Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

666sheep

macrumors 68040
Original poster
Dec 7, 2009
3,686
293
Poland
I'd like to ask owners of Sonnet Tempo ATA133 and ATA100 PCI for screenshots from System Profiler, PCI tab. I need hardware IDs: device ID, vendor/subvendor ID, subsystem ID.
Something like this:

Screen Shot 2022-01-14 at 16.43.14.png

I'm trying to flash some Promise ATA controllers and these data would help me (I think).

TIA
 
I have a Sonnet Tempo attached to my G3 450mhz. Here's what it shows for me:

sc1.png
 
Really, what we need is a dump from the card in Open Firmware or the IOReg dump from OS X.

I forget, but there is a way to get the command line IOReg command to dump a list of all the .properties of a specified device?

For Open Firmware, just put you Mac into Two Machine mode and dump the .properties of the card to a terminal or terminal emulator.

New World Macs support IO in Open Firmware over ethernet: " enet:telnet,192.168.1.xxx" io for a session from a router or " enet:telnet,10.0.0.1" io for a local crossover session.

Old World Macs need a serial connection.

So fire up you terminal and connect, then:

Code:
devalias

That command will give you the alias to your PCI Bus or Buses, normally pci1 and pci2 on new World Macs, and just pci on Old World Macs, next"

Code:
dev pci ls
-or-
dev pci1 ls
-or-
dev pci2 ls

This will list the devices on the PCI Bus, you're looking for UltraTek133@whatever.( 1,2,3,4.. or A,B,C ,D... )

Something like UltraTek133@D

Next:

Code:
dev pci1/@d .properties

Also, a dump from the Tempo Trio would work too @joevt ?

Upload the output of those .propeties from your telnet session or serial connection to a code box for us and I maybe able to figure how to flash cheap and easy to find PC Promise 133 ATA cards to Mac cards as they as rare as hens teeth these days.
 
Oddly, loading the FCode ROM extracted from the Sonnet flasher doesn't work correct.

In real Mac's it builds a .word "driver-buffer", but that's it, no other properties change.

I assumed it may need the device to have an open/close word, as with nVidia FCode ROMs, when we load them from file we have to execute the ROM twice, once gives the device the open/close words and once gives the device all the other .properties.

So I setup the ATA card in PCI-Passthough to Openbios on Qemu, as Openbios gives any PCI device the Open/Close words. This got me a little further, it loaded and 'NDRV' driver,FrmTk,macos,pwpc, but none of the other .properties changed and we don't get the proper " name" property ( UltraTek133 ) or any of the child nodes for the two drive connectors.

I also tried to append Qemu command to include the ROMFILE and that does allow me to dump the FCode ROM from the proper address with PCIPeak and Macsbugs, so we know the Sonnet flashing program can read the ROM if that is one of the checks it does, but sadly it still says " no card".

Loading the 'NDRV' and changing the " name" property isn't enough to get the Sonnet Flashing program for OS 9 to find the card, it just say " No Card". So some other .properties we need to build in the device tree until we find the correct properties to get the Sonnet flashing program to find the card for flashing.

On a side note, the Beige G3 OF load command tries to do Load and Go as do all the New World Macs I have, but the PM9600 just does Load. What this means is you need to strip everything from the Fcode ROM( PCI Header ) to the start of the FCode before you load it from the OF Command line on the Macs, however the 9600 you can use the whole rom file and just do 1 byte-load from the load-base offset of the start of the Fcode.
 
@eyoungren: thank you, but are you sure it's Sonnet Tempo ATA card with Promise chip? ROM revision on your screenshot and all listed HW IDs match Seritek's 1S2 card. Vendor ID is Silicon Image, device ID is SIL3112. Tempo ATA fimware revisions ended with something close to 4.50 AFAIR.

@DearthnVader: thank you for these tips, my OF skills are a bit rusty nowadays. I want to focus on what (S)ATAman from macos9lives said in his thread: it's possible to flash Ultratek 133 PDC20269 cards properly with factory utility. He said that it needs flasher and driver modification to see the IDs. That's why I'd like to know original Tempo ATA 133 ones.
 
