Tuesday, January 18, 2011

MacOSX 10.6.4 ISO/DVD offset

dump everything in DVD to ISO (change /dev/sr0 to your DVD device):
# cat /dev/sr0 > macosx_10.6.4_install.iso

find your offset (it is gonna take quite some time, so be patience):
# hexdump -C macosx_10.6.4_install.iso | grep "48 2b 00 04"
31b4b400 48 2b 00 04 80 00 01 00 31 30 2e 30 00 00 00 00 |H+......10.0....|


convert 31b4b400 to decimal and minus 1024

example:
$ echo `printf "%d\n" 0x31b4b400` - 1024 | bc
833925120

so:
10.6.4 ISO/DVD offset: 833925120

maybe you can try to find your offset if you're using DVD (haven't try this one):
# hexdump -C /dev/sr0 | grep "48 2b 00 04"

then mount your ISO:
# losetup -o 833925120 /dev/loop0 ./mac osx_10.6.4_install.iso
# mkdir /media/osx-dvd
# mount -t hfsplus /dev/loop0 /media/osx-dvd/


to unmount:
# umount /media/osx-dvd
# losetup -d /dev/loop0

you might ask, why "48 2b 00 04" and why minus 1024? refer here: http://www.64lines.com/mounting-hfs-plus
[snip]
Finding an HSF+ Partition

How do you find an HFS+ partition? Well according to docs at http://developer.apple.com/technotes/tn/tn1150.html#VolumeHeader an HFS+ partition starts with 1024 reserved bytes for boot code followed by the VolumeHeader structure. The first 4 bytes of the VolumeHeader structure are a signature and a version number. Essentially "H+" followed by version 4 (or HX followed by 5 for HFSX). Therefore we are looking for the following hexadecimal sequence within the file: "48 2b 00 04" (or "48 58 00 05" for HFSX).

[/snip]

No comments: