Chain0

From OSx86
Jump to: navigation, search

chain0 is a file located in /usr/standalone/i386 containing the x86 bootsector for Darwin. If you copy it over to the root of your Windows system partition (usually C:), it can be used to boot Mac OS X through Windows XP's boot selector by adding a line to boot.ini:

C:\chain0="Mac OS X86"

chain0 will locate the HFS+ partition and will proceed to boot from it.

Contents

[edit] Where to find chain0

darwinx86-801.iso.gz contains /usr/standalone/i386/chain0, the full CD image can be obtained from:

However, it may be difficult to extract chain0 from this image, since it is in Apple's HFS+ filesystem. 7-Zip, Daemon Tools, and UltraISO cannot read the complete disk image. However, chain0 can also be extracted from the VMware image (using WinHex), or if you are lucky enough to have network access within VMware, you could copy the chain0 file to a network share. It's also possible to use Transmac (They both have a fully working trial for 30 days).

  • WINRAR Can be used to extract the chain0 from the darwinx86-801.iso
  • IsoBuster (30 days trial) can read the HFS+ part of the iso

Alternatively, get just the chain0 from here: riccardo.raneri.it or here: www.strawberryforum.org.

[edit] Chain booting error?

This means chain0 was either unable to locate the Mac OS X partition or unable to load (and verify) the partition's boot sector. Chain0 doesn't bother about whether the partition is marked as bootable, but checks partition type and a valid first sector on it.

First, ensure the partition is of type 0xaf (HFS+). Types 0xab (boot2) and 0xa8 (UFS) would be accepted by chain0 as well, but the type should match the actual contents of the partition. Linux fdisk can view and change partition types.

If this fits, check wether your partition has a valid boot sector (= first sector of the partition). Without going too much into the details, this worked from a Mac OS X installed in VMware for me after unmounting the partition (Mac OS X speech: Dragging the Volume to the trash):

sudo dd if=/dev/disk1s2 of=block1 bs=512 count=1
hexdump -x block1

The last two bytes should read "AA55". Else, the boot sector of the partition won't be accepted by chain0.

You can copy over the partition boot sector over from /usr/standalone/i386/boot1h, of course. Often, this won't help much, though. If your installation lacks a valid boot sector, likely something else went wrong as well, and you should verify wether you use the correct installation procedure.

Once chain0 has loaded and verified a valid partition boot sector, chain0 hands control over to it: End of chain0's part of the game.


Additional experiences:

If it's still not working, make sure your Mac OS X partition (af) is not UNDER an extended partition. It also has to be a PRIMARY partition. While chain0's source code indicates support for extended/logical partitions, experiences obviously show a different picture.

Note : see the fix below.

You can verify this by booting a Linux LiveCD and typing "sudo fdisk /dev/hda" or this sequence in Windows XP's shell:

diskpart
select disk 0
list partition

Note: Both samples look at your first disk. Change "hda" to "hdb" btw. "disk 0" to "disk 1" to watch your second disk. Disk three and four accordingly.

Note: Sometimes the order of partitions in the MBR partition table doesn't match the order of the partitions on disk. Watch out for the offsets of the partitions.

Ex.:

Good:

-hda1, primary, boot, ntfs, etc. (windows partition)

-hda2, primary, af, etc.

-hda3, extended...

-hda4, logical, ntfs, etc.


bad:

-hda1, primary, boot, ntfs, etc. (windows partition)

-hda2, extended...

-hda3, primary, af, etc.

-hda4, logical, ntfs, etc.


bad:

-hda1, primary, boot, ntfs, etc. (windows partition)

-hda2, extended...

-hda3, logical, af, etc.

-hda4, logical, ntfs, etc. .

[edit] chain0 in Base64

+jHAjtC88P/7jsCO2L4AfL8A4Py5AAHypeoe4AAAZjHAZqOR4aKV4bRBu6pVzRNyDoH7Vap1CPbB
AQ+VBpXhsAEx247DuwAQid7HBAAAx0QCAQBmx0QIAAAAAOiyAHIIv74RtADoDwD+wvbCBHSvvnvh
6PYA6/5RVoF9QFWqD4WLAIn+uQQAgHwEq3QPgHwEqHQJgHwEr3QD6SsAsAG7AACOw7sAfOhnAHIc
gb/+AVWqD4VYAGaLRAhmAwaR4WaJRAjqAHwAAIHGEADiuon+uQQAikQEPAV0ETwPdA08hXQJgcYQ
AOLr6SMAsAEx247DuwAS6BoAcukI5HUJZotsCGaJLpHh/sS/vhPoav9eWcNR9gaV4QF0CrkFAOgk
AHMM4vm5BQDoBgBzAuL5WcNginQBi0wCtALNE3MFMcDNE/lhw2CJ5R4eZosOkeFmA0wIZlEGUzDk
UGgQAInmtELNE3MFMcDNE/mJ7GHDuwEA/Kw8AHQGtA7NEOv1wwoNQ2hhaW4gYm9vdGluZyBlcnJv
cgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVao=


You can use a web decoder (e.g. http://www.motobit.com/util/base64-decoder-encoder.asp) in order to decode it and save as binary file.

Once you get your hands on chain0, you can check it's correct with this:

MD5 (chain0) = cfca64f400ef99e89b51e59bcb697137

[edit] chain0 Hex Dump

00000000  fa 31 c0 8e d0 bc f0 ff  fb 8e c0 8e d8 be 00 7c  |.1.............||
00000010  bf 00 e0 fc b9 00 01 f2  a5 ea 1e e0 00 00 66 31  |..............f1|
00000020  c0 66 a3 91 e1 a2 95 e1  b4 41 bb aa 55 cd 13 72  |.f.......A..U..r|
00000030  0e 81 fb 55 aa 75 08 f6  c1 01 0f 95 06 95 e1 b0  |...U.u..........|
00000040  01 31 db 8e c3 bb 00 10  89 de c7 04 00 00 c7 44  |.1.............D|
00000050  02 01 00 66 c7 44 08 00  00 00 00 e8 b2 00 72 08  |...f.D........r.|
00000060  bf be 11 b4 00 e8 0f 00  fe c2 f6 c2 04 74 af be  |.............t..|
00000070  7b e1 e8 f6 00 eb fe 51  56 81 7d 40 55 aa 0f 85  |{......QV.}@U...|
00000080  8b 00 89 fe b9 04 00 80  7c 04 ab 74 0f 80 7c 04  |........|..t..|.|
00000090  a8 74 09 80 7c 04 af 74  03 e9 2b 00 b0 01 bb 00  |.t..|..t..+.....|
000000a0  00 8e c3 bb 00 7c e8 67  00 72 1c 81 bf fe 01 55  |.....|.g.r.....U|
000000b0  aa 0f 85 58 00 66 8b 44  08 66 03 06 91 e1 66 89  |...X.f.D.f....f.|
000000c0  44 08 ea 00 7c 00 00 81  c6 10 00 e2 ba 89 fe b9  |D...|...........|
000000d0  04 00 8a 44 04 3c 05 74  11 3c 0f 74 0d 3c 85 74  |...D.<.t.<.t.<.t|
000000e0  09 81 c6 10 00 e2 eb e9  23 00 b0 01 31 db 8e c3  |........#...1...|
000000f0  bb 00 12 e8 1a 00 72 e9  08 e4 75 09 66 8b 6c 08  |......r...u.f.l.|
00000100  66 89 2e 91 e1 fe c4 bf  be 13 e8 6a ff 5e 59 c3  |f..........j.^Y.|
00000110  51 f6 06 95 e1 01 74 0a  b9 05 00 e8 24 00 73 0c  |Q.....t.....$.s.|
00000120  e2 f9 b9 05 00 e8 06 00  73 02 e2 f9 59 c3 60 8a  |........s...Y.`.|
00000130  74 01 8b 4c 02 b4 02 cd  13 73 05 31 c0 cd 13 f9  |t..L.....s.1....|
00000140  61 c3 60 89 e5 1e 1e 66  8b 0e 91 e1 66 03 4c 08  |a.`....f....f.L.|
00000150  66 51 06 53 30 e4 50 68  10 00 89 e6 b4 42 cd 13  |fQ.S0.Ph.....B..|
00000160  73 05 31 c0 cd 13 f9 89  ec 61 c3 bb 01 00 fc ac  |s.1......a......|
00000170  3c 00 74 06 b4 0e cd 10  eb f5 c3 0a 0d 43 68 61  |<.t..........Cha|
00000180  69 6e 20 62 6f 6f 74 69  6e 67 20 65 72 72 6f 72  |in booting error|
00000190  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200

[edit] x86 Disassembly

00000000  FA                cli
00000001  31C0              xor ax,ax
00000003  8ED0              mov ss,ax
00000005  BCF0FF            mov sp,0xfff0
00000008  FB                sti
00000009  8EC0              mov es,ax
0000000B  8ED8              mov ds,ax
0000000D  BE007C            mov si,0x7c00
00000010  BF00E0            mov di,0xe000
00000013  FC                cld
00000014  B90001            mov cx,0x100
00000017  F2A5              repne movsw
00000019  EA1EE00000        jmp 0x0:0xe01e
0000001E  6631C0            xor eax,eax
00000021  66A391E1          mov [0xe191],eax
00000025  A295E1            mov [0xe195],al
00000028  B441              mov ah,0x41
0000002A  BBAA55            mov bx,0x55aa
0000002D  CD13              int 0x13
0000002F  720E              jc 0x3f
00000031  81FB55AA          cmp bx,0xaa55
00000035  7508              jnz 0x3f
00000037  F6C101            test cl,0x1
0000003A  0F950695E1        setnz [0xe195]
0000003F  B001              mov al,0x1
00000041  31DB              xor bx,bx
00000043  8EC3              mov es,bx
00000045  BB0010            mov bx,0x1000
00000048  89DE              mov si,bx
0000004A  C7040000          mov word [si],0x0
0000004E  C744020100        mov word [si+0x2],0x1
00000053  66C7440800000000  mov dword [si+0x8],0x0
0000005B  E8B200            call 0x110
0000005E  7208              jc 0x68
00000060  BFBE11            mov di,0x11be
00000063  B400              mov ah,0x0
00000065  E80F00            call 0x77
00000068  FEC2              inc dl            ;next physical drive
0000006A  F6C204            test dl,0x4       ; A, B, C, D
0000006D  74AF              jz 0x1e
0000006F  BE7BE1            mov si,0xe17b
00000072  E8F600            call 0x16b        ;print error msg
00000075  EBFE              jmp short 0x75    ;halt
00000077  51                push cx
00000078  56                push si
00000079  817D4055AA        cmp word [di+0x40],0xaa55
0000007E  0F858B00          jnz near 0x10d
00000082  89FE              mov si,di
00000084  B90400            mov cx,0x4
00000087  807C04AB          cmp byte [si+0x4],0xab
0000008B  740F              jz 0x9c
0000008D  807C04A8          cmp byte [si+0x4],0xa8
00000091  7409              jz 0x9c
00000093  807C04AF          cmp byte [si+0x4],0xaf
00000097  7403              jz 0x9c
00000099  E92B00            jmp 0xc7
0000009C  B001              mov al,0x1
0000009E  BB0000            mov bx,0x0
000000A1  8EC3              mov es,bx
000000A3  BB007C            mov bx,0x7c00
000000A6  E86700            call 0x110
000000A9  721C              jc 0xc7
000000AB  81BFFE0155AA      cmp word [bx+0x1fe],0xaa55
000000B1  0F855800          jnz near 0x10d
000000B5  668B4408          mov eax,[si+0x8]
000000B9  66030691E1        add eax,[0xe191]
000000BE  66894408          mov [si+0x8],eax
000000C2  EA007C0000        jmp 0x0:0x7c00
000000C7  81C61000          add si,0x10
000000CB  E2BA              loop 0x87
000000CD  89FE              mov si,di
000000CF  B90400            mov cx,0x4
000000D2  8A4404            mov al,[si+0x4]
000000D5  3C05              cmp al,0x5
000000D7  7411              jz 0xea
000000D9  3C0F              cmp al,0xf
000000DB  740D              jz 0xea
000000DD  3C85              cmp al,0x85
000000DF  7409              jz 0xea
000000E1  81C61000          add si,0x10
000000E5  E2EB              loop 0xd2
000000E7  E92300            jmp 0x10d
000000EA  B001              mov al,0x1
000000EC  31DB              xor bx,bx
000000EE  8EC3              mov es,bx
000000F0  BB0012            mov bx,0x1200
000000F3  E81A00            call 0x110
000000F6  72E9              jc 0xe1
000000F8  08E4              or ah,ah
000000FA  7509              jnz 0x105
000000FC  668B6C08          mov ebp,[si+0x8]
00000100  66892E91E1        mov [0xe191],ebp
00000105  FEC4              inc ah
00000107  BFBE13            mov di,0x13be
0000010A  E86AFF            call 0x77
0000010D  5E                pop si
0000010E  59                pop cx
0000010F  C3                ret
00000110  51                push cx       ;read disk
00000111  F60695E101        test byte [0xe195],0x1   ;LBA?
00000116  740A              jz 0x122
00000118  B90500            mov cx,0x5    ;retry 5 times
0000011B  E82400            call 0x142
0000011E  730C              jnc 0x12c
00000120  E2F9              loop 0x11b
00000122  B90500            mov cx,0x5    ;retry 5 times
00000125  E80600            call 0x12e
00000128  7302              jnc 0x12c
0000012A  E2F9              loop 0x125
0000012C  59                pop cx
0000012D  C3                ret
0000012E  60                pusha         ;non-LBA read
0000012F  8A7401            mov dh,[si+0x1]
00000132  8B4C02            mov cx,[si+0x2]
00000135  B402              mov ah,0x2
00000137  CD13              int 0x13
00000139  7305              jnc 0x140
0000013B  31C0              xor ax,ax
0000013D  CD13              int 0x13
0000013F  F9                stc
00000140  61                popa
00000141  C3                ret
00000142  60                pusha         ;LBA read
00000143  89E5              mov bp,sp
00000145  1E                push ds
00000146  1E                push ds
00000147  668B0E91E1        mov ecx,[0xe191]
0000014C  66034C08          add ecx,[si+0x8]
00000150  6651              push ecx
00000152  06                push es
00000153  53                push bx
00000154  30E4              xor ah,ah
00000156  50                push ax
00000157  681000            push word 0x10
0000015A  89E6              mov si,sp
0000015C  B442              mov ah,0x42
0000015E  CD13              int 0x13
00000160  7305              jnc 0x167
00000162  31C0              xor ax,ax
00000164  CD13              int 0x13
00000166  F9                stc
00000167  89EC              mov sp,bp
00000169  61                popa
0000016A  C3                ret
0000016B  BB0100            mov bx,0x1     ;sub printError
0000016E  FC                cld
0000016F  AC                lodsb
00000170  3C00              cmp al,0x0
00000172  7406              jz 0x17a
00000174  B40E              mov ah,0xe
00000176  CD10              int 0x10
00000178  EBF5              jmp short 0x16f
0000017A  C3                ret            ;end printError
0000017B  0A0D              or cl,[di]
0000017D  43                inc bx
0000017E  686169            push word 0x6961
00000181  6E                outsb
00000182  20626F            and [bp+si+0x6f],ah
00000185  6F                outsw
00000186  7469              jz 0x1f1
00000188  6E                outsb
00000189  67206572          and [ebp+0x72],ah
0000018D  726F              jc 0x1fe
0000018F  7200              jc 0x191 .

