How Apple Created Hackintosh, Part II

There is every indication that throughout the early 2000s, Apple internally built and ran all of OS X on x86 PCs (it’s also something Steve Jobs himself mentioned in 2005). Otherwise why would Apple have x86 drivers for AC’97 audio or Intel graphics chips (e.g. Intel 830 and 915 found in Darwin 8.0.1) that could only be found in Intel PCs and were not in any way essential for Darwin? Keeping the x86 support alive was Apple’s insurance policy in case PowerPC was no longer viable—and by the mid-2000s, it wasn’t. IBM’s 64-bit G5 was a good performer, but with no chance to be used in laptops, and the Motorola/Freescale G3 and G4 CPUs fell further and further behind in performance.

An x86-based plan B made perfect sense. This was in fact reported in 2002 and it was known that the project to keep OS X going on Intel was called Marklar.

When the Apple DTS (Developer Transition System, also called DTK or Developer Transition Kit) appeared in June 2005, it didn’t take much to remove the bits that were used to bolt OS X 10.4.1 to the DTS. In mid-August 2005, there was already a “deadmoo” torrent (bovinity anyone?) with OS X Tiger adapted to run in a VMware VM. All it took was combining a few pieces of Darwin with the DTS release of OS X, and there was quite a bit of source code available. The only slightly tricky part was the TPM lock in Rosetta, but even that eventually boiled down to about five patched instructions.

First Intel developer release of OS X (2005)

Hackintosh thus actually predates the official January 2006 release of OS X for Intel. Apple was at least officially not pleased, but that didn’t stop numerous journalists from publishing articles about OS X on Intel—and while getting access to one of the DTK systems would have been difficult (not least because its owner would have to violate his or her agreements with Apple), getting access to Hackintosh was reasonably easy.

Let’s rewind a bit. There were three major reasons why the developer release of OS X Tiger 10.4.1 wouldn’t run on typical PCs at the time.

The Three Locks

The first was that Tiger required the SSE3 instruction set. That was provided by the Prescott Pentium 4 660 CPU in the Apple developer systems, but only some PCs built in 2004 or later supported SSE3—in other words, it was far from universally supported in mid-2005, even though some PCs did support SSE3.

The second reason was that Tiger 10.4.1 only supported certain PCI devices found in the Intel 915G/ICH6 chipset. Notably the IDE controller had to be the ICH6 PATA or SATA IDE device; without that, OS X wouldn’t boot (endless “Still waiting for root device”). Again there were PCs with the ICH6 chipset, but most were not.

The final reason was the “safety”. Even if one had a Pentium 4 processor with SSE3 (no other CPUs supported SSE3 at the time), and a motherboard with ICH6 IDE, Tiger 10.4.1 still wouldn’t boot—because in order to start the GUI, Rosetta had to be used, and Rosetta was locked to the Infineon TPM chip shipped in the Apple DTS (the same TPM chip which also appeared in early Intel Macs, but had no functionality whatsoever).

Perhaps ironically, it was the first problem (SSE3 support) which required the most effort to overcome. Hackers went so far as to build an SSE3 emulator (using SSE2 instructions) into the OS X kernel and patch a few miscellaneous executables in addition. The issue eventually took care of itself when more or less all CPUs supported SSE3. At the time of its release, OS X on Intel had far higher CPU requirements than PC operating systems, simply because Apple did not have any installed base to worry about, and could therefore require (not just use but require) relatively new CPU features like SSE3 or MONITOR/MWAIT.

Fresh Tiger 10.4.1

The second problem area (drivers) was where Darwin was extremely helpful. Darwin already had generic (if perhaps flaky) IDE drivers, it had drivers for various network chips, drivers for PS/2 keyboards and mice. Notably Darwin also had drivers for AC’97 audio, which was common at the time, but the Apple DTS as well as all Intel Macs used HDA instead (High Definition Audio aka Azalia, the successor of AC’97).

The third lock was the one which caused by far the most uproar and speculation, but was the easiest to break. It is fairly apparent that the TPM lock was not meant to be any kind of super duper secure mechanism; it was meant to bolt down the OS to Apple’s hardware, and breaking the lock was the equivalent to clicking the Agree button on a dialog that said “Yes, I understand and agree that I am knowingly violating applicable laws and regulations”.

