I searched my Copland disk image for occurrences of a snippet from the nvramrc and found 7 occurrences.
I mounted the disk image and searched only the HFS partition which also has 7 occurrences which means all occurrences are in the HFS partition.
I take the offsets and divide them by 512 to get block numbers, then use
I mount the disk in Leopard which supports HFS so that I can convert inode numbers to file paths.
Leopard doesn't have the
All the important occurrences seem to be in Mac OS Loader. Here's a list of interesting resources in that file:
I guess you'll want to look at 'ofpt' (131) and 'nvrm' (0).
I mounted the disk image and searched only the HFS partition which also has 7 occurrences which means all occurrences are in the HFS partition.
I take the offsets and divide them by 512 to get block numbers, then use
fsck_hfs to get inode numbers.I mount the disk in Leopard which supports HFS so that I can convert inode numbers to file paths.
Leopard doesn't have the
-B option for fsck_hfs.
Code:
# Note grep -b doesn't work well in earlier macOS versions - it gets offset of line instead of occurrences in the line.
grep -a -b -o 'boot-device 2dup drop " /AAPL,ROM" comp if try then' Copland.dmg | perl -pe 's/:.*//'
hdiutil attach -nomount Copland.dmg
grep -a -b -o 'boot-device 2dup drop " /AAPL,ROM" comp if try then' /dev/disk15s9 | perl -pe "s/:.*//" > /tmp/offsets.txt
perl -ne '
printf("%d ", ($_ / 512));
' /tmp/offsets.txt > /tmp/blocks.txt
fsck_hfs -B /tmp/blocks.txt /dev/disk15s9
# Mount the disk in a version of macOS that supports HFS, such as Leopard
# because FuseHFS does not use HFS inode numbers
diskutil mount disk15s9
GetFileInfo="GetFileInfo"
command -v GetFileInfo > /dev/null 2>&1 || {
GetFileInfo="/Developer/Tools/GetFileInfo"
}
# Use this to get the volume id of the Copland partition:
stat /Volumes/Copland
# Use this to get the path for a file with volume id/inode number:
"$GetFileInfo" -P "/.vol/234881036/721"
# If it doesn't work then use find:
find /Volumes/Copland -inum 721
# Or use ls:
ls -liR /Volumes/CoplandAll the important occurrences seem to be in Mac OS Loader. Here's a list of interesting resources in that file:
Code:
'opfw' (0). \ DBOF xcoff for NuBus Macs
'ofpt' (1, "OFPatches"). \ patches for OF not DBOF?
'ofpt' (2, "CONTROL Driver"). \ control
'ofpt' (3, "Platinum Driver"). \ platinum
'ofpt' (4, "Name Registry NVRAM"). \ OF code to load nvram properties into OF?
'ofpt' (128, "auto-boot?"). \ auto-boot? default value?
'ofpt' (129, "use-nvramrc?"). \ use-nvramrc? default value?
'ofpt' (130, "boot-command"). \ boot-command default value for OF?
'ofpt' (131, "load-base"). \ load-base default value?
'ofpt' (4177, "nvramrc"). \ nvramrc for OF not DBOF?
'ofpt' (-15, "nvramrc"). \ nvramrc for DBOF
'ofpt' (-14, "boot-command"). \ boot-command default value for DBOF?
'boot' (1). \ default boot block
'nkld' (128). \ new kernel loader?
'2ldr' (1, "SecondaryLoader"). \ secondary loader
'nvrm' (0). \ DBOF nvram source (modified by above overrides?)I guess you'll want to look at 'ofpt' (131) and 'nvrm' (0).
load-base and real-base are at a specific offsets in the nvrm.
