI allows software to modify the computers ability to boot - or NOT.
I am unsure if modifying Apple boot software voids the warranty. I was fortunate to get a replacement iMac, but I did not explain what I did to render it unable to boot. Because of that, I'm staying anonymous...
Well, OS X runs X11, which lets it do some Linux apps. Aside from that, you're looking at the same situation Windows is, unless there is a specially designed Linux that does EFI and the GPT (or whatever the Hard Drive issue is). I'd say dual-booted Linux would beat XP to the Mactels because of the fact that a version of Linux can be engineered to work on the Mactels.
I’ve done the exact same thing to bypass security features on SPARCstations. Try it sometime—it’s fun!
Tangent: you don’t need to understand Chinese to understand the instructions on that page. ;)
Join Tor today!
Substitute "user" with Malware.
Download the EFI software from Intel: Or include an copy in the malware.
a sudo command: Or use an escalation of privilege vulnerability
and reboot : Err, not that difficult to achive in software.
There are Linux distros that work with EFI and making a properly formatted partition isn't hard.
Stupidity is like nuclear power, it can be used for good or evil. And you don't want to get any on you.
It's a fairly well known trick, although you're correct that it's a little bit dangerous. But when you fiddle around with BIOS mods, it comes in handy to have a removable BIOS chip for just that reason.
http://www.google.com/search?q=bios+hot+swapping
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
When the iMac is in this broken state, it doesn't boot, chime, show anything on the screen, or read from media.
;-)
Can't exactly "reinstall from the 10.4.4 media".
Zapping NVRAM (still supported with cmd-opt-P-R), removing the motherboard battery and letting it sit with AC for an extended period, and disconnecting the hard drive all do not revive the machine.
with research like this they could be onto a MAJOR Windows security breakthrough...
Hello. Just to give a bit of an update on this issue...
The iMacs in question were rendered unbootable by trying to load additional modules from Intel's EFI Sample Implementation. It is not known which module is at fault currently.
Once the iMac is unbootable, it doesn't chime, boot, attempt to access media, or display an image on the screen. Attempts to zap NVRAM (cmd-opt-P-R is still supported for this task on Intel-based Macs), remove the motherboard battery and leave the AC power disconnected for an extended period of time, and disconnecting the hard disk do not resolve the issue.
At present, we seem to have a number of difficult situations that prevent the installation of Windows directly on Intel-based Macs:
1. Apple did not include its own EFI shell or other tools to access the EFI with the Intel-based Macs, so the tools used have consisted of Intel's EFI Sample Implementation, and Tianocore's EFI Developer Kit.
2. Apple's EFI implementation does not include CSM (Compatibility Support Module), the BIOS backward compatibility layer necessary for booting 32-bit versions of Windows (pre-Vista), such as Windows XP.
3. 32-bit versions of Windows do not currently support booting an EFI machine. (And the Gateway Media Center machine with EFI people keep talking about boots Windows XP Media Center Edition 2005 in BIOS compatibility mode, not with EFI.)
4. Windows XP 64-bit and Windows Server 2003 64-bit support EFI, but the Intel Core Duo is a 32-bit architecture.
5. Windows Vista does support EFI, but the EFI booter (cdboot.efi) currently does not appear to be functioning, and/or it is looking for, and not finding, information that it is looking for on the installation DVD. It does display the typical Windows "Please press any key to boot from the CD..." message. However, the DVD does not appear to contain the necessary EFI boot partition, and EFI does not support UDF volumes and El Torito booting. (Yes, this is a DVD obtained via official channels.)
6. Mac OS X's startup disk control panel presents a Windows Vista installation on a FAT/FAT32 volume as a valid bootable volume, but Windows Vista does not support booting from a FAT/FAT32 partition, only NTFS. Mac OS X can read NTFS volumes, but not write to them. This is currently the stage we're at now. No, I haven't tried "just hooking up a drive with Vista installed" (as many have asked elsewhere) or forcibly creating an NTFS partition whose contents are an already-installed instance of Vista.
7. grub, elilo, etc., all do not work on the Intel-based Macs at this time.
Eventually, whatever method boots Windows natively will have to have a nice wrapper put around it to make it easy for a normal person to do so, and easily dual boot in addition.
To regurgitate what I've said a bit elsewhere, the real benefit to most people will come from running Windows alongside Mac OS X in a "virtual machine" environment, in a window or even full screen, with, for example, a hotkey to switch back and forth between Mac OS X and Windows. To many users who prefer Mac OS X, particularly in enterprise, academic, and research environments, but who also have the occasional applications (usually administrative) that require Windows, this configuration would be a holy grail of sorts. And in this configuration, Windows wouldn't be running in emulation, but it would be running at essentially the native speed of the underlying hardware (with the exception of graphics and disk I/O performance). It will be *much* faster than any emulation ever has been, and there will no doubt be several open source (qemu, xen, wine) and commercial (vmware, Virtual PC) that will allow running Windows (or Windows software) in various capacities. Intel's Virtualization Technology (VT), allowing multiple operating systems to run in separate hardware "partitions" on one
"Apples implementation of EFI allows software to modify the computers ability to boot - or NOT. "
Enough of this firmware is flash-based that software can trash it to the point that it no longer boots from optical media. Key-mashers need to understand that EFI *precedes* the Apple Option-key tricks, so if EFI is hung you are crap out of luck. Unless there's some jumper inside the case which resets EFI to a factory state, that EFI will have to be pulled and reflashed.