Only the Rosetta executables (called oah750 and oah750d in the developer release) communicated with AppleTPMACPI.kext (Apple’s TPM driver). Bringing up the GUI required a font server (ATSServer, for Apple Type System), and the ATSServer binary was PowerPC only, requiring Rosetta. It was possible to boot Tiger 10.4.1 to command line without Rosetta, but not further. It is plausible that Apple deliberately did not build ATSServer as a universal binary so that Rosetta (and therefore TPM) would be needed to bring up the OS.

One of these things is not like the others

There were other binaries shipped with Tiger 10.4.1 which were PowerPC-only, notably iTunes:

Rosetta in action, translating iTunes

However, ATSServer was the only PowerPC binary required to get the GUI off the ground, everything else was non-essential. It is worth noting that by the time the Tiger 10.4.3 update rolled out, iTunes (now in version 6) was already a universal executable and did not need Rosetta anyway, although ATSServer still did:

Intel iTunes in OS X 10.4.3

That supports the theory that ATSServer was deliberately left as a PowerPC binary to make running OS X on non-Apple systems more difficult.

To restate the situation with three “locks” described above, the only change required to get the DTS release of OS X 10.4.1 working on suitable hardware (Intel D915GUX board, for example) was removing the TPM lock. Other and much more extensive changes were needed to allow running on CPUs without SSE3 and on chipsets not using the ICH6 southbridge.

BIOS vs. EFI

Note that EFI was not among the aforementioned locks, since the DTS machines used classic BIOS (seen e.g. here), albeit a slightly customized version for the custom Intel board which Apple used. The DTS board was a close relative of the Intel D915GUX and D915GAG desktop motherboards.

When Intel Macs were officially released with OS X Tiger 10.4.4 in January 2006, things changed somewhat. Unlike the DTS, the released Macs used EFI rather than classic BIOS firmware (and not just that, it was EFI with several custom Apple extensions). But again it didn’t take long before hacked versions of Tiger showed up with a BIOS boot loader (the one originally written by NeXT/Apple) and patches to support AMD processors and more.

The differences between the Apple DTS and shipping Intel Macs were substantial enough that the developer releases of OS X did not run on Intel Macs, and the released Intel OS X (starting with Tiger 10.4.4) did not run on the DTS machines. As a consequence, if DTS owners wanted to upgrade their systems past OS X 10.4.3… they needed Hackintosh.

Perhaps ironically, the roll-out of Intel Macs directly or indirectly led to the death of the OpenDarwin project, because Apple didn’t publish enough code for a standalone system; notably the source code for the EFI boot loader (boot.efi) and the ACPI “platform expert” was never published, although Apple continues to publish the source code for the xnu kernel and numerous other Apple-written components of OS X (nowadays known as macOS).

That didn’t stop Hackintosh, which first used the existing Darwin BIOS boot loader, then added EFI boot support, and continues to run with, or at least hobble along, latest OS X versions and PC hardware. Books were even written about it.

TPM vs. SMC

What’s notable is that the mechanism which OS X uses to lock itself to Apple hardware completely changed between the mid-2005 DTS and the January 2006 Intel Mac release (something which was completely independent of the BIOS to EFI switch). That caused quite a bit of confusion. It apparently confused even the author of the Mac OS X Internals book, because he wrote excellent articles about TPM on OS X and Apple’s non-use of it in Intel Macs, but somehow completely failed to mention that the developer releases of x86 Tiger did in fact use and require the TPM chip, which is where a lot of the confusion originated.

Although the earliest Mac models did ship with the same TPM chip as the DTS machines, TPM was indeed entirely unused. Instead, publicly shipping OS X used (and still uses) DSMOS, or Don’t Steal Mac OS X. OS X executables may have encrypted pages (sections); the xnu kernel decrypts those on the fly, using a key obtained from the hardware, namely the SMC chip (System Management Controller). DSMOS is described in detail here. As with the TPM-based protection in the developer releases, DSMOS is not technically difficult to defeat, but requires knowingly breaking the law. That is a very pragmatic approach—not fighting an endless losing war with hackers but doing enough to force (ab)users to have no legally valid excuses.

As with the developer releases, DSMOS only kicks in when starting the GUI and is not used or needed when booting into single-user mode.

Reference

As far as is known, there were three versions of the OS X Tiger DVD shipped to developers:

  • Tiger 10.4.1 build 8B1025. Finalized on June 3, 2005, this was the version used at the June 2005 WWDC when Intel OS X was first publicly shown.
  • Tiger 10.4.3 build 8B1099. Finalized on October 12, 2005.
  • Tiger 10.4.3 build 8F1111. Finalized on November 3, 2005, this was the final developer disc.

