Unfortunately, the resulting installer reportedly doesn't work in practice. This is from the person who emailed me in November, who tried it before I could:
If there's a way to make this work it requires something else.
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Can we download Mavericks directly from Apple's servers?
- Thread starter Wowfunhappy
- Start date
- Sort by reaction score
Unfortunately, the resulting installer reportedly doesn't work in practice. This is from the person who emailed me in November, who tried it before I could:
If there's a way to make this work it requires something else.
There seems to still be confusion about what to do with the resulting I think I'm going to have the script print this at the end:
Do you think this will be clear enough to a user who knows how to use the Terminal, but only barely? The tricky part is finding "disk number", but there's no good way to set the partition map without that.
I thought about doing something clever like:
But this didn't feel right, at that point I should probably just ship an additional script for creating installer media. I'm not entirely opposed to that if it feels like the only way, but I think I'd rather teach than automate.
I also thought about putting the command to find the disk number first so the instructions are in order, but that's kind of annoying for users who do already know what
For context, here is some example output from diskutil list
I think it's obvious from context that
Edit: Hang on... do my instructions even work...? My laptop won't boot an installer USB created this way...
Edit2: Never mind... I'm just going to provide a second shell script.
InstallMacOSXMavericks.dmg, possibly because Disk Utility on modern macOS is, uh, not the best.
Code:
InstallMacOSXMavericks.dmg successfully created.
If you would like to create a bootable Mavericks installer, run:
sudo diskutil partitionDisk /dev/diskX GPT free - 100%
sudo asr restore --source InstallMacOSXMavericks.dmg --target /dev/diskX --erase
Replace 'X' with the disk number of your USB flash drive. You can find it by running:
diskutil list /Volumes/"NameOfYourFlashDrive"I thought about doing something clever like:
Code:
sudo diskutil partitionDisk $(diskutil list /Volumes/"NameOfYourFlashDrive" | head -n 1) GPT free - 100%
sudo asr restore --source InstallMacOSXMavericks.dmg --target $(diskutil list /Volumes/"NameOfYourFlashDrive" | head -n 1) --eraseI also thought about putting the command to find the disk number first so the instructions are in order, but that's kind of annoying for users who do already know what
/dev/diskX represents and how to find the identifier.For context, here is some example output from diskutil list
Code:
$ diskutil list /Volumes/"Untitled 1"
/dev/disk5
#: TYPE NAME SIZE IDENTIFIER
0: FDisk_partition_scheme *124.6 GB disk5
1: Windows_NTFS Untitled 1 124.6 GB disk5s15 is the number you're looking for, right?Edit: Hang on... do my instructions even work...? My laptop won't boot an installer USB created this way...
Edit2: Never mind... I'm just going to provide a second shell script.
Last edited:
The commands I originally provided didn't work in practice (I tested on my actual laptop), I believe because when I supplied the identifier /dev/diskX instead of a volume name for asr, it appears to have erased the partition map, instead simply writing the dmg to the entire disk.
I normally use this script:
Code:
sudo asr restore --source /<path_to_file>/InstallMacOSXMavericks.dmg --target /Volumes/<destination> --erase --verbose --noprompt --noverify --buffers 1 --buffersize 32m --puppetstrings
The downloader script will now save the following additional script (as
Create Bootable Installer.command) in the same directory as InstallMacOSXMavericks.dmg:
Bash:
#!/bin/sh
set -e
cd "`dirname "$0"`"
asr imagescan --source InstallMacOSXMavericks.dmg
did_find_volume="false"
while [ $did_find_volume == "false" ]
do
printf "Please enter the volume name of your USB flash drive: "
read target_volname
if df -l | grep -q "/Volumes/$target_volname"
then
did_find_volume=true
else
echo
echo "Could not find a volume named $target_volname. Found these volumes:"
df -l | awk -F'/Volumes/' '{print \$2}' | grep -v '^$'
echo
fi
done
printf "WARNING: All data on $target_volname will be erased. Continue? (yes/no) "
read confirmation
if [ "$confirmation" != "y" ] && [ "$confirmation" != "yes" ]; then
echo "Exiting. No changes have been made."
