EFI Modifications Leaves iMac Unbootable?

jerbare writes "In attempting to run Linux and Windows on the new iMac Core Duo, people experimenting with configuring the EFI Console/Boot loader have found they can no longer boot the machine at all. Dave Schroeder of appleintelfaq.com comments, 'We have already irreversibly lost a couple of iMacs trying to load various EFI modules'. Instructions for breaking the iMac's are presently located at the bottom of the comments."

Ugh...been there

[TripMaster Monkey (862126)]

Reminds me of a situation I faced back in the day when I was a tech at a small mom-and-pop computer repair establishment. We received a shipment of motherboards, and found out that the BIOS on every single one of them was corrupt. Since the boards wouldn't even post, the traditional remedy of flashing the BIOS via a bootable floppy was not available. Normally, we would have just boxed up the boards again and returned them for replacements, but we desperately needed those boards to fill orders.

Well, desperate times call for desperate measures...

I got to thinking, "you know...once you've started booting to an OS, that BIOS chip isn't even being used anymore....hmmm". With this in mind, I pulled a working BIOS from another board, swapped it out with the bad BIOS, and powered the system on, booting from the BIOS flash floppy. Once the board had booted to the flash program, I carefully pulled the good chip back out, and put in the bad chip. I then ran the flash program to overwrite the bad BIOS.

Long story short, it worked like a charm. I managed to revive every board in the bad shipment without incident using this unorthodox technique.

Anyway, it should be possible to rig up a similar arrangement here, although as I am unfamilliar with EFI, I'll leave the details up to someone else.

Re:Ugh...been there

[GmAz (916505)]

I did the same thing on my ASUS A7N8X-Deluxe motherboard. They shipped a bunch with their 3.3v batters running about 2.9v. Apparently this would corrupt your bios chip. Well, it did do that to mine and instead of ripping my machine apart and RMAing it, I took the bios chip from my brother-in-laws machine (I built his too and we pretty much had identical machiens) and did the swap trick. Here's a little trick for any of you wanting to try this. Before you boot up your good machine, take the bios chip out and put a piece of dental floss under it and put the chip back in. That way, when the machine is booted and you need to take it out to do the swap, just tug gently on the floss. I didn't wanna stick a metal screwdriver in there to pop it out when it was running. It worked great for me and spent $2 for two 3.3v batteries for the computers.

BIOS Hot Swapping

[Otto (17870)]

It's a fairly well known trick, although you're correct that it's a little bit dangerous. But when you fiddle around with BIOS mods, it comes in handy to have a removable BIOS chip for just that reason.

http://www.google.com/search?q=bios+hot+swapping [google.com]

Re:Unofficial Moderation

[John Napkintosh (140126)]

One time I swapped sim cards with a friend's mobile phone. Are you saying I'm not a h4x0r?

Re:Unofficial Moderation

[rjstanford (69735)]

h4x0r yes.

hacker no.

And that makes all the difference.

Uhh,,,

[Eightyford (893696)]

Instructions for breaking the iMac's are presently located at the bottom of the comments.

Uhh, thanks.

Re:Uhh,,,

[by Anonymous Coward]

Could be worse. If they had succeeded, they'd have an iMac running Windows.

Dual Booting is not the answer

[ZachPruckowski (918562)]

I have a feeling that a virtualization/emulation with hardware graphics support will be available within 6 months that'll make dual booting pointless. I have a feeling that dual-booting OS X with XP or Vista will not work because it's got EFI/BIOS issues and the hard drive formatting issue. And any number of issues that haven't come up yet.

Re:Dual Booting is not the answer

[Incongruity (70416)]

Moreover, running a full windows install within OS X, through some sort of emulation/virtualization is going to be fairly easy as compared to, say PPC versions of virtual pc and it will potentially allow you to sandbox windows and thereby keep it much more secure than the standard installation on commodity hardware. Furthermore, there are few reasons to dual-boot if you can simul-boot? Done right, that method could really make the Intel/OS X macs a major player (think swiss-army knife) -- I know there's been talk of a similar sort of thing w/ linux and windows via WINE but it really looks like the OS X side might come to fruition first, though this really is all conjecture on my part, so whatever.

Re:Dual Booting is not the answer

[Elwood P Dowd (16933)]

And why do you think that OSX will be able to run windows binaries better than WINE and/or Cedega considering that the people at WINE etc. have been trying to reverse engineer the windows libraries for many years now.

Because VirtualPC & VMWare has been "able to run windows binaries better than WINE and/or Cedega" for many years now. Virtualization will work nicely here. No one expects to reverse engineer the windows libraries any better than WINE.

Dunno why no one in this thread seems to be talking about vanderpool. Maybe y'all should just wait to hear from someone who knows what they're talking about. (Not me, for example.)

Re:Dual Booting is not the answer

[killtherat (177924)]

And why do you think that OSX will be able to run windows binaries better than WINE and/or Cedega considering that the people at WINE etc. have been trying to reverse engineer the windows libraries for many years now.

One word: Money.

Apple has lots of it. They can through gobs of money at the problem, and that will always move things faster then a grass roots problem. Just imagine 150 engineers working full time on Wine. They've previously gotten MacOS9 programs to run in MacOSX, so they probably already have a pool of engineers with the needed talents.

Given that MacOSX is based off of BSD Unix, and they've already plugged a great deal of work into the KHTML rendering engine, it's not completely insane to suggest that Apple could pick up Wine, through a large number of engineers at it, and get it to the point were it can run Office and DirectX 9 games.

Counterintuitively...

[by Anonymous Coward]

Unbootable iMacs support an even wider selection of games than do bootable iMacs.

Re:Counterintuitively...

[happyemoticon (543015)]

Like:

• MacketBall
• HackyMac
• Hot Mactatoe
• Mactch (like catch, but with a mac!)
• PattyMac
• HopMac (somewhat detrimental to the screen)
• Pin the FireWire-800 on the MacBook

• • And the one those people who were foolish enough to screw with their computer's firmware are now playing: Doctor.

Denial Of Service - Putting people at threat

[NZheretic (23872)]

Hackers discover vulnerabilities and someone creates malware ( Worm, Trojan, Attack kit or Virus ) that screws with the BIOS settings effectively turning your DRM restricted system into a useless brick.

Just substitute Apple for Microsoft, Mac for Xbox and Internet for Xbox Live in the following...
Denial Of Service - Putting people at threat [zdnet.com]:

Want to guess how long it will take?

It is inevitable that someone mucking around trying to get their XBox360 to do something will trip the hardwired Trusted Platform Modules lock down. Effectively turning the trusted black box into a useless dead heap.

It is inevitable that this and other methods discovered will be publicly known, since the discoverer will want to warn others.

It is also inevitable this and other methods will become the basis for a widespread denial of service attack. Firstly through a fake Email campaign ( "Microsoft alert - follow these instructions to secure your XBox" or "Get Free games/porn - do this to your XBox" ) and later through viruses and networked worms embedded in Microsoft's mediaplayer formats.

Soon a worm that locks users out of their Xbox will be spread via Microsoft's Xbox live service.

Then it will be inevitable that criminals adapt the malware to display a message instructing the hapless victim how to make a payment to fix the problem. The messages would soon contain threats that their Xbox now contains contraband installed by the malware that would get the user in legal peril if they choose to take the Xbox back for repair or to the authorities. The potential rewards to the offshore cyber-criminals would far outweigh the risks.

http://itheresies.blogspot.com/2005_08_01_itheresi es_archive.html [blogspot.com]
Hollywood and the recording industry hold an effective monopoly on a large section of popular content. Both Microsoft and Apple are now offering the ability to content providers to demand that users must use unmodified systems to view said content. It locks you out of parts of your system that will inevitably be abused by third parties wanting to abuse you.

