The Arctic Mac

The Boot Process Part 1

Introduction

In Mac OS X, as the computer boots, it displays various visual feedback. This set of documents is designed to walk you through modifying this visual feedback, and also includes a very basic description of how the boot process works. As a WARNING: This document gives directions for changing the images displayed during boot by Mac OS X 10.4 Client. If you have any other version of Mac OS X, or are running the Server version, please be cautious when following the tutorials as locations of files may not be the same in other versions of Mac OS X.

The Beginning of the Boot Process

When your computer boots (assuming it's a PPC mac), it runs some basic tests, (known as the Power On Self Test - POST), and then loads Open Firmware. Open Firmware is stored on a ROM chip in your computer, and is responsible for loading the OS. It loads some basic device drivers and stuff, checks for relevant key presses, and then launches BootX. BootX is a MachO binary that is responsible for basic setup and calling the kernel. It is also responsible for (and this is where we care) drawing the dark grey apple on it's light grey background that all Mac OS X users are so familiar with.

What about Intel?

Apple's new computers with Intel chipsets boot up differently. Instead of loading Open Firmware and BootX, the computer loads boot.efi (EFI is Extensible Firmware Interface). I'm not on top of the exact process, but the point is that the drawing is now handled by boot.efi instead of BootX. The image is stored similarly, but you cannot follow the PPC instructions. Additions for Intel users can be found at the bottom.

Getting Started

This mod will require the following tools: HexEdit (or other hexadecimal data editor of your choice), Terminal (or other shell access), an image editor - Photoshop or any other plus ImageMagick are covered here, and Mac OS X (um... duh).

Extracting the Image

While not strictly necessary it is a good idea to always extract the image you are trying to modify before actually changing it. This will ensure that you are looking for the image in the right place, and that you aren't editing the wrong data!!

  1. The first thing you need to do is to make a copy of BootX to modify. Go to the Finder, and hit shift-apple-g to open the Go To window. In it, type /System/Library/CoreServices/, and hit the Go button. In the Finder window that opens, start typing bootx (no command keys, just start typing the name) to select the BootX file. Copy this file to your desktop. PLEASE, save yourself trouble and do it with the Finder, not the Terminal. BootX must have the right type code for the computer to boot properly, and the Finder will preserve this, but command line tools won't.
  2. Open the copy of BootX in HexEdit. Make sure that HexEdit is set not to use decimal addresses.
  3. Select starting at $177A8 and continuing for $300 bytes. Copy this Data to a new file, and save that as color.act in a convenient location. (10.2 and 10.3 users can search for the hex string FFFFFFBFBFBF which starts off this section of data to find the appropriate offset for their OS)
  4. Copy the next $4000 bytes from BootX into a new document called apple.raw. If you want, you can also pull the $4000 bytes after that, which contain the image BootX draws when it fails, but we all hope you don't ever have occasion to see that, so there's not a lot of point in editing it.

Opening the Extracted Image in Photoshop

  1. Tell Photoshop to open apple.raw (it doesn't matter how)
  2. Setup the RAW options dialog as shown:
    128 by 128, with a single 8-bit channel
    When the image is opened you should see a funny colored apple:
  3. Go to Image -> Mode -> Indexed Color
  4. Go to Image -> Mode -> Color Table..., and load the color.act file as your color table

    The apple should now look normal.

Opening the Extracted Image using ImageMagick

Open a shell window, cd to the directory where your images are, and enter the following commands (% indicates the shell prompt):
$ cat color.act apple.raw > apple.map
$ convert -depth 8 -size 128x128 apple.map apple.png
$ open apple.png

Heck of a lot easier than with Photoshop, assuming you've got ImageMagick already, which you probably don't.

Injecting a Custom Image

Now, you can take any 128 by 128 image, and save it in the right format, and put it in to BootX to get your custom boot screen. Keep in mind that the image is limited to 256 colors (but you can use ANY 256 you want). Follow instructions below.

Saving Your Custom Image Correctly in Photoshop

  1. Go to Layer -> Merge Visible (if enabled)
  2. Go to Image -> Mode -> Indexed Color...
    In the dialog, for the Palette, select one of the Local options. Set the number of colors to 256.

