How Apple Created Hackintosh, Part II

There is every indication that throughout the early 2000s, Apple internally built and ran all of OS X on x86 PCs (it’s also something Steve Jobs himself mentioned in 2005). Otherwise why would Apple have x86 drivers for AC’97 audio or Intel graphics chips (e.g. Intel 830 and 915 found in Darwin 8.0.1) that could only be found in Intel PCs and were not in any way essential for Darwin? Keeping the x86 support alive was Apple’s insurance policy in case PowerPC was no longer viable—and by the mid-2000s, it wasn’t. IBM’s 64-bit G5 was a good performer, but with no chance to be used in laptops, and the Motorola/Freescale G3 and G4 CPUs fell further and further behind in performance.

An x86-based plan B made perfect sense. This was in fact reported in 2002 and it was known that the project to keep OS X going on Intel was called Marklar.

When the Apple DTS (Developer Transition System, also called DTK or Developer Transition Kit) appeared in June 2005, it didn’t take much to remove the bits that were used to bolt OS X 10.4.1 to the DTS. In mid-August 2005, there was already a “deadmoo” torrent (bovinity anyone?) with OS X Tiger adapted to run in a VMware VM. All it took was combining a few pieces of Darwin with the DTS release of OS X, and there was quite a bit of source code available. The only slightly tricky part was the TPM lock in Rosetta, but even that eventually boiled down to about five patched instructions.

First Intel developer release of OS X (2005)

Hackintosh thus actually predates the official January 2006 release of OS X for Intel. Apple was at least officially not pleased, but that didn’t stop numerous journalists from publishing articles about OS X on Intel—and while getting access to one of the DTK systems would have been difficult (not least because its owner would have to violate his or her agreements with Apple), getting access to Hackintosh was reasonably easy.

Let’s rewind a bit. There were three major reasons why the developer release of OS X Tiger 10.4.1 wouldn’t run on typical PCs at the time.

The Three Locks

The first was that Tiger required the SSE3 instruction set. That was provided by the Prescott Pentium 4 660 CPU in the Apple developer systems, but only some PCs built in 2004 or later supported SSE3—in other words, it was far from universally supported in mid-2005, even though some PCs did support SSE3.

The second reason was that Tiger 10.4.1 only supported certain PCI devices found in the Intel 915G/ICH6 chipset. Notably the IDE controller had to be the ICH6 PATA or SATA IDE device; without that, OS X wouldn’t boot (endless “Still waiting for root device”). Again there were PCs with the ICH6 chipset, but most were not.

The final reason was the “safety”. Even if one had a Pentium 4 processor with SSE3 (no other CPUs supported SSE3 at the time), and a motherboard with ICH6 IDE, Tiger 10.4.1 still wouldn’t boot—because in order to start the GUI, Rosetta had to be used, and Rosetta was locked to the Infineon TPM chip shipped in the Apple DTS (the same TPM chip which also appeared in early Intel Macs, but had no functionality whatsoever).

Perhaps ironically, it was the first problem (SSE3 support) which required the most effort to overcome. Hackers went so far as to build an SSE3 emulator (using SSE2 instructions) into the OS X kernel and patch a few miscellaneous executables in addition. The issue eventually took care of itself when more or less all CPUs supported SSE3. At the time of its release, OS X on Intel had far higher CPU requirements than PC operating systems, simply because Apple did not have any installed base to worry about, and could therefore require (not just use but require) relatively new CPU features like SSE3 or MONITOR/MWAIT.

Fresh Tiger 10.4.1

The second problem area (drivers) was where Darwin was extremely helpful. Darwin already had generic (if perhaps flaky) IDE drivers, it had drivers for various network chips, drivers for PS/2 keyboards and mice. Notably Darwin also had drivers for AC’97 audio, which was common at the time, but the Apple DTS as well as all Intel Macs used HDA instead (High Definition Audio aka Azalia, the successor of AC’97).

The third lock was the one which caused by far the most uproar and speculation, but was the easiest to break. It is fairly apparent that the TPM lock was not meant to be any kind of super duper secure mechanism; it was meant to bolt down the OS to Apple’s hardware, and breaking the lock was the equivalent to clicking the Agree button on a dialog that said “Yes, I understand and agree that I am knowingly violating applicable laws and regulations”.

Only the Rosetta executables (called oah750 and oah750d in the developer release) communicated with AppleTPMACPI.kext (Apple’s TPM driver). Bringing up the GUI required a font server (ATSServer, for Apple Type System), and the ATSServer binary was PowerPC only, requiring Rosetta. It was possible to boot Tiger 10.4.1 to command line without Rosetta, but not further. It is plausible that Apple deliberately did not build ATSServer as a universal binary so that Rosetta (and therefore TPM) would be needed to bring up the OS.

One of these things is not like the others

There were other binaries shipped with Tiger 10.4.1 which were PowerPC-only, notably iTunes:

Rosetta in action, translating iTunes

However, ATSServer was the only PowerPC binary required to get the GUI off the ground, everything else was non-essential. It is worth noting that by the time the Tiger 10.4.3 update rolled out, iTunes (now in version 6) was already a universal executable and did not need Rosetta anyway, although ATSServer still did:

Intel iTunes in OS X 10.4.3

That supports the theory that ATSServer was deliberately left as a PowerPC binary to make running OS X on non-Apple systems more difficult.

To restate the situation with three “locks” described above, the only change required to get the DTS release of OS X 10.4.1 working on suitable hardware (Intel D915GUX board, for example) was removing the TPM lock. Other and much more extensive changes were needed to allow running on CPUs without SSE3 and on chipsets not using the ICH6 southbridge.

BIOS vs. EFI

Note that EFI was not among the aforementioned locks, since the DTS machines used classic BIOS (seen e.g. here), albeit a slightly customized version for the custom Intel board which Apple used. The DTS board was a close relative of the Intel D915GUX and D915GAG desktop motherboards.

When Intel Macs were officially released with OS X Tiger 10.4.4 in January 2006, things changed somewhat. Unlike the DTS, the released Macs used EFI rather than classic BIOS firmware (and not just that, it was EFI with several custom Apple extensions). But again it didn’t take long before hacked versions of Tiger showed up with a BIOS boot loader (the one originally written by NeXT/Apple) and patches to support AMD processors and more.

The differences between the Apple DTS and shipping Intel Macs were substantial enough that the developer releases of OS X did not run on Intel Macs, and the released Intel OS X (starting with Tiger 10.4.4) did not run on the DTS machines. As a consequence, if DTS owners wanted to upgrade their systems past OS X 10.4.3… they needed Hackintosh.

Perhaps ironically, the roll-out of Intel Macs directly or indirectly led to the death of the OpenDarwin project, because Apple didn’t publish enough code for a standalone system; notably the source code for the EFI boot loader (boot.efi) and the ACPI “platform expert” was never published, although Apple continues to publish the source code for the xnu kernel and numerous other Apple-written components of OS X (nowadays known as macOS).

That didn’t stop Hackintosh, which first used the existing Darwin BIOS boot loader, then added EFI boot support, and continues to run with, or at least hobble along, latest OS X versions and PC hardware. Books were even written about it.

TPM vs. SMC

What’s notable is that the mechanism which OS X uses to lock itself to Apple hardware completely changed between the mid-2005 DTS and the January 2006 Intel Mac release (something which was completely independent of the BIOS to EFI switch). That caused quite a bit of confusion. It apparently confused even the author of the Mac OS X Internals book, because he wrote excellent articles about TPM on OS X and Apple’s non-use of it in Intel Macs, but somehow completely failed to mention that the developer releases of x86 Tiger did in fact use and require the TPM chip, which is where a lot of the confusion originated.

Although the earliest Mac models did ship with the same TPM chip as the DTS machines, TPM was indeed entirely unused. Instead, publicly shipping OS X used (and still uses) DSMOS, or Don’t Steal Mac OS X. OS X executables may have encrypted pages (sections); the xnu kernel decrypts those on the fly, using a key obtained from the hardware, namely the SMC chip (System Management Controller). DSMOS is described in detail here. As with the TPM-based protection in the developer releases, DSMOS is not technically difficult to defeat, but requires knowingly breaking the law. That is a very pragmatic approach—not fighting an endless losing war with hackers but doing enough to force (ab)users to have no legally valid excuses.

As with the developer releases, DSMOS only kicks in when starting the GUI and is not used or needed when booting into single-user mode.

Reference

As far as is known, there were three versions of the OS X Tiger DVD shipped to developers:

• Tiger 10.4.1 build 8B1025. Finalized on June 3, 2005, this was the version used at the June 2005 WWDC when Intel OS X was first publicly shown.
• Tiger 10.4.3 build 8B1099. Finalized on October 12, 2005.
• Tiger 10.4.3 build 8F1111. Finalized on November 3, 2005, this was the final developer disc.

It is possible that there were interim updates such as build 8F1111a. The matter is confused because hackers created unofficial builds such as 8F1111g.

For further reference, the first few public releases of Intel OS X were:

• Tiger 10.4.4 build 8G1165. Finalized January 4, 2006 (two months after the last developer release).
• Tiger 10.4.5 build 8G1454. Finalized February 7, 2006. Also available as an update package for 10.4.4.
• Tiger 10.4.5 build 8H1455. Finalized February 14, 2006.
• Tiger 10.4.5 build 8H1619. Finalized February 19, 2006.

There were most likely no generic retail discs of Tiger for Intel. Since by definition all Intel Macs shipped with at least OS X 10.4, there was nothing to upgrade from to Tiger. In other words, Tiger discs came with Intel Macs and were restricted to specific Mac models. That is why it’s somewhat difficult to pin down the dates—because there might have been model-specific additions after the base OS was finalized.

OS X 10.5 Leopard was available as a generic retail upgrade DVD without a model restriction, a practice which continued with 10.6 Snow Leopard. And when Snow Leopard was released, the PowerPC era at Apple was officially over.