It is possible that there were interim updates such as build 8F1111a. The matter is confused because hackers created unofficial builds such as 8F1111g.

For further reference, the first few public releases of Intel OS X were:

  • Tiger 10.4.4 build 8G1165. Probably finalized January 4, 2006 (two months after the last developer release).
  • Tiger 10.4.5 build 8G1454. Finalized February 7, 2006. Also available as an update package for 10.4.4.
  • Tiger 10.4.5 build 8H1455. Finalized February 14, 2006.
  • Tiger 10.4.5 build 8H1619. Probably finalized February 19, 2006.

There were most likely no generic retail discs of Tiger for Intel. Since by definition all Intel Macs shipped with at least OS X 10.4, there was nothing to upgrade from to Tiger. In other words, Tiger discs came with Intel Macs and were restricted to specific Mac models. That is why it’s somewhat difficult to pin down the dates—because there might have been model-specific additions after the base OS was finalized.

OS X 10.5 Leopard was available as a generic retail upgrade DVD without a model restriction, a practice which continued with 10.6 Snow Leopard. And when Snow Leopard was released, the PowerPC era at Apple was officially over.

This entry was posted in Apple, Intel, OS X, PC history, Pre-release. Bookmark the permalink.

10 Responses to How Apple Created Hackintosh, Part II

  1. Yuhong Bao says:

    I think the later 64-bit version required SSSE3, which was not supported in AMD processors for a long time.

  2. Michal Necasek says:

    Right. Again not something that Apple worried about 🙂

  3. I was totally onboard with OS X 1.0 back in 1999, with a G3 iMack, which I then upgraded to an incompatible Sawtooth G4. OS 9 + VirtualPC was a dark day until the OS X 10.0 public beta, which I had recevied on the same day as my OS X Server 1.2v3 CD set to get my G4 going. But OS X 10.0 was so much more exciting. I’d upgraded from the massive desktop to a Nvidia / G4 based cube, and then finally to a G5 iMac. OS X was really amazing.

    But the G5 had basically killed my interest in OS X, as too much of the OS had been locked off, and the processor was just too hot, and too loud. I had gone back to Windows, except then the transition happened and I along with a bunch of people at the time had taken the deadmoo VM, and restored it to a physical disk, and booted up natively. It was great to dual boot between Windows and OS X, just as I had dualbooted between Windows and OS/2 a decade earlier. Hardware incompatibilities had become more and more of a pain to deal with, and I then later picked up one of the 2006 Mac Pro’s, which had the dumbed down 32-bit only firmware. However once I’d loaded up bootcamp, and installed Windows on my ’32bit’ Mac, I stuck in the Hackintosh bootloaders, and was able to use 64bit OS X on my 2006 Mac well until the Mountain Lion days. But work intervened, and OS X versions of apps, namely Microsoft Office were just lagging too much behind. I needed up to date outlook, and I ended up just putting together a Windows 7 PC that I’ve since updated to Windows 10, but oddly enough I haven’t upgraded hardware in this machine in nearly 4 years now. The Xeon E3-1230 v3 with 16GB of RAM and a lowly GTX 760 have filled my neeeds.

    I’ve seen some 4th generation Mac Pro’s go for about $500 USD, and I was tempted to get one, but truth be told, OS X feels too much like something on an iPhone now, and just isn’t as fun as it was when it was back in the 10.2 / 10.6 days.

  4. Michal Necasek says:

    I never really used a Mac until they switched to x86. I briefly saw a G4 Mac and OS X looked cool, but we had it for running Linux (because a G4 at the time was a good way to get a decent PowerPC development machine). In September 2006 I bought my first MacBook Pro, and OS X beat the heck out of Windows XP.

    Snow Leopard was probably the best of the Intel OS X versions, and it went downhill from there, first slowly and now much faster. It’s apparent that Apple’s top developers are not working on OS X, and all the screams about security! security! in combination with semi-competent developers are killing the platform (new High Sierra kext security: totally broken at launch). That and the idiotic desire to make Macs look like overgrown iPhones. I wonder if some light bulb will eventually go on, realizing that the people who want to use an iPad are already using one, and not a Mac.

