DarwinDumper

[blackosx]

v2.8.7 -> 2.8.8

 

- Don't write prefs file if using the faceless option.

- Add detection for BootIA32 and it’s version.

- Add separator lines to Boot Loaders.txt file.

- Read user id and group before writing prefs.

- Add note to html report to inform user that it doesn’t contain all dump info.

- Overhaul custom path coding to be more robust.

- Removed the need to supply the -r option for dumps requiring root privileges when running from the command line.

- Add red cross beside custom path menu option if path no longer exists.

- Update VoodooHDA.kext to v2.8.4 and revise audio dump script.

- Swap Graphics and Audio lines in the html report overview.

- Add more info to log to help in the event of problems.

- Other miscellaneous tweaks and changes.

 

There have been quite a few changes in this version. Please report any bugs

[blacksheep]

Thanks for the report blacksheep.

When run on a real Mac, the video bios is saved from IORegistry.

Can you please post the DarwinDumperReports directory of a dump with the 'BIOS - Video' and I/O Kit Registry' options ticked?

Here you go.

Used 2.8.8 this time.

[blackosx]

Thanks for posting your dumps.

 

Looking at your IORegistry dump I see it contains only a 64K image (0x10000) which is what DarwinDumper saved out. You can see for yourself by loading up IOReg.txt and searching for ATY,bin_image

 

I'm sure there's a simple explanation as to why you do not see the full 128K ROM in OS X's IOReg but I don't know it. Maybe somebody else will be able to throw some light on the subject?

 

If you still want to dump the card's ROM then I understand you can save the card’s ROM from Windows using ATIFlash with a command like this (though check the command first just to make sure it is actually the right command):

atiflash -s 0 myrom.rom 20000

[blackosx]

DarwinDumper is now under GPL v3.

v2.8.9f -> 2.9.0

- Add additional logging for writeable save path.
- Add detection for 4K sector drives in the Disk Partition Table dump (Thanks JrCs).
- Add kernel sysctl_machdep_xcpm dump (Thanks Pike - http://bit.ly/NHg1JH).
- Split HTML report kernel info to separate tables.
- Fix decoding of more than one ATI Video ROM’s.
- Add physical block size disk info to Bootloaders & Disk Sectors dump files.
- Removed the use of Apple’s ‘Strings’ binary, using instead binary grep.
- Widen the HTML report to accommodate more info.
- Update dmidecode to v2.12 (Thanks Slice).

[MARKBOARD NETSET]

Hi Blackosx

 

Edit: Using darwindumper 2.9.1 to dump my Dell inspiron N4050 & iMac mid2010 

 

Thank you for this nice helpful app. Good luck for improving it more and more 

DarwinDumper_2.9.1_Clover_X64_2652_Mav_l.zip

DarwinDumper_2.9.1_Apple_X64_Mav_l.zip

[blackosx]

v2.9.0 -> 2.9.1

 

- Fix incorrect bootlog path in privatise function.

- Add private mask for DMI table -> System UUID in both .txt and .bin files.

- UI now directs user to ‘Save Directory’ page if custom path is missing.

- Revise UI ‘Custom Path’ page and add option for opening the current path in the Finder.

- Change assigned file extensions to dumped EDID files.

[bronxteck]

thanks.

[blackosx]

v2.9.1 -> 2.9.2

 

- Revise driver loading to fix bug where pciutils driver would be unloaded if already present on users system.

- Updated flashrom to v0.9.7-r1786 and amended script to dump first chip if more than one chip found (thanks THe KiNG).

- Updated edid-decode with revised version by Andy Vandijck which now decodes the Chroma Info.

- Kernel message buffer is now dumped using dmesg before any other dumps.

- Disassemble DSDT and any SSDT's as multiple tables from single namespace.

- Add last boot from Apple System Log to kernel log dump.

- Don’t load RadeonPCI kext for vBIOS dump when kernel is booted in 32-bit mode.

 

Please report any problems.

[asquare]

Tanks

[blackosx]

v2.9.2 -> 2.9.3

 

- Fix bug where unique partition ID read from ioreg could be incorrect if more than one result was returned.

- Add error checking when disassembling DSDT and SSDT’s as multiple tables from single namespace.

- Add new style html report which now uses standard jQuery and jQueryUI libraries and makes use of the accordion and tab widgets.

- Improved markup results in a smaller html file for a full dump.

- Split dmi dump in the html report by table types.

- Fix clicking collapsible div to toggle state when both open and closed.

- Add missing filepath /EFI/CLOVER/BOOT/ when looking for UEFI boot files.

