The makings of an Apple-branded Hackintosh.

[Spectere]

As some of you might know, I own an old Power Mac G4, one of the QuickSilver 2001 models.  733MHz processor, 768MB of RAM (soon to be 1.25GB!), 40GB HDD, CD-RW drive, pretty nice system...for 2001.

I was playing around with it today and, well...


(click to enlarge - 1280x960)

When Apple says that a 867MHz processor is required they're not messing around.  The installer will actively prevent installation on a 733MHz system.  I don't have another Mac, so I can't even install it on one system and restore a DMG onto my tower.  Additionally, I don't have a DVD-ROM drive in this system, so how could I possibly install the OS?  No CD distribution was ever released for Leopard -- that stopped with Tiger.

It's funny, but in some ways this is like having another Hackintosh in the house -- both are using operating systems that they aren't intended to run (though you could argue that the Apple-branded Mac running Leopard is a bit less extreme).  The installation files have been untouched, so there are no installer package hacks to get around the.  As far as the real Mac is concerned it can't even boot to the media.  So, how was Leopard installed and run on it?

The main reason that all of this worked without any real novel trickery is due to one thing: Open Firmware.  The reason that it allows you to do such things is coming up.

First of all, we need to solve the mystery of how you could boot to the media.  The first step was to create an image of the Leopard install disc with a system fitted with a DVD drive -- my "Wintel" tower, in this case.  In an ideal world, I could have simply dumped the image onto an external hard drive.  In fact, if I had a FireWire hard drive I could have done this and simply booted to that drive.  However, the model that I'm dealing with doesn't support USB booting at all.  Remember, this is in 2002, where the fact that this system mandated the use of a USB keyboard and mouse was outrageous.  Hell, the fact that USB 1.1 was the dominant standard would have ensured that anyone would have gone batshit crazy trying to install an OS from a USB drive (note: one upgrade that I did slap into this system a few months ago was a USB 2.0 PCI card, so I didn't have to wait hours for the image to transfer).

Long story short, we're going to have to be a little clever if we want to boot to that image.

To solve the dilemma, I turned to Tiger.  I booted to my Tiger CD and went to Disk Utility.  I partitioned the internal hard drive, dumping the image onto a 10GB partition and leaving the other 30GB open for the install.  If you only have experience with PC-compatible hardware, you're probably going to be wondering what kind of trickery I used to boot to that partition and get the process going.

The simple answer is that there is absolutely no trickery required.  PC-compatibles require boot code to be present in the first sector of the drive that's being booted to (it can be a total of 510 bytes -- not including the required two byte magic at the end of the sector -- and can jump to other sectors for more advanced work).  Some boot loaders -- such as the one for DOS and Windows 9X -- are simple, containing only the required code to boot into a single operating system.  Others, such as GRUB, LILO, and the NT boot loader, are significantly more advanced.  Some newer systems allow you to boot to other hard drives at will, giving you the possibility of having multiple boot loaders without requiring chain loads, but it's all basically the same thing.

Open Firmware (and EFI, when it's used effectively), on the other hand, allows you to boot to literally any device that the system firmware supports, letting you go so far as to load a specific kernel.  This allows me to boot directly to the image on the hard drive without having to do anything fancy. In fact, when you run the Startup Disk application from within the Tiger installer, the Leopard drive appears in the list.  Booting to that will let me run the installer, but...wait a sec.

That doesn't change the fact that I still have a 733MHz processor.  Leopard will quickly detect this and forbid me from doing the installation.  It seems like it would be trivial to patch the package file so that it bypasses the CPU check, but our goal is to do this without patching files on the CD.  This hurdle, like the last one, is also resolved by Open Firmware, only this time we have to actually jump into the Open Firmware shell.

In addition to actually pointing the system to the correct boot files, Open Firmware also provides system information to the operating system.  Humorously enough, this information can also be manipulated by the user, provided he/she knows where to go.

As it turns out, the following two lines can be used to set what clock rate OS X detects:

Code: [Select]

dev /cpus/PowerPC,G4@0
d# 867000000 encode-int " clock-frequency" property
Finish it all off with a mac-boot and the Leopard installer will boot up from the hard drive and happily install the operating system on an under-spec Mac.  The modified clock-frequency property doesn't persist through a reboot, so when you boot into the Leopard installation it'll be back to what it should be but the OS won't care at that point (as demonstrated in the screenshot).

So, there you have it.  This is the kind of crap that I do late in the evening on weekends.  Woot.

[OmegaOmni]

Very nicely done...of course I am not suprised this is you we are talking about.  You know how to make a computer dance if you want to...or you can say "Would you kindly do as I say".....sorry been playing a lot of BioShock lately.

Still you will have one awesome Hackintosh.

[Bobbias]

I have to agree with the comment about knowing how to make a computer dance. I'm constantly being impressed with the random shit you do, like this. Most of this stuff, had ever tried my hand at, would likely have resulted in things like hacked installers, damaged installs, and hours of frustration, along with a (maybe) working result, lol.

[Spectere]

Hehe, thanks guys.

I dunno, I just love doing these things and explaining them.  I'm really enthusiastic about this sort of stuff.

I should work on rolling my own GNU/Linux system without leaning on LFS again.  I did that a couple of years ago and had a blast.  I should do it again and document it this time.   Unfortunately, I'll have to grab a replacement hard drive for my compy before I do that.  I still need to replace my dying 750GB.  Grr...

Still you will have two awesome Hackintoshs.

FTFY.

Then again, I'm really not sure what to call the Power Mac thing.  I guess UnderSpecIntosh would probably be a bit more fitting.  I didn't really do any "hacking," per se, just some Open Firmware tomfoolery.

I have been thinking about going back to Tiger, though.  Leopard does take a pretty big performance hit on G4s, especially ones as slow as mine.  I looked up some CPU upgrades on eBay earlier and can actually get a dual 1GHz G4 processor card, but I don't really want to dump about $150 into upgrading an eight year old machine.  I'd rather put my pennies toward an iMac or something.

Oh, I did actually end up sliding a DVD-ROM drive into the machine.  It plays DVDs quite nicely, though it's a bit on the quiet side since I'm just using the internal speaker.  Getting the optical drive tray out was kind of a pain due to the screw placement, but oh well...not like I'm going to have to do it again (err, I hope not, anyway).

I'm also going to be putting in a hard drive from an old Xbox (dead system, working hard drive) after I unlock it (essentially, put it into a working Xbox, power it on to the dashboard, pull the ribbon cable, power the system off...sneaky sneaky!).  That should give me an additional 10GB of storage space (it's from a late model Xbox) in addition to my current 40GB.

[Bobbias]

lawl, unlocking xbox harddrives.

[Spectere]

It's actually a lock on the hard drive itself, hence the reason the Xbox needs to be used to unlock it.  Unless the right code is given to the drive, the drive is essentially a brick.  The board will simply refuse to communicate with anything.  Some computers (Dells, in particular, not sure about others) allow you to lock the hard drive in a similar fashion.

It really isn't much security, but you'd have to do something a little on the crazy side for the hard drive swap trick to work.  When you want to replace your Xbox dashboard, you have to turn the Xbox on with the hard drive plugged in, access data on the hard drive to ensure that the unlock code was sent, then pull the data cable carefully.  You then have to plug it into a PC from there.  But if you think that it's that simple, oh ho, you are mistaken.  If the hard drive is told to initialize, it'll go ahead and lock itself again.  The only way for it to work is to plug the hard drive into the PC while the computer is running.  Timing is critical, because if you plug it in too early the BIOS will initialize the controller.  If you plug it in too late the OS (Linux, in this case) won't pick it up.  It's nucking futs.

Amazingly, I was able to do it without destroying the hard drive, the Xbox, or my old compy.

[Bobbias]

Yeah, I did some reading about the lock mechanism way back when. Kinda ingenious really. What's sad is that so many drives support it, and it sees so little use in the way of protecting data.

[Spectere]

Yep, my thoughts exactly.  Like I said, the only systems that I've seen support them fairly consistently are Dells, and I doubt most people know the feature exists on them, let alone actually use it.

It's far from being foolproof but it seems to be more effective at keeping out snoopers than a BIOS password (since the hard drive remains locked when the system is turned off, making retrieving data from the hard drive on another PC a bit harder).

[Bobbias]

yeah, definitely a good idea, even if it's not a perfect lockdown. It wouldn't stop someone who knows what they're dealing with, but the average snooper or beginner hacker (read: someone who wants to mess with someone else, but doesn't know the first thing about what they're doing) would definitely have trouble.

[OmegaOmni]

That when you develop a program that makes their web browser look at certain types of porn to raise some red flags to the Feds

[Bobbias]

No, it works better if you just install something like emule and download 25 GB of CP.. I'm pretty sure 25GB would be enough to raise some flags.