[edit] logical partition fix: x86 Disassembly patch

@@ -32 +32,3 @@
-00000053  66C7440800000000  mov dword [si+0x8],0x0
+00000053  6631ED            xor ebp,ebp
+00000056  66896C08          mov dword [si+0x8],ebp
+0000005A  90                nop
@@ -61,7 +63,8 @@
-000000A6  E86700            call 0x110
-000000A9  721C              jc 0xc7
-000000AB  81BFFE0155AA      cmp word [bx+0x1fe],0xaa55
-000000B1  0F855800          jnz near 0x10d
-000000B5  668B4408          mov eax,[si+0x8]
-000000B9  66030691E1        add eax,[0xe191]
-000000BE  66894408          mov [si+0x8],eax
+000000A6  66016C08          add [si+0x8],ebp
+000000AA  E86300            call 0x110
+000000AD  7218              jc 0xc7
+000000AF  81BFFE0155AA      cmp word [bx+0x1fe],0xaa55
+000000B5  0F855400          jnz near 0x10d
+000000B9  66A191E1          mov eax,[0xe191]
+000000BD  66014408          add [si+08],eax
+000000C1  90                nop
@@ -87,6 +90,6 @@
-000000F3  E81A00            call 0x110
-000000F6  72E9              jc 0xe1
-000000F8  08E4              or ah,ah
-000000FA  7509              jnz 0x105
-000000FC  668B6C08          mov ebp,[si+0x8]
-00000100  66892E91E1        mov [0xe191],ebp
+000000F3  668B6C08          mov ebp,[si+0x8]
+000000F7  E81600            call 0x110
+000000FA  72E5              jc 0xe1
+000000FC  08E4              or ah,ah
+000000FE  7505              jnz 0x105
+00000100  66872E91E1        xchg [0xe191],ebp

[edit] chain0 built from DEBUG

Start DEBUG.EXE from a command prompt and copy and paste the following lines into it.

  • (To paste, right-click on the program's titlebar, select Edit, then select Paste)
N CHAIN0
E100 fa 31 c0 8e d0 bc f0 ff fb 8e c0 8e d8 be 00 7c
E110 bf 00 e0 fc b9 00 01 f2 a5 ea 1e e0 00 00 66 31
E120 c0 66 a3 91 e1 a2 95 e1 b4 41 bb aa 55 cd 13 72
E130 0e 81 fb 55 aa 75 08 f6 c1 01 0f 95 06 95 e1 b0
E140 01 31 db 8e c3 bb 00 10 89 de c7 04 00 00 c7 44
E150 02 01 00 66 c7 44 08 00 00 00 00 e8 b2 00 72 08
E160 bf be 11 b4 00 e8 0f 00 fe c2 f6 c2 04 74 af be
E170 7b e1 e8 f6 00 eb fe 51 56 81 7d 40 55 aa 0f 85
E180 8b 00 89 fe b9 04 00 80 7c 04 ab 74 0f 80 7c 04
E190 a8 74 09 80 7c 04 af 74 03 e9 2b 00 b0 01 bb 00
E1a0 00 8e c3 bb 00 7c e8 67 00 72 1c 81 bf fe 01 55
E1b0 aa 0f 85 58 00 66 8b 44 08 66 03 06 91 e1 66 89
E1c0 44 08 ea 00 7c 00 00 81 c6 10 00 e2 ba 89 fe b9
E1d0 04 00 8a 44 04 3c 05 74 11 3c 0f 74 0d 3c 85 74
E1e0 09 81 c6 10 00 e2 eb e9 23 00 b0 01 31 db 8e c3
E1f0 bb 00 12 e8 1a 00 72 e9 08 e4 75 09 66 8b 6c 08
E200 66 89 2e 91 e1 fe c4 bf be 13 e8 6a ff 5e 59 c3
E210 51 f6 06 95 e1 01 74 0a b9 05 00 e8 24 00 73 0c
E220 e2 f9 b9 05 00 e8 06 00 73 02 e2 f9 59 c3 60 8a
E230 74 01 8b 4c 02 b4 02 cd 13 73 05 31 c0 cd 13 f9
E240 61 c3 60 89 e5 1e 1e 66 8b 0e 91 e1 66 03 4c 08
E250 66 51 06 53 30 e4 50 68 10 00 89 e6 b4 42 cd 13
E260 73 05 31 c0 cd 13 f9 89 ec 61 c3 bb 01 00 fc ac
E270 3c 00 74 06 b4 0e cd 10 eb f5 c3 0a 0d 43 68 61
E280 69 6e 20 62 6f 6f 74 69 6e 67 20 65 72 72 6f 72
E290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E2a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E2b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E2c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E2d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E2e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
E2f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
RCX
200
W
Q


MD5 (chain0) = cfca64f400ef99e89b51e59bcb697137


This page was last modified on 12 April 2012, at 02:08.
This page has been accessed 452,675 times.
Powered by MediaWiki © 2013 OSx86 Project  |   InsanelyMac  |   Forum  |   OSx86 Wiki  |   Mac Netbook  |   PHP hosting by CatN  |   Designed by Ed Gain   |   Privacy policy   |   About OSx86   |   Disclaimers