exit 1
fi
disk_identifier=$(diskutil list /Volumes/"$target_volname" | head -n 1)
sudo diskutil partitionDisk $disk_identifier GPT jhfs+ "$target_volname" 100%
sudo asr restore --source InstallMacOSXMavericks.dmg --noprompt --target /Volumes/"$target_volname" --eraseDo we really need it though? If you need to remove the signature due to certificate expiration:
GitHub - etrepum/strip_pkg_signature: Strips signature from Apple pkg files
Strips signature from Apple pkg files. Contribute to etrepum/strip_pkg_signature development by creating an account on GitHub.
github.com
Certificate expiration isn't an issue in the Mavericks installer. But it would be nice to have the original.Do we really need it though? If you need to remove the signature due to certificate expiration:
GitHub - etrepum/strip_pkg_signature: Strips signature from Apple pkg files
Strips signature from Apple pkg files. Contribute to etrepum/strip_pkg_signature development by creating an account on GitHub.
But I agree it's not needed. One reason I wanted it is that basically every guide on the internet says to use createinstallmedia to make USB installers, so lots of people seem to try that instead of better-suited tools like Disk Utility, and are confused when it doesn't work. But as of yesterday I'm just including my own script for that.
GitHub - munki/createOSXinstallPkg: Tools for packaging OS X installers
Tools for packaging OS X installers. Contribute to munki/createOSXinstallPkg development by creating an account on GitHub.
github.com
Code:
git clone https://github.com/munki/createOSXinstallPkg.git
git switch -c 1c66704
Switched to a new branch '1c66704'
mbp151@MBP151s-MacBook-Pro createOSXinstallPkg % sudo ./createOSXinstallPkg --source InstallESD.dmg --output InstallOSX.pkg
Password:
Verifying source...
----------------------------------------------------------------
InstallESD.dmg: InstallESD.dmg
OS Version: 10.9.5
OS Build: 13F34
----------------------------------------------------------------
Output path: /Users/mbp151/createOSXinstallPkg/InstallOSX.pkg
Creating package wrapper...
Creating MacOSXInstaller.choiceChanges...
----------------------------------------------------------------
Downloading and adding IncompatibleAppList pkg...
Downloading http://swcdn.apple.com/content/downloads/08/44/041-84709/p7o39zsy2szo6hdwu1wuc3qupx3uhr5wre/OSX_10_9_IncompatibleAppList.pkg to /Users/mbp151/createOSXinstallPkg/InstallOSX.pkg/Contents/Resources/Mac OS X Install Data/OSX_10_9_IncompatibleAppList.pkg...
Writing index.sproduct to /Users/mbp151/createOSXinstallPkg/InstallOSX.pkg/Contents/Resources/Mac OS X Install Data/index.sproduct...
----------------------------------------------------------------
Copying InstallESD into package...
----------------------------------------------------------------
Done! Completed package at: /Users/mbp151/createOSXinstallPkg/InstallOSX.pkg
Last edited:
@Wowfunhappy
>downloaded from the App Store first come as a pkg that installs the app to the /Applications folder
Fascinating. Yeah I do remember from our earlier analysis that the MAS download is a pkg file, but never expected it to be such an interesting procedure to dynamically construct at the final .app on disk.
If the InstallESD.dmg from a true MAS copy is also a .pkg, then it might finally solve https://forums.macrumors.com/threads/os-x-mavericks-10-9-5-file-integrity.2427955 where @Faloude wanted to find a way to validate things. The InstallESD dmg is not signed (nor are the packages within the .dmg signed), but if InstallESD .dmg is itself just a (presumably properly signed) pkg that dynamically generates the .app, then you can verify the signature of that .pkg.
One thing I don't understand though, if all this is true then why does createinstallmedia fail even though a manually created bootable image succeeds? I assumed the two were doing roughly the same thing, but it seems that the .pkg signature is never verified with the latter approach. How does the resulting structure differ?
