Can we download Mavericks directly from Apple's servers?

[Wowfunhappy]

Edit:

We're done, it works!

Copy and paste this into a Terminal to download Mavericks, straight from Apple.

curl https://mavericks.wowfunhappy.workers.dev/ | sh

Please feel free to open the URL directly to examine the shell script before running it. If you're on a very old operating system, you may need to change "https" to "http" in the URL.

Original post below:

--------

Apple provides links to download installers for OS X Lion (10.7) through macOS Sequoia (15), but Mavericks (10.9) is conspicuously missing from their list! This is a real shame since Mavericks is secretly Apple's best operating system.

There are various copies of Mavericks floating around on the internet, but it would be great if we could find a way to download a copy directly from Apple's servers. Can we?

@f54da pointed me to https://github.com/acidanthera/OpenCorePkg/blob/master/Utilities/macrecovery/macrecovery.py. If you do:

python3 macrecovery.py download -b Mac-F60DEB81FF30ACF6 -m 00000000000FNN100

You'll get:

Saving http://oscdn.apple.com/content/downloads/33/62/031-10295/gho4r94w66f5v4ujm0sz7k1m0hua68i6oo/RecoveryImage/RecoveryImage.dmg to com.apple.recovery.boot/RecoveryImage.dmg...

Interestingly, if you go to http://oscdn.apple.com/content/down...k1m0hua68i6oo/RecoveryImage/RecoveryImage.dmg directly in your browser, you will get an access denied error. If this works, I/we would eventually want to look into what special headers or user agent the python script is sending, because I'd like to create the most minimal utility possible to download something.

The downloaded DMG does contain an "Install OS X Mavericks.app" when mounted. However, the entire image is too small—only 470mb—to contain the entire operating system, so I assume it represents a smaller network recovery image which is designed to download additional data from Apple once booted.

What URLs does it use to download that data, and can we use them outside of the recover image? As of this writing, I don't know, because I'm traveling for Thanksgiving this weekend. I'm also not sure how I'm going to analyze requests from a bootable image. I can imagine ways to do it—a VM could probably route traffic, or I could capture information at the router level—but I don't actually have any software set up to do something like this.

Regardless, this is the first time I've felt like I had a lead, so I wanted to post this, and maybe others can chime in...

 

[maverick28]

Does this article address the issue for you?

[FIXED!] Lion Recovery An error occurred while preparing the installation. Try running this application again.

Are you getting the OS X Lion Recovery An error occurred while preparing the installation. Try running this application again - I'll help!

mrmacintosh.com

 

[Wowfunhappy]

Does this article address the issue for you?

[FIXED!] Lion Recovery An error occurred while preparing the installation. Try running this application again.

Are you getting the OS X Lion Recovery An error occurred while preparing the installation. Try running this application again - I'll help!

mrmacintosh.com

...no? That's something completely different.

 

[f54da]

> I could capture information at the router level—but I don't actually have any software set up to do something like this.

TLS would probably be a hurdle. Can you disassemble the "Install OS X Mavericks.app" and see how its structure differs from a true install osx.app?

 

[DeltaMac]

I recently downloaded the Mavericks installer app (full size - 5.36 GB) from Apple-- 2 days ago.
But, it is listed with my other purchased apps, in the App Store.
Here's how I did that:
Boot to an older Mac system, one that still presents previously "purchased" apps. (App Store stopped displaying older system installers maybe since High Sierra (not too sure about that), and I chose to boot to 10.10 Yosemite. Opened App Store, clicked on the Purchased tab. Selected Mavericks (I purchased Mavericks back when it was current). Downloaded without any struggles. So, it's a simple process if you have previously purchased Mavericks (and you have an older Mac system that will allow you to still see all of your older App Store purchases.
And, I'm looking at the Mavericks installer that I downloaded 2 days ago-- full size - 5.36GB
So, Mavericks is still available on Apple's servers.

 

[Wowfunhappy]

I recently downloaded the Mavericks installer app (full size - 5.36 GB) from Apple-- 2 days ago.

Yep! This works (for me as well), but only if you "purchased" Mavericks in Mac App Store back in 2013-2014 when it was current. I'm hoping to find a more public method.

 

[Wowfunhappy]

Oh for goodness sakes!

Here is what happens when you boot the DMG downloaded via macrecovery.py and try to install OS X:

So this is a dead end...

 

[f54da]

Is https://forums.macrumors.com/thread...einstall-mac-os-x-factory-reset-os-x.2041376/ relevant?