  5. Christian says:

    My first encounter with a Mac and Mac OS X was when my father bought an iBook running Jaguar (10.2) in 2002; I immediately fell for the OS even though it was still in its early days at that point and wished I could afford a Mac myself, but I could not (getting an iBook myself was not an option because it lacked a DVI output). I considered getting a used Mac and even dabbled with the idea of a Pegasos virtualising Mac OS X [1] but these plans have never come into fruition. But when the (G4-based) Mac mini was announced in January 2005, I decided to jump aboard right away. On that one, I briefly ran Panther and then Tiger for a long time – until the end of 2009 to be exact, when I finally decided the performance of a G4 was no longer sufficient and I replaced it with a 2009 Core 2 Duo Mac mini running Snow Leopard. A couple of years later, I replaced that with what is my current main machine.

    I concur with you that Snow Leopard was the best of the Intel OS X versions (as much as I think Tiger is the best release for PPC). Lion was a huge disappointment, fortunately the following two versions were improvements, making Mavericks my “Snow Leopard v2” for Macs too new for the real Snow Leopard. I could never adjust to the new design introduced in Yosemite… I have an installation of Sierra (don’t plan to upgrade until security updates disappear) but don’t enjoy using the platform nearly as much as I did in the early days of OS X.

    I have a couple of PowerPC Macs running Jaguar, Panther, Tiger and Leopard and it’s nice to be able to intermittently go back to the “old times” and remind myself why I was so attracted to OS X’s Aqua GUI when I first saw it (2001?).

  6. Christian says:

    Two additional tidbits:

    – It is possible to virtualise Mac OS X on non-Apple PowerPC hardware using Mac-on-Linux (see e.g. http://mobile.osnews.com/printer.php?news_id=3589). Would this count as a pre-Intel Hackintosh, or must OS X be running natively for a machine to be worthy of that designation?

    – Mac OS X 10.4.4 build 8G1165, i.e. the very first public Intel release, can be run in VirtualBox in EFI mode. I got it to boot by replacing the following files with the versions shipped in 10.4.8:

    /mach_kernel
    /System/Library/Extensions/AppleSMC.kext
    /System/Library/Extensions/Dont Steal Mac OS X.kext
    /System/Library/Extensions/IOUSBFamily.kext
    /System/Library/Extensions/System.kext

    Ethernet doesn’t work in that system, but the GUI and applications all work as expected.

  7. Michal Necasek says:

    I’d say emulation does not count if it emulates an Apple machine. Hackintoshes are distinguished by not being able to run unmodified OS X and needing at a minimum a shim boot loader and at worst all kinds of ACPI table modifications, hacky drivers, kernel patches, and other ugliness. The Pegasos thing is a bit different and I’m not sure just where it falls. If it was able to run Darwin + GUI then it might have been conceptually close to Intel Hackintoshes.

  8. Christian says:

    The Pegasos can’t run Darwin/OS X natively but can using Mac-on-Linux, on top of Linux – as far as I know, MoL only emulates some hardware and contains a copy of BootX that will enable Mac OS to boot but passes through the host’s CPU, making it conceptionally similar to a VM on an x86 system. I’ve used it a couple of times, to e.g. run Mac OS 9 or 10.1 on a Mac mini, which will only “take to” 10.2 (unofficially, since they shipped with 10.3.7 at the earliest) to 10.5.

  9. MiaM says:

    Not much of a hack, but some PPC Mac’s before G3 could also run the early versions of OS X, albeit incretibly slow. I remember running a 7600 (iirc) with 96MB ram. I also put in some old USB 1.x PCI card and with that I could use a mouse with more than one button 🙂

    While we are at it, one reason for OS X being so nice back in the early years is that at the time the competition were far worse than today. The Linux GUIs sucked, you had to pay for StarOffice to get an office suite on Linux (iirc, maybe it were open sourced earlier) and so on.

    Nowdays I’ve tried some of the not-that-old OS X’s (10.6.8 I think), and run various Ubuntu linuxes but always end up running Windows on my main computer simply because all other OS’s lack something as good as FooBar 2000 and Miranda-IM…

  10. The only Mac I’ve got is an eMac G4 that I got for free because the previous owner was getting rid of it; it’s running Tiger along with quite a few other goodies (such as MS Office 2008 and Photoshop CS3).

    > As a consequence, if DTS owners wanted to upgrade their systems past OS X 10.4.3… they needed Hackintosh.

    Oh, the irony…

    > you had to pay for StarOffice to get an office suite on Linux (iirc, maybe it were open sourced earlier)

    The first preview release of OpenOffice.org was on 13 October 2001, just six and a half months after Cheetah was released and less than three weeks after Puma.

Leave a Reply

Your email address will not be published. Required fields are marked *