- Only include relevant css and js for ioregistry viewer dump to html report if necessary.

- Move the Apple System Log to it’s own dump as root privileges are not needed for it.

- Many other small bug fixes, tweaks and improvements.

[blackosx]

v2.9.3 -> 2.9.4

 

- Replace the MacGap UI with newly compiled fat binary. (Thanks alexq/STLVNUB).

- Fix problem with new html report where more than one edid exists.

- Revise cleanup of temporary dmi files.

- Add atomdis to disassemble ATI Radeon vbios ROM (Thanks Slice).

- Add AnalyseVBIOS to analyse Nvidia vbios ROM (Thanks Slice).

- Replace 32-bit version of RadeonPCI.kext for OS X 10.6 and 10.7 with revised version by Slice that does not kernel panic.

- Add word decoded to decoded Radeon ROM txt file.

- Revised AppleSystemLog dump code.

- Try twice to unload VoodooHDA.kext (because of dependencies), if the script loaded it.

[blackosx]

v2.9.4 -> 2.9.5

 

- Firmware log should now correctly dump regardless of firmware-vendor.

- Replaced edid-decode with binary version that works on 10.8.

- Fix bdisk script output for partition type 0f (WIN95: Extended partition, LBA-mapped).

- Include Ozmosis Defaults.plist in bootloader configuration files dump.

- Adjust privatise routine to only mask loader confing data thats longer than 3 chars to avoid multiple search/replace issue.

- Add detection for a Non System FAT16 partition boot sector to the boot loader detection routine, to match the disk partition routine.

[Onixs]

still no way to dump AcpiTables on Yosemite? Tried 2.9.5 but still no .AML found in Acpi Tables folder.

[blackosx]

Not currently, since Apple removed them from ioreg.

 

One way to get the ACPI tables from within the OS would be to access them directly from memory but that will require the attention of a kind developer with some spare time.

[pokenguyen]

MacIASL can still get ACPI tables from system.

[blackosx]

I've just tried PHPdev32's MacIASL and it does indeed retrieve the ACPI tables from Yosemite. Nice!

Thanks for the info pokenguyen.

[blackosx]

From pokenguyen's note about MacIASL working fine in Yosemite, I've taken a look at PHPdev32's excellent MacIASL app and from that gone on to create a small program to dump the ACPI tables (as a binary .plist) which DarwinDumper can then use. So thank you for MacIASL PHPdev32.

 

The app and sources are currently posted at:

http://www.projectosx.com/forum/index.php?s=&showtopic=2447&view=findpost&p=41150

 

There's also DarwinDumper_v2.9.6beta4 which makes use of it and can now dump the ACPI tables in Yosemite.

http://www.projectosx.com/forum/index.php?s=&showtopic=2447&view=findpost&p=41154

 

I hope to release DarwinDumper_v2.9.6 soon.

[blackosx]

v2.9.5 -> 2.9.6

 

- Add CPU Info option. Using x86info binary (Thanks Slice).

- Add dumpACPI tool to dump ACPI tables from OS X, including Yosemite.

[blackosx]

I'm working towards adding an option to DarwinDumper to dump native ACPI tables, or at least the native DSDT, from memory. I've created a script to do this and have run many tests here on my hack (booting from Chameleon, CloverEFI and Ozmosis), an iMac11,2 and MacMini6,2. The scans on these machines all work well.

 

I am now at the stage where I require more data and would like to ask for testers to run the script and provide results for examination.

 

The script does the following:

1 - Attempts to load pmem.kext which presents /dev/pmem.

2 - Runs the FirmwareMemoryMap dtrace script to create a memory map.

3 - Identifies areas of memory to scan.

4 - Looks for valid RSDP pointers.

5 - Follows all pointers found and subsequently finds, verifies and writes all located ACPI tables to file.

 

The script creates a save directory named dump_<TIME> in the same directory as the script.

 

If anyone is willing to run this test then I would like the following:

- a copy of the dump_<TIME> directory.

- which bootloader used for current boot.

- any errors or problems with the script.

 

Please note:

1 - The script requires root priviliges to load the kext, and will ask for your password.

2 - As the script accesses direct memory, there may be a chance your system could freeze. This is unlikely as it's following a memory map, but it's worth being aware of so I recommend saving all open files and finish any work before testing.