Last edited:
Thought OP request was for the Sonnet Tempo ATA133 and / or ATA100 cards? Mac version pictured here. (Whereas the PC version does not have the “M” identifier at the end of PDC20269 - on the Promise chip.)Front.pngBack.pngST-ATA133M.png
 
Thought OP request was for the Sonnet Tempo ATA133 and / or ATA100 cards? Mac version pictured here. (Whereas the PC version does not have the “M” identifier at the end of PDC20269 - on the Promise chip.)

Is there a chance for OS X ASP screenshot of this one?
 
Panther & Tiger...
 

Attachments

  • Panther.png
    Panther.png
    26.4 KB · Views: 89
  • Tiger.png
    Tiger.png
    35.9 KB · Views: 121
@eyoungren: thank you, but are you sure it's Sonnet Tempo ATA card with Promise chip? ROM revision on your screenshot and all listed HW IDs match Seritek's 1S2 card. Vendor ID is Silicon Image, device ID is SIL3112. Tempo ATA fimware revisions ended with something close to 4.50 AFAIR.
I have been working on my garage for the past week and a half and am finally getting to where all the computer stuff has been dumped (boxes, cables, screws, parts, bits and pieces, etc). I will keep an eye out for the box the card was sent in (it's in one of the piles) and verify.

I know it's a Sonnet and I know it's a PCI-SATA card. I thought I saw Tempo, but I may be wrong.

@jbarley sent it to me a few years back.
 
Oddly, loading the FCode ROM extracted from the Sonnet flasher doesn't work correct.

In real Mac's it builds a .word "driver-buffer", but that's it, no other properties change.

I assumed it may need the device to have an open/close word, as with nVidia FCode ROMs, when we load them from file we have to execute the ROM twice, once gives the device the open/close words and once gives the device all the other .properties.

So I setup the ATA card in PCI-Passthough to Openbios on Qemu, as Openbios gives any PCI device the Open/Close words. This got me a little further, it loaded and 'NDRV' driver,FrmTk,macos,pwpc, but none of the other .properties changed and we don't get the proper " name" property ( UltraTek133 ) or any of the child nodes for the two drive connectors.

I also tried to append Qemu command to include the ROMFILE and that does allow me to dump the FCode ROM from the proper address with PCIPeak and Macsbugs, so we know the Sonnet flashing program can read the ROM if that is one of the checks it does, but sadly it still says " no card".

Loading the 'NDRV' and changing the " name" property isn't enough to get the Sonnet Flashing program for OS 9 to find the card, it just say " No Card". So some other .properties we need to build in the device tree until we find the correct properties to get the Sonnet flashing program to find the card for flashing.

On a side note, the Beige G3 OF load command tries to do Load and Go as do all the New World Macs I have, but the PM9600 just does Load. What this means is you need to strip everything from the Fcode ROM( PCI Header ) to the start of the FCode before you load it from the OF Command line on the Macs, however the 9600 you can use the whole rom file and just do 1 byte-load from the load-base offset of the start of the Fcode.


The FCode probably has some compression and therefore loads itself in two different steps.
The first step is something like this:

Code:
hex
tokenizer[ 0000 ]tokenizer set-rev-level
tokenizer[ 004A ]tokenizer pci-architecture
tokenizer[ 002A ]tokenizer pci-data-structure-start
tokenizer[ 0020 ]tokenizer pci-data-structure-length
tokenizer[ 105A 4D69 018085 ]tokenizer pci-header
tokenizer[ 10000 ]tokenizer rom-size
fcode-version2
\ format:    0x08
\ checksum:  0x72c0 (ok)
\ len:       0xfd1a (64794 bytes)
hex
headerless
variable variable_800															\ (800)
…
variable variable_816															\ (816)
: colon_l!													\ (817)
: colon_l@													\ (818)
: colon_variable_805_l@													\ (819)
: colon_variable_804_l@													\ (81a)
: colon_definition_function_81b													\ (81b)
…
: colon_definition_function_822													\ (822)
: colon_variable_80a_l!													\ (823)
: colon_definition_function_824													\ (824)
…
: colon_definition_function_83f													\ (83f)

