Hacking the Mac startup chime

The chime is located outside the reach of the MacOS, embedded in the EPROM of the CPU board itself. You might be able to get there using Open Firmware, but there is no way to get to it by normal means. I have never heard of this hack being possible, but if someone out there has actually dont it, WOW.

BTW, don't mess around too too much in Open Firmware (Apple/Opt/O/F on the boot chime) because it controls all the hardware aspects of your computer. A wrong command might leave you with no screen or a permenantly shut-off IDE bus.

Oh, Open Firmware is the tiny UNIX OS that controls the hardware aspects of your computer. It is on a seperate chip on the motherboard and boots the Mac into a command line.

Does the Mac check the checksum of the ROM in any way? If not, it should be possible to dump the image, locate the audio data, change it & reburn the chip.

I've had 100% failure trying to do that, it's not easy to wipe the eprom on a Mac like it is on a PC, and there's no defined way on how to reload once the info's been wiped. The problem is the you can't wipe the firmware/rom without botching up the hardware definitions, and unlike an open-firmware mess up, you can't fix it by unplugging the motherboard.

Where in OpenFirmware would I begin to look to do this?

--DDTM

I seem to remember someone managing to do this once (dont remember who, where, or when tho). So, it seems it is possible, but very difficult/dangerious.

Any extra details will be greatly appreciated if you can recall more.

Thanks!
--DDTM

this was a coupla years ago, and it was mentioned in passing in a forum (possibly applefritter, possibly macaddict, possibly somewhere else). Sorry i dont remember more, however, if i find anything, i'll post it here.

talking of open firmware:

http://playground.sun.com/pub/p1275/misc/ofwsong.au

Wait a tic..
Isn't the ROM in New World macs on a file? "Mac OS Rom"?
You could look around in there, although you won't find anything with ResEdit - hexedit maybe

I had origninally suspected it may be in the ROM, but never could find it with ResEdit. This explanation makes a lot of sense. So what is 'hexedit'?

--DDTM

Arron wrote:

Wait a tic..
Isn't the ROM in New World macs on a file? "Mac OS Rom"?
You could look around in there, although you won't find anything with ResEdit - hexedit maybe

TOM

we're still awaiting news of anyone successfully replacing it.

Since in pre-New World Macs it's in the hardware boot ROMs, has anyone ever pulled the actual chips and replaced with their own versions? You can dump those ROMs to disk, so it's at least theoretically possible.

IIRC in New World Macs it's in the (updateable) firmware, normally not a user modifiable area. How would one 'dump' that?

I imagine a good place to start would be to open and examine a firmware updater . . .

edit- interesting, veeeeery interesting. Just looked around inside the iMac firmware updater file. Of course I have no idea exactly what I'm looking at, but it is interesting!

dan k

I guess it would be possible to hack the chime in older macs with a new ROM chip. If you make an exact 1:1 copy of the ROM and just replace the chime with your own, heck that -sounds- easy enough. You'd have to figure out how the chime was coded though, and probably have to replace it with a chime of the same duration and same size on the ROM.

Hacking a firmware updater is another fantastic idea. I also do not have a clue when it comes to firmware, but if the chime is in an area that can be changed you could write an updater to change it, or hack an existing one. I imagine that apple simply doesn't include the chime's address in it's updaters. Once you found that you could -just- hack the updater to copy File: A to Address: B. You'd just be redirecting the source and location of what the updater is meant to do.

Would it be cheating to add ones own hardware + software to change the chime?

I was thinking of building a hardware board that would cut off the speakers at startup, play its own chime through the speakers and then reconnect the speakers to the mac. The board would then play the chime on ever power cycle.

Cheating?

Making a firmware updater would be tricky. Here's my idea:

What I suggest is running the entire ROM through an audio player that can play and record raw audio and theoretically it should play the chime at some point (the rest would probably just play as noise). You would get to the point it starts playing at and write over your own raw audio. Recording too soon or too far would of course render your ROM useless as it would write over real code.
You would then by some method save the ROM back into the machine (eprom burner or the ROM file theory).

EDIT: SndSampler works. (sndsampler.com). From the "goodies" menu click "Open as raw audio".
On new macs, this is relevant:
http://developer.apple.com/documentation/Hardware/Developer_Notes/Macintosh_CPUs-G3/original_iMac/iMac.2b.html
Its all on the _motherboard_ boot rom. You would have to take out the chip (tricky), read it, hope that the audio isn't encrypted or compressed then write it again. On an old mac, you can use a ROM-extraction utility and play it as audio (above), which would be much easier. Writing it back... who knows?

The reason you wont find anything with ResEdit is because the contents of the ROM are not organised into resources. Just raw hex/binary/whatever data.

A few details I thought I'd throw in…
You CAN freak out your mac via playing with Open Firmware, but if you really mess it up, you can pull the PRAM and restart it with defaults. Otherwise it is nearly impossible to really break Open Firmware >ON OLD WORLD MACHINES

Whoops! Forgot about those symbols, let's try again…
You CAN freak out your mac via playing with Open Firmware, but if you really mess it up, you can pull the PRAM and restart it with defaults. Otherwise it is nearly impossible to really break Open Firmware ON OLD WORLD MACHINES, in my experience. I have however heard that you can lock yourself out booting a New World machine.

Instead of pulling ROMs, there are classic utilities for dumping the contents of the macintosh firmware ROM to file. That would be the easy part! It would be a ludicrous amount of work to sift through raw data for a piece of audio, not even knowing what format it is encoded in. I guess I would make scripts to sonify pieces of ROM data, then play them back in SoundHack with bogus sound file header info. IE play this bit as if it is an AIFF file. Now pretend it is an SND file. Etc. This is not easy, I can barely play back weirdly coded binary data which I KNOW is an audio file, never mind find audio in other data. It can be done. If/ when you find the sound, reencoding the data with another chime and making a new ROM would be relatively easy.
M

AFAIK, that'd likely be the best way to determine where the startup chimes are located in the Mac's ROMs. Taking snapshots of the memory addresses accessed by a Signmaker console to the font Cartridge's ROMs was the method used when we decoded the cartridge's font data format back in the day. That ought to work for identifying the startup chime's address location in the Mac ROMs.

Has anyone ever seen a listing of the startup process order for the Mac? The chimes must be before the RAM tests according to my PEx experiences.

jt

I had always thought the RAM tests happened before the chime. I have never been blessed/cursed to experience a bad RAM chime, so I did not know any different.

I would have thought that they had to take place before the chime, because you don't get a regular chime with bad ram. It's entirely possible my memory is inaccurate.