Chain0
From OSx86
chain0 is a file located in /usr/standalone/i386 containing the x86 bootsector for Darwin. If you copy it over to the root of your Windows system partition (usually C:), it can be used to boot Mac OS X through Windows XP's boot selector by adding a line to boot.ini:
C:\chain0="Mac OS X86"
chain0 will locate the HFS+ partition and will proceed to boot from it.
Contents |
[edit] Where to find chain0
darwinx86-801.iso.gz contains /usr/standalone/i386/chain0, the full CD image can be obtained from:
- Mirror 1
- Mirror 2
- Mirror 3 (requires AppleID, you can register it for free in the Apple site)
- chain0 source (requires AppleID, you can register it for free in the Apple site)
However, it may be difficult to extract chain0 from this image, since it is in Apple's HFS+ filesystem. 7-Zip, Daemon Tools, and UltraISO cannot read the complete disk image. However, chain0 can also be extracted from the VMware image (using WinHex), or if you are lucky enough to have network access within VMware, you could copy the chain0 file to a network share. It's also possible to use Transmac (They both have a fully working trial for 30 days).
- WINRAR Can be used to extract the chain0 from the darwinx86-801.iso
- IsoBuster (30 days trial) can read the HFS+ part of the iso
Alternatively, get just the chain0 from here: riccardo.raneri.it
[edit] Chain booting error?
This means chain0 was either unable to locate the Mac OS X partition or unable to load (and verify) the partition's boot sector. Chain0 doesn't bother about whether the partition is marked as bootable, but checks partition type and a valid first sector on it.
First, ensure the partition is of type 0xaf (HFS+). Types 0xab (boot2) and 0xa8 (UFS) would be accepted by chain0 as well, but the type should match the actual contents of the partition. Linux fdisk can view and change partition types.
If this fits, check wether your partition has a valid boot sector (= first sector of the partition). Without going too much into the details, this worked from a Mac OS X installed in VMware for me after unmounting the partition (Mac OS X speech: Dragging the Volume to the trash):
sudo dd if=/dev/disk1s2 of=block1 bs=512 count=1 hexdump -x block1
The last two bytes should read "AA55". Else, the boot sector of the partition won't be accepted by chain0.
You can copy over the partition boot sector over from /usr/standalone/i386/boot1h, of course. Often, this won't help much, though. If your installation lacks a valid boot sector, likely something else went wrong as well, and you should verify wether you use the correct installation procedure.
Once chain0 has loaded and verified a valid partition boot sector, chainO hands control over to it: End of chain0's part of the game.
Additional experiences:
If it's still not working, make sure your Mac OS X partition (af) is not UNDER an extended partition. It also has to be a PRIMARY partition. While chain0's source code indicates support for extended/logical partitions, experiences obviously show a different picture.
You can verify this by booting a Linux LiveCD and typing "sudo fdisk /dev/hda" or this sequence in Windows XP's shell:
diskpart select disk 0 list partition
Note: Both samples look at your first disk. Change "hda" to "hdb" btw. "disk 0" to "disk 1" to watch your second disk. Disk three and four accordingly.
Note: Sometimes the order of partitions in the MBR partition table doesn't match the order of the partitions on disk. Watch out for the offsets of the partitions.
Ex.:
Good:
-hda1, primary, boot, ntfs, etc. (windows partition)
-hda2, primary, af, etc.
-hda3, extended...
-hda4, logical, ntfs, etc.
bad:
-hda1, primary, boot, ntfs, etc. (windows partition)
-hda2, extended...
-hda3, primary, af, etc.
-hda4, logical, ntfs, etc.
bad:
-hda1, primary, boot, ntfs, etc. (windows partition)
-hda2, extended...
-hda3, logical, af, etc.
-hda4, logical, ntfs, etc.
[edit] chain0 in Base64
+jHAjtC88P/7jsCO2L4AfL8A4Py5AAHypeoe4AAAZjHAZqOR4aKV4bRBu6pVzRNyDoH7Vap1CPbB AQ+VBpXhsAEx247DuwAQid7HBAAAx0QCAQBmx0QIAAAAAOiyAHIIv74RtADoDwD+wvbCBHSvvnvh 6PYA6/5RVoF9QFWqD4WLAIn+uQQAgHwEq3QPgHwEqHQJgHwEr3QD6SsAsAG7AACOw7sAfOhnAHIc gb/+AVWqD4VYAGaLRAhmAwaR4WaJRAjqAHwAAIHGEADiuon+uQQAikQEPAV0ETwPdA08hXQJgcYQ AOLr6SMAsAEx247DuwAS6BoAcukI5HUJZotsCGaJLpHh/sS/vhPoav9eWcNR9gaV4QF0CrkFAOgk AHMM4vm5BQDoBgBzAuL5WcNginQBi0wCtALNE3MFMcDNE/lhw2CJ5R4eZosOkeFmA0wIZlEGUzDk UGgQAInmtELNE3MFMcDNE/mJ7GHDuwEA/Kw8AHQGtA7NEOv1wwoNQ2hhaW4gYm9vdGluZyBlcnJv cgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVao=
You can use a web decoder (e.g. http://www.motobit.com/util/base64-decoder-encoder.asp) in order to decode it and save as binary file.