" "(…)" \ 252 bytes
encode-bytes

" "(…)" \ 252 bytes
encode-bytes
encode+

…

" "(…)" \ < 252 bytes
encode-bytes
encode+

" driver,FirmTek,MacOS,PowerPC"
property
colon_definition_function_83f													\ (83f)
colon_definition_function_824													\ (824)
['] c@
byte-load
fcode-end
pci-end

" driver,FirmTek,MacOS,PowerPC" is a property that's ≈ 61K bytes. Some stuff is done with this (colon_definition_function_83f), then it calls byte-load on the result which means there's more FCode in the result.

colon_definition_function_83f is like this:
Code:
: colon_definition_function_83f													\ (83f)
	" driver,FirmTek,MacOS,PowerPC"
	colon_definition_function_83e												\ (83e)
	0=
	if																			\ (0x5)
		2drop
		exit
	then
	get-package-property
	if																			\ (0x4)
		exit
	then
	drop
	dup
	colon_l@												\ (818)
	dup
	0
	<>
	if																			\ (0x56)
		colon_variable_80a_l!											\ (823)
		4
		+
		colon_variable_809_l!											\ (821)
		" create driver-buffer"
		evaluate
		colon_variable_80a_l@											\ (822)
		allot
		" driver-buffer"
		evaluate
		colon_variable_80b_l!											\ (825)
		colon_variable_80b_l@											\ (824)
		0
		<>
		if																		\ (0xb)
			colon_variable_80b_l@										\ (824)
			colon_variable_80a_l@										\ (822)
			erase
			colon_definition_function_83d										\ (83d)
		then
	else																		\ (0x5)
		2drop
	then
	" driver,FirmTek,MacOS,PowerPC"
	delete-property
	;

colon_definition_function_83d is maybe the decompression function.
 
  • Like
Reactions: 666sheep
What about flashing the card under DOS using PROMISE flasher? It loads ROM from the file, unlike Sonnet utility which has it integrated in rsrc part of application. I got ROM dump from Tempo 133 (found on macos9lives forum), saved using PROMISE flasher, but I have a doubt if it's complete. File size is 32768 bytes, while length specified in the header should be 37888 bytes - unless my math is incorrect. 4A in hex gives 74 in decimal, 74x512 gives 37888. Incomplete ROM would brick the card and as I have only one ATA133 to play with, it most likely will be one-way journey :) ROM dump attached.
 

Attachments

  • OLDBIOS.BIN.zip
    31.6 KB · Views: 120
What about flashing the card under DOS using PROMISE flasher? It loads ROM from the file, unlike Sonnet utility which has it integrated in rsrc part of application. I got ROM dump from Tempo 133 (found on macos9lives forum), saved using PROMISE flasher, but I have a doubt if it's complete. File size is 32768 bytes, while length specified in the header should be 37888 bytes - unless my math is incorrect. 4A in hex gives 74 in decimal, 74x512 gives 37888. Incomplete ROM would brick the card and as I have only one ATA133 to play with, it most likely will be one-way journey :) ROM dump attached.
The Promise Dos Flashing utility refuses to flash the ROM extracted from the Sonnet utility rsrc fork, says "bad file" or some such. Older versions of PTIFlash supported a Dos command line switch of /Unlimit to bypass any checking for flashing the Promise ATA 100 and older cards, but these versions don't support the ATA 133 card.
 
Panther & Tiger...
That really doesn't help, we really need a dump of the devices full Open Firmware .properties. Pretty easy on New World machines, but you'll need two Mac's with a serial connection to do it on an Old World machine.

On New World hosts they support telnet, so the 2nd machine can be Windows/Linux/Mac, pretty much everything has a telnet client. Hell, @LightBulbFun even telneted into Open firmware from across the globe if you want to open the telnet port on your router and forward that port to a new world Mac.

Assuming you have a New World Mac and you can connect it via Ethernet to your router this takes like less than 10 Min. to do a local dump and upload it here so we can see all the .properties. Old world is a bit more complex, requires a third party, yet free, terminal emulator on the client with a serial connection. Any old 68k with the same serial/printer/modem port as the host old world host machine can be used as the client, or a New World Machine with one of those USB to Mac Serial connectors will work assuming you have a printer/modem cable.