Posted by: David Mohring [slashdot.org] Posted on: 11/29/05

Re:Denial Of Service - Putting people at threat

[krbvroc1 (725200)]

On a related note, my neighbor asked me to perform the normal 'cleanup / devirus / windows update' on his laptop. He owns an HP laptop and has a 'Boot up BIOS password set'. So I didnt have to enter a password each time, the first thing I did was go into the BIOS. I entered the current password and when asked for a new password, I simply hit 'Enter' and 'Enter' to confirm. When I rebooted, it still asked for a password and 'Enter' does not work. The laptop is now completely useless. I have no idea how it will be fixed. From some internet searches, supposedely I can provide HP with a magic 'system hash code' and they can tell me a password, but I have no clue if I can get through to the right person, what happens if it is outside of warranty, etc.

Re:Denial Of Service - Putting people at threat

[evilviper (135110)]

IBM insisted there was no way to flash/unlock or otherwise repair the problem.

IBM are lying assholes. Anybody, with $20 worth of equipment can wire up a simple adapter for a thinkpad and read the EEPROM, where the password is stored in the clear. I was one of the people who helped figure out the requisite information that made it's way onto this site: http://www.ja.axxs.net/unlock/ [axxs.net]

What can I say? Read it and weep. I wouldn't be surprised if IBM was selling new systems to customers, then turning around and clearing the passwords on the old ones and reselling them as "refurbished".

Seems like a poor design, but certainly nobody ever saw her locked documents.

That's ridiculous. First of all, the power-on password has nothing to do with the hard drive password, except that most notebooks typically tie them together. IBM could easily have the hard drive passworded, but make the notebook perfectly usable once the drive has been swapped.

Additionally, it's trivially easy to read files off of a passworded hard drive. The password is stored in an EEPROM on the board, so all you have to do is buy an nearly identical drive and swap the circuit board to read all the documents.

If they were smart, they would store the password in sector 0 on the platters. Then, swaping the board wouldn't work. Also, running a strong magnet over the hard drive would erase the password as it erased the files, keeping the files safe, but also allowing you to erase the whole drive, and use it again without knowing the password.

Re:Denial Of Service - Putting people at threat

[Chuckstar (799005)]

As recently as the G4 towers, a firmware update required the user to physically depress the Programmer's button (the hardware interrupt button) on the computer itself. This may be different now, although I doubt it. The whole point was to make software-only firmware updates impossible in order to avoid this very threat. The hardware simply will not re-flash the firmware without that button being pressed. So at least some social engineering is required to get users to press that button.

I always assumed all computers worked that way. Otherwise, it would be trivial to get people to ruin their firmware -- just trojan horse the thing.

Re:Denial Of Service - Putting people at threat

[TheRaven64 (641858)]

When the first flash BIOSes came out in the PC world there were a few viruses that would re-flash the BIOS with junk, turning the machine into a doorstop. These days most virus writers want to add your machine to a botnet, rather than destroy it, so it's probably less likely. More likely is hiding a copy of the virus in the EFI code so that it is automatically reinstated if removed when the system invokes an EFI call (resume from sleep would be my choice).

The real question here should be...

[BigZaphod (12942)]

When you screw this up, do you still get the sad mac?

Re:The real question here should be...

[by Anonymous Coward]

You'll have to settle for a sad owner instead.

Update

[daveschroeder (516195)]

Hello. Just to give a bit of an update on this issue...

The iMacs in question were rendered unbootable by trying to load additional modules from Intel's EFI Sample Implementation [intel.com]. It is not known which module is at fault currently.

Once the iMac is unbootable, it doesn't chime, boot, attempt to access media, or display an image on the screen. Attempts to zap NVRAM (cmd-opt-P-R is still supported for this task on Intel-based Macs), remove the motherboard battery and leave the AC power disconnected for an extended period of time, and disconnecting the hard disk do not resolve the issue.

At present, we seem to have a number of difficult situations that prevent the installation of Windows directly on Intel-based Macs:

1. Apple did not include its own EFI shell or other tools to access the EFI with the Intel-based Macs, so the tools used have consisted of Intel's EFI Sample Implementation [intel.com], and Tianocore's EFI Developer Kit [tianocore.org].