 

Thanks

 

dumpACPIfromMem_v0.38_auto_debug.zip

 

EDIT: Fixed a bug in the memory region detection routine.

dumpACPIfromMem_v0.39_auto_debug.zip

 

EDIT2: Take into account 4 byte address pointers in ACPI v1.0 RSDT.

dumpACPIfromMem_v0.40_auto_debug.zip

 

EDIT3: Fix bug when looking in FACP for FACS and DSDT address pointers when parsing ACPI v1.0 RSDT.

dumpACPIfromMem_v0.41_auto_debug.zip

 

EDIT4: Replaced pmem.kext with signed version from http://www.rekall-forensic.com

dumpACPIfromMem_v0.42_auto_debug.zip

 

EDIT5: Reduce block size for more accuracy.

dumpACPIfromMem_v0.43_auto_debug.zip

 

EDIT6: Check for non-original SSDT-CpuPM tables and don’t scan for further tables.

dumpACPIfromMem_v0.44_auto_debug.zip

 

EDIT7: 

- Add check for SSDT with table ID CpuSsdt. Previously only checked for CpuPm.

- Reset facs and dsdt address vars before interpreting an RSDT/XSDT table.

- Tables with 00 in signature no longer get saved.

- Dump directories that contain just an RSDT with invalid address pointers are deleted.

dumpACPIfromMem_v0.45_auto_debug.zip

 

[kyndder]

Here you go > http://cl.ly/1W0r2B0G0k2B

 

Thank you blackosx!

[blackosx]

Thank you kyndder.

I'll take a look.

 

EDIT: Well we got a successful dump!

However, your dump highlighted a bug in the routine that detects the memory regions to scan.

I have fixed it and posted v0.39 of the script above.

 

If you get time, can you please test the new version?

 

EDIT2: And was that dump from Clover UEFI or CloverEFI?

 

Thanks

[Maniac10]

No noticeable problem with CloverEFI: dump_160911.zip

[blackosx]

Thank you too Maniac10.

I'll take a look

 

EDIT:

I can see what looks like your patched DSDT and SSDT but not original BIOS tables.

Looking at your forum signature I see your board is the Z68AP-D3, and I see the BIOS uses ACPI v1.0b

 

My script has a bug, or lack of correct code handling, for the ACPI v1.0 RSDT and currently, wrongly, iterates through the RSDT expecting 8 byte pointer addresses (as that's all I've been testing with), where as it needs to take 4 byte pointer addresses.

 

The log shows:

Found Table:  at b0fa8340b0fa3100 | Length: 0
Found Table:  at b0fa8480b0fa8400 | Length: 0
Found Table:  at b0fa8640b0fa8600 | Length: 0
Found Table:  at b0faaa30b0faa970 | Length: 0
Found Table:  at b0fa8240b0faaa90 | Length: 0
Found Table:  at b0faecc0b0fab380 | Length: 0

 

Where as your RSDT shows:

[024h 0036   4]       ACPI Table Address   0 : B0FA3100
[028h 0040   4]       ACPI Table Address   1 : B0FA8340
[02Ch 0044   4]       ACPI Table Address   2 : B0FA8400
[030h 0048   4]       ACPI Table Address   3 : B0FA8480
[034h 0052   4]       ACPI Table Address   4 : B0FA8600
[038h 0056   4]       ACPI Table Address   5 : B0FA8640
[03Ch 0060   4]       ACPI Table Address   6 : B0FAA970
[040h 0064   4]       ACPI Table Address   7 : B0FAAA30
[044h 0068   4]       ACPI Table Address   8 : B0FAAA90
[048h 0072   4]       ACPI Table Address   9 : B0FA8240
[04Ch 0076   4]       ACPI Table Address  10 : B0FAB380
[050h 0080   4]       ACPI Table Address  11 : B0FAECC0

I'll post a revised script soon.

 

Thanks for testing.

[kyndder]

EDIT2: And was that dump from Clover UEFI or CloverEFI?

 

Clover UEFI...

 

Here's the new dump > http://cl.ly/2t0H4641262u

 

Thank you again!

[blackosx]

@Maniac10 - I have revised the script and posted v0.40 in earlier post.

If you could please re-test when you get time then that would be great.

Thanks

Clover UEFI...

 

Here's the new dump > http://cl.ly/2t0H4641262u

 

Thank you again!

Thanks again kynnder.

I'll take a look.

 

EDIT:

The good news is the routine deciding which memory regions to read now performs as expected.

However, looking at the dumped DSDT I see

Name (VER0, "Clover auto patched")

So it's not the native BIOS DSDT table.

 

My local tests have been with CloverEFI and not UEFI. I will need to conduct tests with Clover UEFI here before knowing more.

 

Thanks for your time kynnder.