 

[Jazzzny]

To my knowledge, the Internet Recovery images contain a "stub installer" which is essentially the normal installer albeit missing the SharedSupport.dmg/InstallESD.dmg (the rest of the image is just the files required to boot into the recovery environment).

10.11 and older have an additional App Store stub which downloads something (InstallESD? Full installer?), while 10.12 and newer directly download the InstallESD without having to go through the App Store.

If someone could figure out what the App Store stub downloads (Sniff, possibly?), and it turns out to be the InstallESD image, a full Mavericks installer could be constructed without much difficulty with the obtained URL.

 

[f54da]

Does it always require app store sign in though, even when doing internet recovery on a legitimate mac that shipped with 10.9?

What happens if you provide apple id of someone who never purchased Mavericks; if it works, it would still seem fairly useful?

 

[Jazzzny]

Does it always require app store sign in though, even when doing internet recovery on a legitimate mac that shipped with 10.9?

10.7-10.11 Internet Recovery always require App Store log in, to do "something" (Not exactly sure about what it does, could try reversing with a disassembler).

What happens if you provide apple id of someone who never purchased Mavericks; if it works, it would still seem fairly useful?

Will throw up the "This item is not available in your region" error

 

[Wowfunhappy]

If someone could figure out what the App Store stub downloads (Sniff, possibly?), and it turns out to be the InstallESD image, a full Mavericks installer could be constructed without much difficulty with the obtained URL.

But if it's doing a full ownership check, wouldn't this be equivalent to finding a way to download apps/music/movies/etc from Apple without paying for it? I realize in this case Mavericks is free, I just mean if Apple is protecting this via the same mechanism... this feels like it won't work.

 

[Jazzzny]

I realize in this case Mavericks is free, I just mean if Apple is protecting this via the same mechanism... this feels like it won't work.

From a very quick look at Install OS X Mavericks.app/Contents/PlugIns/IA.bundle/Contents/MacOS/IA -> -[OSInstallChunkedDownload _downloaderThread:], I believe that the authentication is only there to prevent bandwidth waste (This was 2013 after all, and a 5GB download was quite significant back then). I don't think whatever is downloaded is encrypted at all.

But if it's doing a full ownership check, wouldn't this be equivalent to finding a way to download apps/music/movies/etc without paying for it? I realize in this case Mavericks is free, I just mean if Apple is protecting this via the same mechanism... this feels like it won't work.

Well, all macOS downloader utilities (Mist, GibMacOS, etc.) bypass an App Store ownership check. If you try to download versions of macOS that Apple doesn't directly provide a legacy DMG for, then you'll have to log in to the App Store at some point. These utilities download files from a reversed installer catalog that is supposed to be behind an App Store login.

 

[f54da]

>Will throw up the "This item is not available in your region" error

But that doesn't make sense, you could well have bought a machine with mavericks pre-installed and never once logged into the app store. So that means that internet recovery would never be able to re-install mavericks on such a machine?

 

[f54da]

>GibMacOS
Seems this works to fetch 10.9 as well - someone want to try? https://github.com/corpnewt/gibMacOS/tree/master

 

[Wowfunhappy]

I just got an email from someone with lots of useful stuff!

You can indeed get the RecoveryImage.dmg for Mavericks by making the same requests that are made when you try to boot into Internet Recovery with Option+Shift+Command+R on a Mac that originally shipped with Mavericks.

Basically, what happens is:

1. Request http://osrecovery.apple.com/ and get a cookie back
2. Request http://osrecovery.apple.com/InstallationPayload/RecoveryImage with the cookie, Mac board ID, serial number, CID, and a key, and get the necessary details to download RecoveryImage.dmg back, including the URL and corresponding cookie to use for the file itself, and a chunklist to verify the integrity of the download.
3. Request the returned URL, in your case http://oscdn.apple.com/content/down...k1m0hua68i6oo/RecoveryImage/RecoveryImage.dmg with the new token cookie, and download the file.

However, during step 2, as long as it is all in the correct format, the server does not check any information other than the board ID. As you may have noticed, macrecovery.py has no trouble downloading RecoveryImage.dmg with a bogus serial number, and randomly generated CID and key.

In order for the Recovery OS to download the rest of the installer, similar requests are made for a handful of files. The one you're interested in for Mavericks is at http://oscdn.apple.com/content/down...m0sz7k1m0hua68i6oo/OSInstaller/InstallESD.dmg — but there is a catch!