>downloaded from the App Store first come as a pkg that installs the app to the /Applications folder
Fascinating. Yeah I do remember from our earlier analysis that the MAS download is a pkg file, but never expected it to be such an interesting procedure to dynamically construct at the final .app on disk.
If the InstallESD.dmg from a true MAS copy is also a .pkg, then it might finally solve https://forums.macrumors.com/threads/os-x-mavericks-10-9-5-file-integrity.2427955 where @Faloude wanted to find a way to validate things. The InstallESD dmg is not signed (nor are the packages within the .dmg signed), but if InstallESD .dmg is itself just a (presumably properly signed) pkg that dynamically generates the .app, then you can verify the signature of that .pkg.
One thing I don't understand though, if all this is true then why does createinstallmedia fail even though a manually created bootable image succeeds? I assumed the two were doing roughly the same thing, but it seems that the .pkg signature is never verified with the latter approach. How does the resulting structure differ?
It is a
XAR archive containing the actual InstallESD.dmg i.e it is labeled InstallESD.dmg on the outside, but it is a XAR. In fact all of them legacy MAS installers are using the same XAR package wrapping the InstallESD.dmg. That is why you can't use createinstallmedia directly on the outer package.
Analysis of the MAS Mavericks macOS installer:
List the contents:
Unpack the archive:
Find packages:
And there you go. Once you copy the InstallESD.dmg to the Shared Support folder you have
DMGs compressed with zlib often incorrectly appear as "VAX COFF", due to the zlib header.
Code:
cd "/Applications/Install OS X Mavericks.app/Contents"
macos:Contents maverickspl$ ls -l
total 0
-rw-r--r-- 1 root wheel 2289 Dec 30 12:49 Info.plist
drwxr-xr-x 3 root wheel 102 Sep 20 2014 MacOS
-rw-r--r-- 1 root wheel 8 Dec 30 12:49 PkgInfo
drwxr-xr-x 5 root wheel 170 Sep 8 2014 PlugIns
drwxr-xr-x 60 root wheel 2040 Sep 20 2014 Resources
drwxr-xr-x 4 root wheel 136 Dec 30 12:49 SharedSupport
drwxr-xr-x 3 root wheel 102 Sep 8 2014 _CodeSignature
drwxr-xr-x 3 root wheel 102 Dec 30 12:49 _MASReceipt
-rw-r--r-- 1 root wheel 532 Dec 30 12:49 version.plist
macos:Contents maverickspl$ cd SharedSupport/
macos:SharedSupport maverickspl$ ls
InstallESD.dmg OSInstall.mpkg
macos:SharedSupport maverickspl$ file InstallESD.dmg
InstallESD.dmg: xar archive - version 1List the contents:
Code:
xar -tf InstallESD.dmg
Distribution
InstallMacOSX.pkg
InstallMacOSX.pkg/Bom
InstallMacOSX.pkg/Payload
InstallMacOSX.pkg/Scripts
InstallMacOSX.pkg/PackageInfo
InstallMacOSX.pkg/InstallESD.dmg
Resources
Resources/ar.lproj
Resources/ar.lproj/Localizable.strings
Resources/ar.lproj/VolumeCheck.strings
Resources/ca.lproj
Resources/ca.lproj/Localizable.strings
Resources/ca.lproj/VolumeCheck.strings
Resources/cs.lproj
Resources/cs.lproj/Localizable.strings
Resources/cs.lproj/VolumeCheck.strings
Resources/da.lproj
Resources/da.lproj/Localizable.strings
Resources/da.lproj/VolumeCheck.strings