2. Apple's EFI implementation does not include CSM (Compatibility Support Module), the BIOS backward compatibility layer necessary for booting 32-bit versions of Windows (pre-Vista), such as Windows XP.

3. 32-bit versions of Windows do not currently support booting an EFI machine. (And the Gateway Media Center machine with EFI people keep talking about boots Windows XP Media Center Edition 2005 in BIOS compatibility mode, not with EFI.)

4. Windows XP 64-bit and Windows Server 2003 64-bit support EFI, but the Intel Core Duo is a 32-bit architecture.

5. Windows Vista does support EFI, but the EFI booter (cdboot.efi) currently does not appear to be functioning, and/or it is looking for, and not finding, information that it is looking for on the installation DVD. It does display the typical Windows "Please press any key to boot from the CD..." message. However, the DVD does not appear to contain the necessary EFI boot partition, and EFI does not support UDF volumes and El Torito booting. (Yes, this is a DVD obtained via official channels.)

6. Mac OS X's startup disk control panel presents a Windows Vista installation on a FAT/FAT32 volume as a valid bootable volume, but Windows Vista does not support booting from a FAT/FAT32 partition, only NTFS. Mac OS X can read NTFS volumes, but not write to them. This is currently the stage we're at now. No, I haven't tried "just hooking up a drive with Vista installed" (as many have asked elsewhere) or forcibly creating an NTFS partition whose contents are an already-installed instance of Vista.

7. grub, elilo, etc., all do not work on the Intel-based Macs at this time.

Eventually, whatever method boots Windows natively will have to have a nice wrapper put around it to make it easy for a normal person to do so, and easily dual boot in addition.

To regurgitate what I've said a bit elsewhere, the real benefit to most people will come from running Windows alongside Mac OS X in a "virtual machine" environment, in a window or even full screen, with, for example, a hotkey to switch back and forth between Mac OS X and Windows. To many users who prefer Mac OS X, particularly in enterprise, academic, and research environments, but who also have the occasional applications (usually administrative) that require Windows, this configuration would be a holy grail of sorts. And in this configuration, Windows wouldn't be running in emulation, but it would be running at essentially the native speed of the underlying hardware (with the exception of graphics and disk I/O performance). It will be *much* faster than any emulation ever has been, and there will no doubt be several open source (qemu, xen, wine) and commercial (vmware, Virtual PC) that will allow running Windows (or Windows software) in various capacities. Intel's Virtualization Technology (VT), allowing multiple operating systems to run in separate hardware "partitions" on one

Re:Update

[daveschroeder (516195)]

I should note that a colleague is also tracking these issues on his site [journalspace.com], the same one noted in the submission. Sooner or later, and with a bounty now offered for anyone who gets Windows XP booting on a Mac [winxponmac.com], I've no doubt something interesting will be accomplished.

Update: iMacs restored to working state

[daveschroeder (516195)]

By following these steps, the iMacs that had difficulty with certain EFI modules appear to have been restored to a functioning state:

1. Disconnect the internal hard disk

2. Disconnect the iMac from AC power

3. Plug in AC while holding the power button

4. Power up the iMac and zap NVRAM (cmd-opt-P-R)

The hard disk can be reformatted and the operating system restored.

Get rid of EFI completely!

[dfjunior (774213)]

I got tired of mucking around with all the electronic gobbldeygook connected to EFI, so I just tore all that shit out and bolted on a good old-fashioned Holley 4bbl carburetor...

Next step is a hood scoop and a bigger hard drive...

Not quite

[daveschroeder (516195)]

When the iMac is in this broken state, it doesn't boot, chime, show anything on the screen, or read from media.

Can't exactly "reinstall from the 10.4.4 media". ;-)

Zapping NVRAM (still supported with cmd-opt-P-R), removing the motherboard battery and letting it sit with AC for an extended period, and disconnecting the hard drive all do not revive the machine.