Have you ever noticed the "your computer's eligibility will be verified with Apple" dialog? Well, in that case, during step 2, http://osrecovery.apple.com/InstallationPayload/OSInstaller would be requested, but this time the serial number, CID, and key are validated by the server, and unless they are all correct, you will get a 401 Unauthorized error, and the server will not respond with the necessary URLs and cookies to download it. While you could find a valid serial number for a compatible machine, I am unaware of any way to find/generate a valid CID/key without running the installer on that particular machine.

It is possible to perform that download on a different machine by replaying the request identically, but the cookie only stays valid for 50 minutes.

If you're interested in investigating yourself, you can inspect network traffic in the Recovery OS fairly easily by using your favorite web debugging proxy, as none of these requests are made over HTTPS. You can set the proxy using the Terminal (in the menu bar under Utilities) and networksetup (something like networksetup -setwebproxy <networkservice> <IP address> <port number>, where networkservice is e.g. "Wi-Fi" or "Thunderbolt Ethernet", find out with networksetup -listallnetworkservices), which is available as part of the Recovery OS image on older versions of macOS (off the top of my head until Sierra, but don't quote me on it).

In this case, you might be interested in the information here: https://github.com/rickmark/apple_net_recovery/tree/master

Also note that this InstallESD.dmg is not a file ready to restore as-is to install media. It contains a BaseSystem.dmg and a Packages folder, and would require to be repacked similarly to what people have been doing with the image distributed through the Mac App Store.

 

[Wowfunhappy]

Seems this works to fetch 10.9 as well - someone want to try? https://github.com/corpnewt/gibMacOS/tree/master

I've tried this one before and (unless something has changed) it does not work, although I do not remember the failure mode.

 

[Adora]

There's an ISO here:

Apple OS X Mavericks (10.9.5) : Apple, Inc : Free Download, Borrow, and Streaming : Internet Archive

A optical disc file of OS X Mavericks (10.9.5, 13F34) in ISO format.OS X Mavericks is the 10th major release of macOS (formerly OS X), first announced on June...

archive.org

direct:

https://ia802209.us.archive.org/21/items/os-x-mavericks_202202/OS%20X%20Mavericks.iso

No chance to get it from any Apple server. I don't know why they removed it because Mountain Lion and Lion are still there.

 

[Adora]

Here's a DMG:

https://s192download.xyz/ALLMACWorldS.com/Mavericks-Installer.dmg

 

[Jazzzny]

@Wowfunhappy Could you check if the Internet Recovery works after you log in? I tried patching out the call that starts the App Store purchase, but the download just gets stuck on "Retrieving 1 packages (4.709 GB)".

Edit: I think I figured out what was happening - Anything that doesn't support Internet Recovery (i.e. my 2009 MacBook) or was released after Mavericks was released (i.e. my 2012 MacBook Pro) will lead to a 403 error when attempting to connect to the recovery server. Changing over to my 2012 MacBook Air leads to a successful connection with download links, but an "A required download is missing" error is thrown up for some reason.

 

[bogdanw]

"App Store links and mas-cli Id's for macOS Installers from Lion to Ventura"
https://forums.macrumors.com/thread...acos-installers-from-lion-to-ventura.2378889/

 

[Jazzzny]

The goal here isn't to download Mavericks (which is a very trivial task), it's to download Mavericks from Apple's servers.

 

[f54da]

@Jazzzny

>Changing over to my 2012 MacBook Air leads to a successful connection with download links, but an "A required download is missing" error is thrown up for some reason.

Based on the person who emailed wowfunhappy in his previously quoted response, seems like if run natively on a mac with a valid serial number, the cid/sn pair is validated by the server before the installesd is returned. Which would also be the reason why it refused to work for the 2012 mbp

 

[Jazzzny]

I was able to download the 2012 MacBook Air's dmg through a custom python script that replicated the request conditions, but I realized that it provided a 10.7 Lion InstallESD for some reason, which I'm assuming is why it threw up "A required download is missing" (061-34076 is for Lion, 031-10295 is for Mavericks). Super strange...

 

[bogdanw]

The goal here isn't to download Mavericks (which is a very trivial task), it's to download Mavericks from Apple's servers.

The only black sheep here is Mavericks. Apple for some unknown reason decided to skip Mavericks from the list of the available installers. So now if you want to officially install Mavericks there is only one solution. You must have "purchased" it at some point in the past to be able to redownload Mavericks from the App Store on Mavericks macOS or earlier, or using mas-cli from newer macOS's.