Resources/Dutch.lproj
Resources/Dutch.lproj/Localizable.strings
Resources/Dutch.lproj/VolumeCheck.strings
Resources/el.lproj
Resources/el.lproj/Localizable.strings
Resources/el.lproj/VolumeCheck.strings
Resources/English.lproj
Resources/English.lproj/Localizable.strings
Resources/English.lproj/VolumeCheck.strings
Resources/fi.lproj
Resources/fi.lproj/Localizable.strings
Resources/fi.lproj/VolumeCheck.strings
Resources/French.lproj
Resources/French.lproj/Localizable.strings
Resources/French.lproj/VolumeCheck.strings
Resources/German.lproj
Resources/German.lproj/Localizable.strings
Resources/German.lproj/VolumeCheck.strings
Resources/he.lproj
Resources/he.lproj/Localizable.strings
Resources/he.lproj/VolumeCheck.strings
Resources/hr.lproj
Resources/hr.lproj/Localizable.strings
Resources/hr.lproj/VolumeCheck.strings
Resources/hu.lproj
Resources/hu.lproj/Localizable.strings
Resources/hu.lproj/VolumeCheck.strings
Resources/id.lproj
Resources/id.lproj/Localizable.strings
Resources/id.lproj/VolumeCheck.strings
Resources/Italian.lproj
Resources/Italian.lproj/Localizable.strings
Resources/Italian.lproj/VolumeCheck.strings
Resources/Japanese.lproj
Resources/Japanese.lproj/Localizable.strings
Resources/Japanese.lproj/VolumeCheck.strings
Resources/ko.lproj
Resources/ko.lproj/Localizable.strings
Resources/ko.lproj/VolumeCheck.strings
Resources/ms.lproj
Resources/ms.lproj/Localizable.strings
Resources/ms.lproj/VolumeCheck.strings
Resources/no.lproj
Resources/no.lproj/Localizable.strings
Resources/no.lproj/VolumeCheck.strings
Resources/pl.lproj
Resources/pl.lproj/Localizable.strings
Resources/pl.lproj/VolumeCheck.strings
Resources/pt.lproj
Resources/pt.lproj/Localizable.strings
Resources/pt.lproj/VolumeCheck.strings
Resources/pt_PT.lproj
Resources/pt_PT.lproj/Localizable.strings
Resources/pt_PT.lproj/VolumeCheck.strings
Resources/ro.lproj
Resources/ro.lproj/Localizable.strings
Resources/ro.lproj/VolumeCheck.strings
Resources/ru.lproj
Resources/ru.lproj/Localizable.strings
Resources/ru.lproj/VolumeCheck.strings
Resources/sk.lproj
Resources/sk.lproj/Localizable.strings
Resources/sk.lproj/VolumeCheck.strings
Resources/Spanish.lproj
Resources/Spanish.lproj/Localizable.strings
Resources/Spanish.lproj/VolumeCheck.strings
Resources/sv.lproj
Resources/sv.lproj/Localizable.strings
Resources/sv.lproj/VolumeCheck.strings
Resources/th.lproj
Resources/th.lproj/Localizable.strings
Resources/th.lproj/VolumeCheck.strings
Resources/tr.lproj
Resources/tr.lproj/Localizable.strings
Resources/tr.lproj/VolumeCheck.strings
Resources/uk.lproj
Resources/uk.lproj/Localizable.strings
Resources/uk.lproj/VolumeCheck.strings
Resources/vi.lproj
Resources/vi.lproj/Localizable.strings
Resources/vi.lproj/VolumeCheck.strings
Resources/zh_CN.lproj
Resources/zh_CN.lproj/Localizable.strings
Resources/zh_CN.lproj/VolumeCheck.strings
Resources/zh_TW.lproj
Resources/zh_TW.lproj/Localizable.strings
Resources/zh_TW.lproj/VolumeCheck.stringsUnpack the archive:
Code:
mkdir tmp && cd tmp
xar -xf ../InstallESD.dmgFind packages:
Code:
find .
.