On a NWM just boot with the card installed holding CMD+OPT+O+F and ethernet connected to your router. Assuming your router has a 192.168.1.xxx address range just type:

Code:
" enet:telnet,192.168.1.201" io

Assuming .201 isn't conflicting with any other device on your routing table, then just fire up telnet on the client and connect:

Code:
telnet 192.168.1.201

You'll be greeted with the OF command line in your telnet session, on later MacOS you'll want brew, brew install telnet, as Apple ditched telnet some time back, but it still should work on Windows or Linux.

Then just find the device on you PCI bus and get it's properties as I outlined in post #3. Copy the text from the telnet session into a code box here and we are golden.
 
The FCode probably has some compression and therefore loads itself in two different steps.
The first step is something like this:

Code:
hex
tokenizer[ 0000 ]tokenizer set-rev-level
tokenizer[ 004A ]tokenizer pci-architecture
tokenizer[ 002A ]tokenizer pci-data-structure-start
tokenizer[ 0020 ]tokenizer pci-data-structure-length
tokenizer[ 105A 4D69 018085 ]tokenizer pci-header
tokenizer[ 10000 ]tokenizer rom-size
fcode-version2
\ format:    0x08
\ checksum:  0x72c0 (ok)
\ len:       0xfd1a (64794 bytes)
hex
headerless
variable variable_800                                                            \ (800)
…
variable variable_816                                                            \ (816)
: colon_l!                                                    \ (817)
: colon_l@                                                    \ (818)
: colon_variable_805_l@                                                    \ (819)
: colon_variable_804_l@                                                    \ (81a)
: colon_definition_function_81b                                                    \ (81b)
…
: colon_definition_function_822                                                    \ (822)
: colon_variable_80a_l!                                                    \ (823)
: colon_definition_function_824                                                    \ (824)
…
: colon_definition_function_83f                                                    \ (83f)

" "(…)" \ 252 bytes
encode-bytes

" "(…)" \ 252 bytes
encode-bytes
encode+

…

" "(…)" \ < 252 bytes
encode-bytes
encode+

" driver,FirmTek,MacOS,PowerPC"
property
colon_definition_function_83f                                                    \ (83f)
colon_definition_function_824                                                    \ (824)
['] c@
byte-load
fcode-end
pci-end

" driver,FirmTek,MacOS,PowerPC" is a property that's ≈ 61K bytes. Some stuff is done with this (colon_definition_function_83f), then it calls byte-load on the result which means there's more FCode in the result.

colon_definition_function_83f is like this:
Code:
: colon_definition_function_83f                                                    \ (83f)
    " driver,FirmTek,MacOS,PowerPC"
    colon_definition_function_83e                                                \ (83e)
    0=
    if                                                                            \ (0x5)
        2drop
        exit
    then
    get-package-property
    if                                                                            \ (0x4)
        exit
    then
    drop
    dup
    colon_l@                                                \ (818)
    dup
    0
    <>
    if                                                                            \ (0x56)
        colon_variable_80a_l!                                            \ (823)
        4
        +
        colon_variable_809_l!                                            \ (821)
        " create driver-buffer"
        evaluate
        colon_variable_80a_l@                                            \ (822)
        allot
        " driver-buffer"
        evaluate
        colon_variable_80b_l!                                            \ (825)
        colon_variable_80b_l@                                            \ (824)
        0
        <>
        if                                                                        \ (0xb)
            colon_variable_80b_l@                                        \ (824)
            colon_variable_80a_l@                                        \ (822)
            erase
            colon_definition_function_83d                                        \ (83d)
        then
    else                                                                        \ (0x5)
        2drop
    then
    " driver,FirmTek,MacOS,PowerPC"
    delete-property
    ;

colon_definition_function_83d is maybe the decompression function.
It's pretty apparent what the drive-buffer is, it's a buffer. LOL

The question is why is it not executed when we load the ROM from a file and execute the FCODE on a real Mac?

Code:
load hd:,\SonnetPCIROM.bin
" pci/@e" open-dev to my-self
400004a 1 byte-load

The property driver,FirmTek,MacOS,PowerPC is just an 'NDRV', sadly just a binary blackbox that we can't really see what it does in any human readable from by detoking the FCODE. Oddly the " Name" property " model" property and other properties built into the device tree by the ROM are not human readable as I've seen with every other FCODE ROM I've ever detoked, and those are the properties we need built into the device tree to get the Sonnet flashing utility to see the card and flash it.

Building the " name" property and the " model" property are not enough for the Sonnet flasher, looking inside the data fork it's not clear what the flasher is checking for, hopefully not something in the properties of the child nodes of the card, as I don't know how to easily create child nodes from the OF command line?

Diff:
dev pci/@e
" Ultra-Tek133P+" encode-string " name" property
" PDC20269" encode-string " model" property
 
Last edited:
The Promise Dos Flashing utility refuses to flash the ROM extracted from the Sonnet utility rsrc fork, says "bad file" or some such. Older versions of PTIFlash supported a Dos command line switch of /Unlimit to bypass any checking for flashing the Promise ATA 100 and older cards, but these versions don't support the ATA 133 card.

Yes, I tried it and even 2 bytes change in original PC ROM causes "bad file" message. It was device ID, so PTIflasher seems check if device ID is right or there's a checksum somewhere in the file which needs to be fixed as well. So dead end it seems. But I was able to update PC ROM to latest available from PROMISE - my card is Maxtor and had their old ROM.
The device ID of Sonnet (left) is different than "naked" PROMISE card (right):

deviceID.jpg

My card shows up in OF device tree as pci105a,4d68@3 (using "dev / ls"), under /pci@f2000000:

OF.jpg
What, according, to this Apple doc translates to vendorID,deviceID.
No "Ultratek133" or so in OF tree. According devicehunt this ID belongs to PDC20268, 20269 should be identified as 4d69.
Other card I have - PDC20268 (Ultra100TX2) identifies itself in OF exactly the same: pci105a,4d68 and it does not make it visible for Sonnet Tempo 100 FW updater.

Back to the properties: I'm having some troubles with specifying right device path for
Code:
dev .properties
command.

Code:
devalias
lists pci0, pci1 and pci2 but

Code:
dev pci*number ls
- returns nothing.

Im working on New World Mac, GE under 9.2.1, OS X does not see the card at all.
Both cards do work in my old PC box, so we can exclude "dead card" case.

Is there a possibility to save OF commands output to file somehow? I'm working directly in OF on this G4, not with telnet connection from another Mac.
 
Last edited:
What about flashing the card under DOS using PROMISE flasher? It loads ROM from the file, unlike Sonnet utility which has it integrated in rsrc part of application. I got ROM dump from Tempo 133 (found on macos9lives forum), saved using PROMISE flasher, but I have a doubt if it's complete. File size is 32768 bytes, while length specified in the header should be 37888 bytes - unless my math is incorrect. 4A in hex gives 74 in decimal, 74x512 gives 37888. Incomplete ROM would brick the card and as I have only one ATA133 to play with, it most likely will be one-way journey :) ROM dump attached.
You're right. File size 32768 is too short.

Use derez to get the firmware from the rsrc fork.
Code:
PATH=/usr/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Users/joevt/Library/Python/2.7/bin:/opt/X11/bin:/Library/Apple/usr/bin:/Volumes/Updates/Docs/Open_Firmware_and_Forth/OpenBIOS/JoesOpenBIOSStuff/detok/obj-amd64:/Volumes/Updates/Docs/Open_Firmware_and_Forth/OpenBIOS/JoesOpenBIOSStuff/toke/obj-amd64:/Volumes/Updates/Docs/Open_Firmware_and_Forth/MacOSX

cd /Volumes/Updates/Third\ Party\ System\ Software/Sonnet/ATA133\ Jaguar\ lg\ drive\ support2
theapp=ata133_lgdrv_45
derez "$theapp" > app.z
for theresource in $(perl -0777 -n -E 'while (/data .(....). \((\d+).*\n\t\$"55AA/mg) { print $1 . "_" . $2 . "\n"; }' app.z); do
    echo $theresource
    derez -only "'${theresource:0:4}'(${theresource:5})" "$theapp" | sed -nE '/.\$"([0-9A-F ]+).*/s//\1/p' | xxd -p -r > "${theresource}.rom"
    DumpPCIRom.sh "${theresource}".rom > "${theresource}".4th 2> "${theresource}".log
done

It's pretty apparent what the drive-buffer is, it's a buffer. LOL

The question is why is it not executed when we load the ROM from a file and execute the FCODE on a real Mac?

Code:
load hd:,\SonnetPCIROM.bin
" pci/@e" open-dev to my-self
400004a 1 byte-load
The firmware is usually loaded from pci probe context. Maybe something is different when you're loading the firmware from disk. Compile a version of the firmware with a bunch of debug statements to see if it gets to the final byte-load command and also to output the address used for the byte load command.

The property driver,FirmTek,MacOS,PowerPC is just an 'NDRV', sadly just a binary blackbox that we can't really see what it does in any human readable from by detoking the FCODE.
The driver,FirmTek,MacOS,PowerPC property during the first step of the load is not an NDRV - it is missing the PEF header Joy!peffpwpc that an NDRV should have in the first 12 bytes.

Oddly the " Name" property " model" property and other properties built into the device tree by the ROM are not human readable as I've seen with every other FCODE ROM I've ever detoked, and those are the properties we need built into the device tree to get the Sonnet flashing utility to see the card and flash it.

Building the " name" property and the " model" property are not enough for the Sonnet flasher, looking inside the data fork it's not clear what the flasher is checking for, hopefully not something in the properties of the child nodes of the card, as I don't know how to easily create child nodes from the OF command line?

Diff:
dev pci/@e
" Ultra-Tek133P+" encode-string " name" property
" PDC20269" encode-string " model" property
I have a Tempo 133 Firmware 4.0.app (for the Tempo Trio) It is similar to the other Tempo firmwares where it decompresses from a driver,FirmTek,MacOS,PowerPC property. I extracted part 2 of the firmware (the decompressed part) from memory in Open Firmware on my 8600 (I think I explained how to get the memory from Open Firmware elsewhere - basically just get a hex dump of the memory range used for the Open Firmware dictionary which also includes all the properties and buffers).

Part 2 has the real fcode for the Tempo. It adds an NDRV named "driver,AAPL,MacOS,PowerPC" for Mac OS 9 and it adds an mkext named "driver,AAPL,MacOSX,PowerPC" for Mac OS X.
You can use DumpPEF command to disassemble the NDRV.

I think the only NDRV Mac OS X every used are those created for graphics cards - Mac OS X has Graphics NDRV kext compatibility just to allow those to work.
 
I've attached the Open Firmware commands and their output and part 2 of the firmware.
I used serial port to capture the text.

Code:
dev / ls
dump-device-tree
printenv
devalias
device-end
words

You can see the firmtek properties for the card I have.
 

Attachments

  • PowerMac8600withTempoTrio.zip
    147 KB · Views: 83
You're right. File size 32768 is too short.

Use derez to get the firmware from the rsrc fork.
Thank you, it almost worked :)

Entered the folder containing unpacked Tempo 133.app, replaced your file name with mine after "theapp=".
And I got 2 errors:
Code:
sed: RE error: illegal byte sequence

and

Code:
-bash: DumpPCIRom.sh: command not found

Result was 2 empty files, app.z and log with above error.

Screen Shot 2022-01-15 at 20.06.27.png

I have command line tools installed, Intel Mac with High Sierra 10.13.6.

BTW, will just selecting and copying 37888 bytes from the start of PCI header of the ROM work as well? Attached the file I made this way.
 

Attachments

  • Tempo133_40.bin.zip
    36.6 KB · Views: 83
Last edited:
OK, I got the properties of the card from OF. All starts to be more clear. 4d68 is subsystem ID, not the device ID. Apple doc I linked before misleaded me a bit. I need to do some research how to capture text from OF without serial port.

