Late-2013 21.5" black boot screen delay

Discussion in 'iMac' started by yjchua95, Jun 24, 2015.

  1. yjchua95 macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #1
    Hi,

    My late-2013 iMac has been staying at the boot screen for about 5 seconds before showing the Apple logo. All my other Macs don't have this problem and display the Apple logo within 1-2 seconds. (call me picky or OCD, but I'll assume that something isn't right and that an EFI rootkit might've attacked my iMac - definitely not Thunderstrike, but could be something related to the flawed suspend-resume implementation of Apple's sleep mode).

    I've ensured that the startup disk was selected and tried a NVRAM and SMC reset, to no avail. A clean install didn't help either.

    Has anyone experienced this as well? I'm thinking that there might be something with the EFI.
     
  2. darkweather macrumors regular

    darkweather

    Joined:
    Aug 8, 2013
    #2
    I have the same problem too. And i'm waiting for the solution.
     
  3. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #3
    Is your model identifier iMac14,3 (BTO 21.5" iMac) as well? And is the boot ROM version IM143.0118.B11, with an SMC version of 2.17f7?
     
  4. darkweather, Jun 25, 2015
    Last edited: Jun 25, 2015

    darkweather macrumors regular

    darkweather

    Joined:
    Aug 8, 2013
    #4
    Mine is late 2012 21.5" imac,
    iMac13,1
    Boot ROM:IM131.010A.B05
    SMC:2.9f5
     
  5. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #5
    Off topic, but my iMac is a 14,3. It was an in store purchase and wasn't a custom build.
     
  6. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #6
    Hmm, strange. The official identifier for the 21.5" iMac is supposed to be 14,1.
     
  7. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #7
    Yeah, it's the 2.9-3.6ghz iMac with 8GB of RAM, a 1TB HDD and a 750 m GPU. Must be a one of a kind then ;)
     
  8. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #8
    Mine's the 3.1GHz i7 with 16GB RAM, 256GB SSD and the 750M.
     
  9. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #9
    And your identifier is also 14,3? I just double checked mine and that is what mine is haha
     
  10. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #10
    Yup mine is also 14,3.
     
  11. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #11
    I don't really want to have to bump this, but has anyone else faced this as well?

    Right now I'm thinking that some boot kit like Thunderstrike (doubt it though, it was patched in 10.10.2) or the sleep-wake implementation flaw (discovered by Pedro Vilaça) may have caused it.
     
  12. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #12
    Could you video what is happening?
     
  13. yjchua95, Jun 28, 2015
    Last edited: Jun 28, 2015

    yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #13
    Here's the videos comparing the delay between the chime and the Apple logo: http://1drv.ms/1fXSKkH

    The 21.5" iMac is always consistently much slower than my other Macs when it comes to the period between the chime and the Apple logo showing up.

    Note: In this case, both Macs don't have FileVault enabled. The rMBP is a 13" early-2015 i7/16/512 variant with Force Touch.

    I'm thinking that during the abnormally long delay between the chime and the Apple logo on the iMac, some extra (and possibly illegal) background tasks may be in progress in the iMac, due to some form of bootkit.
     
  14. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #14
    Am I not right in thinking the delay you have on the 21.5" is due to any other bootable drives or partitions you have? As you are supposed to hold down the alt key to change what partition/drive you wish to boot from. Do you have a partition on your iMacs storage or an external drive connected?
     
  15. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #15
    And is there a difference in transfer speeds between the 256GB SSD in your iMac against the 13 inch you compared it too?
     
  16. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #16
    Nope, there is only one partition in the internal 256GB SSD. There are no external devices connected.
     
  17. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #17
    Massive difference (700 vs 1500), but I tested it against my 27" retina (the 256GB in the 21.5" and the 5K 512GB clock in at around 700 as well) and the 5K booted up as fast as the 13" rMBP.

    Transfer rates are not a factor. Rather, it's the delay between the chime and the Apple logo, which have nothing to do with the SSD speeds, as during this period, the computer isn't actually booting - it's doing some EFI tasks like searching for the boot partition.

    What I'm worried about is that the abnormal delay in the 21.5" is due to some extra (non-Apple) EFI tasks that may have been injected by a boot kit. And some boot kits (like the one exploiting the sleep-wake flaw) can be deployed without physical access. All the bootkit would need to do is to force a sleep (like running a script related to pmset) and execute.
     
  18. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #18
    Then I'm really not sure. Have you tried reformatting the operating system?
     
  19. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #19
    Yes, I have. A clean install that was preceded by a secure wipe (single pass though).

    A clean install can't remove boot kits.
     
  20. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #20

    And you're sure than its a boot kit that you have on your Mac?
     
  21. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #21
    Not sure, but I don't have any explanations for the delay. It's definitely something related to the EFI, that's for sure.
     
  22. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #22
    I believe that you could only be infected if it's transmitted via a physical drive (ie an external TB drive) and cannot be infected with so,etching just over the web?
     
  23. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #23
    It can be done over the web, without physical access (in the case of the sleep-wake vulnerability), but Thunderstrike has to be deployed physically via a TB device (and this was patched quite early with 10.10.2). See my post regarding pmset earlier in this thread.
     
  24. MartinAppleGuy macrumors 68020

    MartinAppleGuy

    Joined:
    Sep 27, 2013
    #24

    Right. Really not sure how I can help then. Is there not software out there that could detect and remove any greats deep down such as boot kit?
     
  25. yjchua95 thread starter macrumors 604

    Joined:
    Apr 23, 2011
    Location:
    GVA, KUL, MEL (current), ZQN
    #25
    You can probably detect it, but you can't remove it. Not without Apple flashing the EFI with a firmware update.
     

Share This Page