./Distribution
./InstallMacOSX.pkg
./InstallMacOSX.pkg/Bom
./InstallMacOSX.pkg/InstallESD.dmg
./InstallMacOSX.pkg/PackageInfo
./InstallMacOSX.pkg/Payload
./InstallMacOSX.pkg/Scripts
./Resources
./Resources/ar.lproj
./Resources/ar.lproj/Localizable.strings
./Resources/ar.lproj/VolumeCheck.strings
./Resources/ca.lproj
./Resources/ca.lproj/Localizable.strings
./Resources/ca.lproj/VolumeCheck.strings
./Resources/cs.lproj
./Resources/cs.lproj/Localizable.strings
./Resources/cs.lproj/VolumeCheck.strings
./Resources/da.lproj
./Resources/da.lproj/Localizable.strings
./Resources/da.lproj/VolumeCheck.strings
./Resources/Dutch.lproj
./Resources/Dutch.lproj/Localizable.strings
./Resources/Dutch.lproj/VolumeCheck.strings
./Resources/el.lproj
./Resources/el.lproj/Localizable.strings
./Resources/el.lproj/VolumeCheck.strings
./Resources/English.lproj
./Resources/English.lproj/Localizable.strings
./Resources/English.lproj/VolumeCheck.strings
./Resources/fi.lproj
./Resources/fi.lproj/Localizable.strings
./Resources/fi.lproj/VolumeCheck.strings
./Resources/French.lproj
./Resources/French.lproj/Localizable.strings
./Resources/French.lproj/VolumeCheck.strings
./Resources/German.lproj
./Resources/German.lproj/Localizable.strings
./Resources/German.lproj/VolumeCheck.strings
./Resources/he.lproj
./Resources/he.lproj/Localizable.strings
./Resources/he.lproj/VolumeCheck.strings
./Resources/hr.lproj
./Resources/hr.lproj/Localizable.strings
./Resources/hr.lproj/VolumeCheck.strings
./Resources/hu.lproj
./Resources/hu.lproj/Localizable.strings
./Resources/hu.lproj/VolumeCheck.strings
./Resources/id.lproj
./Resources/id.lproj/Localizable.strings
./Resources/id.lproj/VolumeCheck.strings
./Resources/Italian.lproj
./Resources/Italian.lproj/Localizable.strings
./Resources/Italian.lproj/VolumeCheck.strings
./Resources/Japanese.lproj
./Resources/Japanese.lproj/Localizable.strings
./Resources/Japanese.lproj/VolumeCheck.strings
./Resources/ko.lproj
./Resources/ko.lproj/Localizable.strings
./Resources/ko.lproj/VolumeCheck.strings
./Resources/ms.lproj
./Resources/ms.lproj/Localizable.strings
./Resources/ms.lproj/VolumeCheck.strings
./Resources/no.lproj
./Resources/no.lproj/Localizable.strings
./Resources/no.lproj/VolumeCheck.strings
./Resources/pl.lproj
./Resources/pl.lproj/Localizable.strings
./Resources/pl.lproj/VolumeCheck.strings
./Resources/pt.lproj
./Resources/pt.lproj/Localizable.strings
./Resources/pt.lproj/VolumeCheck.strings
./Resources/pt_PT.lproj
./Resources/pt_PT.lproj/Localizable.strings
./Resources/pt_PT.lproj/VolumeCheck.strings
./Resources/ro.lproj
./Resources/ro.lproj/Localizable.strings
./Resources/ro.lproj/VolumeCheck.strings
./Resources/ru.lproj
./Resources/ru.lproj/Localizable.strings
./Resources/ru.lproj/VolumeCheck.strings
./Resources/sk.lproj
./Resources/sk.lproj/Localizable.strings
./Resources/sk.lproj/VolumeCheck.strings
./Resources/Spanish.lproj
./Resources/Spanish.lproj/Localizable.strings
./Resources/Spanish.lproj/VolumeCheck.strings
./Resources/sv.lproj
./Resources/sv.lproj/Localizable.strings
./Resources/sv.lproj/VolumeCheck.strings
./Resources/th.lproj
./Resources/th.lproj/Localizable.strings
./Resources/th.lproj/VolumeCheck.strings
./Resources/tr.lproj
./Resources/tr.lproj/Localizable.strings
./Resources/tr.lproj/VolumeCheck.strings
./Resources/uk.lproj
./Resources/uk.lproj/Localizable.strings
./Resources/uk.lproj/VolumeCheck.strings
./Resources/vi.lproj
./Resources/vi.lproj/Localizable.strings
./Resources/vi.lproj/VolumeCheck.strings
./Resources/zh_CN.lproj
./Resources/zh_CN.lproj/Localizable.strings
./Resources/zh_CN.lproj/VolumeCheck.strings
./Resources/zh_TW.lproj
./Resources/zh_TW.lproj/Localizable.strings
./Resources/zh_TW.lproj/VolumeCheck.strings
Code:
cpio -i < ./InstallMacOSX.pkg/PayloadAnd there you go. Once you copy the InstallESD.dmg to the Shared Support folder you have
Install OS X Mavericks.app Created solely from the InstallESD.dmg XAR archive.