OF2.jpg
 
Entered the folder containing unpacked Tempo 133.app, replaced your file name with mine after "theapp=".
And I got 2 errors:
Code:
sed: RE error: illegal byte sequence
don't know what could cause that. Post the result of derez -only "'${theresource:0:4}'(${theresource:5})" "$theapp" > "${theresource}.txt" as a zipped file.

and

Code:
-bash: DumpPCIRom.sh: command not found

Result was 2 empty files, app.z and log with above error.
That's because you don't have DumpPCIRom.sh.
https://forums.macrumors.com/threads/imac-g3-tray-bootrom-dump-1mbyte.2316567/post-30429064

I have command line tools installed, Intel Mac with High Sierra 10.13.6.
I'm using Monterey which uses zsh instead of bash so there might be a difference that needs fixing.

BTW, will just selecting and copying 37888 bytes from the start of PCI header of the ROM work as well? Attached the file I made this way.
I don't know what you mean. Selecting 37888 bytes from what? It sounds like you want to just append some random extra bytes. How is that any better than not having the bytes at all (like your truncated 32768 sized rom).
 
don't know what could cause that. Post the result of derez -only "'${theresource:0:4}'(${theresource:5})" "$theapp" > "${theresource}.txt" as a zipped file.
Here you go. I got an error using this code, attached.

That's because you don't have DumpPCIRom.sh.

Thank you, grabbed it from linked post.

I don't know what you mean. Selecting 37888 bytes from what? It sounds like you want to just append some random extra bytes. How is that any better than not having the bytes at all (like your truncated 32768 sized rom).

The ROM image in rsrc fork of Sonnet Updater starts @offset 260 in decimal, with PCI header. 55 AA 4A - where 4A is length of the image, right? Converted to decimal and multiplied with 512 it gives image length 37888 in decimal. So image should end @offset 38148 in decimal (260 + 37888). Am I missing something here?
 

Attachments

  • derez.txt.zip
    822 bytes · Views: 81
Last edited:
Here you go. I got an error using this code, attached.
That's because you didn't run the first command which sets theresource=fwre_136
You should try understanding what these commands do so you can fix simple problems like these.

The ROM image in rsrc fork of Sonnet Updater starts @offset 260 in decimal, with PCI header. 55 AA 4A - where 4A is length of the image, right? Converted to decimal and multiplied with 512 it gives image length 37888 in decimal. So image should end @offset 38148 in decimal (260 + 37888). Am I missing something here?
How did you calculate 260 as the offset?
Are you talking about offset 260 of the entire resource fork? Why do weird stuff like that when there's a command derez to parse the resource fork?

Or if you mean to remove the pci header from the contents of the single resource 'fwre'(13) to be able to execute the fcode directly, why do complicated stuff like that when you can use the result of the DumpPCIRom command, remove the tokenizer commands, then use toke to create a binary that doesn't have the pci header? (use DumpPCIRom to confirm the result matches the source). And this way you can add to the code to help with debugging.

I think I've lost track of what your goal is.

The FCode probably has some compression and therefore loads itself in two different steps.
Regarding the compression, the example firmware I have has 64193 bytes of fcode in the first step (63K) and the decompressed fcode is 93816 bytes (91K) so you see how it can be useful if the rom chip is only 64K or if the rom chip also contained a BIOS or EFI image.
Anyway, it's possible that the decompressed fcode does not require anything of the first fcode, in that case you could load just the decompressed part if you are able to extract it.
 
How did you calculate 260 as the offset?
Are you talking about offset 260 of the entire resource fork?

Exactly.

Screen Shot 2022-01-16 at 08.35.27.png

The goal is: patch the Sonnet flasher and driver inside with HW IDs of Promise cards. According to guy form macos9lives, who successfully flashed these cards, it's all what's necessary to make Sonnet app see and flash these cards properly.
But for me it's a hard learning process (as you see), because I only have experience with making EFI ROMs for Mac Pro GPUs. Add the EFI part in proper place, compress/decompress when needed, alter device ID inside for using it with other GPUs from the same family, fix the checksum(s), oprom indicators etc. As I'm not a programmer, I'm doing most of this in Hex editor.

Anyway, I'm grateful for your patience, help and explanations. Now I got proper fwre.txt, along with another error in log, when I tried to execute the full script to get the ROM dump. Attached.
 

Attachments

  • fwre136.zip
    167.7 KB · Views: 170
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.