Once you get your hands on chain0, you can check it's correct with this:
MD5 (chain0) = cfca64f400ef99e89b51e59bcb697137
[edit] chain0 Hex Dump
00000000 fa 31 c0 8e d0 bc f0 ff fb 8e c0 8e d8 be 00 7c |.1.............||
00000010 bf 00 e0 fc b9 00 01 f2 a5 ea 1e e0 00 00 66 31 |..............f1|
00000020 c0 66 a3 91 e1 a2 95 e1 b4 41 bb aa 55 cd 13 72 |.f.......A..U..r|
00000030 0e 81 fb 55 aa 75 08 f6 c1 01 0f 95 06 95 e1 b0 |...U.u..........|
00000040 01 31 db 8e c3 bb 00 10 89 de c7 04 00 00 c7 44 |.1.............D|
00000050 02 01 00 66 c7 44 08 00 00 00 00 e8 b2 00 72 08 |...f.D........r.|
00000060 bf be 11 b4 00 e8 0f 00 fe c2 f6 c2 04 74 af be |.............t..|
00000070 7b e1 e8 f6 00 eb fe 51 56 81 7d 40 55 aa 0f 85 |{......QV.}@U...|
00000080 8b 00 89 fe b9 04 00 80 7c 04 ab 74 0f 80 7c 04 |........|..t..|.|
00000090 a8 74 09 80 7c 04 af 74 03 e9 2b 00 b0 01 bb 00 |.t..|..t..+.....|
000000a0 00 8e c3 bb 00 7c e8 67 00 72 1c 81 bf fe 01 55 |.....|.g.r.....U|
000000b0 aa 0f 85 58 00 66 8b 44 08 66 03 06 91 e1 66 89 |...X.f.D.f....f.|
000000c0 44 08 ea 00 7c 00 00 81 c6 10 00 e2 ba 89 fe b9 |D...|...........|
000000d0 04 00 8a 44 04 3c 05 74 11 3c 0f 74 0d 3c 85 74 |...D.<.t.<.t.<.t|
000000e0 09 81 c6 10 00 e2 eb e9 23 00 b0 01 31 db 8e c3 |........#...1...|
000000f0 bb 00 12 e8 1a 00 72 e9 08 e4 75 09 66 8b 6c 08 |......r...u.f.l.|
00000100 66 89 2e 91 e1 fe c4 bf be 13 e8 6a ff 5e 59 c3 |f..........j.^Y.|
00000110 51 f6 06 95 e1 01 74 0a b9 05 00 e8 24 00 73 0c |Q.....t.....$.s.|
00000120 e2 f9 b9 05 00 e8 06 00 73 02 e2 f9 59 c3 60 8a |........s...Y.`.|
00000130 74 01 8b 4c 02 b4 02 cd 13 73 05 31 c0 cd 13 f9 |t..L.....s.1....|
00000140 61 c3 60 89 e5 1e 1e 66 8b 0e 91 e1 66 03 4c 08 |a.`....f....f.L.|
00000150 66 51 06 53 30 e4 50 68 10 00 89 e6 b4 42 cd 13 |fQ.S0.Ph.....B..|
00000160 73 05 31 c0 cd 13 f9 89 ec 61 c3 bb 01 00 fc ac |s.1......a......|
00000170 3c 00 74 06 b4 0e cd 10 eb f5 c3 0a 0d 43 68 61 |<.t..........Cha|
00000180 69 6e 20 62 6f 6f 74 69 6e 67 20 65 72 72 6f 72 |in booting error|
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa |..............U.|
00000200
[edit] x86 Disassembly
00000000 FA cli 00000001 31C0 xor ax,ax 00000003 8ED0 mov ss,ax 00000005 BCF0FF mov sp,0xfff0 00000008 FB sti 00000009 8EC0 mov es,ax 0000000B 8ED8 mov ds,ax 0000000D BE007C mov si,0x7c00 00000010 BF00E0 mov di,0xe000 00000013 FC cld 00000014 B90001 mov cx,0x100 00000017 F2A5 repne movsw 00000019 EA1EE00000 jmp 0x0:0xe01e 0000001E 6631C0 xor eax,eax 00000021 66A391E1 mov [0xe191],eax 00000025 A295E1 mov [0xe195],al 00000028 B441 mov ah,0x41 0000002A BBAA55 mov bx,0x55aa 0000002D CD13 int 0x13 0000002F 720E jc 0x3f 00000031 81FB55AA cmp bx,0xaa55 00000035 7508 jnz 0x3f 00000037 F6C101 