Code:
cd tmp/InstallMacOSX.pkg/
macos:InstallMacOSX.pkg maverickspl$ file InstallESD.dmg
InstallESD.dmg: VAX COFF executable not stripped - version 376
Code:
hdiutil imageinfo InstallESD.dmg | grep Format
Format Description: UDIF read-only compressed (zlib)
Format: UDZO
Last edited:
i have a mbp that shipped with 10.8 and the 10.9 installer does require a sign in but you can bypass that by installing 10.8 and upgrading to 10.9
Someone in PMs says they ran my script on High Sierra and only ended up with InstallESD.dmg. Wondering if anyone else has had this occur, or can see why it might? It is expected behavior on non-macOS systems, but if
$(uname) is Darwin the script should use hidutil to construct the bootable image.Does this mean that the .app installer is able to be recreated?
Also, I've been doing some research on how to recreate the MLB. I feel as though this would be useful because it would remove any specific information from being sent to apple, but everything I try seems to be invalid.
It would definitely be useful, but at this point it looks impossible—Apple appears to have a database of valid MLBs which it checks against. See dhinakg's post here: https://forums.macrumors.com/thread...rs.2444350/page-5?post=33626413#post-33626413
What is entirely unclear to me is why, if Apple has this database, they don't use it to verify iMessage (Hackintosh users are able to use iMessage with fake MLBs). However, that doesn't change the mathematical fact that a hash is irreversible, unless Apple has found a way to break all modern cryptography and then decided to use their new ability for the most banal purpose imaginable and nothing else.
Last edited:
Been working with mitmproxy to maybe get the appstore page working, hard to explain my thought process here but more soon 👀
interesting. Obvious question is whether it's functional? We already know the URL for the pkg requested, (and it's a fixed URL and thus obviously also a fixed fairplay key), we just need to decrypt the package afterwards.
In theory if you could replay requests and trick MAS into downloading & decrypting the package, that would suffice. In practice there probably is some session ID stuff in there to prevent easy replays, but the key we know is fixed anyway. I've thought about just bypassing MAS and calling into fairplay private library to trigger decryption, but that's too much of a waste of time for me.
In theory if you could replay requests and trick MAS into downloading & decrypting the package, that would suffice. In practice there probably is some session ID stuff in there to prevent easy replays, but the key we know is fixed anyway. I've thought about just bypassing MAS and calling into fairplay private library to trigger decryption, but that's too much of a waste of time for me.
I'm not sure yet, I had to take a break and work on stuff that isn't for my hobby, but I'll test it more later. Even if it works, it's definitely not user-friendly. So far, I've involved mitmproxy, frida, and the /etc/hosts file, which is not a very easy setup. It is easy to reproduce with a guide, though, so I'll make that once I work on it again and also actually confirm this does what I want it to do in the first place lol. I wonder if anyone else has done a custom app store page before 🤔
EDIT 1:
Tad bit nervous about this, unsure what it's for: I also have to figure out how to make it not redirect to system settings lol, I'll compare it with another app store page. They are in json format so they're pretty easy.
EDIT 1:
Tad bit nervous about this, unsure what it's for: I also have to figure out how to make it not redirect to system settings lol, I'll compare it with another app store page. They are in json format so they're pretty easy.
Last edited: