EFI-X: a Mac in Disguise

The 160$ USB Stick That Made MacOS run on Intel PCs

When Apple moved to Intel in 2006, it closed a door and opened a window. The door was PowerPC: nobody was going to run Mac OS X on a G4 clone. The window was that a Mac was now, chip for chip, a PC with a nicer case and EFI firmware instead of a BIOS. The OSx86 community climbed through that window within months. They patched the kernel to skip the CPU checks, wrote kexts that impersonated the hardware the OS insisted on, and, most importantly, built bootloaders that constructed the EFI environment the kernel expected on top of a machine that had never heard of EFI. Boot-132, PC_EFI, Chameleon: each one a small program that ran before the kernel and spoke to it, fluently, in the language of a machine it was not on.

The impersonation had several parts. The System Management Controller, the little chip on a real Mac that holds the key Apple’s kernel checks (the famous “our hard work by these words guarded, please don’t steal” verse, which is why people call it the haiku chip), was answered by a kext called FakeSMC that returned the same words. Graphics cards had their PCI vendor and device IDs remapped so the stock NVIDIA drivers would load. SMBIOS tables were rewritten to claim the board was a MacPro3,1. All of it was stitched together by a bootloader that lived in the first sectors of a disk, loaded itself before anything Apple wrote, and then handed control to the real kernel on a scaffold it had built out of synthetic firmware tables. If that sounds…