test cl,0x1 0000003A 0F950695E1 setnz [0xe195] 0000003F B001 mov al,0x1 00000041 31DB xor bx,bx 00000043 8EC3 mov es,bx 00000045 BB0010 mov bx,0x1000 00000048 89DE mov si,bx 0000004A C7040000 mov word [si],0x0 0000004E C744020100 mov word [si+0x2],0x1 00000053 66C7440800000000 mov dword [si+0x8],0x0 0000005B E8B200 call 0x110 0000005E 7208 jc 0x68 00000060 BFBE11 mov di,0x11be 00000063 B400 mov ah,0x0 00000065 E80F00 call 0x77 00000068 FEC2 inc dl ;next physical drive 0000006A F6C204 test dl,0x4 ; A, B, C, D 0000006D 74AF jz 0x1e 0000006F BE7BE1 mov si,0xe17b 00000072 E8F600 call 0x16b ;print error msg 00000075 EBFE jmp short 0x75 ;halt 00000077 51 push cx 00000078 56 push si 00000079 817D4055AA cmp word [di+0x40],0xaa55 0000007E 0F858B00 jnz near 0x10d 00000082 89FE mov si,di 00000084 B90400 mov cx,0x4 00000087 807C04AB cmp byte [si+0x4],0xab 0000008B 740F jz 0x9c 0000008D 807C04A8 cmp byte [si+0x4],0xa8 00000091 7409 jz 0x9c 00000093 807C04AF cmp byte [si+0x4],0xaf 00000097 7403 jz 0x9c 00000099 E92B00 jmp 0xc7 0000009C B001 mov al,0x1 0000009E BB0000 mov bx,0x0 000000A1 8EC3 mov es,bx 000000A3 BB007C mov bx,0x7c00 000000A6 E86700 call 0x110 000000A9 721C jc 0xc7 000000AB 81BFFE0155AA cmp word [bx+0x1fe],0xaa55 000000B1 0F855800 jnz near 0x10d 000000B5 668B4408 mov eax,[si+0x8] 000000B9 66030691E1 add eax,[0xe191] 000000BE 66894408 mov [si+0x8],eax 000000C2 EA007C0000 jmp 0x0:0x7c00 000000C7 81C61000 add si,0x10 000000CB E2BA loop 0x87 000000CD 89FE mov si,di 000000CF B90400 mov cx,0x4 000000D2 8A4404 mov al,[si+0x4] 000000D5 3C05 cmp al,0x5 000000D7 7411 jz 0xea 000000D9 3C0F cmp al,0xf 000000DB 740D jz 0xea 000000DD 3C85 cmp al,0x85 000000DF 7409 jz 0xea 000000E1 81C61000 add si,0x10 000000E5 E2EB loop 0xd2 000000E7 E92300 jmp 0x10d 000000EA B001 mov al,0x1 000000EC 31DB xor bx,bx 000000EE 8EC3 mov es,bx 000000F0 BB0012 mov bx,0x1200 000000F3 E81A00 call 0x110 000000F6 72E9 jc 0xe1 000000F8 08E4 or ah,ah 000000FA 7509 jnz 0x105 000000FC 668B6C08 mov ebp,[si+0x8] 00000100 66892E91E1 mov [0xe191],ebp 00000105 FEC4 inc ah 00000107 BFBE13 mov di,0x13be 0000010A E86AFF call 0x77 0000010D 5E pop si 0000010E 59 pop cx 0000010F C3 ret 00000110 51 push cx ;read disk 00000111 F60695E101 test byte [0xe195],0x1 ;LBA? 00000116 740A jz 0x122 00000118 B90500 mov cx,0x5 ;retry 5 times 0000011B E82400 call 0x142 0000011E 730C jnc 0x12c 00000120 E2F9 loop 0x11b 00000122 B90500 mov cx,0x5 ;retry 5 times 00000125 E80600 call 0x12e 00000128 7302 jnc 0x12c 0000012A E2F9 loop 0x125 0000012C 59 pop cx 0000012D C3 ret 0000012E 60 pusha ;non-LBA read 0000012F 8A7401 mov dh,[si+0x1] 00000132 8B4C02 mov cx,[si+0x2] 00000135 B402 mov ah,0x2 00000137 CD13 int 0x13 00000139 7305 jnc 0x140 0000013B 31C0 xor ax,ax 0000013D