We're going to pretend Apple doesn't really release mistakes like this and that there's a failsafe for restoring the EFI. Otherwise, you potentially have the mother of all DRM traps in front of you.
"Made up/misattributed quote that makes me look smart. I am on
Actually, if you RTFC (RTF Comments) which are at the end of the article (as it says in the story) you'll find that you can completely screw your new Intel Mac into not booting. Not even running the OS X install CD will fix it. Here's one of the comments describing the problem:
infested with jello like fishes no melotron wishes
Is the EFI cachable? And if so, wouldn't it be possible to create a custom boot which cached custom EFIs so you could experiement without overwriting the nvram/eeprom/whatever? Alternatively, if everything else is the same between intelMacs and typical PCs, wouldn't you be able to cache an EFI to boot MacOS?
https://www.eff.org/https-everywhere
Because the nature of the effort was to boot XP, they are no longer booting Windows instead of no longer booting OS X.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
somewhere in this thread are various instructions on how to fix it.
Try This:
1. Remove the primary battery on the notebook
2. Open up the notebook and remove it's internal battery.
3. Power on the notebook (without it's batteries installed).
4. With the notebook on, turn it off by removing the power cord.
5. Leave notebook sit for at least 1 hour, the longer the better.
Now plug the notebook back in and turn it on, if it starts up and displays an error message saying it's lost it's CMOS settings or something like that then your good to go.
iPaperweight.
G-Force music visualization
By following these steps, the iMacs that had difficulty with certain EFI modules appear to have been restored to a functioning state:
1. Disconnect the internal hard disk
2. Disconnect the iMac from AC power
3. Plug in AC while holding the power button
4. Power up the iMac and zap NVRAM (cmd-opt-P-R)
The hard disk can be reformatted and the operating system restored.
Until and unless Apple publishes a spec for how to modify the EFI, this is in the "you broke it, tough shit" category.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Could it be that the TPM module is being used to verify the state of the EFI?
It would make sense to me, that one of the most fundamental aspects of a Trusted Platform Module would be to ensure that the platform is booting in a state you can trust, and not booting on some hacked EFI pointing to (and enabling) devices that the user has no idea are installed. As this is Apple's (or any major vendor to my knowledge) first foray into the TPM arena, perhaps this is part of that whole security featureset that you paid for but can't work with, I'm in the same boat, and would like to feel free to try Darwin in other incarnations as well as use the equipment for Windows and prove to my friends outright why Apple is such the superior gear.
Is there any way we can map the calls made on the system bus during the complete post? Do we have ANY information on how TPM is being used here?
There's a glaring hole in the documentation imho a long way from the 1984 ad...http://www.uriah.com/apple-qt/1984.html but there always seems to be someone's visage up on that screen no matter how you slice it.
cyberbianif I claimed I was emperor just because some watery tart lobbed a scimitar at me they'd put me away!
I got tired of mucking around with all the electronic gobbldeygook connected to EFI, so I just tore all that shit out and bolted on a good old-fashioned Holley 4bbl carburetor...
Next step is a hood scoop and a bigger hard drive...
Support for EFI is a standard linux kernel option, and i doubt it would be hard to support apple's partitioning scheme... They already used their own partitioning scheme on PPC machines, and linux supports that just fine.
I also believe EFI is the standard firmware used on Itanium systems too, so linux already must support it to run on such systems.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
From Dave Schroeder posted 01/23/06
By following these steps, the iMacs that had difficulty with certain EFI modules appear to have been restored to a functioning state:
- Disconnect the internal hard disk
- Disconnect the iMac from AC power
- Plug in AC while holding the power button
- Power up the iMac and zap NVRAM (cmd-opt-P-R)
The hard disk can be reformatted and the operating system restored.I think the best way to go about this would be to do something that was done to enable Linux to boot on old world Macs. On a PowerMac 8600 (for example) the best way to boot into PPC Linux, was to use a special boot loader called BootX http://penguinppc.org/bootloaders/bootx/. Basically, it was an OS 9 program that immediately ran as OS 9 had a basic initialization startup. It gave you a choice to ether to continue to boot into OS 9 or boot into Linux. It is unique from other boot loaders in that it bypasses a computer's firmware and lets Mac OS handle it. I think this is the way to go....let OS X handle the boot process that deals with the firmware, then give users a choice to boot into Windows or finish with the OS X boot process.
Granted, this second argument might not pan out -- now that Apple is on the intel bandwagon, They may speed up the upgrade cycle for different models. Since it's not very different from any of the millions of other intel based systems out there, It will be easier to port new hardware to the new machine. The Physical hardware is/nearly is identical with the exception of how the form factor might be when the non-imac models come out, and the software drivers will be easier to port since the underligning hardware calls to the CPU and system buses are going to be the same/nearly the same.
Mod parent up.
This basically is the answer to the question behind the first ~100 or so posts (mine included).
So it's not an irrecoverable "bricking" problem, but it does get close.
I wonder if it's possible, rather than reformatting the HD, to put it into another machine and just wipe the partition with the bad NVRAM image on it. Not that it really matters in a test environment (which I hope is the only place anyone would ever try this), where you'd probably want to reformat and reinstall anyway, but I just wonder if it's possible.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."