    Now, under "Forced" go to "Custom". It will open up a color palette dialog. As the first color, pick some color in your image other than the background color. As the second, pick the background color (the second image in the color table is used to fill the whole screen when drawing). Then OK both dialogs.
  3. Go to Image -> Mode -> Color Table..., and Save the color table as new.act. Before closing, go to the color table name, and select Grayscale. Then click OK. Yes, it will look funny (it looked funny before, remember?)
  4. Save the image as a Photoshop RAW document called new.raw

Saving Your Custom Image Using ImageMagick

Basically, you should follow the first two instructions for Photoshop in whatever image editor you use (or at least, the equivalent) in order to get your image prepared. Then save it as an indexed 8-bit PNG file named new.png.

Now, run the following commands:
$ convert new.png new.map

Next, open the file new.map in HexEdit. Select the last $4000 bytes in the file, and move them (CUT and PASTE) to a new file, which we'll call new.raw. Save the remaining data to a file called new.act

Using HexEdit to Inject the New Image

This part is pretty easy. Open new.act, new.raw and your copy of BootX in HexEdit. You've got a new color table in new.act. Paste it over where you took the original color table from. Keep in mind that depending on a lot of things, there's some chance your new color table won't be a full $300 bytes in length. If so, since the color table in BootX needs to be a full $300 bytes, you can just paste your new colors over the beginning of it and leave the end untouched. (or if you prefer, just pad your new color table with zeros until it's the right length). You also have a new raw image called new.raw. Put this where the original apple came from. Save.

Swapping out the BootX files

Now, you've got a copy of BootX that you've modded, and you need to put it where the original was. We're going to use the Finder again to preserve the creator code.

  1. Hit shift-apple-g to open the Go To window. In it, type /System/Library/CoreServices/, and hit the Go button.
  2. Find the BootX file, and rename it to BootXBackup. Authenticate when asked.
  3. Copy your modified BootX into /System/Library/CoreServices/. Authenticate again when asked.
  4. Restart to admire your handiwork

But... but... Wait...

At this point, you may have noticed that the spinny on the boot screen doesn't quite look right... and that's where Part 2 comes in.

What about if I messed up?

Well, you'll have to try to fix your system. To get it to boot so you can work with it, you'll have to go in from Open Firmware. When you boot, hold down apple-option-o-f to load Open Firmware.

At the prompt, you can type dir hd:,\dir1\dir2\ to list the contents of a directory on your HD. (The given command would list the directory /dir1/dir2/) Put a number immediately after the colon to switch to a different partition number. Go find a copy of BootX on your disk now, using this. If you can't find BootX, you're going to need to do a reinstall. If you can, continue.

Type boot hd:,\System\Library\CoreServices\BootX, putting in the location of the BootX file you found above. You should now boot up. If your modded BootX is messed up and won't load the system, try with your BootXBackup. If you've trashed that (you naughty!! never trash that backup unless you restore it as the main), then you'll need to do an Archive and Install.

For Intel Users

So, what do you have to do differently? Well, the first thing is that instead of BootX, your computer boots off a file called boot.efi (found in the same location as BootX). The next issue is that the image is compressed in boot.efi using Run Length Encoding (RLE). Now, this makes things challenging for a couple reasons. First, you've got to take care of doing the Encoding/Decoding of the image (depending on which way you're going), but it also adds another small issue of how you're going to deal with it if your new data is longer than the original. With uncompressed data this isn't a problem, since it's always the same length, but different images compress different amounts.

So, what do you need to know?

First the location of the CLUT in boot.efi: $01E040 for $300 bytes.

Second the location of the image in boot.efi: $011140 for $55C bytes.

Third, where to find RLE tools: here

And finally, what to do if your image is too long: replace the old image with it, then replace the hex data at the following location with an RLE block count: $30DE for 4 bytes. The RLE block count is 1/2 the image data size (after being RLE'd). BUT WAIT. Intel uses Little Endian. Go look it up on wikipedia. Basically, this means that it reverses the byte order. So the original block count of $000002AE is stored in the file as $AE020000. Weird, I know. So you have to do the same thing. Reverse your bytes... so $12345678 (the way you'd normally think of it) becomes $78563412 in little Endian.