CD13 int 0x13 0000013F F9 stc 00000140 61 popa 00000141 C3 ret 00000142 60 pusha ;LBA read 00000143 89E5 mov bp,sp 00000145 1E push ds 00000146 1E push ds 00000147 668B0E91E1 mov ecx,[0xe191] 0000014C 66034C08 add ecx,[si+0x8] 00000150 6651 push ecx 00000152 06 push es 00000153 53 push bx 00000154 30E4 xor ah,ah 00000156 50 push ax 00000157 681000 push word 0x10 0000015A 89E6 mov si,sp 0000015C B442 mov ah,0x42 0000015E CD13 int 0x13 00000160 7305 jnc 0x167 00000162 31C0 xor ax,ax 00000164 CD13 int 0x13 00000166 F9 stc 00000167 89EC mov sp,bp 00000169 61 popa 0000016A C3 ret 0000016B BB0100 mov bx,0x1 ;sub printError 0000016E FC cld 0000016F AC lodsb 00000170 3C00 cmp al,0x0 00000172 7406 jz 0x17a 00000174 B40E mov ah,0xe 00000176 CD10 int 0x10 00000178 EBF5 jmp short 0x16f 0000017A C3 ret ;end printError 0000017B 0A0D or cl,[di] 0000017D 43 inc bx 0000017E 686169 push word 0x6961 00000181 6E outsb 00000182 20626F and [bp+si+0x6f],ah 00000185 6F outsw 00000186 7469 jz 0x1f1 00000188 6E outsb 00000189 67206572 and [ebp+0x72],ah 0000018D 726F jc 0x1fe 0000018F 7200 jc 0x191
[edit] chain0 built from DEBUG
Start DEBUG.EXE from a command prompt and cut and paste the following lines into it.
- (To paste, right-click on the program's titlebar, select Edit, then select Paste)
N CHAIN0 E100 fa 31 c0 8e d0 bc f0 ff fb 8e c0 8e d8 be 00 7c E110 bf 00 e0 fc b9 00 01 f2 a5 ea 1e e0 00 00 66 31 E120 c0 66 a3 91 e1 a2 95 e1 b4 41 bb aa 55 cd 13 72 E130 0e 81 fb 55 aa 75 08 f6 c1 01 0f 95 06 95 e1 b0 E140 01 31 db 8e c3 bb 00 10 89 de c7 04 00 00 c7 44 E150 02 01 00 66 c7 44 08 00 00 00 00 e8 b2 00 72 08 E160 bf be 11 b4 00 e8 0f 00 fe c2 f6 c2 04 74 af be E170 7b e1 e8 f6 00 eb fe 51 56 81 7d 40 55 aa 0f 85 E180 8b 00 89 fe b9 04 00 80 7c 04 ab 74 0f 80 7c 04 E190 a8 74 09 80 7c 04 af 74 03 e9 2b 00 b0 01 bb 00 E1a0 00 8e c3 bb 00 7c e8 67 00 72 1c 81 bf fe 01 55 E1b0 aa 0f 85 58 00 66 8b 44 08 66 03 06 91 e1 66 89 E1c0 44 08 ea 00 7c 00 00 81 c6 10 00 e2 ba 89 fe b9 E1d0 04 00 8a 44 04 3c 05 74 11 3c 0f 74 0d 3c 85 74 E1e0 09 81 c6 10 00 e2 eb e9 23 00 b0 01 31 db 8e c3 E1f0 bb 00 12 e8 1a 00 72 e9 08 e4 75 09 66 8b 6c 08 E200 66 89 2e 91 e1 fe c4 bf be 13 e8 6a ff 5e 59 c3 E210 51 f6 06 95 e1 01 74 0a b9 05 00 e8 24 00 73 0c E220 e2 f9 b9 05 00 e8 06 00 73 02 e2 f9 59 c3 60 8a E230 74 01 8b 4c 02 b4 02 cd 13 73 05 31 c0 cd 13 f9 E240 61 c3 60 89 e5 1e 1e 66 8b 0e 91 e1 66 03 4c 08 E250 66 51 06 53 30 e4 50 68 10 00 89 e6 b4 42 cd 13 E260 73 05 31 c0 cd 13 f9 89 ec 61 c3 bb 01 00 fc ac E270 3c 00 74 06 b4 0e cd 10 eb f5 c3 0a 0d 43 68 61 E280 69 6e 20 62 6f 6f 74 69 6e 67 20 65 72 72 6f 72 E290 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa RCX 200 W Q
MD5 (chain0) = cfca64f400ef99e89b51e59bcb697137
